@@ -0,0 +1,17 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+feat(plugin-security)!: the six built-in positions are declared position metadata of the plugin (ADR-0131 D2)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) no authorable key, export or stored shape changes; the refusal is of six reserved position names at one REST door, and no stored definition is rewritten -->
+
+**BREAKING** on one write door, shipped as `minor` under the repo's launch-window convention for breaking changes.
+
+- **What is declared.** The identity positions `platform_admin`, `org_owner`, `org_admin` and `org_member` (ADR-0068 D2) and the audience anchors `everyone` and `guest` (ADR-0090 D5/D9) are registered with the engine registry as `position` metadata owned by `com.objectstack.plugin-security`, the way the plugin's own permission sets are. Their names, labels and descriptions come from one list built from `@objectstack/spec`'s `BUILTIN_IDENTITY_NAMES` and `BUILTIN_IDENTITY_METADATA` and the anchor text, and the built-in seeder reads that same list.
+- **Rows and grants do not move.** `sys_position` is seeded exactly as before: the same names, the same organizations (one copy per organization under a walled posture, one organization-less pass under `single`), `managed_by: 'platform'`, `active: true`, `is_default: false`, and the same labels and descriptions. No principal's grants change.
+- **What a client can now read.** `GET /api/v1/meta/position` lists the six beside the stack's own positions, and `GET /api/v1/meta/position/:name` answers `200` with each one's definition, where it answered `404 RESOURCE_NOT_FOUND`. The security catalog read (`createSecurityCatalogReader` in `@objectstack/core`) lists them from the engine registry.
+- **What a client can no longer write.** `PUT /api/v1/meta/position/:name` naming one of the six is refused `403 NOT_OVERRIDABLE`: the name is provided by a code package, and `position` has no overlay. It was saved as an environment-wide definition before. Give an authored position a different name. `DELETE /api/v1/meta/position/:name` on one of the six still answers `200` and removes nothing.
+- **The declared-positions seeder** keeps reading the engine registry first and the metadata service only when the registry holds no position. The six are left out of that decision and out of what it seeds, so stack-declared positions keep seeding and the six keep the built-in seeder as their one writer.
@@ -0,0 +1,19 @@
+---
+'@objectstack/metadata': patch
+'@objectstack/runtime': patch
+---
+
+fix(runtime,metadata): publishing or reverting a read-only package is refused with `422 WRITABLE_PACKAGE_REQUIRED`, and package membership reads the `_packageId` stamp
+
+Clause-②: no
+
+ADR-0070 D2 makes a code or installed package read-only. `POST /api/v1/packages/:id/publish` and `POST /api/v1/packages/:id/revert` did not check this. These two answers change:
+
+- **Publish of a code or installed package: 200 → 422.** Before, the publish door answered 200. For a package whose items carry an authored `packageId`, for example `com.example.showcase`'s two capabilities, it answered `success: true` and wrote `publishedDefinition`, `state` and `version` onto those read-only items. For every other code package it answered `success: false`, "No metadata items found". It now answers `422 WRITABLE_PACKAGE_REQUIRED` before anything is written, the same refusal that `PATCH /packages/:id/disable` and `DELETE /packages/:id` already give.
+- **Revert of a code or installed package: 404 or 409 → 422.** Before, the revert door answered `404 RESOURCE_NOT_FOUND` "No metadata items found" (for example `com.objectstack.setup` and the platform packages that ship objects) or `409 RESOURCE_CONFLICT` "Package '…' has never been published" (for example `com.example.showcase`). It now answers `422 WRITABLE_PACKAGE_REQUIRED`. The check runs after the protocol's stored-row answer, so a revert of a code package that has a stored row bound to it, such as an organization overlay draft, keeps its answer.
+
+To customise what a code package provides, use an ADR-0005 organization overlay. Overlay drafts publish through `POST /api/v1/packages/:id/publish-drafts` and the per-item publish door, and this change leaves both alone.
+
+**Unchanged:** a writable package's publish and revert, and an id that nothing carries (revert 404; publish 200 with `success: false`).
+
+`MetadataManager.publishPackage` and `revertPackage` now find a package's members by `packageId`, `package` or the private `_packageId` stamp. The artifact loader writes that stamp through `applyProtection`, and the ObjectQL object bridge copies it onto every object it registers. Before, an item that carried only the stamp was not a member. `MetadataManager` has no notion of package kind; the refusal of read-only packages lives at the two doors above.
@@ -17,6 +17,9 @@ on:
       # that governs it ever running on the PR that adds it.
       - 'osv-scanner.toml'
       - 'scripts/check-osv-exemptions.mjs'
+      # The pull_request verdict of the OSV step (#22082): an edit to it must
+      # be exercised on the PR that makes it.
+      - 'scripts/osv-base-relative.mjs'
       # Re-run when the workflow itself changes, so edits to these gates are
       # exercised on the PR that introduces them.
       - '.github/workflows/validate-deps.yml'
@@ -32,6 +35,11 @@ jobs:
   validate:
     name: Validate Package Dependencies
     runs-on: ubuntu-latest
+    # Measured over the 100 most recent completed runs: p50 1.3 min, max
+    # 1.9 min (#22082). 15 leaves room for a cold pnpm store and two OSV
+    # scans on a pull request, and stops a hung step long before GitHub's
+    # 360-minute default would.
+    timeout-minutes: 15
     permissions:
       contents: read
       issues: write
@@ -138,12 +146,111 @@ jobs:
           node scripts/check-osv-exemptions.mjs --self-test
           node scripts/check-osv-exemptions.mjs
 
