@@ -51,10 +51,11 @@
 // The production import stays lazy and stays where it is: this line decides
 // only WHERE the first load is paid in THIS suite, and `os build`'s cold path
 // must not pull the data engine in to judge a stack with no contributions.
-import '@objectstack/objectql/core';
+import { ObjectQL } from '@objectstack/objectql/core';
 import { describe, it, expect } from 'vitest';
 import { composeStacks, normalizeStackInput, ObjectStackDefinitionSchema } from '@objectstack/spec';
-import { artifactPackagesOf, collectNavGroupInputs, findNavGroupDiagnostics } from './nav-contribution-groups.js';
+import { artifactPackages } from './artifact-packages.js';
+import { collectNavGroupInputs, findNavGroupDiagnostics } from './nav-contribution-groups.js';
 
 type AnyRec = Record<string, unknown>;
 
@@ -148,8 +149,13 @@ const parsedArtifact = (group: string): AnyRec => {
  * file keep passing while the rule the commands actually run drifted — which is
  * the same defect one layer down that the shared `checkNavContributionGroups`
  * exists to prevent.
+ *
+ * ⭐ [#18490] That is now the OWNER's rule and not a mirror of it:
+ * `nav-contribution-groups.ts` used to export its own `artifactPackagesOf`,
+ * which had already drifted from `artifactPackages` on an empty
+ * `manifest.id` + `manifest.name` (pinned at the foot of this file).
  */
-const packagesOf = (parsed: AnyRec) => artifactPackagesOf(parsed);
+const packagesOf = (parsed: AnyRec) => artifactPackages(parsed);
 
