@@ -0,0 +1,22 @@
+---
+"@objectstack/service-automation": minor
+---
+
+fix(service-automation)!: a connector stored in the environment never reads the host's files
+
+A provider-bound connector saved through the metadata door (`PUT /api/v1/meta/connector/:name`, Studio), environment-wide or into a package created in the environment (`POST /api/v1/packages`, an `authored` package), had its package-relative refs resolved against the HOST's root, as if the host's own stack had declared it. A stored definition is no package's declaration and has no directory on disk, so a relative ref it names is now refused, the way an installed package's has been since #28534.
+
+Clause-②: no (narrowing) — a stored connector entry (environment-wide, or in an `authored` package) is refused its package-relative file and path refs, which it was handed before against the host's root. Nothing is widened.
+
+Metadata-protocol: narrowed (a stored connector's `providerConfig` may no longer name a package-relative file, and a stored stdio `mcp` transport is refused)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key is added, removed or renamed and the stored shape is unchanged: the same `providerConfig` is accepted at the save door, and what is refused is the host's root being read on the stored entry's behalf. No conversion can carry a file the environment never held; the refusal names the entry, its package if it has one, the ref and the remedy. -->
+
+**BREAKING** behaviour narrowing for stored connectors (`@objectstack/service-automation`), shipped as `minor`.
+
+- **Before.** A stored entry's package-relative refs (an `openapi` spec path, a stdio `mcp` transport's working directory) resolved against the host's root.
+- **Now.** Every such ref is refused for a stored entry, naming the entry, its package if it has one, and the ref: a configuration fault, so the instance is not materialized and the reconcile logs the refusal. It never fails a boot: a stored row already at rest when the platform starts is logged and skipped like one saved while it runs, and the host's own entries beside it serve. Only an entry the host's stack declares reads the host's root: one a package registration filed with the same provider binding, or one the host's own artifact carries. A stored row is never read as the host's, whatever `_packageId` its body carries.
+- **Unchanged.** A stored entry carrying its document inline or as an `http(s)` URL, every entry of the host's own stack, and an installed package's entries (refused as before).
+- **Who sees it.** A connector saved in the environment whose `openapi` spec is a package-relative path, or whose `mcp` transport is stdio.
+
+**The remedy.** Carry the document inline in the definition, or name it by an `http(s)` URL; reach an MCP server from a stored entry over `http`.
@@ -0,0 +1,20 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol)!: a stored row's package in the metadata list is its column's, never its body's
+
+The metadata list read (`getMetaItems`, and the execution read the automation engine binds from) served a stored row's `_packageId` from its `package_id` column only when the body carried none, so a row whose body carried another package's id was served as that package's item. The column now wins: a body stamp is replaced by the column's package, or dropped when the row is bound to no package. The save door has stripped a body's `_packageId` since #16702, so only a row written before that, or by another writer, carries one.
+
+Clause-②: no (narrowing) — a stored row whose body carries a `_packageId` other than its column's is served under its column's package (or none), no longer under the body's. Nothing is widened.
+
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key is added, removed or renamed and no stored body is rewritten or refused: the row's package binding is its `package_id` column, which the read already served whenever the body carried no stamp; a body stamp that disagrees with the column was never written by the save door, so no author has anything to convert. -->
+
+**BREAKING** read narrowing (`@objectstack/metadata-protocol`), shipped as `patch`.
+
+- **Before.** A stored row whose body carried `_packageId` was served with the body's value, whatever its column said.
+- **Now.** It is served with its column's package, or with none when the row is bound to no package.
+- **Unchanged.** A row whose body carries no stamp, or one equal to its column, is served exactly as before.
+- **Who sees it.** Only a row written before the save door began stripping body stamps, or by a writer other than the save door.
@@ -875,6 +875,7 @@ retry):
 | Instance `name` collides with a plugin-registered connector | **Hard boot error** — there is no silent precedence between the two worlds |
 | stdio transport without host opt-in | **Hard boot error** with the `declarativeStdio` fix inline — a security rejection is never retried |
 | An entry of an **installed** package (`os package install`, `POST /api/v1/marketplace/install-local`) names a package-relative file — an `openapi` `spec` path — or needs a location inside its package, as a stdio `mcp` transport's working directory does | Configuration fault, **never resolved against the host's directory**: an installed package has no directory on the runtime it was installed into, and the host's is not its own. The instance is not materialized, and the reconcile's error names the entry, its package and the ref. Rebuild the package with a current `os build`, which carries an `openapi` spec file into the artifact, or inline the document; reach an MCP server from an installed package over `http`. Whether an entry is the host's is read from what the install recorded, never from the package's own words: an entry carrying a `_packageId` other than its own package's is refused at the install, every member of a `packages[]` bundle is recorded as installed whatever its `source` says, and an entry naming a package no registration records is refused its ref too. The host's own entries keep reading their files |
+| A **stored** entry — one saved in this environment through the metadata door (`PUT /api/v1/meta/connector/:name`, Studio), environment-wide or in a package created here (`POST /api/v1/packages`) — names a package-relative file or needs a location inside a package | Configuration fault, **never resolved against the host's directory**: a stored definition is no package's declaration and has no directory on disk. The instance is not materialized, and the reconcile's error names the entry, its package if it has one, and the ref. This one is never fatal, even at boot: a stored row at rest is logged and skipped, and the platform starts. Carry the document inline in the definition, or name it by an `http(s)` URL; reach an MCP server from a stored entry over `http`. Only what the host's own stack declares reads its files: a stored row is never read as the host's, whatever `_packageId` its body carries |
