@@ -0,0 +1,21 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/cli': minor
+'@objectstack/cloud-connection': minor
+---
+
+fix(metadata-protocol,cli,cloud-connection)!: an object extension that re-declares an owner's field in `fields` beyond its display properties is refused at the save and publish doors, at `os validate` and at the install door, with a prescription naming `fieldPatches` (ADR-0146 D10) (#30610)
+
+Clause-②: no (narrowing) — the `object_extension` save, publish and restore doors, `os validate` and `POST /api/v1/marketplace/install-local` refuse an `objectExtensions[].fields` entry naming a field the extended object's owner declares when it changes anything outside the display-property whitelist, a body they accepted before. Nothing is widened.
+Metadata-protocol: narrowed
+Skills-docs: no move — `skills/**` and `content/docs/**` already teach `fieldPatches` as the way to change a base field's display, and no page teaches taking an owner field over through `fields`; the prescription ships in the refusal text.
+
+<!-- adr-0087: not-required (no-migration-prescription) A refused shape with no mechanical rewrite: which keys of a re-declared field were meant as display and which as a takeover is a judgement about the field, and no first-party artifact (examples, HotCRM) writes the shape. A stored row that already re-declares an owner field keeps registering with the registry's warning, and is judged when it is next saved or published. -->
+
+**BREAKING** accept-set narrowing at the metadata save and publish doors (`PUT /api/v1/meta/object_extension/NAME`, draft and live, the per-item and package publish, and the restore doors), at `os validate`, and at the marketplace install door.
+
+- **Before.** An extension written into `fields` with the name of a field the extended object's owner declares replaced the owner's field whole when the registry folded the object: a module package could turn the owner's `amount: number` into `text`, drop its `required`, or make it `readonly`, and every reader judged the field on the extension's definition. Only the registry's warning named it.
+- **Now.** Such an entry is refused when it changes anything outside the display-property whitelist (`label`, `description`, `inlineHelpText`, `placeholder`, an option's `label`): `400 VALIDATION_ERROR` at the save and publish doors (located in `issues[]` at `fields.FIELD`), `422 VALIDATION_ERROR` at the install door (every entry in `details.refusals`), and exit 1 with the entry on `errors` at `os validate`. Each refusal names the keys the entry changes and prescribes `fieldPatches`. Both bodies are read through the field schema first, so a default the parse stamps is no change; options are compared by stored value, so a relabel or reorder is no change.
+- **Unchanged.** A re-declaration that changes only display properties is admitted. An extension of an object its own package owns is not judged, nor is an added field. `os validate` judges an owner declared by another package of the same artifact; a target outside the artifact is judged at install, against the installed owner. The registry's warning on a re-declared field stays. `os build` does not yet run the check.
+
+**The remedy.** Move a display change of an owner's field into the extension's `fieldPatches` (the field name as its key, the whitelisted properties as its body), and add a behaviour of your own as a new field under a new name.
@@ -81,6 +81,9 @@ import { findExtensionFieldSuffixRefusals } from '../utils/extension-field-suffi
 // [ADR-0146 D10, second rule] The field-patch target check's walk; the verdict
 // is the marketplace install door's own judge.
 import { findFieldPatchTargetRefusals } from '../utils/field-patch-targets.js';
+// [ADR-0146 D10, second rule] An extension re-declaring an owner's field beyond
+// the display-property whitelist; the verdict is the save and install doors' own.
+import { findRedeclaredOwnerFieldRefusals } from '../utils/extension-redeclared-owner-fields.js';
 // [#29051] An undeclared top-level flow cycle (ADR-0044): the automation
 // engine's own judge (`findUndeclaredFlowCycle`, `@objectstack/metadata-core`).
 import { findFlowCycleRefusals } from '../utils/flow-undeclared-cycle.js';
@@ -754,6 +757,35 @@ export default class Validate extends Command {
         this.exit(1);
       }
 
+      // 3a-v-bis. [ADR-0146 D10, second rule] A base field changes only within
+      //     the display-property whitelist: an `objectExtensions[].fields`
+      //     entry naming a field another package of this artifact declares
+      //     replaces that field whole, so it is refused when it changes
+      //     anything else. The verdict is the save and install doors' own
+      //     (`judgeRedeclaredOwnerFields`); see
+      //     `utils/extension-redeclared-owner-fields.ts` for the walk.
