@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a `.custom` pair's published override of a dashboard, report or email template no longer sits in the registry under the base's envelope
+
+Clause-②: no
+Metadata-protocol: none
+
+A published override of a base's dashboard, report or email template, saved in the base's `<base>.custom` pair, was registered in the registry's bare slot wearing the BASE's artifact envelope (`_packageId` = the base, `_provenance: 'package'`). The base's per-package layer, which the base's export reads, then listed the override beside the base's own item. Views already stayed out of that slot. The override is now kept out of it for these three types as well, and is still served from its stored row. The by-name read, the effective list and the layered read serve exactly what they served before. The base's per-package layer lists only the base's own item, and the pair's layer lists only the override. A registry read that names the base's item directly answers the base's own item. A row of a package that ships its own artifact of the name keeps its entry as before. Nothing to migrate: a restart re-hydrates the registry under the new rule.
@@ -296,6 +296,41 @@ function boundPackageOf(packageId: unknown): string | undefined {
     return typeof packageId === 'string' && packageId !== '' && packageId !== 'sys_metadata' ? packageId : undefined;
 }
 
+/**
+ * [#29600] The types whose stored row stays out of the registry's bare slot
+ * when it is bound to a package that ships no artifact of its name while
+ * another package does: the row would wear the other package's envelope
+ * there, and the per-package layer would list the copy under that package.
+ * Every protocol read of these types serves such a row from the row itself
+ * (the by-name read, both lists, the layered read), so the bare entry served
+ * no reader the row does not. `view` is not here: it has its own, wider rule
+ * (#22057, `anotherPackageShips`).
+ *
+ * ⛔ A closed list, judged on the canonical type. `page`, `app`, `dataset`,
+ * `doc` and `book` are left out on purpose: their reads serve a `.custom`
+ * pair's override FROM the bare entry (the by-name read, the list, and
+ * `registry.getAllApps`), so they need a row-served path before their bare
+ * entry can go. `flow` registers with no artifact envelope at all (Regime C,
+ * #20913), and the boot pull arms its declared override from the bare slot.
+ */
+const BORROWED_ENVELOPE_DECLINED_TYPES: ReadonlySet<string> = new Set(['dashboard', 'report', 'email_template']);
+
+/**
+ * [#29600] Whether the hydrator keeps a stored row of `canonicalType`, bound
+ * to `packageId`, out of the registry's bare slot because `artifact` (the
+ * envelope it would graft on) is ANOTHER package's: the artifact lookup
+ * scopes to the row's package and falls back to whichever package ships the
+ * name. A row of a package that ships its own artifact of the name keeps its
+ * bare entry with its own envelope (#4624, ADR-0048); a package-less row, and
+ * a row of a name (or bundle member) no package ships, register as before.
+ */
+function declinesBorrowedEnvelope(canonicalType: string, packageId: unknown, artifact: unknown): boolean {
+    if (!BORROWED_ENVELOPE_DECLINED_TYPES.has(canonicalType)) return false;
+    const bound = boundPackageOf(packageId);
+    if (bound === undefined || !artifact || typeof artifact !== 'object') return false;
+    return (artifact as { _packageId?: unknown })._packageId !== bound;
+}
+
 /**
  * [#16702] ADR-0010 §3.3 — the three protection keys that are READ-SIDE
  * DERIVED, and therefore must never be persisted from a caller's body.
@@ -422,6 +457,7 @@ function isShippedViewItem(artifact: unknown): boolean {
 export {
     boundPackageOf,
     bundleMemberOf,
+    declinesBorrowedEnvelope,
     envelopePackageId,
     isShippedViewItem,
     mergeArtifactProtection,
 
