Protect _config from ownership hijack, deletion, and query leakage (#67)

[cuibonobo]

Summary

The _config singleton — the stack's identity, read at open and consulted by every permission check — was unprotected:

1. update('_config', { entityId: 'someone-else' }) passed schema validation cleanly and silently re-anchored stack ownership.
2. delete('_config'), soft or hard, left the stack unreadable/unopenable.
3. Query exclusion existed only as a hardcoded WHERE clause convention that a future adapter could easily forget.

Per the issue's layering principle — adapters are storage engines, Stack is the library's invariant layer, ScopedStack is per-requester policy — the fix for (1) and (2) belongs in Stack itself, inherited by every adapter and by ScopedStack (which delegates to Stack) without any adapter-specific code. Query exclusion is the deliberate exception: it has to stay a WHERE predicate to avoid post-filtering breaking pagination, and turns out to already be centralized in sqlite-shared for both real SQL adapters (landed as part of #46's refactor since this issue was filed).

Changes

• Stack.update('_config', ...) rejects a changed entityId with StackConflictError (409) — a stack-integrity conflict, not a schema violation, since the new value is a perfectly valid string. Other fields (timezone) update normally.
• Stack.delete('_config') is rejected unconditionally, soft or hard, with StackConflictError.
• Stack.restoreVersion('_config', ...) rejects restoring a snapshot whose entityId disagrees with the live record's — closes the same door via the restore path.
• MemoryAdapter (core's test double) now excludes _config from generic queries too, matching the real adapters' behavior and making the exclusion rule testable at the core level (previously it didn't model _config as a record at all).
• docs/spec.md: _config protections documented under Stack initialization, the query-exclusion rule stated as normative, and the 409 error-table row extended to mention it.

Since ScopedStack.update()/delete()/restoreVersion() all delegate to the corresponding Stack method, these guards apply identically whether called directly or through a ScopedStack view — including for the stack owner.

Cross-referenced prerequisites (#49 identity, #53 error codes, #46 shared SQL layer, #50 MemoryAdapter fidelity, #52 fixtures, #55 ID validation, #62 restore validation) were already closed before this landed; #49 (DID identity) remains open but isn't a blocker — this issue only guards the field that exists today.

Test plan

• packages/core typecheck clean
• packages/core lint clean
• Full packages/core test suite passing (430/430), including 11 new cases:
  • update() rejects an entityId change, allows a timezone change, and treats setting entityId to its current value as a no-op
  • soft delete and hard delete both rejected
  • restoreVersion() rejects a snapshot with a different entityId, allows one with the same
  • generic query excludes _config; get('_config') still works
  • ScopedStack-as-owner delegation: the owner can't bypass either guard through the scoped surface
• record-adapter-sqlite (88/88) and sqlite-shared (36/36) suites unaffected — confirmed no other package manipulates _config through Stack (only via direct SQL/adapter-level test setup, which this change doesn't touch)

---

Generated by Claude Code