+      const redeclaredRefusals = findRedeclaredOwnerFieldRefusals(result.data as Record<string, unknown>);
+      if (redeclaredRefusals.length > 0) {
+        if (flags.json) {
+          await emitJson({
+            valid: false,
+            errors: redeclaredRefusals,
+            warnings: warningsSoFar(),
+            conversions: conversionNotices,
+            duration: timer.elapsed(),
+          });
+          this.exit(1);
+        }
+        const n = redeclaredRefusals.length;
+        console.log('');
+        printError(`${n} extension field${n > 1 ? 's re-declare' : ' re-declares'} an owner's field beyond its display properties (ADR-0146 D10)`);
+        printBulletList(
+          redeclaredRefusals.map((r) => `${r.path} [${r.code}] ${r.message}`),
+          { noun: 'extension-field refusal(s)', remedy: JSON_FULL_LIST_REMEDY },
+        );
+        this.exit(1);
+      }
+
       // 3a-vi. [#28893] Flow region shape (ADR-0031) is judged by the rule
       //     table above since #29049 (`flow-region-shape-invalid`,
       //     `@objectstack/lint`'s `validate-flow-region-shape.ts`), so all
 
@@ -0,0 +1,78 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `os validate`'s half of ADR-0146 D10's display-property whitelist: an
+ * `objectExtensions[].fields` entry naming a field the extended object's owner
+ * declares replaces that field whole, so it is refused when it changes
+ * anything outside the whitelist, when the owner is another package of this
+ * composed artifact.
+ *
+ * ## One judge, not a second rule
+ *
+ * The verdict is `@objectstack/metadata-protocol`'s `judgeRedeclaredOwnerFields`,
+ * the SAME judge the save, publish and restore doors of an `object_extension`
+ * item and the marketplace install door ask, so a green validate is an
+ * extension those doors admit. What this module owns is the WALK: which
+ * package owns each object the artifact declares — every `packages[]` entry
+ * under its own id (ADR-0130 D4), or the stack itself as one package under
+ * `manifest.id` — and which extensions each package carries. An extension of
+ * a package's own object changes its own field and is not judged; a target
+ * outside the artifact is judged at install, against the installed owner.
+ */
+
+import { judgeRedeclaredOwnerFields, type ObjectOwnerDeclaration } from '@objectstack/metadata-protocol';
+
+import { artifactPackages } from './artifact-packages.js';
+
+/** One refused entry, located. `message` is the doors' sentence, verbatim. */
+export interface RedeclaredOwnerFieldRefusalRow {
+  /** Where the entry sits in the parsed stack, e.g. `packages[1].manifest.objectExtensions[0].fields.amount`. */
+  path: string;
+  /** The code the save doors refuse the same entry with. */
+  code: 'VALIDATION_ERROR';
+  object: string;
+  field: string;
+  /** The package the extension is declared in. */
+  packageId: string | undefined;
+  /** The package that declares the object. */
+  ownerPackageId: string | undefined;
+  /** The keys the entry changes, every one outside the display-property whitelist. */
+  changed: string[];
+  message: string;
+}
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** The objects a stack body declares, by name — a list of definitions or a name-keyed map. */
+function declaredObjects(body: Record<string, unknown>): Array<[string, unknown]> {
+  const objects = body.objects;
+  if (Array.isArray(objects)) {
+    return objects.flatMap((o) => (isRecord(o) && typeof o.name === 'string' ? [[o.name, o] as [string, unknown]] : []));
+  }
+  return isRecord(objects) ? Object.entries(objects) : [];
+}
+
+/** Every extension field of the parsed stack that re-declares an in-artifact owner's field beyond its display properties. */
