diff --git a/CHANGELOG.md b/CHANGELOG.md
index 988f834..8c1aa03 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -326,6 +326,10 @@ version 2: its `{{ … }}` sequences become substitution points, and its
 
 ### 2
 
+- §3.2 — a message of §§5–8 whose payload omits a required identity
+  field is malformed: a consumer **MUST NOT** index or act on it,
+  **MUST NOT** derive the value from context, topic or another field,
+  and **MUST** log the rejection at WARN naming the missing field.
 - §8.6 (new) — `ovos.skill.loaded`, the session-keyed load announcement
   with a registered `capabilities` vocabulary (`fallback`, `common_query`,
   `converse`); withdrawn by `ovos.skill.deregister`. §10.3 (new) —
diff --git a/intent-4.md b/intent-4.md
index 2540fd8..ddcecd9 100644
--- a/intent-4.md
+++ b/intent-4.md
@@ -195,6 +195,18 @@ Because the payload carries the identity that acts, a message of
 a skill has no `skill_id` of its own to declare; §3.1 binds
 skills, not every emitter.
 
+The payload is not complete without its identity. A message of
+§§5–8 whose payload omits a required identity field — `skill_id`,
+`intent_name` or `entity_name`, or `lang` where the table above
+requires it — is **malformed**. A consumer **MUST NOT** index or act
+on it, **MUST NOT** derive the missing value from `context`, from
+the topic, from the shape of another field, or from any other
+source, and **MUST** log the rejection at WARN with the §5.3 fields
+that are present, the rejecting topic, and the name of the missing
+field. A registration lacking a third of its identity describes no
+intent, and a consumer that repairs it silently leaves the producer
+with no signal that its message was wrong.
+
 Which sources may act on which targets is, deployment-wide, an
 unsolved trust problem — a hardening decision this specification
 cannot settle. Unguarded, `ovos.skill.deregister` (§8.4) is a remote