fix(mod-api): reserve generated metadata ids

docs/modding.md

@@ -228,7 +228,9 @@ and data-only record shapes as `mod.content`, but only `get`, `has`, and
 `each`. Returned records are detached copies and cannot mutate either dataset.
 Every generated base record passes the selected generation's existing public
 schema before it is returned; extractor metadata beside record maps stays out
-of the registry id space. A malformed record makes `get` return nil, `has`
+of the registry id space and is reserved against `register`, `override`,
+`patch`, and `remove` writes through the active registry. A malformed record
+makes `get` return nil, `has`
 return false, and `each` return no rows, and invalidates that dataset view.
 Records containing functions, userdata, threads, metatables, or cycles are not
 exposed. Each open call receives an independent facade, so one mod cannot

docs/rfcs/0015-imported-dataset-views.md

@@ -71,8 +71,9 @@ the selected version's generation routing and the engine's existing
 `Schemas`, `Registry`, and `Builtins` normalization, so structured sources
 such as type matchups retain the same public ids used by the active
 `mod.content` facade and extractor metadata beside record maps is not exposed
-as a record id. Every generated base record is checked with that selected
-generation's existing public schema before it can cross `get`, `has`, or
+as a record id or writable through the active registry's mutation verbs. Every
+generated base record is checked with that selected generation's existing
+public schema before it can cross `get`, `has`, or
 `each`; there is no dataset-specific duplicate schema. No register, patch,
 override, or remove verb is exposed. Each call returns an independent facade
 over the cached internal dataset, so facade mutation cannot cross mod