@@ -533,6 +533,7 @@ export {
 import {
     boundPackageOf,
     bundleMemberOf,
+    declinesBorrowedEnvelope,
     isShippedViewItem,
     mergeArtifactProtection,
     stateTenantAuthorship,
@@ -10820,16 +10821,39 @@ export class ObjectStackProtocolImplementation implements
      * it registered nothing on a save then ([#23298]: a kernel that hydrates
      * its own store now registers a save as its boot does, by this rule).
      *
-     * ⛔ `view` only, judged on the canonical type. Every other type registers
-     * as before: a row bound to one package, of a name two packages ship, holds
-     * the bare entry with its own body and its own package's envelope (#4624,
-     * ADR-0048, pinned in `objectql`'s `protocol-boot-hydration-scoped.test.ts`).
+     * ⛔ This rule is `view` only, judged on the canonical type. Every other type
+     * registers as before, save the borrowed-envelope rule below: a row bound
+     * to one package, of a name two packages ship, holds the bare entry with
+     * its own body and its own package's envelope (#4624, ADR-0048, pinned in
+     * `objectql`'s `protocol-boot-hydration-scoped.test.ts`).
      * Registry readers that name no package read those entries (the declared
      * security-metadata bootstraps, the action router, the picklist read), and
      * which body they should see for such a name is not ruled here. A
      * package-less view row, and a view row of a name only its own package
      * ships or no package ships, register as before too.
      *
+     * ## [#29600] …and a dashboard, report or email-template row never wears another package's envelope
+     *
+     * A row of these three types bound to a package that ships no artifact of
+     * its name (or bundle member), under a name another package ships, is not
+     * registered either ({@link declinesBorrowedEnvelope}). The artifact lookup
+     * falls back to the package that ships the name, so the bare entry wore
+     * THAT package's envelope (`_packageId`, `_provenance: 'package'`) and the
+     * per-package layer listed it as that package's own item: after a `.custom`
+     * pair published its declared override of a base's dashboard, the base's
+     * layer (and with it the base's export) carried two items of the name.
+     * Every protocol read of these types answers such a row from the row
+     * itself — the by-name read, the effective list, the layered read and the
+     * pair's per-package layer — so they served the same body before and
+     * after, measured for each reader. What changes is the registry-direct
+     * read of the name, which answers the shipping package's own item.
+     *
+     * ⛔ Those three types only. A row of a package that ships its own artifact
+     * of the name keeps its bare entry (#4624). `page`, `app`, `dataset`, `doc`
+     * and `book` still register: their reads serve a pair's override from the
+     * bare entry, so it can go only once they serve it from the row. `flow`
+     * registers with no artifact envelope (below).
+     *
      * ## [#23233] The entry carries the row's package binding
      *
      * The registered body is stamped with the row's package binding as
@@ -10984,6 +11008,12 @@ export class ObjectStackProtocolImplementation implements
         const artifact = this.lookupArtifactItem(
             type, (data as any).name, options.packageId ?? undefined, bundleMemberOf(type, data),
         );
+        // [#29600] See the header: a dashboard, report or email-template row
+        // bound to a package that ships no artifact of its name, under a name
+        // another package ships, is not registered under the bare name, where
+        // it would wear that other package's envelope. Its reads answer it from
+        // its row. ⛔ Those three types only.
+        if (declinesBorrowedEnvelope(canonicalType, options.packageId, artifact)) return true;
         // [#16702] Say what this row IS before the artifact envelope is grafted
         // on top of it. Every body reaching this hydrator came out of a
         // `sys_metadata` write and is therefore tenant-authored by definition
@@ -11821,7 +11851,9 @@ export class ObjectStackProtocolImplementation implements
      *     ships, is not re-registered here: under the bare name it would
      *     answer every package's read of the name. The walk stops there, as
      *     for any baseline found. ⛔ View only, as at the hydration: every
-     *     other type re-registers as before.
+     *     other type re-registers as before. [#29600] The hydration's
+     *     borrowed-envelope rule has no twin here: this limb registers the
+     *     baseline's own body and grafts no artifact envelope onto it.
      *  3. [#5079] When NEITHER layer has anything, the deleted row was the
      *     whole item — so the plain-key entry is retired too
      *     ({@link SchemaRegistry.removeOverlayEntry}).
 
@@ -401,7 +401,12 @@ const T = 'email_template';
 const subjectOf = async (protocol: ObjectStackProtocolImplementation, member?: string) =>
     ((await protocol.getMetaItem({ type: T, name: NAME, ...(member !== undefined ? { member } : {}) })) as any)?.item?.subject;
 
-/** The registry's own entry for one member — what a peer, a send or a bare-name engine read is served. */
+/**
+ * The registry's own entry for one member — what a bare-name engine read is
+ * served. [#29600] A pair's override of a member the package ships is not
+ * registered (it is served from its row, which the send reads through the
+ * execution list), so this answers the package's member there.
+ */
 const registrySubject = (engine: ObjectQL, member: string) =>
     (engine.registry.getItem<any>(T, NAME, undefined, member))?.subject;
 
@@ -445,21 +450,25 @@ describe('the by-name doors address ONE member by the selector (#22877, stage 2)
     it('DELETE by member: resetting zh-CN removes its row only, and the en-US overlay stays served — the registry included', async () => {
         const stores = new Map<string, Map<string, Record<string, unknown>>>();
         const { engine, protocol } = await bootWithBothSaved(stores);
-        expect(registrySubject(engine, 'en-US')).toBe('ADMIN en');
-        expect(registrySubject(engine, 'zh-CN')).toBe('ADMIN zh');
+        expect(await servedSubjects(protocol)).toEqual({ 'en-US': 'ADMIN en', 'zh-CN': 'ADMIN zh' });
+        // [#29600] The pair's override of a member the package ships is served
+        // from its row and never registered under the package's envelope: the
+        // registry's entry is the package's own member.
+        expect(registrySubject(engine, 'en-US')).toBe('PKG en');
+        expect(registrySubject(engine, 'zh-CN')).toBe('PKG zh');
 
