@@ -0,0 +1,22 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+**BREAKING** fix(metadata-protocol): the adopt-orphans door asks the save door's owner judges, before the `__c` judge (ADR-0029 D9.9, ADR-0086 D3, #28776)
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+Skills-docs: none — no file under `skills/**` teaches the adopt-orphans door (0 hits for `adopt-orphans` and `reassignOrphanedMetadata`).
+
+<!-- adr-0087: not-required (no-migration-prescription) The narrowing refuses an adoption (`POST /api/v1/packages/:id/adopt-orphans`) that would rebind an active package-less object whose name another package owns in the registry, or an active package-less permission set whose body `packageId` names a package other than the target. Both refusals are the save door's own, asked at one more door with their existing envelopes. No metadata key, accepted value of a key, export or error code is removed or renamed, and no stored shape changes. The remedy is an authoring choice a person makes: bind the object to its owner, delete or rename one of the two rows, or drop or fix the set's `packageId`. There is no mechanical conversion between two metadata versions for `objectstack migrate meta` to apply. Measured at the PR's base: fresh CRM and showcase boots store 0 `sys_metadata` rows, and the 9 sites that seed `sys_metadata` rows in `packages/qa/**` hold 0 adoptable active rows either judge refuses. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); no `packages/spec/**` file is touched, so no schema, type or runtime interface moves (not type-surface-only, not runtime-interface-only); and no export is retired (not runtime-export-retired). -->
+
+`reassignOrphanedMetadata` (REST `POST /api/v1/packages/:id/adopt-orphans`) rebinds every active package-unbound row into the target package. Since #28735 it asks the `__c` judge first. It asked neither owner judge the save door asks before that one, so a package-less row could become a package's own item without them.
+
+The door now asks both, in the save door's order (owner first, then the existing `__c` call), against the TARGET package and before the first storage update. Any refusal refuses the adoption whole: no row moves and nothing is written through to the registry.
+
+- **An active orphan object whose name another package owns** (ADR-0029 D9.9): `422 OBJECT_OVERLAY_PACKAGE_MISMATCH`, the save door's message naming the owner. Adopted, the row was rebound in storage while the registry kept the other owner: two rows for one object. The `sys_metadata` sentinel owner is not judged. An orphan object is the sentinel's own registration, the owner the adoption hands over.
+- **An active orphan permission set whose body `packageId` disagrees with the target** (ADR-0086 D3): `400 VALIDATION_ERROR`, the save door's message, `issues[0].path = 'packageId'`.
+
+An adopted draft is judged by both when it is promoted, as before. The namespace-prefix judge is not asked at this door. Every installed package declares a namespace, so it would refuse nearly every real orphan object. Whether adoption refuses, renames or leaves the prefix unjudged is an open design question. No new error code.
+
+**Migration.** None needed for this repository: 0 rows affected (measured above). An environment whose adoption is refused fixes the named row, as the message says, and adopts again.
@@ -0,0 +1,179 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0029 D9.9, ADR-0086 D3, #28776] The adopt-orphans door
+ * (`reassignOrphanedMetadata`, REST `POST /api/v1/packages/:id/adopt-orphans`)
+ * asks the save door's two owner judges, in the save door's order (before the
+ * `__c` judge #28735 added), against the TARGET package, before the first
+ * storage update, and refuses the adoption whole with each judge's envelope:
+ *
+ *  - an active orphan `object` whose name ANOTHER package owns in the registry:
+ *    `OBJECT_OVERLAY_PACKAGE_MISMATCH` / 422 (D9.9);
+ *  - an active orphan `permission` set whose body `packageId` disagrees with the
+ *    target: `VALIDATION_ERROR` / 400, `issues[0].path = 'packageId'` (D3).
+ *
+ * The D9.9 arm skips the `'sys_metadata'` sentinel owner: an orphan object is
+ * the sentinel's own registration, the owner the adoption hands over, so the
+ * judge asked unchanged would refuse EVERY object adoption (measured on a real
+ * CRM boot for #28776: `classifyObjectContribution` answers `mismatch` with the
+ * sentinel for a package-less object saved through the real door). The plain
+ * orphan below pins that.
+ *
+ * The namespace-prefix judge is not asked at this door (#28776's ruling), so
+ * nothing here pins it either way.
+ *
+ * The engine double stores rows and answers the registry's owner lookups from a
+ * table the test sets, the way `SchemaRegistry.getObjectOwner` answers them; the
+ * write-through to the registry after a rebind is spied out, since what is
+ * pinned is which rows the adoption moves.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+// [#5619] The producer's OWN write-verb dispatch decision, from
+// `@objectstack/metadata-core` and NOT `@objectstack/objectql` (objectql
+// depends on this package, so that import would close a cycle).
