@@ -0,0 +1,18 @@
+---
+'@objectstack/cloud-connection': patch
+---
+
+fix(cloud-connection)!: install-local's cloud branch refuses a package whose namespace or security catalog name another package or a built-in holds (#31392)
+
+Clause-②: no (narrowing) — `POST /api/v1/marketplace/install-local` with a cloud-fetched package (`packageId` + `versionId`) whose register the registry refuses because another installed package owns its namespace, or because another package or a built-in holds a position, permission set or capability name it ships, answers `422 PLUGIN_REGISTER_FAILED` where it answered `200` with `hotLoaded: false` and wrote the ledger entry. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) no key of any schema is added, removed or re-shaped and no stored row is read differently: the narrowing is one runtime refusal at one door, for two registry refusals the inline branch of the same door already answers 422, and its remedy is the rename or uninstall the refusal names, so there is nothing for `objectstack migrate meta` to rewrite. A ledger entry an earlier build wrote this way is read as before at boot. -->
+
+**BREAKING** for a cloud-branch install that relied on the lenient answer for a held namespace or a held security catalog name.
+
+- **Before.** The cloud branch refused two of the registry's held-name refusals: a security catalog name the environment catalog holds (#25366) and a bare name another package holds (#31296). A package whose `manifest.namespace` another installed package owns (with no declared dependency on it), or that ships a position, permission set or capability name another package or a built-in holds, was refused by the registry and then ledgered anyway, answering `200` with `hotLoaded: false`, "loads at the next restart". It does not: both checks run again at every load with no seal, so the next boot refuses the registration again.
+- **Now.** Both refusals are answered `422 PLUGIN_REGISTER_FAILED` with the registry's sentence naming both holders, as the inline branch answers them. Nothing is registered or written, and an installed earlier version stays registered and ledgered. The door recognises the registry's three held-name refusals by their own code and `name`, never by a list of types or holders.
+- **Unchanged.** Any other register failure on the cloud branch keeps the lenient answer (`200`, `hotLoaded: false`, `hotLoadError`). Under `OS_METADATA_COLLISION=warn` the registry throws nothing for a held namespace, so the install proceeds as before. A namespace held by a writable base is still refused `409 RESOURCE_CONFLICT` before the register.
+
+**The remedy.** Rename the item (or choose another namespace) in the incoming package, declare the holding app in its `manifest.dependencies` when it extends that app, rename the item in the holding package, or uninstall that package, then install again. A built-in name is never available to a package.
@@ -40,7 +40,14 @@
  *     answered before (#25366; its full matrix lives in
  *     `marketplace-install-local-catalog-name-collision.test.ts`);
  *   - CONTROL, the same package declaring a flow name nobody holds: `200`,
- *     `hotLoaded: true`, registered and ledgered.
+ *     `hotLoaded: true`, registered and ledgered;
+ *   - #31392, the namespace sibling: a fresh install and an upgrade declaring
+ *     the namespace the holder owns, with no dependency on it, answer the same
+ *     `422` with the registry's namespace sentence, nothing registered or
+ *     ledgered. Measured before the fix: `200`, `hotLoaded: false`, ledgered.
+ *     The `objectql` service hands the door the engine's `manifests`, so the
+ *     holder this door installed reads as a code package (step 1f's writable
+ *     base refusal is not this one).
  *
  * A register failure that is NOT a registry refusal keeps #22695's lenient
  * answer; `marketplace-install-local-hot-loaded.test.ts` pins that.
@@ -154,6 +161,10 @@ async function bootPlugin() {
         objectql: withInstallerGrants({
             convertPackageBodyForward: (body: unknown) => ql.convertPackageBodyForward(body),
             registry: ql.registry,
+            // [#31392] The engine's registered code packages, read live, so a
+            // package this door installed reads as code and not as a writable
+            // base (`isWritablePackage`), as on the real `objectql` service.
+            get manifests() { return (ql as unknown as { manifests: Map<string, unknown> }).manifests; },
             syncSchemas: async () => undefined,
         }),
     };
@@ -298,3 +309,57 @@ describe('install-local cloud branch refuses a package declaring a bare name ano
         expectHolderFlowKept(ql);
     });
 });
+
+describe('install-local cloud branch refuses a package whose namespace another package owns, before any write (#31392)', () => {
+    const versions = {
+        // The holder's namespace (`dispatch`), under another id, with no dependency on it.