+      # Two verdicts, one scanner pin (#22082, ruling A).
+      #
+      # `schedule` and `workflow_dispatch` judge `main` ABSOLUTELY: every
+      # advisory the lockfile matches fails the step. That daily red is the
+      # signal that files the finding card, and this step is unchanged by the
+      # pull_request verdict below.
+      #
+      # A pull request is judged BASE-RELATIVELY: it answers for the advisories
+      # it introduces, not for the ones `main` already carries -- those are
+      # `main`'s to fix, and a pull request that changes no dependency cannot
+      # fix them. The steps below scan the pull request's lockfile and the merge
+      # base's, each under its own `osv-scanner.toml`, and
+      # scripts/osv-base-relative.mjs fails only on an advisory the merge base
+      # does not match; the others become notices naming the advisory and its
+      # open finding card. A scan that does not reach a verdict fails closed.
+      #
+      # The pin is an untagged upstream commit after the v2.5.0 tag whose
+      # action.yml runs the ghcr.io/google/osv-scanner-action:v2.5.0 image (the
+      # comment here used to read v2.3.8). Keep all three `uses:` lines on ONE
+      # sha: the two verdicts must come from the same scanner.
       - name: Audit dependencies for known vulnerabilities (OSV-Scanner)
-        uses: google/osv-scanner-action/osv-scanner-action@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.3.8
+        if: github.event_name != 'pull_request'
+        uses: google/osv-scanner-action/osv-scanner-action@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # untagged, v2.5.0 image
         with:
           scan-args: |-
             --lockfile=pnpm-lock.yaml
 
+      # The checkout is the pull request's test merge (refs/pull/N/merge) at
+      # depth 1. Its first parent is the base-branch commit GitHub merged the
+      # pull request into -- the merge base of the scanned tree and the base
+      # branch -- so ONE depth-1 fetch of that sha is all the history this needs
+      # (never fetch-depth: 0). When neither pnpm-lock.yaml nor osv-scanner.toml
+      # differs from it, the pull request cannot introduce an advisory and no
+      # scan runs. The ledger is part of the condition: a pull request that
+      # deletes an exemption changes the verdict without touching the lockfile.
+      - name: Stage the OSV comparison against the merge base (pull request)
+        id: osv-stage
+        if: github.event_name == 'pull_request'
+        run: |
+          node scripts/osv-base-relative.mjs --self-test
+          mapfile -t parents < <(git cat-file -p HEAD | sed -n 's/^parent //p')
+          if [ "${#parents[@]}" -ne 2 ]; then
+            echo "::error title=OSV base-relative verdict unavailable::HEAD is not the pull request's two-parent test merge (${#parents[@]} parent(s) found), so there is no merge base to judge against"
+            exit 1
+          fi
+          base="${parents[0]}"
+          git fetch --no-tags --depth=1 origin "$base"
+          echo "base=$base" >> "$GITHUB_OUTPUT"
+          if git diff --quiet "$base" HEAD -- pnpm-lock.yaml osv-scanner.toml; then
+            echo "::notice title=OSV-Scanner verdict (base-relative)::lockfile unchanged — inherits main's verdict. pnpm-lock.yaml and osv-scanner.toml are identical to the merge base ${base:0:12}, so this pull request introduces no advisory; main's daily scheduled scan judges that lockfile."
+            echo "compare=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          for side in base head; do
+            if [ "$side" = base ]; then rev="$base"; else rev=HEAD; fi
+            mkdir -p ".osv-compare/$side"
+            git show "$rev:pnpm-lock.yaml" > ".osv-compare/$side/pnpm-lock.yaml"
+            git show "$rev:osv-scanner.toml" > ".osv-compare/$side/osv-scanner.toml"
+          done
+          echo "compare=true" >> "$GITHUB_OUTPUT"
+
+      # Both scans may exit non-zero (findings), so neither stops the job; the
+      # judge below reads each result file against its step's outcome.
+      # `--config` is explicit because the scanner looks for osv-scanner.toml
+      # only in the scanned lockfile's own directory (measured on 2.5.0: a
+      # ledger one directory up is not applied).
+      - name: OSV-Scanner on the merge base's lockfile (pull request)
+        id: osv-scan-base
+        if: steps.osv-stage.outputs.compare == 'true'
+        continue-on-error: true
+        uses: google/osv-scanner-action/osv-scanner-action@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # untagged, v2.5.0 image
+        with:
+          scan-args: |-
+            --config=.osv-compare/base/osv-scanner.toml
+            --format=json
+            --output-file=.osv-compare/base/results.json
+            --lockfile=.osv-compare/base/pnpm-lock.yaml
+
+      - name: OSV-Scanner on the pull request's lockfile (pull request)
+        id: osv-scan-head
+        if: steps.osv-stage.outputs.compare == 'true'
+        continue-on-error: true
+        uses: google/osv-scanner-action/osv-scanner-action@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # untagged, v2.5.0 image
+        with:
+          scan-args: |-
+            --config=.osv-compare/head/osv-scanner.toml
+            --format=json
+            --output-file=.osv-compare/head/results.json
+            --lockfile=.osv-compare/head/pnpm-lock.yaml
+
+      - name: Judge the pull request's OSV findings against the merge base's (pull request)
+        if: steps.osv-stage.outputs.compare == 'true'
+        env:
+          BASE_OUTCOME: ${{ steps.osv-scan-base.outcome }}
+          HEAD_OUTCOME: ${{ steps.osv-scan-head.outcome }}
+          BASE_SHA: ${{ steps.osv-stage.outputs.base }}
+          # Read-only use: the open-issue search that names an inherited
+          # advisory's finding card. The verdict never depends on it.
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          node scripts/osv-base-relative.mjs \
+            --base-results .osv-compare/base/results.json --base-outcome "$BASE_OUTCOME" \
+            --head-results .osv-compare/head/results.json --head-outcome "$HEAD_OUTCOME" \
+            --base-sha "$BASE_SHA"
+
       - name: List outdated packages
         if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
         run: |
 