         expect(await protocol.deleteMetaItem({ type: T, name: NAME, member: 'zh-CN' })).toMatchObject({ success: true, reset: true });
         expect(overlayRows(stores).map((r) => r.bundle_member ?? null)).toEqual([null]);
         // The reset member is back on the package wording; the other member's
-        // overlay is still the registry's entry — not swept with the group.
+        // overlay is still served — not swept with the group.
         expect(registrySubject(engine, 'zh-CN')).toBe('PKG zh');
-        expect(registrySubject(engine, 'en-US')).toBe('ADMIN en');
+        expect(await subjectOf(protocol, 'en-US')).toBe('ADMIN en');
         expect(await servedSubjects(protocol)).toEqual({ 'en-US': 'ADMIN en', 'zh-CN': 'PKG zh' });
         expect(await subjectOf(protocol, 'zh-CN')).toBe('PKG zh');
 
         const after = await boot(stores);
         expect(await servedSubjects(after.protocol)).toEqual({ 'en-US': 'ADMIN en', 'zh-CN': 'PKG zh' });
-        expect(registrySubject(after.engine, 'en-US')).toBe('ADMIN en');
+        expect(await subjectOf(after.protocol, 'en-US')).toBe('ADMIN en');
     });
 
     it('DELETE by member of a member NO artifact ships: its overlay leaves the registry, and the canonical overlay stays', async () => {
@@ -479,7 +488,10 @@ describe('the by-name doors address ONE member by the selector (#22877, stage 2)
 
         expect(await protocol.deleteMetaItem({ type: T, name: DIGEST, member: 'zh-CN' })).toMatchObject({ success: true, reset: true });
         expect(digestEntry('zh-CN')).toBeUndefined();
-        expect(digestEntry('en-US')).toBe('ADMIN digest en');
+        // [#29600] The canonical member's override (a member the package
+        // ships) is served from its row; the registry holds the package's.
+        expect(((await protocol.getMetaItem({ type: T, name: DIGEST, member: 'en-US' })) as any)?.item?.subject).toBe('ADMIN digest en');
+        expect(digestEntry('en-US')).toBe('PKG digest en');
         const listed: any = await protocol.getMetaItemsForExecution({ type: T });
         const digest = (listed?.items ?? []).filter((it: any) => it?.name === DIGEST).map((it: any) => `${it.locale}:${it.subject}`);
         expect(digest).toEqual(['en-US:ADMIN digest en']);
@@ -491,7 +503,8 @@ describe('the by-name doors address ONE member by the selector (#22877, stage 2)
         expect(await protocol.deleteMetaItem({ type: T, name: NAME })).toMatchObject({ success: true, reset: true });
         expect(overlayRows(stores).map((r) => r.bundle_member)).toEqual(['zh-CN']);
         expect(registrySubject(engine, 'en-US')).toBe('PKG en');
-        expect(registrySubject(engine, 'zh-CN')).toBe('ADMIN zh');
+        // [#29600] The zh-CN override stays served, from its row.
+        expect(await subjectOf(protocol, 'zh-CN')).toBe('ADMIN zh');
         expect(await subjectOf(protocol)).toBe('PKG en');
     });
 
@@ -739,12 +752,18 @@ describe('the package-batch doors and the cluster fan-out carry the member (#228
 
         await writer.protocol.saveMetaItem({ type: T, name: NAME, item: template('en-US', 'ADMIN en') });
         await writer.protocol.saveMetaItem({ type: T, name: NAME, item: template('zh-CN', 'ADMIN zh') });
-        await vi.waitFor(() => expect(registrySubject(peer.engine, 'zh-CN')).toBe('ADMIN zh'));
-        expect(registrySubject(peer.engine, 'en-US')).toBe('ADMIN en');
+        // [#29600] A pair's override of a shipped member is served from its
+        // row and never enters the registry, so the peer converges on its
+        // served read, and its registry keeps the package's own members.
+        await vi.waitFor(async () => expect(await subjectOf(peer.protocol, 'zh-CN')).toBe('ADMIN zh'));
+        expect(await subjectOf(peer.protocol, 'en-US')).toBe('ADMIN en');
+        expect(registrySubject(peer.engine, 'zh-CN')).toBe('PKG zh');
+        expect(registrySubject(peer.engine, 'en-US')).toBe('PKG en');
 
         await writer.protocol.deleteMetaItem({ type: T, name: NAME, member: 'zh-CN' });
-        await vi.waitFor(() => expect(registrySubject(peer.engine, 'zh-CN')).toBe('PKG zh'));
-        expect(registrySubject(peer.engine, 'en-US')).toBe('ADMIN en');
+        await vi.waitFor(async () => expect(await subjectOf(peer.protocol, 'zh-CN')).toBe('PKG zh'));
+        expect(await subjectOf(peer.protocol, 'en-US')).toBe('ADMIN en');
+        expect(registrySubject(peer.engine, 'zh-CN')).toBe('PKG zh');
     });
 });