@@ -39,6 +39,7 @@ const SHELL = [
 
 /** The environment this suite sets; each test starts with all of it unset and leaves it as it found it. */
 const ENV = [
+  'OS_PAGE_REACT_ENABLED',
   'OS_PAGE_REACT',
   'OS_CONSOLE_CSP_CONNECT_SRC',
   'OS_CLOUD_URL',
@@ -73,10 +74,18 @@ afterEach(() => {
   }
 });
 
-async function mount(opts: { runtimeConfig?: ConstructorParameters<typeof RuntimeConfigPlugin>[0] } = {}) {
+async function mount(opts: {
+  runtimeConfig?: ConstructorParameters<typeof RuntimeConfigPlugin>[0];
+  warnings?: string[];
+} = {}) {
   const server = new HonoHttpServer(0);
   server.installNotFoundSeam();
-  const logger = { warn: () => {}, info: () => {}, debug: () => {}, error: () => {} };
+  const logger = {
+    warn: (message: string) => { opts.warnings?.push(message); },
+    info: () => {},
+    debug: () => {},
+    error: () => {},
+  };
   if (opts.runtimeConfig) {
     const hooks: Array<() => Promise<void>> = [];
     await new RuntimeConfigPlugin(opts.runtimeConfig).start({
@@ -140,10 +149,11 @@ describe('the console document is served with a nonce-based content-security-pol
     const nonce = headerNonce(res.headers.get('content-security-policy'));
     const html = await res.text();
 
+    // The build's three, and the server's react-pages capability global.
     const tags = scriptTags(html);
-    expect(tags).toHaveLength(3);
+    expect(tags).toHaveLength(4);
     for (const tag of tags) expect(tag).toContain(` nonce="${nonce}"`);
-    expect(html.match(/ nonce="/g)).toHaveLength(3);
+    expect(html.match(/ nonce="/g)).toHaveLength(4);
   });
 
   it('draws a fresh nonce for every response', async () => {
@@ -175,26 +185,57 @@ describe('the console document is served with a nonce-based content-security-pol
   });
 });
 
-describe('\'unsafe-eval\' follows the react-pages tier', () => {
-  it('is allowed while the tier is on, which is the default', async () => {
-    const request = await mount();
+describe('\'unsafe-eval\' follows the react-pages tier, which is off unless the deployment turns it on', () => {
+  /** The served document's policy, its nonce, and its html. */
+  async function serve(warnings?: string[]) {
+    const request = await mount({ warnings });
     const res = await request('/_console/');
-    expect(directives(res.headers.get('content-security-policy')).get('script-src')).toContain("'unsafe-eval'");
+    const policy = res.headers.get('content-security-policy');
+    return { scriptSrc: directives(policy).get('script-src')!, nonce: headerNonce(policy), html: await res.text() };
+  }
+
+  it('is refused by default, and the document carries the disable global under the nonce', async () => {
+    const { scriptSrc, nonce, html } = await serve();
+    expect(scriptSrc).not.toContain("'unsafe-eval'");
+    expect(html).toContain(
+      `<script nonce="${nonce}">window.__OBJECTUI_CAPABILITIES_DISABLED__=(window.__OBJECTUI_CAPABILITIES_DISABLED__||[]).concat('react-pages');</script>`,
+    );
+    expect(html).not.toContain('window.__OBJECTUI_CAPABILITIES__=');
   });
 
-  it('is refused with OS_PAGE_REACT=off, and the injected disable global carries the nonce', async () => {
+  it('is allowed with OS_PAGE_REACT_ENABLED=true, and the document carries the enable global under the nonce', async () => {
+    process.env.OS_PAGE_REACT_ENABLED = 'true';
+    const { scriptSrc, nonce, html } = await serve();
+    expect(scriptSrc).toContain("'unsafe-eval'");
+    expect(html).toContain(
+      `<script nonce="${nonce}">window.__OBJECTUI_CAPABILITIES__=(window.__OBJECTUI_CAPABILITIES__||[]).concat('react-pages');</script>`,
+    );
+    expect(html).not.toContain('__OBJECTUI_CAPABILITIES_DISABLED__');
+  });
+
+  it('reads the legacy OS_PAGE_REACT in both directions while the new name is unset', async () => {
+    process.env.OS_PAGE_REACT = 'on';
+    expect((await serve()).scriptSrc).toContain("'unsafe-eval'");
     process.env.OS_PAGE_REACT = 'off';
-    const request = await mount();
-    const res = await request('/_console/');
-    const policy = res.headers.get('content-security-policy');
-    expect(directives(policy).get('script-src')).not.toContain("'unsafe-eval'");
+    expect((await serve()).scriptSrc).not.toContain("'unsafe-eval'");
+  });
 
