@@ -0,0 +1,22 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec)!: `defineStack`, `os validate` and `os build` refuse a collection item whose body `_packageId` names a package other than the one that ships it
+
+The stack schema (`ObjectStackDefinitionSchema`) now judges every item of the collections the registration door files under their package (`OWNER_STAMP_JUDGED_COLLECTIONS`: connectors, flows, views, actions, permission sets, seed `data` and the rest) and raises an issue at the item's `_packageId` when the body carries a stamp other than the package that ships it: the stack's `manifest.id` (no package without a manifest), or for a release artifact each `packages[]` body's own `id`, with a top-level item no body declares judged against `manifest.id`. `defineStack` answers `STACK_SCHEMA_INVALID` / 422; `os validate`, `os build` and the artifact door's parse report the located issue. The judge is one pure function, `judgeCollectionItemOwnerStamp` (`@objectstack/spec/kernel`), which `@objectstack/objectql`'s registration refusal calls too, so the build door and the boot cannot disagree.
+
+Clause-②: no (narrowing) — the stack schema refuses a collection item whose body `_packageId` names a package other than the one that ships it, which it parsed before and the registration refused only at boot or install. Nothing is widened.
+
+Metadata-protocol: narrowed (a collection item's `_packageId`, declared by `MetadataProtectionFields`, is refused at the build doors unless it is absent or names the package that ships the item)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key is added, removed or renamed, and no value a legitimate producer writes is refused: the registration is the only writer of `_packageId` (`os build` writes none, the package export strips every underscore key), and a stamp equal to the shipping package is still accepted. A foreign stamp exists only in a body somebody wrote by hand, which the registration door already refuses at boot or install; this moves the same refusal to where the body is written. A conversion could not tell a foreign stamp from an agreeing one without the owner that judges it, and the refusal names the item, both values and the remedy. -->
+
+**BREAKING** accept-set narrowing at the build doors (`@objectstack/spec`), shipped as `minor`.
+
+- **Before.** `defineStack({ manifest: { id: 'com.acme.app', … }, connectors: [{ name: 'billing', …, _packageId: 'com.acme.host' }] })` parsed, and `os validate` exited 0; `ObjectQL.registerApp` refused the stack at boot or install with `VALIDATION_ERROR` / 400 at `_packageId`.
+- **Now.** The parse raises an issue at `connectors.0._packageId` whose message starts "Drop `_packageId` from connector 'billing'", names the stamp and the package that ships the item, and `os validate` / `os build` exit 1. `''` is refused the same way; `null` is refused by the item schema's own type check at the same key.
+- **Unchanged.** An absent `_packageId` and one equal to the shipping package parse as before. Objects, object extensions, apps, picklist extensions, datasources, datasource mappings and translations are not judged at either door. A top-level copy of a `packages[]` body's item is not judged against the artifact's id. A stack's `plugins` (runtime plugin instances) are not read by the parse; the registration door judges a nested plugin's items when it registers them.
+- **Who sees it.** Whoever hand-writes `_packageId` on a stack item naming another package, or on any item of a stack with no `manifest`, which no build, export or install writes.
+
+**The remedy.** Drop `_packageId` from the body. The package an item belongs to is the one that ships and registers it, stamped by the registration.
@@ -0,0 +1,22 @@
+---
+"@objectstack/objectql": patch
+---
+
+refactor(objectql): the registration door's `_packageId` refusal calls the shared spec judge
+
+`collectionItemOwnerStampRefusal` now asks `judgeCollectionItemOwnerStamp` (`@objectstack/spec/kernel`) for the verdict and the words, the judge the stack schema runs at `defineStack`, `os validate` and `os build`, so the build door and the boot cannot disagree. Its `VALIDATION_ERROR` / 400 envelope with `issues[]` at `_packageId`, its words, and its exemption for a stamp a registration of this process wrote onto the caller's object are unchanged.
+
+Clause-②: no (narrowing) — carried by `@objectstack/spec`'s `minor` in the same change: the build doors now refuse the body `_packageId` this door already refused. This package's own accept set is unchanged. Nothing is widened.