+export function findRedeclaredOwnerFieldRefusals(parsed: Record<string, unknown>): RedeclaredOwnerFieldRefusalRow[] {
+  const entries = artifactPackages(parsed);
+  const bodies = entries.length > 0
+    ? entries.map(({ index, id, body }) => ({ id: id as string | undefined, body, at: `packages[${index}].manifest.` }))
+    : [{
+      id: isRecord(parsed.manifest) && typeof parsed.manifest.id === 'string' ? parsed.manifest.id : undefined,
+      body: parsed,
+      at: '',
+    }];
+  const owners = new Map<string, ObjectOwnerDeclaration>();
+  for (const { id, body } of bodies) {
+    for (const [name, definition] of declaredObjects(body)) {
+      if (!owners.has(name)) owners.set(name, { packageId: id, definition });
+    }
+  }
+  return bodies.flatMap(({ id, body, at }) => judgeRedeclaredOwnerFields({
+    packageId: id, objectExtensions: body.objectExtensions, ownerOf: (name) => owners.get(name), at,
+  }).map((r) => ({
+    path: r.path, code: 'VALIDATION_ERROR' as const, object: r.object, field: r.field,
+    packageId: r.packageId, ownerPackageId: r.ownerPackageId, changed: r.changed, message: r.message,
+  })));
+}
@@ -262,15 +262,22 @@ const BUILD_ONLY_GATES: Readonly<Record<string, string>> = {
  * Three rows it has held moved to SHARED_NON_REGISTRY_GATES when `compile.ts`
  * gained the call: `findViewContainerNameRefusals` (#20331 → #20393),
  * `findOverrideDeclarationRefusals` (#28410 → #28643) and
- * `findExtensionFieldSuffixRefusals` (#28564 → #28727). It holds one today,
- * `findFieldPatchTargetRefusals` (#28565), whose card did not name the build.
+ * `findExtensionFieldSuffixRefusals` (#28564 → #28727). It holds two today,
+ * `findFieldPatchTargetRefusals` (#28565) and `findRedeclaredOwnerFieldRefusals`
+ * (#30610), whose cards did not name the build.
  */
 const VALIDATE_ONLY_GATES: Readonly<Record<string, string>> = {
   findFieldPatchTargetRefusals:
     '[ADR-0146 D10, second rule] An object extension\'s `fieldPatches` naming a field or option value its ' +
     'in-stack target lacks, judged by the marketplace install door\'s own `fieldPatchTargetRefusals`. Wired ' +
     'where the rollout card asked for it (`os validate` and the install door); `os build` still emits such an ' +
     'artifact, which the install door then refuses — the build-side gap, reported rather than closed here.',
+  findRedeclaredOwnerFieldRefusals:
+    '[ADR-0146 D10, second rule] An `objectExtensions[].fields` entry re-declaring a field another package of the ' +
+    'artifact declares, beyond the display-property whitelist, judged by the save and install doors\' own ' +
+    '`judgeRedeclaredOwnerFields`. Wired at the three doors its card named (`os validate`, the publish doors, the ' +
+    'install door); `os build` still emits such an artifact, which the install door then refuses — the same ' +
+    'build-side gap as the row above, reported rather than closed here.',
 };
 
 /**
 
@@ -0,0 +1,110 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [ADR-0146 D10, second rule] `os validate` asks the display-property
+ * whitelist judge — the save and install doors' own
+ * (`judgeRedeclaredOwnerFields`), over the walk
+ * `utils/extension-redeclared-owner-fields.ts` takes. What is pinned here is
+ * the command, on an assembled artifact (ADR-0130 D4) whose second package
+ * extends the first package's object: an `objectExtensions[].fields` entry
+ * that changes the owner field's `type` exits 1 with the entry located on
+ * `errors` (`code: VALIDATION_ERROR`); the same entry changing only the
+ * label validates clean.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { execFile } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { childEnv } from './helpers/serve-process.js';