+import { assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/metadata-core';
+import { ObjectStackProtocolImplementation } from './protocol.js';
+
+const TARGET = 'app.probe-target';
+const OTHER = 'app.probe-other';
+
+interface Row {
+    id: string;
+    type: string;
+    name: string;
+    package_id: string | null;
+    organization_id: string | null;
+    state: string;
+    metadata: string;
+}
+
+/** Rows stored package-less, and the registry's owner of each object name. */
+function makeProtocol(rows: Array<Omit<Row, 'id' | 'package_id' | 'organization_id'>>, owners: Record<string, string>) {
+    const store = new Map<string, Row>(rows.map((r, i) => [`r_${i + 1}`, {
+        ...r, id: `r_${i + 1}`, package_id: null, organization_id: null,
+    }]));
+    const engine: any = {
+        async find(table: string, opts?: { where?: Record<string, unknown>; limit?: number }) {
+            if (table !== 'sys_metadata') return [];
+            // The one shape the adoption reads: every environment row, no bound.
+            if (opts?.limit !== undefined || Object.keys(opts?.where ?? {}).length !== 0) {
+                throw new Error(`fake engine: unsupported read ${JSON.stringify(opts)}`);
+            }
+            return [...store.values()].map((r) => ({ ...r }));
+        },
+        async findOne(table: string, opts: { where: Record<string, unknown> }) {
+            assertEngineFindOnePredicate(table, opts);
+            return null;
+        },
+        async update(_t: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+            assertEngineUpdateDispatch(data, opts);
+            const row = store.get(String(opts.where.id));
+            if (!row) return { id: null };
+            Object.assign(row, data);
+            return { id: row.id };
+        },
+        registry: {
+            getObjectOwner: (name: string) => (owners[name] ? { packageId: owners[name] } : undefined),
+            getArtifactItem: () => undefined,
+            getPackage: () => undefined,
+            registerObject: () => {},
+            unregisterObject: () => true,
+        },
+    };
+    const protocol = new ObjectStackProtocolImplementation(engine, () => new Map(), undefined) as any;
+    const update = vi.spyOn(engine, 'update');
+    const writeThrough = vi.spyOn(protocol, 'applyRegistryWriteThrough').mockResolvedValue(undefined);
+    const bindings = () => Object.fromEntries([...store.values()].map((r) => [`${r.type}/${r.name}`, r.package_id]));
+    return { protocol, update, writeThrough, bindings };
+}
+
+const object = (name: string, ...fields: string[]) => ({
+    type: 'object', name, state: 'active',
+    metadata: JSON.stringify({
+        name, label: name, sharingModel: 'private',
+        fields: Object.fromEntries(['title', ...fields].map((f) => [f, { type: 'text', label: f }])),
+    }),
+});
+const permissionSet = (name: string, packageId?: string) => ({
+    type: 'permission', name, state: 'active',
+    metadata: JSON.stringify({ name, label: name, objects: {}, ...(packageId !== undefined ? { packageId } : {}) }),
+});
+
+async function attempt<T>(run: () => Promise<T>): Promise<{ result: T | null; error: any }> {
+    try {
+        return { result: await run(), error: null };
+    } catch (error) {
+        return { result: null, error };
+    }
+}
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('[ADR-0029 D9.9, #28776] the adopt door refuses an orphan object whose name another package owns', () => {
+    it('refused whole with OBJECT_OVERLAY_PACKAGE_MISMATCH / 422 naming the owner; no row moves, nothing is written through', async () => {
+        const h = makeProtocol([object('probe_clean'), object('probe_taken')], { probe_clean: 'sys_metadata', probe_taken: OTHER });
+
+        const { error } = await attempt(() => h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET }));
+
+        expect(error).toBeInstanceOf(Error);
+        expect({ code: error.code, status: error.status }).toEqual({ code: 'OBJECT_OVERLAY_PACKAGE_MISMATCH', status: 422 });
+        expect(error.message).toContain(
+            `Cannot layer object 'probe_taken': the overlay is bound to package '${TARGET}', but the object is owned by package '${OTHER}'.`,
+        );
+        expect(h.update).not.toHaveBeenCalled();
+        expect(h.writeThrough).not.toHaveBeenCalled();
+        expect(h.bindings()).toEqual({ 'object/probe_clean': null, 'object/probe_taken': null });
+    });
+
+    it('is asked before the `__c` judge, in the save door\'s order: a row both judges refuse answers the owner refusal', async () => {
+        const h = makeProtocol([object('probe_taken', 'x__c')], { probe_taken: OTHER });
+