+
+Metadata-protocol: narrowed (a collection item's `_packageId` is refused at the build doors as it already was at registration)
+
+<!-- adr-0087: not-required (no-migration-prescription) This package changes no key, value or verdict: the registration door refuses exactly what it refused before, in the same words. The narrowing it travels with is the build doors', declared on `@objectstack/spec`. -->
+
+**BREAKING** accept-set narrowing at the build doors, declared on `@objectstack/spec`'s `minor`; this `patch` carries the shared judge's caller only.
+
+- **Before.** The registration door compared a body's `_packageId` with the registering package itself.
+- **Now.** It calls the spec judge, which also runs at the build doors.
+- **Unchanged.** Every verdict and every word at `registerApp`, the seed datasets, the `viewItems:` channel and the `manifest` service's residual registration.
+- **Who sees it.** Nobody at this door; an author now hears the same refusal at `os validate`.
+
+**The remedy.** Drop `_packageId` from the body.
@@ -0,0 +1,154 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0010] `os validate` — the build door an author runs before shipping —
+ * refuses a collection item whose body carries another package's `_packageId`,
+ * run for real, located at the item's key.
+ *
+ * ## The defect, measured before the fix
+ *
+ * A stack whose connector body carried `_packageId: 'com.example.host'` (a
+ * stamp only the registration writes) validated clean and exited 0; the
+ * registration door (`ObjectQL.registerApp`) refused it at boot or install
+ * with `VALIDATION_ERROR` / 400 at `_packageId`. The author heard about it
+ * from a failed install, not where they wrote it.
+ *
+ * ## One judge
+ *
+ * Both doors call `judgeCollectionItemOwnerStamp` (`@objectstack/spec/kernel`).
+ * So the headline pin asserts equality with the judge's own build-door words,
+ * and with the verdict the registration door returns for the same stack,
+ * driven through `ObjectQL.registerApp`, rather than a literal copy of the
+ * words, which would be a second spelling of them.
+ *
+ * Integration tier: it spawns the source CLI (`packages/cli/vitest-tiers.ts`).
+ * Two spawns, one per fixture. The CLI runs through `bin/run-dev.js` (source,
+ * under `node`), and `@objectstack/spec` resolves through `exports` to `dist/`.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { execFile } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ObjectQL } from '@objectstack/objectql';
+import { judgeCollectionItemOwnerStamp } from '@objectstack/spec/kernel';
+import { childEnv } from './helpers/serve-process.js';
+import { writeDefineStackConfig } from './helpers/define-stack-fixture.js';
+
+const HERE = resolve(fileURLToPath(import.meta.url), '..');
+const CLI = resolve(HERE, '../bin/run-dev.js');
+/** A cold spawn of the CLI source entry runs well past vitest's 5 s default. */
+const SPAWN_TIMEOUT_MS = 180_000;
+
+const OWNER = 'com.example.ownerstamp';
+const FOREIGN = 'com.example.host';
+
+const manifest = {
+  id: OWNER,
+  namespace: 'ost',
+  name: 'Owner stamp door probe',
+  version: '1.0.0',
+  type: 'app',
+  engines: { protocol: '^18' },
+};
+
+const connector = (stamp?: string) => ({
+  name: 'ost_billing',
+  label: 'Billing',
+  type: 'api',
+  provider: 'openapi',
+  providerConfig: { spec: './specs/billing.json' },
+  ...(stamp === undefined ? {} : { _packageId: stamp }),
+});
+
+/** The smallest OpenAPI document the connector's `providerConfig.spec` can name. */
+const OPENAPI_DOC = { openapi: '3.0.3', info: { title: 'Billing', version: '1.0.0' }, paths: {} };
+
+const stackOf = (stamp?: string) => ({ manifest, connectors: [connector(stamp)] });
+
+const FIXTURES = {
+  /** The connector body names another package as its owner. */
+  stamped: stackOf(FOREIGN),
+  /** CONTROL: the same body without the stamp. */
+  unstamped: stackOf(),
+} as const;
+
+interface Run {
+  code: number;
+  stdout: string;
+  stderr: string;
+}
+
+function runCli(args: string[], cwd: string): Promise<Run> {
+  return new Promise((resolvePromise) => {
+    execFile(
+      process.execPath,
+      [CLI, ...args],
+      { cwd, maxBuffer: 16 * 1024 * 1024, env: childEnv({ NO_COLOR: '1' }) },
+      (err, stdout, stderr) => {
+        resolvePromise({
+          code: err ? (typeof (err as { code?: unknown }).code === 'number' ? (err as unknown as { code: number }).code : 1) : 0,
+          stdout: String(stdout),
+          stderr: String(stderr),
+        });
+      },
+    );
+  });
+}
+
+interface ValidateError {
+  code?: string;
+  path?: unknown[];
+  message?: string;
+}
+
+/** `os validate --json` on failure: the parse's issues ride `errors`. */
+const errorsOf = (stdout: string): ValidateError[] => (JSON.parse(stdout) as { errors?: ValidateError[] }).errors ?? [];
+
+const dirs = new Map<keyof typeof FIXTURES, string>();
+
+beforeAll(() => {
+  for (const [kind, stack] of Object.entries(FIXTURES) as Array<[keyof typeof FIXTURES, unknown]>) {
+    const dir = mkdtempSync(join(tmpdir(), `os-owner-stamp-door-${kind}-`));
+    // `strict: false`: the door's own parse must judge the content, not `defineStack` at load.
