@@ -0,0 +1,21 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-automation': minor
+---
+
+feat(service-automation, metadata-protocol): a flow override declared in the shipping package's paired `<base>.custom` is the packaged flow — saved, served and armed in place of the base, and deleting it restores the base (#28412)
+
+Clause-②: yes (widening)
+Metadata-protocol: semantic
+
+ADR-0146 D9 item 1 for `flow`. A flow a code package ships could be changed only by cloning it under a new name, so the clone and the base both ran on every record change. Now the base package's paired `.custom` package can override it in place:
+
+- **The save door admits it.** A flow saved into `<base>.custom` under the base flow's name, declaring `overrides: { package: '<base>', basedOn }`, passes the ADR-0146 D2 override write gate (`flow` is open there now; `action` still answers "not yet available"). The draft save, the per-item publish, `publishPackageDrafts`, `os validate` and the install-local gate admit it as they admit a declared view override.
+- **Every read serves it as the base.** The flow view (`getMetaItems` / `getMetaItemsForExecution`), the by-name read, the layered read (`code` = the base's flow, `effective` = the override) and the per-package customization list serve the override in the base's slot, under the base's `_packageId`, once per name. The one predicate is N-10's `isServedOverrideRowOf`, judged on the row's stored `package_id` — never on the body's `_packageId`.
+- **The automation engine arms it in place of the base.** The boot pull, the `kernel:ready` sync, the `metadata:reloaded` re-sync and the metadata-mutation sync each arm the override. One record change runs one body. The boot pull ranks it above the loader's body (a new `override` contender rank), reading the row's stored binding, which the protocol's registry hydration now records on the hydrated flow body as a non-enumerable symbol (`bindStoredRow` / `storedRowBindingOf`, newly exported). That symbol cannot be authored in JSON and never leaves the process.
+- **The ledger identity stays the base's.** The override keeps the base flow's name and owner, so the activation toggle, the ledger row, `FLOW_DISABLED` and the §7.3 subflow guard treat it as the base. Switched off, it is silent. Switched on, it is armed again.
+- **Deleting it restores the base.** A `/meta` delete naming the pair removes its row (admitted past the sealed-removal refusal, as the narrowing direction), and each arming step re-arms the base with one registration, never a withdraw first. A run suspended on the base finishes on the base (N-12), while new runs start on the override.
+- **Every other stored row stays shadowed.** A dependent package's declaration, a package-less row whose body names the pair, and the pair's undeclared row are not armed. The shadowing warning's remedy is now "declare it as an override in '<base>.custom' (overrides: { package, basedOn }), or save it under a new name". It no longer says "clone".
+- **The sealed save sentence for a packaged flow** names the declaration in place of the clone route: "… Declare an override from '<base>.custom' or rename it to customize it, or switch it off (…). See docs/adr/0126-packaged-metadata-customization-model.md." A delete still names the clone and the switch.
+
+No spec key is added or reshaped. A flow item's existing `overrides` declaration, refused before, now takes effect.
@@ -98,12 +98,15 @@ describe('#28410 — findOverrideDeclarationRefusals walks the artifact under th
       manifest: manifest(PAIR, [BASE]),
       dashboards: [{ name: 'crm_board', overrides: { package: BASE, basedOn: '1.0.0' } }],
       objects: [{ name: 'crm_account', overrides: { package: BASE, basedOn: '1.0.0' } }],
+      // [#28412, ADR-0146 D9] A declared flow override is admitted now (its D9
+      // conditions are delivered); an `action` declaration still waits.
       flows: [{ name: 'crm_flow', overrides: { package: BASE, basedOn: '1.0.0' } }],
+      actions: [{ name: 'crm_call', objectName: 'crm_account', label: 'Call', overrides: { package: BASE, basedOn: '1.0.0' } }],
       pages: [{ name: 'crm_home', overrides: { package: 'com.unlisted', basedOn: '1.0.0' } }],
     });
     expect(rows.map((r) => [r.path, r.rule])).toEqual([
       ['objects[0]', 'declared_object'],
-      ['flows[0]', 'declared_type_not_yet_available'],
+      ['actions[0]', 'declared_type_not_yet_available'],
       ['pages[0]', 'declared_outside_pair'],
     ]);
   });
 
