docs(objectql): the claims comments read true with positions in the engine's collection loop

With positions registered by ObjectQL.registerApp's collection loop (now on
main), three comments this change added said the loop never registers them.
The claims doc and the installPackage comment now say what the claims are for
on either tree: installPackage itself registers no items, so the claim is how
the package door remembers every declared name. The declared-names reader's
note and the runtime pin's header no longer say positions reach no engine
slot. Comments only; no behaviour change.

Claude-Session: https://claude.ai/code/session_01EUBvqtauTDmHi2ZgY759p2
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/objectql/src/registry.ts

@@ -2254,13 +2254,13 @@ export class SchemaRegistry {
    * {@link refuseSecurityCatalogNameConflicts}, forgotten by
    * {@link uninstallPackage}.
    *
-   * The registry's item store answers "who holds this name?" for every item it
-   * registered — but it does not register every catalog item a package
-   * declares: the engine's collection loop has no `positions` entry, so a
-   * package's positions reach only the metadata service's in-memory registrars
-   * (`AppPlugin`'s security block, the artifact door). The claim is how the
-   * package door remembers them, so a second package declaring one of them is
-   * refused like any other second holder.
+   * The registry's item store answers who holds a name only for items
+   * something registered into it, and `installPackage` registers none: a
+   * package's collections reach the item store through `ObjectQL.registerApp`'s
+   * collection loop (positions only where that loop carries them), never
+   * through a bare `installPackage`. The claim is how the package door
+   * remembers every name a package declared, so a second package declaring one
+   * of them is refused like any other second holder.
    */
   private securityCatalogClaims = new Map<SecurityCatalogType, Map<string, string>>();
 
@@ -4653,8 +4653,8 @@ export class SchemaRegistry {
       this.debug(`[Registry] Overwriting package: ${manifest.id}`);
     }
     collection.set(manifest.id, pkg);
-    // The names this package now holds — positions included, which the
-    // engine's collection loop never registers (see `securityCatalogClaims`).
+    // The names this package now holds, recorded whether or not an item store
+    // entry will carry them (see `securityCatalogClaims`).
     if (selfId !== undefined) this.recordSecurityCatalogClaims(selfId, manifest);
     this.log(`[Registry] Installed package: ${manifest.id} (${manifest.name})`);
     return pkg;

packages/objectql/src/security-catalog-namespace.ts

@@ -135,9 +135,11 @@ function itemName(item: unknown): string | undefined {
  * nested `plugins[]` entry's (a nested plugin contributes under its parent
  * package — `ObjectQL.registerPlugin`), one level deep, arrays only.
  *
- * `positions` is read although the engine's collection loop does not register
- * it: the in-memory registrars (`AppPlugin`'s security block, the artifact
- * door) do, for the very same package, so the package's claim covers it.
+ * `positions` is read like the other two collections. The engine's collection
+ * loop registers a package's positions under the package
+ * (`ObjectQL.registerApp`), and the in-memory registrars (`AppPlugin`'s
+ * security block, the artifact door) register them for the very same package;
+ * the package's claim covers them either way.
  *
  * ⚠️ A non-array `permissions` is skipped, not misread: at the manifest stage
  * that key is the ADR-0025 capability GRANT (`{ services, hooks, … }`), not a

packages/runtime/src/standalone-stack-security-catalog-one-holder.test.ts

@@ -7,10 +7,10 @@
 //
 // ## Why the refusal is asserted at the boot, not inside the in-memory registrars
 //
-// Positions reach no engine registry slot: `AppPlugin`'s security block
+// Positions also reach the metadata service: `AppPlugin`'s security block
 // (`registerInMemory`, the `'app-plugin'` registrar) and the artifact door
 // (`MetadataPlugin._registerArtifactBodyCollections`, the `'artifact-door'`
-// registrar) write them to the metadata service, in `start()`. But neither runs
+// registrar) write them there, in `start()`. But neither runs
 // for a package the engine has not installed first: `AppPlugin.init()` registers
 // every package of the bundle through the `manifest` service in Phase 1 — a
 // multi-package artifact package by package — and the engine's package door