+    writeDefineStackConfig(dir, stack, { strict: false });
+    // The connector's spec file, so the control's only verdict is the stamp's.
+    mkdirSync(join(dir, 'specs'));
+    writeFileSync(join(dir, 'specs', 'billing.json'), JSON.stringify(OPENAPI_DOC));
+    dirs.set(kind, dir);
+  }
+});
+
+afterAll(() => {
+  for (const dir of dirs.values()) rmSync(dir, { recursive: true, force: true });
+});
+
+describe('os validate refuses a collection item whose body names another package as its owner', () => {
+  it('exit 1: located at the item\'s `_packageId`, in the judge\'s build words, and the registration door refuses the same body', async () => {
+    const run = await runCli(['validate', '--json'], dirs.get('stamped')!);
+    expect(run.code, `expected exit 1:\n${run.stdout}\n${run.stderr}`).toBe(1);
+    const errors = errorsOf(run.stdout);
+    expect(errors.map((e) => ({ code: e.code, path: (e.path ?? []).join('.') })))
+      .toEqual([{ code: 'custom', path: 'connectors.0._packageId' }]);
+    expect(errors[0].message).toBe(judgeCollectionItemOwnerStamp(connector(FOREIGN), 'connector', 'ost_billing', OWNER, 'build')!.message);
+
+    // The same verdict at the registration door, for the same body.
+    let boot: any;
+    try {
+      new ObjectQL().registerApp({ ...manifest, connectors: [connector(FOREIGN)] } as any);
+    } catch (e) {
+      boot = e;
+    }
+    expect(boot).toMatchObject({ code: 'VALIDATION_ERROR', status: 400 });
+    expect(boot.issues).toEqual([expect.objectContaining({ path: '_packageId' })]);
+    expect(boot.message).toBe(judgeCollectionItemOwnerStamp(connector(FOREIGN), 'connector', 'ost_billing', OWNER, 'register')!.message);
+  }, SPAWN_TIMEOUT_MS);
+
+  it('CONTROL: the same body without the stamp exits 0', async () => {
+    const run = await runCli(['validate', '--json'], dirs.get('unstamped')!);
+    expect(run.code, `expected exit 0:\n${run.stdout}\n${run.stderr}`).toBe(0);
+    expect((JSON.parse(run.stdout) as { valid?: boolean }).valid).toBe(true);
+  }, SPAWN_TIMEOUT_MS);
+});
@@ -0,0 +1,98 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0010] The registration door and the build door judge a collection
+ * item's body `_packageId` with ONE judge (`judgeCollectionItemOwnerStamp`,
+ * `@objectstack/spec/kernel`), so the two cannot disagree. This file holds
+ * them equal from the registration side:
+ *
+ *  - the same stamp gets the same verdict at both doors — `registerApp`
+ *    (boot / install) and the stack schema's parse (`defineStack`,
+ *    `os validate`, `os build`) — and each door's words are the judge's own;
+ *  - the build door judges exactly the collections `registerApp` refuses a
+ *    foreign stamp in (`OWNER_STAMP_JUDGED_COLLECTIONS`), key by key over the
+ *    stack schema's whole key set, so the build door neither misses a
+ *    collection the boot refuses nor refuses one the boot accepts.