@@ -239,6 +239,12 @@ export { isServedOverrideRowOf } from './served-override.js';
 export type { ServedOverrideRow } from './served-override.js';
 export type { ServedOverrideEntry } from './protocol-served-overrides.js';
 
+// [#28412, ADR-0146 D9 item 1] The `package_id` column of the stored row a
+// registry body was hydrated from, recorded by the protocol's hydration and
+// read by the automation boot pull, which judges a flow override on the
+// column (`isServedOverrideRowOf`), ⛔ never on the body's `_packageId`.
+export { bindStoredRow, storedRowBindingOf } from './stored-row-binding.js';
+
 // [ADR-0131 D6] The `unmanaged` install mode's walled-posture refusal — the
 // function `importUnmanagedPackage` raises, exported so the install door
 // (`@objectstack/cloud-connection` install-local) answers it with the same
 
@@ -338,6 +338,29 @@ export function packagedBaseRegimeSentence(
     return lock + rowPrescription(row, name);
 }
 
+/**
+ * [#28412, ADR-0146 D2 / D9 item 1] The sealed SAVE sentence of a Regime C
+ * item whose type the declared override opens (`flow`), or `undefined` for a
+ * type with no Regime C row. The lock of {@link packagedBaseRegimeSentence},
+ * then `declare` — the writer's own fix, the declaration from the base's
+ * paired `.custom` or a rename, phrased by the override write gate's module —
+ * in place of the row's clone path, then the row's switch, then the ADR-0126
+ * citation. The clone is not named: a clone is a second flow beside the base,
+ * and both run; the declared override is the one body that replaces it
+ * (ADR-0146 D9 item 1). The removal sentence keeps the row's prescription.
+ *
+ * Kept under the REST door's 500-character bound for an 88-character name
+ * (pinned beside the other rows).
+ */
+export function regimeCDeclaredSaveSentence(type: string, name: string, declare: string): string | undefined {
+    const singular = PLURAL_TO_SINGULAR[type] ?? type;
+    const row = packagedBaseRegimeRow(singular);
+    if (row?.regime !== 'C') return undefined;
+    const switchOff = row.routes.switchOff ? `, or switch it off (${row.routes.switchOff})` : '';
+    return `Metadata item '${singular}/${name}' is provided by a managed package and is sealed against in-place edits. `
+        + `${declare}${switchOff}. See ${REGIME_C_ADR}.`;
+}
+
 /** [ADR-0131 D6] The decision record every sealed-item sentence without a regime row cites. */
 const MANAGED_SEAL_ADR = 'docs/adr/0131-total-organization-ownership-no-null-organization-id.md';
 
 
@@ -15,6 +15,11 @@
  * re-indented one level and otherwise unedited: the same reads, in the same
  * order, throwing exactly where they did with the same message.
  *
+ * Edited since: [#28412, ADR-0146 D9 item 1] `declinesStoredRow` takes the
+ * stored row it judges, and does not decline a shipped flow name's row that
+ * the one served-override predicate (`isServedOverrideRowOf`) admits for the
+ * shipping package — its declared `.custom` override, the packaged flow.
+ *
  * ## How the moved bodies reach the class
  *
  * The shape #23050 set for `rest-server.ts` (its `data-action-routes.ts`
@@ -44,6 +49,7 @@ import type { ObjectStackProtocolImplementation } from './protocol.js';
 import { canonicalMetaType } from './protocol.js';
 import type { ItemLock } from './item-lock.js';
 import { isOriginGatedType } from './packaged-base-regime.js';
+import { isServedOverrideRowOf, type ServedOverrideRow } from './served-override.js';
 import { isCodeArtifactBody } from '@objectstack/metadata-core';
 import { PLURAL_TO_SINGULAR } from '@objectstack/spec/shared';
 import {
@@ -131,9 +137,15 @@ export function isStoredFlowEntryOfShippedName(
 
