Good doc, Masha. The direction is right. Here's my take with some additional considerations.
- Registry as source of truth for what flags exist — yes, absolutely
- Validate flag keys on write — reject keys not in registry. This prevents drift
- Merge on read — registry defaults + per-org overrides. This is the core change
- Show ALL registry flags in the admin UI — this is actually the highest-impact change