@@ -1795,6 +1795,47 @@ export class MetadataManager implements IMetadataService {
     }
   }
 
+  /**
+   * [#22113] The registry items that belong to `packageId`, for the two
+   * package-wide writes ({@link publishPackage}, {@link revertPackage}).
+   *
+   * An item belongs to a package when any of three keys names it:
+   *
+   *  - `packageId` — the publish envelope's own key, and what a caller that
+   *    registers an item for a package writes;
+   *  - `package` — the legacy package stamp;
+   *  - `_packageId` — the private provenance stamp. `applyProtection`
+   *    (`@objectstack/spec/shared`, ADR-0010 §3.7) writes it on every item a
+   *    code-shipped artifact registers here, and the ObjectQL object bridge
+   *    copies it onto every object it registers here. A code-shipped item
+   *    carries ONLY this key, and it is the key the metadata protocol scopes
+   *    this registry's items by when it serves a package's reads.
+   *
+   * Reading the first two alone made a package's publish and revert miss
+   * every item that carries only the stamp ("No metadata items found" while
+   * every read served them).
+   *
+   * ⛔ Not a writability check. This class has no package-kind concept, so it
+   * cannot tell a read-only code package (ADR-0070 D2) from a writable one,
+   * and with the stamp read it would publish a code package's items like any
+   * other. The refusal belongs to the caller that holds the predicate: the
+   * `POST /packages/:id/publish` and `/revert` doors (`@objectstack/runtime`)
+   * refuse a non-writable package with `422 WRITABLE_PACKAGE_REQUIRED` before
+   * calling either method.
+   */
+  private collectPackageMembers(packageId: string): Array<{ type: string; name: string; data: any }> {
+    const members: Array<{ type: string; name: string; data: any }> = [];
+    for (const [type, typeStore] of this.registry) {
+      for (const [name, data] of typeStore) {
+        const meta = data as any;
+        if (meta?.packageId === packageId || meta?.package === packageId || meta?._packageId === packageId) {
+          members.push({ type, name, data: meta });
+        }
+      }
+    }
+    return members;
+  }
+
   /**
    * Publish an entire package:
    * 1. Validate all draft items
@@ -1832,16 +1873,10 @@ export class MetadataManager implements IMetadataService {
     const shouldValidate = options?.validate !== false;
     const publishedBy = options?.publishedBy;
 