 /** The body of `ObjectStackProtocolImplementation#declinesStoredRow`; the method's docblock there is its contract. */
 export function declinesStoredRow(
-    this: Pick<LockStateHost, 'isDeclaredCodeDatasource' | 'isShippedFlowName' | 'isUnservedSealedOverlay'>,
-    type: string, name: unknown): boolean {
-    if (this.isShippedFlowName(type, name)) return true;
+    this: Pick<LockStateHost, 'isDeclaredCodeDatasource' | 'isShippedFlowName' | 'isUnservedSealedOverlay' | 'packagedArtifactOwner'>,
+    type: string, name: unknown, row?: ServedOverrideRow): boolean {
+    if (this.isShippedFlowName(type, name)) {
+        // [#28412, ADR-0146 D9 item 1] …except the one row that IS the
+        // packaged flow now: the shipping package's declared override, judged
+        // on the row's own `package_id` and body by the one served-override
+        // predicate. Every other stored row of the name stays declined.
+        return !isServedOverrideRowOf(row, this.packagedArtifactOwner({ type: 'flow', name: name as string }));
+    }
     if (typeof name !== 'string' || name === '') return false;
     return this.isDeclaredCodeDatasource(type, name) || this.isUnservedSealedOverlay(type, name);
 }
 
@@ -36,7 +36,7 @@
  */
 
 import type { ObjectStackProtocolImplementation } from './protocol.js';
-import { isOriginGatedType, managedItemSealedSentence } from './packaged-base-regime.js';
+import { isOriginGatedType, managedItemSealedSentence, regimeCDeclaredSaveSentence } from './packaged-base-regime.js';
 import { SysMetadataRepository } from './sys-metadata-repository.js';
 import {
     customizationBasePackageId,
@@ -144,9 +144,14 @@ export function refusePackagedBaseOverride(
         // of the bare seal: the override write gate ({@link judgeOverrideWrite})
         // admits exactly the pair's declaration, so the seal is no longer the
         // whole story.
+        // [#28412] A Regime C type the declared override opens (`flow`) names
+        // the declaration in place of its clone path, keeping its switch.
+        const owner = this.packagedArtifactOwner(request);
+        const declare = sealedDeclareOrRenameClause(request.type, owner, request.packageId);
         const err = new Error(
-            managedItemSealedSentence(request.type, request.name, 'save')
-            + sealedDeclareOrRenameTail(request.type, this.packagedArtifactOwner(request), request.packageId),
+            (declare === undefined ? undefined : regimeCDeclaredSaveSentence(request.type, request.name, declare))
+            ?? managedItemSealedSentence(request.type, request.name, 'save')
+                + sealedDeclareOrRenameTail(request.type, owner, request.packageId),
         );
         (err as any).code = 'NOT_OVERRIDABLE';
         (err as any).status = 403;
@@ -164,9 +169,10 @@ export function refusePackagedBaseOverride(
  *   (ruling A on #28390), so a dependent's one fix is a new name, and the
  *   declare advice would send it to a refusal (`declared_outside_pair`).
  *
- * Empty for a type with no open channel — `flow` and `action` wait for
- * ADR-0146 D9's conditions (their regime rows keep their own routes), and an
- * excluded type has none — and when the shipping package has no pair id.
+ * Empty for a type with no open channel — `action` waits for ADR-0146 D9's
+ * conditions (its regime row keeps its own routes), and an excluded type has
+ * none — and when the shipping package has no pair id. [#28412] `flow` is
+ * open: its sealed sentence names the declaration too.
  */
 function sealedDeclareOrRenameTail(type: string, basePackageId: unknown, writerPackageId: unknown): string {
     const singular = PLURAL_TO_SINGULAR[type] ?? type;
@@ -181,21 +187,79 @@ function sealedDeclareOrRenameTail(type: string, basePackageId: unknown, writerP
         + `(overrides: { package: '${basePackageId}', basedOn }), or rename the item.`;
 }
 