-    const nonce = headerNonce(policy);
-    const html = await res.text();
-    const tags = scriptTags(html);
-    expect(tags).toHaveLength(4);
-    for (const tag of tags) expect(tag).toContain(`nonce="${nonce}"`);
-    expect(html).toContain(`<script nonce="${nonce}">window.__OBJECTUI_CAPABILITIES_DISABLED__=`);
+  it('lets the new name win over the legacy one', async () => {
+    process.env.OS_PAGE_REACT = 'on';
+    process.env.OS_PAGE_REACT_ENABLED = 'false';
+    expect((await serve()).scriptSrc).not.toContain("'unsafe-eval'");
+  });
+
+  it('keeps the tier off on a value that is neither on nor off, and says so once', async () => {
+    process.env.OS_PAGE_REACT_ENABLED = 'ture';
+    const warnings: string[] = [];
+    const request = await mount({ warnings });
+    for (let i = 0; i < 2; i += 1) {
+      const res = await request('/_console/');
+      expect(directives(res.headers.get('content-security-policy')).get('script-src')).not.toContain("'unsafe-eval'");
+    }
+    const named = warnings.filter((w) => w.includes('OS_PAGE_REACT_ENABLED="ture"'));
+    expect(named).toHaveLength(1);
   });
 });
 
 
@@ -48,6 +48,7 @@ import fs from 'fs';
 import { createHash, randomBytes } from 'crypto';
 import { createRequire } from 'module';
 import { pathToFileURL, fileURLToPath } from 'url';
+import { readEnvWithDeprecation } from '@objectstack/types';
 
 // ─── Constants ──────────────────────────────────────────────────────
 
@@ -733,7 +734,7 @@ const DEFAULT_MAP_STYLE_ORIGIN = 'https://demotiles.maplibre.org';
  *   Console keeps its session token where any script on the page can read it,
  *   so only the build's own files and the document's own inline scripts (the
  *   early-branding, process-polyfill, crypto-shim and boot-splash scripts, and
- *   the server's react-pages disable global) may run: a script element that
+ *   the server's react-pages capability global) may run: a script element that
  *   markup injected later carries no nonce, and an inline event handler never
  *   matches one. No public CDN is listed. A CDN host in `script-src` admits
  *   every file that CDN serves, so the Studio's Monaco editor, which loads its
@@ -743,7 +744,8 @@ const DEFAULT_MAP_STYLE_ORIGIN = 'https://demotiles.maplibre.org';
  *   whose grammar engine is WebAssembly compiled in the page. It permits
  *   compiling WebAssembly and nothing else; JavaScript `eval` stays refused.
  * - `'unsafe-eval'` only while the `kind:'react'` page tier is on (ADR-0081;
- *   on unless `OS_PAGE_REACT=off`). That runtime evaluates the author's
+ *   off unless `OS_PAGE_REACT_ENABLED=true`, `readReactPagesTier`). That
+ *   runtime evaluates the author's
  *   transpiled page source with `Function`, which nothing but `'unsafe-eval'`
  *   permits. With the tier off, the policy refuses it.
  * - `style-src 'self' 'unsafe-inline'`: the document's own `<style>` (the boot
@@ -793,6 +795,43 @@ function consoleContentSecurityPolicy(input: {
   return directives.map((directive) => directive.join(' ')).join('; ');
 }
 