 describe('#14553 — `os build` checks `navigationContributions[].group` across one composed artifact', () => {
   it('the fixture really is a two-package artifact — the floor under every reading below', async () => {
@@ -175,7 +181,7 @@ describe('#14553 — `os build` checks `navigationContributions[].group` across
   it('needs only the parsed stack — the commands call it with one argument', async () => {
     // Both `os compile` and `os validate` reach this through
     // `findNavGroupDiagnostics(result.data)`, letting the package walk default
-    // to `artifactPackagesOf`. Pinned because the explicit-packages form is
+    // to `artifactPackages`. Pinned because the explicit-packages form is
     // what every other case here exercises, so a default that silently stopped
     // deriving would leave this file green while both commands went blind.
     const typod = artifact('sales_grp');
@@ -287,3 +293,136 @@ describe('#14553 — `os build` checks `navigationContributions[].group` across
     expect(found[0].group).toBe('nav_accounts');
   });
 });
+
+/**
+ * #18490 — the package-id rule has ONE owner again, and importing it decided
+ * the one input the two copies disagreed on.
+ *
+ * `nav-contribution-groups.ts` used to carry its own `artifactPackagesOf`. It
+ * differed from `artifactPackages` in a single guard: a non-empty check on
+ * `manifest.name`. For a package whose `manifest.id` AND `manifest.name` are
+ * both `''` the owner answered `''` and the copy answered `packages[<index>]`.
+ * Deleting the copy chose `''`, so what this block pins is not the string but
+ * the REASON it is right: `''` is what the runtime fold names that package,
+ * and `packages[<index>]` is a spelling the runtime cannot produce at all.
+ *
+ * ⛔ Neither side's rule is re-spelled here. The build's answer comes out of
+ * the shipped `findNavGroupDiagnostics`, the runtime's out of a real
+ * `ObjectQL`, and the assertion is that the two STRINGS match — so the day
+ * either rule moves, this reds instead of agreeing with itself.
+ *
+ * `ObjectQL` is taken from `@objectstack/objectql/core`, the entry this file
+ * already loads at module top (see the note there): the pin adds assertions,
+ * not a module graph.
+ */
+describe('#18490 — the artifact package-id rule is the owner\'s, and both doors name one package alike', () => {
+  const EMPTY_PKG_NAMESPACE = 'ord';
+
+  /** The contributing package, with the divergent identity: both keys `''`. */
+  const emptyIdOrdersStack = (group: string) => ({
+    manifest: {
+      id: '',
+      name: '',
+      namespace: EMPTY_PKG_NAMESPACE,
+      version: '1.0.0',
+      type: 'module' as const,
+      navigationContributions: [{
+        app: APP,
+        group,
+        items: [{ id: 'nav_orders', type: 'object' as const, objectName: 'ord_order', label: 'Orders' }],
+      }],
+    },
+    objects: [{
+      name: 'ord_order',
+      label: 'Order',
+      sharingModel: 'private' as const,
+      fields: { name: { name: 'name', type: 'text' as const, label: 'Order Number', required: true } },
+    }],
+  });
+
+  /** Through the SAME parse chain `compile.ts` and `validate.ts` run. */
+  const parsedEmptyIdArtifact = (group: string): AnyRec => {
+    const composed = composeStacks(
+      [emptyIdOrdersStack(group), coreStack()],
+      { manifest: 'preserve' },
+    ) as unknown as Record<string, unknown>;
+    const normalized = normalizeStackInput(composed, { onConversionNotice: () => {} });
+    const result = ObjectStackDefinitionSchema.safeParse(normalized);
+    if (!result.success) {
+      throw new Error(`fixture does not parse: ${JSON.stringify(result.error.issues.slice(0, 3))}`);
+    }
+    return result.data as unknown as AnyRec;
+  };
+
+  it('an empty `manifest.id` AND `manifest.name` REACHES this check — the divergence is not hypothetical', () => {
+    // The floor under the two assertions below. `ManifestSchema` requires both
+    // keys as strings and constrains neither to be non-empty, so `''` parses —
+    // which is the only reason the two rules' disagreement was ever reachable
+    // from `os build` / `os validate` at all. If a future spec change refuses
+    // it, this reds FIRST and says the pins under it now measure nothing.
+    const parsed = parsedEmptyIdArtifact(GROUP);
+    const ids = packagesOf(parsed).map((pkg) => pkg.id).sort();
+    expect(ids).toEqual(['', CORE_ID]);
+  });
+
+  it('the build names that package EXACTLY as the runtime fold does', async () => {
+    const parsed = parsedEmptyIdArtifact('sales_grp');
+    const built = await findNavGroupDiagnostics(parsed);
+    expect(built).toHaveLength(1);
+
+    // The same artifact installed into a real registry: `registerApp` derives
+    // the id it registers a contribution under, `getApp` runs the fold, and
+    // the fold records its own diagnostic for the relocation.
+    const engine = new ObjectQL();
+    const core = coreStack();
+    engine.registerApp({ ...core.manifest, apps: core.apps });
+    engine.registerApp({ ...emptyIdOrdersStack('sales_grp').manifest });
+    engine.registry.getApp(APP);
+    const folded = engine.registry.getAppNavDiagnostics(APP);
+    expect(folded).toHaveLength(1);
+
+    // The whole point of the card, in two lines: one package, two doors, one
+    // name — the `packageId` field a consumer reads and the sentence an author
+    // reads.
+    expect(built[0].packageId).toBe(folded[0].packageId);
+    expect(built[0].message).toBe(folded[0].message);
+  });
+
+  it('⛔ and that shared name is NOT the deleted copy\'s positional spelling', async () => {
+    // Stated as its own assertion because the pin above would also pass if
+    // BOTH doors moved to `packages[0]`. The runtime has no positional
+    // fallback (`manifest.id || manifest.name`), so a build printing one is a
+    // build naming a package the runtime never will.
+    const parsed = parsedEmptyIdArtifact('sales_grp');
+    const built = await findNavGroupDiagnostics(parsed);
+    expect(built[0].packageId).toBe('');
+    expect(built[0].packageId).not.toBe('packages[0]');
+    expect(built[0].message).not.toContain('packages[0]');
+  });
+
+  it('two packages that both resolve to the empty id still produce TWO findings', async () => {
+    // The id is carried and printed, never used as a map key, a dedupe key or
+    // a sort key on this path. Pinned because "both collapse to one finding"
+    // is the failure mode an empty id would have if it ever became one, and it
+    // would present as a REPORT GOING QUIET rather than as an error.
+    const second = {
+      manifest: {
+        id: '',
+        name: '',
+        navigationContributions: [{
+          app: APP,
+          group: 'sales_grp',
+          items: [{ id: 'nav_second', type: 'object' as const, objectName: 'ord_order', label: 'Second' }],
+        }],
+      },
+    };
+    const parsed = parsedEmptyIdArtifact('sales_grp');
+    const widened: AnyRec = {
+      ...parsed,
+      packages: [...((parsed.packages ?? []) as unknown[]), second],
+    };
+    const found = await findNavGroupDiagnostics(widened);
+    expect(found).toHaveLength(2);
+    expect(found.map((d) => d.packageId)).toEqual(['', '']);
+  });
+});
@@ -39,6 +39,42 @@
  * contribution: `os build`'s cold path should not pull the data engine in to
  * judge two empty arrays.
  *
+ * ## Why the package-id rule is imported too, and which answer that chose
+ *
+ * `artifactPackages` (`./artifact-packages.ts`) is the declared sole owner of
+ * "which package is this", and this module used to carry a second copy of it.
+ * The two had already drifted on one input — a package whose `manifest.id` AND
+ * `manifest.name` are both the empty string, which
+ * `ObjectStackDefinitionSchema` accepts (both keys are required strings on
+ * `ManifestSchema`; neither has a non-empty constraint, so `''` parses). The
+ * owner computed that package's id as `''`; the copy computed it as
+ * `packages[<index>]`.
+ *
+ * ⭐ Importing the owner therefore CHOSE `''`, and that is the answer this path
+ * wants — measured against the runtime, which is the authority this module
+ * declares it mirrors two sections up. `ObjectQL.registerApp` derives the id it
+ * registers a contribution under as `manifest.id || manifest.name` and has NO
+ * positional fallback, so the fold registers that package under `''` and its
+ * relocation diagnostic reads `Package "" contributes …`. Under the deleted
+ * copy the build printed `Package "packages[0]" …` for the same artifact —
+ * two doors naming one package differently, which is the whole defect the
+ * shared `checkNavContributionGroups` exists to prevent, one field over.
+ *
+ * ⚠️ Two bounds on that reading, because they are where it could be wrong
+ * rather than merely narrow:
+ *
+ *  - **The id is not a key here.** It is carried onto the diagnostic as
+ *    `packageId` and printed; nothing on this path uses it as a map key, a
+ *    dedupe key or a sort key, so two packages that both resolve to `''` still
+ *    produce two findings rather than collapsing into one. Measured, not read.
+ *  - **`artifactPackages` declares a precondition this path meets.** It reads
+ *    the PARSED stack and does not re-check entry shape, so a `null` element
+ *    would throw where the copy returned a positional id. Both commands call
+ *    `findNavGroupDiagnostics(result.data)`, and every malformed element —
+ *    `null`, a string, a non-object `manifest`, a missing one — is refused by
+ *    `ArtifactPackageSchema` before that. ⛔ Do not hand this function a
+ *    hand-built `packages[]` that has not been through the parse.
+ *
  * ## Why the findings ride the declared `warnings` key, and why BOTH commands
  * ## compute them
  *
@@ -63,35 +99,24 @@
 