+        const { error } = await attempt(() => h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET }));
+
+        expect({ code: error?.code, status: error?.status }).toEqual({ code: 'OBJECT_OVERLAY_PACKAGE_MISMATCH', status: 422 });
+        expect(h.bindings()).toEqual({ 'object/probe_taken': null });
+    });
+
+    it('CONTROL (the sentinel pin): a plain orphan the registry owns under the `sys_metadata` sentinel is admitted and moves; so does one nobody owns', async () => {
+        const h = makeProtocol([object('probe_plain'), object('probe_unowned')], { probe_plain: 'sys_metadata' });
+
+        const res = await h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET });
+
+        expect(res).toMatchObject({ success: true, reassignedCount: 2, targetPackageId: TARGET });
+        expect(h.bindings()).toEqual({ 'object/probe_plain': TARGET, 'object/probe_unowned': TARGET });
+    });
+
+    it('CONTROL: an orphan object the target itself owns is admitted', async () => {
+        const h = makeProtocol([object('probe_mine')], { probe_mine: TARGET });
+
+        const res = await h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET });
+
+        expect(res.reassignedCount).toBe(1);
+        expect(h.bindings()).toEqual({ 'object/probe_mine': TARGET });
+    });
+});
+
+describe('[ADR-0086 D3, #28776] the adopt door refuses an orphan permission set whose body names another owner', () => {
+    it('refused whole with VALIDATION_ERROR / 400, `issues` at `packageId`; no row moves', async () => {
+        const h = makeProtocol([object('probe_clean'), permissionSet('probe_set', OTHER)], { probe_clean: 'sys_metadata' });
+
+        const { error } = await attempt(() => h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET }));
+
+        expect(error).toBeInstanceOf(Error);
+        expect({ code: error.code, status: error.status }).toEqual({ code: 'VALIDATION_ERROR', status: 400 });
+        expect(error.issues).toEqual([expect.objectContaining({ path: 'packageId', code: 'custom' })]);
+        expect(error.message).toContain(`Drop \`packageId\` from permission set 'probe_set'`);
+        expect(h.update).not.toHaveBeenCalled();
+        expect(h.bindings()).toEqual({ 'object/probe_clean': null, 'permission/probe_set': null });
+    });
+
+    it('CONTROL: a set whose body names the target, and one that names no owner, are admitted and move', async () => {
+        const h = makeProtocol([permissionSet('probe_named', TARGET), permissionSet('probe_bare')], {});
+
+        const res = await h.protocol.reassignOrphanedMetadata({ targetPackageId: TARGET });
+
+        expect(res.reassignedCount).toBe(2);
+        expect(h.bindings()).toEqual({ 'permission/probe_named': TARGET, 'permission/probe_bare': TARGET });
+    });
+});
@@ -26903,6 +26903,32 @@ export class ObjectStackProtocolImplementation implements
      * 400, `issues[]` locating each field): no row moves and nothing is
      * written through to the registry. An adopted draft is judged when it is
      * promoted (the promotion asks the same judge against its binding).
+     *
+     * ## [ADR-0029 D9.9, ADR-0086 D3, #28776] …and the owner judges, first
+     *
+     * The save door asks two owner judges before the suffix judge, and so
+     * does this adoption, in the same order and with their own envelopes,
+     * before the first storage update: any refusal refuses the adoption whole.
+     *
+     *  - An active `object` row whose name ANOTHER package owns in the
+     *    registry ({@link classifyObjectContribution}'s `mismatch`) is refused
+     *    with {@link overlayPackageMismatchError}
+     *    (`OBJECT_OVERLAY_PACKAGE_MISMATCH` / 422). Adopted, it was rebound in
+     *    storage while the registry kept the other owner
+     *    ({@link releaseAdoptedObjectOwner} answers `false`): two rows for one
+     *    object, the shape D9.9 exists to refuse. ⛔ Not the `'sys_metadata'`
+     *    sentinel owner: an orphan object IS the sentinel's registration, the
+     *    owner this adoption hands over, so asked unchanged the judge would
+     *    refuse every object adoption.
+     *  - An active `permission` row whose body `packageId` disagrees with the
+     *    target is refused with {@link permissionSetOwnerBindingRefusal}
+     *    (`VALIDATION_ERROR` / 400, the save door's words).
+     *
+     * The namespace-prefix judge is deliberately NOT asked here: every
+     * installed package declares a namespace, so it would refuse nearly every
+     * real orphan object, and whether an adoption refuses, renames or leaves
+     * the prefix unjudged is the maintainer's question (#28776's ruling). A
+     * draft is judged by both owner judges when it is promoted.
