@@ -0,0 +1,18 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql)!: a tenant's reworded copy of a packaged validation rule is one rule with the package's, run once with the tenant's sentence: the registry fold merges validation rules by name (#27949)
+
+Clause-②: no (narrowing) — a tenant overlay's same-named copy of a packaged or extension-contributed rule no longer runs its own condition: the package's rule runs, with the copy's `message` and `active`. A write the copy's condition alone refused, or that only the package's rule refuses, is judged by the package's rule. Rules of different names are unchanged.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no stored row needs rewriting: the fold reads a stored overlay row as it is, taking a copied rule's message and active from it and the rest from the package. Nothing is tombstoned, and an author has no code to change. -->
+
+**BREAKING** for a tenant overlay that copies a packaged rule (`@objectstack/objectql`, served by every object read and the write door through the registry fold). ADR-0029 D9.2a gains a dated note: "validations stay additive" means rules of different names add; a same-named rule merges by name, with the condition owned by the package.
+
+- **Before.** The fold concatenated `validations`. A Studio GET, edit and PUT of an object stores a copy of every rule the read served, so a tenant who reworded an extension's rule held a copy beside the extension's original: both ran, and a refused write reported the rule twice, once in each sentence. A copy of the owner's rule ran as stored, so a later package fix to that rule never reached the tenant.
+- **Now.** A rule's identity within an object is its `name`. Two rules of one name are one rule. A tenant overlay's copy of a rule a code layer ships (the owner or an extension) runs as the package declares it, with the copy's `message` and `active`. `active: false` switches the rule off. A refused write reports it once, in the tenant's sentence, and a package fix to the rule reaches the tenant.
+- **A copy that changes more than `message` and `active`** (its `type`, its condition, or any other key the package owns) does not run its own version. The package's rule runs, and the registry names the copy once at `error` (`validation_rule_copy_changed`), with the prescription: to change the condition, add a rule under a new name, or change it in the package. Loading a stored copy only reports it and never fails the boot or an upgrade. `SchemaRegistry.tenantRuleCopyRefusal(name, body)` returns that refusal (`ValidationRuleCopyRefusedError`, `INVALID_METADATA`, 422) for a body before it is stored; refusing such a save at the metadata save door is a follow-up change.
+- **Unchanged.** A rule of a new name, the tenant's or an extension's, is added. A rule the overlay leaves out stays out. Between two code layers a later layer's same-named rule replaces the earlier one, as a field does. `getPackagedObjectBase` serves the packaged rules merged by name the same way.
+- **Who sees it.** A tenant whose overlay rewords or switches off a packaged rule: the rule now runs once. A tenant whose overlay changed a packaged rule's condition: the package's condition runs instead, and the boot log names the rule. To keep a different condition, add it as a rule under a new name.
@@ -540,6 +540,42 @@ Binding consequences:
   were considered and **rejected**. Dropping scalars from the fold entirely
   (#8284's arm B) remains rejected and is not this clause.
 
+> **Note (2026-10-30, #27949; ruling of record 6524229156, letter C′; where the
+> refusal sits: ruling of record 6545641964, letter B, 2026-10-31): "validations
+> stay additive" means rules of DIFFERENT names add. A same-named rule merges by
+> name, with the condition owned by the package.**
+>
+> A validation rule's identity within an object is its `name` (the schema's
+> "unique rule name"). The fold therefore merges `validations` by name across the
+> layers, the way `fields` merge by key, instead of concatenating them: two rules
+> of one name in one object are one rule. Measured before this note: a tenant
+> overlay that reworded an extension's rule (the Studio GET → edit → PUT of the
+> folded object stores a copy of every rule it served) held a copy beside the
+> extension's original, and both ran, so a refused write reported the rule twice.
+>
+> - **What the tenant owns.** A tenant overlay's copy of a packaged or
+>   extension-contributed rule supplies the rule's `message` and `active`
+>   (`active: false` is the explicit, visible deactivation). Everything else —
+>   the `type`, the condition and every other key the evaluator reads — is the
+>   package's: the fold enforces the code layer's rule with the tenant's
+>   sentence and switch, so a later package fix to the rule reaches the tenant.
+>   This is the opposite of whole-rule replacement, which would freeze the
+>   enforced rule against package fixes.
+> - **A changed condition or type is refused, loudly, at the save door, with the
+>   prescription "to change the condition, add a rule under a new name, or change
+>   it in the package"** — never two rules running beside each other, never a
+>   silent replacement. The overlay LOAD path never refuses: a copy stored before
+>   the condition changed (a package upgrade) is indistinguishable from one the
+>   tenant changed, so the fold never runs a copy's condition and names each such
+>   copy once, at `error`, with that prescription; it never drops the tenant's
+>   layer for it, so an upgrade never fails on stored data.
+> - **Different names stay additive**, as this clause has always protected: an
+>   extender's or a tenant's rule of a new name is added. A rule the overlay
+>   leaves out stays out, as D9.2's replace means. Between two code layers a
+>   later layer's same-named rule replaces the earlier one, as a field does.
+> - **Idempotence (#8027) holds by the merge itself:** a folded base re-folds to
+>   the same rules, so `validations` are no longer subtracted before the fold.
+
 #### D9.3 — selection is by KIND; priority stays descriptive
 
 `contributors.sort((a, b) => a.priority - b.priority)` (`#contributors`) totals the whole