Reject a downloaded or cached Marketplace package whose decoded immutable UID differs from the application-admitted request before any tenant installation or cache invalidation. Keep signature, scope, Marketplace provenance and source-admission policy unchanged.
This closes a source-version identity gap found while preparing transparent legacy credits forwarding. It prevents validating one provider package and silently installing another; original provider/App identities remain authoritative.
Reviewed local candidate 0aa5d04e72a641d7e9cc8e08d3c31701fb23f816; identical tree a2420679f4. Independent Gateway and neighboring admission tests passed (89), Ruff/type checks passed. Dev first; promote into the existing migration PR after live regression.
zyssyz123