      */
     async reassignOrphanedMetadata(request: {
         targetPackageId: string;
@@ -26935,6 +26961,35 @@ export class ObjectStackProtocolImplementation implements
                 && !this.isArtifactBacked(PLURAL_TO_SINGULAR[r.type] ?? r.type, String(r.name)),
         );
 
+        // [ADR-0029 D9.9, ADR-0086 D3, #28776] ⭐ THE OWNER JUDGES, in the save
+        // door's order (before the `__c` judge below), against the TARGET and
+        // before the first update: refused whole, each with its own envelope.
+        // The object arm skips the `'sys_metadata'` sentinel owner, the orphan's
+        // own registration this adoption hands over; see the header.
+        for (const row of orphans) {
+            if (row?.state !== 'active' || typeof row.name !== 'string') continue;
+            const type = canonicalMetaType(String(row.type));
+            if (type === 'object') {
+                const layer = this.classifyObjectContribution(row.name, request.targetPackageId);
+                if (layer.kind === 'mismatch' && layer.ownerPackageId !== 'sys_metadata') {
+                    throw ObjectStackProtocolImplementation.overlayPackageMismatchError(
+                        row.name, request.targetPackageId, layer.ownerPackageId,
+                    );
+                }
+            } else if (type === 'permission') {
+                let body: unknown;
+                try {
+                    body = typeof row.metadata === 'string' ? JSON.parse(row.metadata) : row.metadata;
+                } catch {
+                    continue;
+                }
+                const ownerRefusal = permissionSetOwnerBindingRefusal(
+                    type, body, row.name, request.targetPackageId, 'save',
+                );
+                if (ownerRefusal) throw ownerRefusal;
+            }
+        }
+
         // [ADR-0146 D10, #28735] ⭐ THE `__c` RESERVATION, JUDGED AGAINST THE
         // TARGET, before the first update below: each active object row this
         // adoption rebinds becomes the target's own object. Refused whole, with
 
@@ -44,8 +44,11 @@
  *    refuses to drop it), said once at `error`;
  *  - CONTROL: an adoption of non-object items leaves the object registry
  *    untouched, and the view write-through follows the view as before;
- *  - CONTROL: a package-less row of an object another package's row owns is
- *    rebound in storage and the registry keeps that owner, as before.
+ *  - a package-less row of an object another package's row owns: the
+ *    registry keeps that owner (#23646), and since #28776 the adoption is
+ *    refused whole with the save door's D9.9 refusal
+ *    (`OBJECT_OVERLAY_PACKAGE_MISMATCH` / 422), so storage no longer rebinds
+ *    the row beside the owner's (this was a CONTROL pinning that rebind).
  *
  * The negative control (the object limb removed, these pins red) is a one-off
  * ablation recorded in the PR body, not a test.
@@ -342,7 +345,7 @@ describe('#23646 — an orphan adoption moves an adopted object\'s registry owne
         expect((k.engine.registry.getItem('view', VIEW) as { _packageId?: string } | undefined)?._packageId).toBe(Q);
     });
 
-    it('CONTROL: a package-less row of an object another package\'s row owns is rebound in storage, and that owner stays', async () => {
+    it('[#28776] a package-less row of an object another package\'s row owns: the adoption is refused whole (D9.9), nothing is rebound, and that owner stays', async () => {
         const stores: Stores = new Map();
         const drops: string[] = [];
         const k = await boot(stores, drops);
@@ -356,11 +359,16 @@ describe('#23646 — an orphan adoption moves an adopted object\'s registry owne
         const registerItem = vi.spyOn(k.engine.registry, 'registerItem');
         const unregisterObject = vi.spyOn(k.engine.registry, 'unregisterObject');
 
-        const adopted = await k.protocol.reassignOrphanedMetadata({ targetPackageId: Q });
+        const refused = await k.protocol.reassignOrphanedMetadata({ targetPackageId: Q }).then(
+            () => undefined, (e: any) => e,
+        );
 
-        expect(adopted).toMatchObject({ reassignedCount: 1, reassigned: [{ type: 'object', name: NAME }] });
-        expect(storedBindings(stores).sort()).toEqual([Q, R].sort());
-        // Nothing of the residue reaches the registry, in either half.
+        // The save door's D9.9 refusal, naming the target and the owner.
+        expect({ code: refused?.code, status: refused?.status }).toEqual({ code: 'OBJECT_OVERLAY_PACKAGE_MISMATCH', status: 422 });
+        expect(String(refused?.message)).toContain(`owned by package '${R}'`);
+        // Nothing is rebound: the residue stays package-less beside R's row.
+        expect(storedBindings(stores).map((b) => b ?? 'none').sort()).toEqual([R, 'none'].sort());
+        // [#23646] …and that owner stays: nothing reaches the registry, in either half.
         expect(unregisterObject).not.toHaveBeenCalled();
         expect(registerObject).not.toHaveBeenCalled();
         expect(registerItem.mock.calls.filter(([type]) => type === 'object')).toEqual([]);