 import type { NavContributionGroupDiagnostic } from '@objectstack/objectql';
 
+import { artifactPackages } from './artifact-packages.js';
+
 type AnyRec = Record<string, unknown>;
 
 const asArray = (v: unknown): unknown[] => (Array.isArray(v) ? v : []);
 const asRec = (v: unknown): AnyRec | undefined =>
   v && typeof v === 'object' && !Array.isArray(v) ? (v as AnyRec) : undefined;
 
-/** One artifact package, in the `{ id, body }` shape the commands walk. */
-export interface CompiledPackage {
-  readonly id: string;
-  readonly body: AnyRec;
-}
-
 /**
- * The artifact's package entries, derived from the PARSED stack.
+ * One artifact package, in the `{ id, body }` shape the commands walk — the
+ * shape `artifactPackages` returns, narrowed to the two facts read here.
  *
- * Mirrors `compile.ts`' `artifactPackages` id rule — `manifest.id`, falling
- * back to `name`, then to the positional spelling — because that is the string
- * the runtime registers a contribution under, so a command names a package the
- * same way the fold does. Derived here rather than passed in, so both commands
- * reach the check through ONE call that needs only the parsed stack.
+ * ⛔ The id RULE is not re-spelled: this is a structural parameter type, and
+ * `./artifact-packages.ts` remains the only place that computes an id.
  */
-export function artifactPackagesOf(parsed: AnyRec): CompiledPackage[] {
-  return asArray(parsed.packages).map((entry, index) => {
-    const body = asRec((entry as { manifest?: unknown })?.manifest) ?? {};
-    const id = typeof body.id === 'string' && body.id !== ''
-      ? body.id
-      : (typeof body.name === 'string' && body.name !== '' ? body.name : `packages[${index}]`);
-    return { id, body };
-  });
+export interface CompiledPackage {
+  readonly id: string;
+  readonly body: AnyRec;
 }
 
 /**
@@ -170,7 +195,7 @@ export function collectNavGroupInputs(
  */
 export async function findNavGroupDiagnostics(
   parsed: AnyRec,
-  packages: readonly CompiledPackage[] = artifactPackagesOf(parsed),
+  packages: readonly CompiledPackage[] = artifactPackages(parsed),
 ): Promise<NavContributionGroupDiagnostic[]> {
   const { apps, contributions } = collectNavGroupInputs(parsed, packages);
   if (contributions.length === 0 || apps.length === 0) return [];