+ *
+ * The registration door's envelope and its exemption for a stamp a
+ * registration wrote stay pinned in `collection-item-owner-stamp.test.ts`.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { ObjectStackDefinitionSchema, STACK_DEFINITION_KEYS } from '@objectstack/spec';
+import { judgeCollectionItemOwnerStamp, OWNER_STAMP_JUDGED_COLLECTIONS } from '@objectstack/spec/kernel';
+import { ObjectQL } from './engine.js';
+
+const PKG = 'com.probe.pkg';
+const FOREIGN = 'com.probe.host';
+
+const connector = (stamp?: unknown) => ({
+    name: 'probe_conn',
+    label: 'Probe',
+    type: 'api',
+    provider: 'openapi',
+    providerConfig: { spec: './specs/billing.json' },
+    ...(stamp === undefined ? {} : { _packageId: stamp }),
+});
+
+/** The registration door's answer: the thrown error, or `undefined`. */
+function boot(body: Record<string, unknown>): any {
+    try {
+        new ObjectQL().registerApp(body as any);
+        return undefined;
+    } catch (e) {
+        return e;
+    }
+}
+
+/** The build door's answer: the parse's issues at a `_packageId`. */
+function build(stack: Record<string, unknown>) {
+    const result = ObjectStackDefinitionSchema.safeParse(stack);
+    return result.success ? [] : result.error.issues.filter((i) => i.path[i.path.length - 1] === '_packageId');
+}
+
+describe('[ADR-0010] one verdict at the registration door and the build door', () => {
+    const manifest = { id: PKG, name: 'probe', namespace: 'probe', version: '1.0.0', type: 'app' };
+
+    it('a foreign stamp, `\'\'`, an equal stamp and no stamp: refused at both or accepted at both', () => {
+        const cases: Array<[unknown, boolean]> = [[FOREIGN, true], ['', true], [PKG, false], [undefined, false]];
+        for (const [stamp, refused] of cases) {
+            const atBoot = boot({ ...manifest, connectors: [connector(stamp)] });
+            const atBuild = build({ manifest, connectors: [connector(stamp)] });
+            const label = `stamp ${JSON.stringify(stamp)}`;
+            if (!refused) {
+                expect(atBoot, label).toBeUndefined();
+                expect(atBuild, label).toEqual([]);
+                continue;
+            }
+            expect(atBoot, label).toMatchObject({ code: 'VALIDATION_ERROR', status: 400 });
+            expect(atBoot.issues, label).toEqual([{ path: '_packageId', code: 'custom', message: expect.any(String) }]);
+            expect(atBuild.map((i) => [i.path.join('.'), i.code]), label).toEqual([['connectors.0._packageId', 'custom']]);
+            // Each door's words are the one judge's, for its own door.
+            const judged = (door: 'build' | 'register') => judgeCollectionItemOwnerStamp(connector(stamp), 'connector', 'probe_conn', PKG, door)!;
+            expect(atBoot.message, label).toBe(judged('register').message);
+            expect(atBoot.issues[0].message, label).toBe(judged('register').issueMessage);
+            expect(atBuild[0].message, label).toBe(judged('build').message);
+        }
+    });
+
+    it('`null`: refused at both — by the judge at boot, by the item schema\'s type check at build, both at `_packageId`', () => {
+        expect(boot({ ...manifest, connectors: [connector(null)] })).toMatchObject({ code: 'VALIDATION_ERROR', status: 400 });
+        expect(build({ manifest, connectors: [connector(null)] }).map((i) => [i.path.join('.'), i.code]))
+            .toEqual([['connectors.0._packageId', 'invalid_type']]);
+    });
+});
+
+describe('[ADR-0010] the build door judges exactly the collections the registration door refuses a foreign stamp in', () => {
+    it('key by key over the stack schema\'s whole key set', () => {
+        const refusedAtBoot: string[] = [];
+        for (const key of STACK_DEFINITION_KEYS) {
+            const probe = { name: 'probe_item', object: 'probe_item', records: [], _packageId: FOREIGN };
+            const error = boot({ id: PKG, name: 'probe', [key]: [probe] });
+            const atStamp = error?.code === 'VALIDATION_ERROR'
+                && Array.isArray(error.issues) && error.issues.some((i: any) => i?.path === '_packageId');
+            if (atStamp) refusedAtBoot.push(key);
+        }
+        expect(refusedAtBoot.sort()).toEqual([...OWNER_STAMP_JUDGED_COLLECTIONS].sort());
+    });
+});