 | MCP server unreachable / `tools/list` fails; remote spec URL unreachable or transiently failing (408/429/5xx) | **Not fatal**: the instance registers **degraded** (visible on `GET /api/v1/automation/connectors` with the reason), dispatches fail with that reason, and the platform retries on a 5s→5min backoff — recovery is automatic |
 | An `mcp` instance's `toolsSnapshot` does not match what the server serves (a pinned tool's description or `inputSchema` changed; or a pinned tool is no longer listed, on an instance whose credential did not reach the server) | **Not fatal**: the instance registers **degraded** with no actions, its reason naming each tool and the digest it now serves, and the logs say "serves a tool definition that differs from its toolsSnapshot" (`CONNECTOR_UPSTREAM_CHANGED`); it is re-checked on the same backoff and recovers once the server serves the pinned definitions again — or set the pin to the reviewed digest. A pinned tool no longer listed on an instance whose credential **did** reach the server (its `auth` over http) takes the credential row above instead: a server may hide tools from a credential, so the reason names both causes (fix the credential and set it again, or update the pin), a stored credential is marked `rejected`, and no retry runs against the same value |
 | A retry of a degraded instance reaches the upstream and meets a configuration fault (an `include` naming a tool or operation the upstream does not offer; on an `mcp` instance that sends a static credential, the credential row above applies instead) | **Not fatal**: the instance stays **degraded**, now with the configuration reason, and is **not retried** — dispatches fail saying to edit its declaration; an edit of the entry (or a restart) re-attempts it |
 
@@ -0,0 +1,48 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// [#28594] `storedOverlayEntries` serves a stored row's `_packageId` from the
+// row's `package_id` COLUMN, never from its body: a body stamp is replaced by
+// the column's package, or dropped when the row is bound to no package. Every
+// reader of the list (the connector materializer judging whose root a file ref
+// reads among them) asks an item's owner of `_packageId`.
+
+import { describe, it, expect } from 'vitest';
+import { storedOverlayEntries } from './protocol-stored-overlay-reads.js';
+
+const host = { convertStoredItem: (_type: string, body: unknown) => body };
+const parse = (records: any[]) => storedOverlayEntries.call(host, { type: 'connector' }, records);
+const row = (body: Record<string, unknown>, packageId: string | null) => ({
+    type: 'connector', name: String(body.name), metadata: JSON.stringify(body), package_id: packageId,
+});
+
+describe('#28594 — a stored row\'s package is its column\'s', () => {
+    it('a body stamp on a row bound to no package is dropped', () => {
+        const [entry] = parse([row({ name: 'a', _packageId: 'com.acme.host' }, null)]);
+        expect(entry!.packageId).toBeUndefined();
+        expect(entry!.data).not.toHaveProperty('_packageId');
+    });
+
+    it('a body stamp naming another package is replaced by the column\'s', () => {
+        const [entry] = parse([row({ name: 'a', _packageId: 'com.acme.host' }, 'com.acme.authored')]);
+        expect(entry!.packageId).toBe('com.acme.authored');
+        expect(entry!.data._packageId).toBe('com.acme.authored');
+    });
+
+    it('control: a body with no stamp is stamped from its column, and an agreeing stamp is kept', () => {
+        const [bound, agreeing, unbound] = parse([
+            row({ name: 'a' }, 'com.acme.authored'),
+            row({ name: 'b', _packageId: 'com.acme.authored' }, 'com.acme.authored'),
+            row({ name: 'c' }, null),
+        ]);
+        expect(bound!.data._packageId).toBe('com.acme.authored');
+        expect(agreeing!.data._packageId).toBe('com.acme.authored');
+        expect(unbound!.data).not.toHaveProperty('_packageId');
+    });
+
+    it('a row whose metadata is an object is not written: the served body is a copy', () => {
+        const body = { name: 'a', _packageId: 'com.acme.host' };
+        const [entry] = parse([{ type: 'connector', name: 'a', metadata: body, package_id: null }]);
+        expect(entry!.data).not.toHaveProperty('_packageId');
+        expect(body._packageId).toBe('com.acme.host');
+    });
+});
@@ -155,15 +155,28 @@ export function storedOverlayEntries(
     // provenance classification see overlay rows the way they see
     // registry items.
     return records.map((record) => {
-        const data = this.convertStoredItem(
+        const parsed = this.convertStoredItem(
             String(record.type ?? request.type),
             typeof record.metadata === 'string'
                 ? JSON.parse(record.metadata)
                 : record.metadata,
         ) as any;
         const recPkg = (record as { package_id?: string | null }).package_id ?? undefined;
-        if (recPkg && data && typeof data === 'object' && (data as any)._packageId === undefined) {
-            (data as any)._packageId = recPkg;
+        // [#28594] The row's package is its COLUMN's, and only the column's: a
+        // `_packageId` the stored body carries is not served (dropped when the
+        // row is bound to no package, replaced when it is bound to another).
+        // The save door already strips a body's stamp (`stripDerivedProvenance`
+        // in `protocol.ts`: the server states provenance, a caller never does),
+        // but a row at rest can still carry one, and every reader of this list
+        // asks an item's owner of `_packageId` — the connector materializer
+        // deciding whose root a file ref reads among them. A copy, so a cached
+        // row's body is never written.
+        let data = parsed;
+        if (data && typeof data === 'object' && !Array.isArray(data) && (data as any)._packageId !== recPkg) {
+            const bound: Record<string, unknown> = { ...(data as Record<string, unknown>) };
+            if (recPkg) bound._packageId = recPkg;
+            else delete bound._packageId;
+            data = bound;
         }
         // [ADR-0131 D6/D7] Every row is the environment's: the family
         // declares no organization column, and the reads that feed this