+/**
+ * [#28412, ADR-0146 D2] {@link sealedDeclareOrRenameTail}'s choice, as the
+ * clause a Regime C sentence carries in place of its clone path
+ * (`regimeCDeclaredSaveSentence`): the pair (or a write naming no package)
+ * may declare from the pair or rename; any other named package may only
+ * rename. `undefined` exactly where the tail is empty.
+ */
+function sealedDeclareOrRenameClause(type: string, basePackageId: unknown, writerPackageId: unknown): string | undefined {
+    const singular = PLURAL_TO_SINGULAR[type] ?? type;
+    if (!isOpenOverrideType(singular) || typeof basePackageId !== 'string') return undefined;
+    const pair = customizationPackageId(basePackageId);
+    if (!pair.ok) return undefined;
+    const writer = typeof writerPackageId === 'string' && writerPackageId.length > 0 ? writerPackageId : undefined;
+    if (writer !== undefined && writer !== pair.value) {
+        return `Rename it to customize it (only '${pair.value}' may declare an override of '${basePackageId}')`;
+    }
+    return `Declare an override from '${pair.value}' or rename it to customize it`;
+}
+
 // ─────────────────────────────────────────────────────────────────────────
 // ADR-0146 D2 — the override write gate (ruling A on decision card #28390)
 // ─────────────────────────────────────────────────────────────────────────
 
+/**
+ * [#28412, ADR-0146 D9] The behavioural types whose D9 conditions this runtime
+ * delivers, so the gate admits their declared override:
+ *
+ *  - `flow` — all four. Served over the code package and rebound in one reload
+ *    (`@objectstack/service-automation`'s flow precedence and the flow view of
+ *    this package, which admit exactly the `.custom` row
+ *    `isServedOverrideRowOf` names); ledger identity inherited (the
+ *    override keeps the base's name, so `packagedFlowOwner`, the toggle door,
+ *    the §7.3 subflow guard and the `FLOW_DISABLED` consult key it as the
+ *    base); version pinning (#28405: a suspended run finishes on the body it
+ *    started on).
+ *
+ * ⛔ Not `action`: its override door is not cut (D9's `action` paragraph), so
+ * its declaration keeps the "not yet available" refusal. A type joins this set
+ * in the change that delivers its conditions, never ahead of it.
+ */
+const CONDITIONS_DELIVERED: ReadonlySet<string> = new Set(['flow']);
+
 /**
  * Whether a declared override of `type` is admitted today: the closed list's
  * disposition is `overridable` AND the type waits for no ADR-0146 D9
- * condition. `flow` (D9 conditions, opened by its own card in this same gate)
- * and `action` (its ledger switch first; refused for the whole epic) carry
- * `conditions`, so they are classified overridable and still refused here.
- * Read from `OVERRIDE_TYPE_CLASSIFICATION`, never re-derived.
+ * condition this runtime has not delivered ({@link CONDITIONS_DELIVERED}).
+ * `flow` carries `conditions` and is delivered; `action` (its door is not cut)
+ * carries them and is not, so it is classified overridable and still refused
+ * here. The disposition and the conditions are read from
+ * `OVERRIDE_TYPE_CLASSIFICATION`, never re-derived.
  */
 function isOpenOverrideType(singular: string): boolean {
     const row = getOverrideTypeClassification(singular);
-    return row?.disposition === 'overridable' && (row.conditions?.length ?? 0) === 0;
+    if (row?.disposition !== 'overridable') return false;
+    return (row.conditions?.length ?? 0) === 0 || CONDITIONS_DELIVERED.has(singular);
+}
+
+/**
+ * [#28412, ADR-0146 D9 item 1] Whether a removal addressed to `packageId`
+ * removes the shipping package's PAIR row of an open-override type — the
+ * row the pair's declared override is stored in. Such a removal is admitted
+ * past the sealed-removal refusal: it removes no managed definition, and the
+ * code package's item is what every read serves (and, for a flow, what the
+ * automation engine arms) once the row is gone — the narrowing direction the
+ * #6960 ruling names. ⛔ Only the pair, named: a removal naming no package, or
+ * any other package, keeps the sealed refusal it had.
+ */
+export function isPairRowRemoval(type: string, basePackageId: unknown, packageId: unknown): boolean {
+    const singular = PLURAL_TO_SINGULAR[type] ?? type;
+    if (!isOpenOverrideType(singular) || typeof basePackageId !== 'string') return false;
+    if (typeof packageId !== 'string' || packageId.length === 0) return false;
+    const pair = customizationPackageId(basePackageId);
+    return pair.ok && pair.value === packageId;
 }
 