+        'v1-ns-held': packageVersion(INCOMING_ID, '1.0.0', [FREE_FLOW], { namespace: 'dispatch' }),
+        'v1-free': packageVersion(INCOMING_ID, '1.0.0', [FREE_FLOW]),
+        'v2-ns-held': packageVersion(INCOMING_ID, '2.0.0', [FREE_FLOW], { namespace: 'dispatch' }),
+    };
+
+    function expectNamespaceRefusal(res: any) {
+        expect(res.status, JSON.stringify(res.payload)).toBe(422);
+        expect(BaseResponseSchema.safeParse(res.payload).success).toBe(true);
+        expect(envelopeViolations(res.payload)).toEqual([]);
+        expect(ApiErrorSchema.safeParse(res.payload.error).success).toBe(true);
+        expect(res.payload.success).toBe(false);
+        expect(res.payload.error.code).toBe('PLUGIN_REGISTER_FAILED');
+        // The registry's own sentence: the namespace, its owner, and the package it stopped.
+        expect(res.payload.error.message).toContain(`namespace "dispatch" is already owned by package "${HOLDER_ID}"`);
+        expect(res.payload.error.message).toContain(`package "${INCOMING_ID}" cannot be installed alongside it`);
+    }
+
+    it('a fresh install is refused: 422 naming the namespace and its owner, nothing registered or ledgered', async () => {
+        serveVersions(versions);
+        const { ql, installFromCloud, installHolder } = await bootPlugin();
+        await installHolder();
+        const before = ledger();
+
+        const res = await installFromCloud('v1-ns-held');
+
+        expectNamespaceRefusal(res);
+        expect(res.payload.data).toBeUndefined();
+        expect(ql.registry.getPackage(INCOMING_ID)).toBeUndefined();
+        expect(ledger()).toEqual(before);
+        expect(ledger().incoming).toBeNull();
+        expectHolderFlowKept(ql);
+    });
+
+    it('an upgrade into the held namespace is refused: 422, the installed version still registered and ledgered', async () => {
+        serveVersions(versions);
+        const { ql, installFromCloud, installHolder } = await bootPlugin();
+        await installHolder();
+        const first = await installFromCloud('v1-free');
+        expect(first.status, JSON.stringify(first.payload)).toBe(200);
+        const before = ledger();
+
+        const res = await installFromCloud('v2-ns-held');
+
+        expectNamespaceRefusal(res);
+        expect(ql.registry.getPackage(INCOMING_ID)?.manifest?.version).toBe('1.0.0');
+        expect(ledger()).toEqual(before);
+        expect(ledger().incoming?.version).toBe('1.0.0');
+        expectHolderFlowKept(ql);
+    });
+});
@@ -36,7 +36,13 @@
  *     the ledger exactly as before the call, and the environment's item still
  *     the environment's;
  *   - CONTROL, the same flows shipping a name nobody holds: `200`,
- *     `hotLoaded: true`, the new version registered and ledgered.
+ *     `hotLoaded: true`, the new version registered and ledgered;
+ *   - #31392, the cloud-fetched branch with the other two holders: a name
+ *     another installed package holds (a fresh install and an upgrade) and a
+ *     built-in name (`everyone`) answer the same `422` naming that holder,
+ *     nothing registered or ledgered, and a name nobody holds beside the
+ *     holding package still installs. Measured before the fix: `200`,
+ *     `hotLoaded: false`, ledgered.
  *
  * A capability is code-only (`allowRuntimeCreate: false`), so no environment
  * save produces one; its case pins that the door judges the refusal, not the
@@ -48,6 +54,7 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { BaseResponseSchema, ApiErrorSchema, envelopeViolations } from '@objectstack/spec/api';
+import { EVERYONE_POSITION } from '@objectstack/spec/identity';
 // The plugin reaches `@objectstack/runtime` through a lazy `import()`; its first
 // load is paid here, at module top, never inside a clocked `it`.