-    // Collect all items belonging to this package
-    const packageItems: Array<{ type: string; name: string; data: any }> = [];
-    for (const [type, typeStore] of this.registry) {
-      for (const [name, data] of typeStore) {
-        const meta = data as any;
-        if (meta?.packageId === packageId || meta?.package === packageId) {
-          packageItems.push({ type, name, data: meta });
-        }
-      }
-    }
+    // Collect all items belonging to this package — the same membership
+    // `revertPackage` reads. A read-only code package never gets here through
+    // the publish door, which refuses it first (see `collectPackageMembers`).
+    const packageItems = this.collectPackageMembers(packageId);
 
     if (packageItems.length === 0) {
       return {
@@ -2060,15 +2095,7 @@ export class MetadataManager implements IMetadataService {
    * Restores all metadata definitions from their published snapshots.
    */
   async revertPackage(packageId: string): Promise<void> {
-    const packageItems: Array<{ type: string; name: string; data: any }> = [];
-    for (const [type, typeStore] of this.registry) {
-      for (const [name, data] of typeStore) {
-        const meta = data as any;
-        if (meta?.packageId === packageId || meta?.package === packageId) {
-          packageItems.push({ type, name, data: meta });
-        }
-      }
-    }
+    const packageItems = this.collectPackageMembers(packageId);
 
     // [#7559] ADR-0112 — both refusals below carry a DECLARED `code` + `status`.
     // They are the ordinary answers to an ordinary request (revert a package id
 
@@ -822,6 +822,71 @@ describe('MetadataManager — IMetadataService Contract', () => {
         message: expect.stringContaining('has never been published'),
       });
     });
+
+    // [#22113] An item can carry ONLY the private `_packageId` stamp —
+    // `applyProtection` writes it on every item an artifact registers, and the
+    // ObjectQL object bridge copies it onto every object. Collecting members by
+    // `packageId` / `package` alone answered 404 "No metadata items found" for a
+    // package every read serves. (Whether the package may be reverted at all is
+    // the door's question — it refuses a read-only one with 422 first.)
+    it('finds a package by the _packageId stamp: never published ⇒ 409, not 404', async () => {
+      await manager.register('object', 'code_item', {
+        name: 'code_item', label: 'Code Item', _packageId: 'com.acme.code', _provenance: 'package',
+      });
+
+      await expect(manager.revertPackage('com.acme.code')).rejects.toMatchObject({
+        code: 'RESOURCE_CONFLICT',
+        status: 409,
+        message: "Package 'com.acme.code' has never been published",
+      });
+    });
+
+    it('membership is any of packageId, package or _packageId: each member with a snapshot is restored', async () => {
+      const snapshot = (label: string) => ({ label });
+      await manager.register('object', 'by_package_id', {
+        name: 'by_package_id', packageId: 'com.acme.keys', publishedDefinition: snapshot('A'), state: 'draft',
+      });
+      await manager.register('object', 'by_package', {
+        name: 'by_package', package: 'com.acme.keys', publishedDefinition: snapshot('B'), state: 'draft',
+      });
+      await manager.register('object', 'by_stamp', {
+        name: 'by_stamp', _packageId: 'com.acme.keys', publishedDefinition: snapshot('C'), state: 'draft',
+      });
+      // Control: a different package's item is not a member.
+      await manager.register('object', 'other_pkg', {
+        name: 'other_pkg', _packageId: 'com.acme.other', publishedDefinition: snapshot('D'), state: 'draft',
+      });
+
+      await manager.revertPackage('com.acme.keys');
+
+      for (const [name, label] of [['by_package_id', 'A'], ['by_package', 'B'], ['by_stamp', 'C']] as const) {
+        const item = await manager.get('object', name) as any;
+        expect({ name, state: item.state, metadata: item.metadata }).toEqual({ name, state: 'active', metadata: { label } });
+      }
+      const other = await manager.get('object', 'other_pkg') as any;
+      expect(other.state).toBe('draft');
+      expect(other.metadata).toBeUndefined();
+    });
+  });
+
+  // [#22113] `publishPackage` reads the same membership as `revertPackage`:
+  // an item carrying only the stamp is a member. (Flipped from the pin that
+  // held it OUT while nothing refused a read-only code package; the
+  // `POST /packages/:id/publish` door now refuses one with
+  // `422 WRITABLE_PACKAGE_REQUIRED` before this method runs.)
+  describe('publishPackage — an item carrying only the _packageId stamp', () => {
+    it('is a member: it is snapshotted and published', async () => {
+      await manager.register('object', 'stamped_item', {
+        name: 'stamped_item', label: 'Stamped Item', _packageId: 'com.acme.stamped', _provenance: 'package',
+      });
+
+      const result = await manager.publishPackage('com.acme.stamped', { validate: false });
+
+      expect(result).toMatchObject({ success: true, itemsPublished: 1, version: 1 });
+      const item = await manager.get('object', 'stamped_item') as any;
+      expect(item.state).toBe('active');
+      expect(item.publishedDefinition).toMatchObject({ name: 'stamped_item', label: 'Stamped Item' });
+    });
   });
 
   describe('getPublished', () => {