 /** One item written into one package — what the override write gate judges. */
@@ -312,9 +376,10 @@ export function judgeOverrideWrite(
                 `${item} carries \`overrides\`, but a ${type} takes no override (ADR-0146 D6). `
                 + `Remove \`overrides\` and create your own ${type} under a new name ("new similar").`);
         }
-        // `flow` and `action` are classified overridable and wait for D9's
-        // conditions (`isOpenOverrideType`): "flow customization is not yet
-        // available", and the same sentence for an action.
+        // `action` is classified overridable and waits for D9's conditions
+        // (`isOpenOverrideType`): "action customization is not yet available".
+        // [#28412] `flow`'s conditions are delivered, so it is judged below
+        // like every open type.
         if (!isOpenOverrideType(type)) {
             return refuse('declared_type_not_yet_available',
                 `${item} carries \`overrides\`: ${type} customization is not yet available, so a declared ${type} `
 
@@ -31,10 +31,12 @@
  *    leaves a legacy organization's out, ADR-0131 D6/D7). No per-organization
  *    axis exists to filter on (ADR-0131 D6), so every caller gets one answer.
  *  - A row the reads decline ({@link ObjectStackProtocolImplementation.declinesStoredRow}:
- *    a stored row under a shipped flow name, a code-defined datasource name,
- *    sealed managed content) is not listed. Its declaration may be well
- *    formed, but the base's document is what every read serves for the name
- *    (ADR-0146 D9's conditions are N-11's), so it overrides nothing yet.
+ *    a code-defined datasource name, sealed managed content) is not listed.
+ *    Its declaration may be well formed, but the base's document is what
+ *    every read serves for the name, so it overrides nothing. [#28412] A
+ *    shipped flow name's declared override is not declined (ADR-0146 D9
+ *    item 1): the reads serve it over the base's flow, so it is listed; the
+ *    row is handed over whole, so the decline judges it on its own binding.
  *
  * ## What it reports, and what it never computes
  *
@@ -112,7 +114,7 @@ export async function listServedOverrides(
         if (typeof row?.name !== 'string' || row.name === '') continue;
         if (!isServedOverrideRowOf(row, base)) continue;
         const type = PLURAL_TO_SINGULAR[row.type] ?? row.type;
-        if (this.declinesStoredRow(type, row.name)) continue;
+        if (this.declinesStoredRow(type, row.name, row)) continue;
         const member = typeof row.bundle_member === 'string' && row.bundle_member !== '' ? row.bundle_member : undefined;
         // `isServedOverrideRowOf` parsed this body already; a body it admitted parses.
         const declaration = (storedRowDocument(row) as { overrides?: { basedOn?: unknown } }).overrides;