 import '@objectstack/runtime';
@@ -284,3 +291,109 @@ describe('install-local refuses a package whose catalog name an environment-auth
         }
     }
 });
+
+/** [#31392] The package already holding the catalog name, installed first through the same door's inline branch. */
+const HOLDER_ID = 'com.acme.dispatch-roles';
+
+/** The registry's sentence for a held catalog name: the name, the incoming package, and `holder` as its holder. */
+function expectHeldElsewhereRefusal(res: any, name: string, holder: string) {
+    expect(res.status, JSON.stringify(res.payload)).toBe(422);
+    expect(BaseResponseSchema.safeParse(res.payload).success).toBe(true);
+    expect(envelopeViolations(res.payload)).toEqual([]);
+    expect(ApiErrorSchema.safeParse(res.payload.error).success).toBe(true);
+    expect(res.payload.success).toBe(false);
+    expect(res.payload.error.code).toBe('PLUGIN_REGISTER_FAILED');
+    expect(res.payload.error.message).toContain(`package "${APP_ID}"`);
+    expect(res.payload.error.message).toContain(`"${name}" is already held by ${holder}`);
+}
+
+describe('install-local cloud branch refuses a package whose catalog name another package or a built-in holds, before any write (#31392)', () => {
+    const k = CASES[0];
+    const cloud = BRANCHES[1];
+    const versions = {
+        'v1': packageVersion(k, '1.0.0', [k.shipped]),
+        'v2-collides': packageVersion(k, '2.0.0', [k.shipped, k.cloned]),
+        'v2-free': packageVersion(k, '2.0.0', [k.shipped, k.free]),
+        'v1-built-in': {
+            id: APP_ID,
+            name: 'acme_field_service',
+            type: 'app',
+            version: '1.0.0',
+            positions: [{ name: EVERYONE_POSITION, label: 'Everyone at Acme' }],
+        },
+    };
+    const holder: Bag = {
+        id: HOLDER_ID,
+        name: 'acme_dispatch_roles',
+        type: 'app',
+        version: '1.0.0',
+        [k.collection]: [{ ...item(k, k.cloned), label: 'held by the roles package' }],
+    };
+
+    async function bootWithHolder() {
+        cloud.serve(versions);
+        const booted = await bootPlugin(cloud.controlPlaneUrl);
+        const held = await booted.install({ manifest: holder });
+        expect(held.status, JSON.stringify(held.payload)).toBe(200);
+        return booted;
+    }
+    const ledgerOf = (id: string) => new LocalManifestSource(dir).read(id).entry;
+    function expectHolderItemKept(ql: ObjectQL) {
+        expect(ql.registry.getItem<Bag>(k.type, k.cloned)?.label).toBe('held by the roles package');
+        expect(ql.registry.getPackage(HOLDER_ID)?.manifest?.version).toBe('1.0.0');
+    }
+
+    it('a fresh install of a name another package holds is refused: 422 naming the holder, nothing registered or ledgered', async () => {
+        const { ql, install } = await bootWithHolder();
+        const holderEntry = ledgerOf(HOLDER_ID);
+
+        const res = await install(cloud.body(versions, 'v2-collides'));
+
+        expectHeldElsewhereRefusal(res, k.cloned, `package "${HOLDER_ID}"`);
+        expect(res.payload.data).toBeUndefined();
+        expect(ql.registry.getPackage(APP_ID)).toBeUndefined();
+        expect(ledgerOf(APP_ID)).toBeNull();
+        expect(ledgerOf(HOLDER_ID)).toEqual(holderEntry);
+        expectHolderItemKept(ql);
+    });
+
+    it('an upgrade to a name another package holds is refused: 422, the installed version still registered and ledgered', async () => {
+        const { ql, install } = await bootWithHolder();
+        const first = await install(cloud.body(versions, 'v1'));
+        expect(first.status, JSON.stringify(first.payload)).toBe(200);
+        expect(first.payload.data.hotLoaded).toBe(true);
+        const entry = ledgerOf(APP_ID);
+
+        const res = await install(cloud.body(versions, 'v2-collides'));
+
+        expectHeldElsewhereRefusal(res, k.cloned, `package "${HOLDER_ID}"`);
+        expect(ql.registry.getPackage(APP_ID)?.manifest?.version).toBe('1.0.0');
+        expect(ledgerOf(APP_ID)).toEqual(entry);
+        expectHolderItemKept(ql);
+    });
+
+    it('a fresh install of a built-in name is refused: 422 naming the platform, nothing registered or ledgered', async () => {
+        cloud.serve(versions);
+        const { ql, install } = await bootPlugin(cloud.controlPlaneUrl);
+
+        const res = await install(cloud.body(versions, 'v1-built-in'));
+
+        expectHeldElsewhereRefusal(res, EVERYONE_POSITION, 'the platform');
+        expect(ql.registry.getPackage(APP_ID)).toBeUndefined();
+        expect(ledgerOf(APP_ID)).toBeNull();
+    });
+
+    it('CONTROL — beside the holder, an upgrade shipping a name nobody holds installs: 200, hot-loaded, ledgered', async () => {
+        const { ql, install } = await bootWithHolder();
+        expect((await install(cloud.body(versions, 'v1'))).status).toBe(200);
+
+        const res = await install(cloud.body(versions, 'v2-free'));
+
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(res.payload.data.hotLoaded).toBe(true);
+        expect(res.payload.data.hotLoadError).toBeUndefined();
+        expect(ql.registry.getPackage(APP_ID)?.manifest?.version).toBe('2.0.0');
+        expect(ledgerOf(APP_ID)?.version).toBe('2.0.0');
+        expectHolderItemKept(ql);
+    });
+});