DL-497
The highest layer with a member wins it whole: a file, or a whole skills/<name>/ or extensions/<id>/ directory; nothing merges inside a member. An MCP file is mcp/<server>.json whose mcpServers holds only <server> or nothing, so path identity is server identity. The tenant’s locks.yml lists paths and /-ended prefixes the user and role layers may not set: their door rejects a covered member, and the merge drops a stored one with a Warn. The door requires each extension manifest entry’s SDK-derived id to equal <id>.
Status: Active (Matt, 2026-10-13)