+import { defineStackSource, linkSpec } from './helpers/define-stack-fixture.js';
+
+const HERE = resolve(fileURLToPath(import.meta.url), '..');
+const CLI = resolve(HERE, '../bin/run-dev.js');
+const TSX = resolve(HERE, '../../../node_modules/.bin/tsx');
+
+/** Two packages: the core owns `rof_deal`, the module re-declares its `amount` as `amount`. */
+const assembled = (amount: Record<string, unknown>) => ({
+  manifest: { id: 'com.example.rof', namespace: 'rof', version: '1.0.0', name: 'Rof', type: 'app' },
+  packages: [
+    {
+      manifest: {
+        id: 'com.example.rof', namespace: 'rof', version: '1.0.0', name: 'Rof', type: 'app',
+        objects: [{
+          name: 'rof_deal', label: 'Deal', sharingModel: 'private',
+          fields: { name: { type: 'text', label: 'Name' }, amount: { type: 'number', label: 'Amount' } },
+        }],
+      },
+    },
+    {
+      manifest: {
+        id: 'com.example.rof.revenue', namespace: 'rof', version: '1.0.0', name: 'Revenue', type: 'module',
+        dependencies: { 'com.example.rof': '^1.0.0' },
+        objectExtensions: [{ extend: 'rof_deal', fields: { amount } }],
+      },
+    },
+  ],
+});
+
+interface Run {
+  code: number;
+  stdout: string;
+  stderr: string;
+}
+
+function runValidate(cwd: string): Promise<Run> {
+  return new Promise((resolvePromise) => {
+    execFile(
+      TSX,
+      [CLI, 'validate', '--json'],
+      // `childEnv()`, never a bulk `process.env` copy (check:cli-test-child-env).
+      { cwd, maxBuffer: 16 * 1024 * 1024, env: childEnv({ NO_COLOR: '1' }) },
+      (err, stdout, stderr) => {
+        resolvePromise({
+          code: err ? (typeof (err as { code?: unknown }).code === 'number' ? (err as unknown as { code: number }).code : 1) : 0,
+          stdout: String(stdout),
+          stderr: String(stderr),
+        });
+      },
+    );
+  });
+}
+
+let typeChangeDir: string;
+let relabelDir: string;
+
+beforeAll(() => {
+  typeChangeDir = mkdtempSync(join(tmpdir(), 'os-validate-rof-type-'));
+  writeFileSync(join(typeChangeDir, 'objectstack.config.ts'),
+    defineStackSource(assembled({ type: 'text', label: 'Amount' }), { strict: false }));
+  linkSpec(typeChangeDir);
+  relabelDir = mkdtempSync(join(tmpdir(), 'os-validate-rof-relabel-'));
+  writeFileSync(join(relabelDir, 'objectstack.config.ts'),
+    defineStackSource(assembled({ type: 'number', label: 'Deal size' }), { strict: false }));
+  linkSpec(relabelDir);
+});
+
+afterAll(() => {
+  rmSync(typeChangeDir, { recursive: true, force: true });
+  rmSync(relabelDir, { recursive: true, force: true });
+});
+
+describe('os validate — an extension re-declaring an owner field beyond its display properties (ADR-0146 D10)', () => {
+  it('exits 1 with the entry located on errors, VALIDATION_ERROR, naming what it changes', async () => {
+    const run = await runValidate(typeChangeDir);
+    expect(run.code, run.stderr).toBe(1);
+    const report = JSON.parse(run.stdout);
+    expect(report.valid).toBe(false);
+    expect(report.errors.map((e: { path: string; code: string; changed: string[] }) => ({ path: e.path, code: e.code, changed: e.changed })))
+      .toEqual([{ path: 'packages[1].manifest.objectExtensions[0].fields.amount', code: 'VALIDATION_ERROR', changed: ['type'] }]);
+    expect(report.errors[0].message).toContain('`fieldPatches`');
+  }, 120_000);
+
+  it('validates clean when the entry changes only the label', async () => {
+    const run = await runValidate(relabelDir);
+    expect(run.code, `${run.stdout}\n${run.stderr}`).toBe(0);
+    expect(JSON.parse(run.stdout).valid).toBe(true);
+  }, 120_000);
+});
@@ -11,6 +11,11 @@
  * or one the same artifact delivers: a patch reaches the owner's own fields
  * only, so a field another installed extension adds is not one it can name.