+/** The variable a deployment sets to turn the `kind:'react'` page tier on. */
+export const REACT_PAGES_ENV = 'OS_PAGE_REACT_ENABLED';
+/** Its earlier name, read when the new one is unset (`readEnvWithDeprecation`). */
+const REACT_PAGES_LEGACY_ENV = 'OS_PAGE_REACT';
+const REACT_PAGES_ON = new Set(['true', '1', 'on', 'yes', 'enabled']);
+const REACT_PAGES_OFF = new Set(['', 'false', '0', 'off', 'no', 'disabled']);
+
+/**
+ * Whether this deployment serves the `kind:'react'` page tier (ADR-0081, as
+ * amended: off by default). That tier runs the page author's code in every
+ * viewer's Console with no sandbox, so it is on only when the operator says so
+ * with `OS_PAGE_REACT_ENABLED=true` (or the legacy `OS_PAGE_REACT=on`). A value
+ * that is neither an on nor an off spelling leaves the tier off and is reported
+ * through `onUnrecognized`, so a typo never reads as a silent refusal.
+ */
+export function readReactPagesTier(onUnrecognized?: (name: string, value: string) => void): boolean {
+  const raw = readEnvWithDeprecation(REACT_PAGES_ENV, REACT_PAGES_LEGACY_ENV);
+  const value = String(raw ?? '').trim().toLowerCase();
+  if (REACT_PAGES_ON.has(value)) return true;
+  if (!REACT_PAGES_OFF.has(value)) {
+    const name = process.env[REACT_PAGES_ENV] !== undefined ? REACT_PAGES_ENV : REACT_PAGES_LEGACY_ENV;
+    onUnrecognized?.(name, String(raw));
+  }
+  return false;
+}
+
+/**
+ * The inline script that tells the Console's capability gate (objectui
+ * `@object-ui/core`, `isCapabilityEnabled`) which way this deployment set the
+ * react-pages tier. The server writes it in both directions, so its answer
+ * holds whichever default the Console build carries.
+ */
+function reactPagesCapabilityScript(reactPages: boolean): string {
+  const list = reactPages ? '__OBJECTUI_CAPABILITIES__' : '__OBJECTUI_CAPABILITIES_DISABLED__';
+  return `<script>window.${list}=(window.${list}||[]).concat('react-pages');</script>`;
+}
+
 /**
  * Every `<script>` start tag in `html` with `nonce` added, unless it already
  * carries one. Only start tags match: `</script>` and escaped text do not.
@@ -863,14 +902,19 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
       }
 
       // The `kind:'react'` page tier (executes author JS in the main React
-      // tree) is ON by default. A deployment that does not trust its page
-      // authors turns it off with `OS_PAGE_REACT=off`; we then inject the
-      // disable global the console's capability gate reads. Read per request
-      // (env can change without a rebuild — index.html is re-read on every
-      // fallback hit too).
-      const reactPagesDisabled = (): boolean => {
-        const v = String(process.env.OS_PAGE_REACT ?? '').trim().toLowerCase();
-        return v === 'off' || v === '0' || v === 'false' || v === 'no' || v === 'disabled';
+      // tree) is OFF unless the operator turns it on (`readReactPagesTier`);
+      // either way the document carries the global the console's capability
+      // gate reads. Read per request (env can change without a rebuild —
+      // index.html is re-read on every fallback hit too).
+      let reportedUnrecognizedReactPages = false;
+      const reportUnrecognizedReactPages = (name: string, value: string) => {
+        if (reportedUnrecognizedReactPages) return;
+        reportedUnrecognizedReactPages = true;
+        ctx.logger?.warn?.(
+          `Console static: ${name}=${JSON.stringify(value)} is not an on or off value, so kind:'react' pages `
+          + `stay off and render a notice instead of running. Set ${REACT_PAGES_ENV}=true to turn them on, or `
+          + 'unset it to keep them off. Reported once.',
+        );
       };
 
       // A runtime-config read that fails leaves the shell's head as the build
@@ -904,11 +948,8 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
           const baseTag = `<base href="${CONSOLE_PATH}/">`;
           html = html.replace(/<head(\s[^>]*)?>/i, (m) => `${m}\n    ${baseTag}`);
         }
-        if (!reactPages) {
-          const capTag =
-            `<script>window.__OBJECTUI_CAPABILITIES_DISABLED__=(window.__OBJECTUI_CAPABILITIES_DISABLED__||[]).concat('react-pages');</script>`;
-          html = html.replace(/<head(\s[^>]*)?>/i, (m) => `${m}\n    ${capTag}`);
-        }
+        const capTag = reactPagesCapabilityScript(reactPages);
+        html = html.replace(/<head(\s[^>]*)?>/i, (m) => `${m}\n    ${capTag}`);
         // Stamped while the document holds only the build's markup and the
         // server's own tags: nothing read at request time is written yet, so
         // no runtime value can ever carry the nonce.
@@ -917,9 +958,9 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
 
       const serveDocument = async (c: any, reqPath: string): Promise<Response> => {
         const nonce = randomBytes(16).toString('base64');
-        // One read per document, so the injected disable global and the
+        // One read per document, so the injected capability global and the
         // policy's `'unsafe-eval'` always agree.
-        const reactPages = !reactPagesDisabled();
+        const reactPages = readReactPagesTier(reportUnrecognizedReactPages);
         const html = readIndexHtml(reactPages, nonce);
         const shell = await readShellConfig(app, c, reportShellConfigReadFailure);
         const policy = consoleContentSecurityPolicy({