spec: judge a collection item's _packageId against its owning body at defineStack / os validate / os build, so the stamp the boot now refuses (#28534) is refused where it is written #28628

epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

Filing gate: ① a follow-up a landed review owes, finding class (b) (where a refusal fires vs where the author writes). Raised by the CONTRACT_REVIEW_TIER delta review of PR #28587 (comment 6555831347, should-fix S5); re-read by this seat. Child of #27293 (E4). ⛔ Not a claim. It is out of #28534's claim because it is a packages/spec change.

The gap

PR #28587 makes objectql's registerApp and the manifest service's residual door refuse a collection item whose body carries a _packageId other than its registering package's (collectionItemOwnerStampRefusal, packages/objectql/src/engine.ts on that branch). The refusal fires at boot or install only. defineStack, os validate and os build still accept such a body, so the author learns about it from a failed install, not where they wrote it. For permission sets the same rule already runs at build time: ADR-0086 D3's judgePermissionSetOwnerBinding (packages/spec/src/security/permission-set-owner-binding.ts:88, read at origin/main d94dd3a6) is shared by the build doors and the boot.

Work

After PR #28587 lands, add one judge for a collection item's _packageId against its owning body, in packages/spec, the way judgePermissionSetOwnerBinding is shaped. Run it at defineStack, os validate, os build and the artifact parse, and have objectql's refusal call the same judge so the two cannot disagree. Tests: a body carrying a foreign _packageId is refused by os validate with a located message; the same body without the stamp passes (control). This change is in the spec lane (Metadata-protocol: narrowed, the build-door half of the same narrowing), so it needs that lane's review.

Business reason

An AI that writes a metadata app should be told at os validate that a key does not belong in the body, not at an administrator's install.

Reader

The triage seat grades and routes it (spec lane); the epic PM of #27293 dispatches after PR #28587 lands.

Dedupe

The 500 most recent issues and PRs (read 2026-11-01T07:03Z), titles grepped for _packageId|owner stamp|owner binding: 0 hits. Control connector: 53 hits.