  * A patch that matches installs.
+ *
+ * Step 2e' sits beside it in this harness: an `objectExtensions[].fields`
+ * entry that re-declares an owner's field, refused `422 VALIDATION_ERROR` when
+ * it changes anything outside the display-property whitelist, admitted when
+ * it changes only display properties.
  */
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
@@ -227,3 +232,52 @@ describe('install-local 2e — the field-patch target check (ADR-0146 D10)', ()
         expect(h.installRegistrations()).toHaveLength(1);
     });
 });
+
+const redeclaringPackage = (fields: Record<string, unknown>) => ({
+    id: 'com.example.crm-takeover', name: 'CRM takeover', version: '1.0.0', scope: 'project', type: 'module',
+    dependencies: { [BASE]: '1.x' },
+    objectExtensions: [{ extend: 'crm_account', fields }],
+});
+
+describe('install-local 2e\' — an extension re-declaring an owner field beyond its display properties (ADR-0146 D10)', () => {
+    it('refuses a type change of the installed owner\'s field, and installs nothing', async () => {
+        const h = await mount(dir);
+        const res = await h.install({ manifest: redeclaringPackage({ industry: { type: 'text', label: 'Industry' } }) });
+        expectRefusal(res, ['objectExtensions[0].fields.industry']);
+        expect(res.payload.error.details.refusals[0]).toMatchObject({
+            object: 'crm_account', field: 'industry', ownerPackageId: BASE, changed: ['options', 'type'],
+        });
+        expect(res.payload.error.message).toContain('`fieldPatches`');
+        expect(h.installRegistrations()).toEqual([]);
+        expect(h.syncs()).toBe(0);
+        expect(readdirSync(dir)).toEqual([]);
+    });
+
+    it('refuses an added option value (`options` membership), on an owner the same artifact delivers', async () => {
+        const h = await mount(dir);
+        const res = await h.install({
+            manifest: {
+                id: 'com.example.multi', name: 'Multi', version: '1.0.0', scope: 'project', type: 'app',
+                packages: [
+                    { manifest: { id: 'com.example.multi.core', name: 'Core', version: '1.0.0', type: 'app',
+                        objects: [{ name: 'multi_ticket', fields: { status: { type: 'select', label: 'Status', options: [{ value: 'open', label: 'Open' }] } } }] } },
+                    { manifest: { id: 'com.example.multi.more', name: 'More', version: '1.0.0', type: 'module',
+                        objectExtensions: [{ extend: 'multi_ticket', fields: { status: { type: 'select', label: 'Status', options: [{ value: 'open', label: 'Open' }, { value: 'hold', label: 'On hold' }] } } }] } },
+                ],
+            },
+        });
+        expectRefusal(res, ['packages[1].manifest.objectExtensions[0].fields.status']);
+        expect(res.payload.error.details.refusals[0]).toMatchObject({ changed: ['options'], ownerPackageId: 'com.example.multi.core' });
+    });
+
+    it('lit control: a re-declaration that changes only display properties installs', async () => {
+        const h = await mount(dir);
+        const res = await h.install({
+            manifest: redeclaringPackage({
+                industry: { type: 'select', label: 'Sector', options: [{ value: 'tech', label: 'Technology' }, { value: 'retail', label: 'Retail' }] },
+            }),
+        });
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(h.installRegistrations()).toHaveLength(1);
+    });
+});