@@ -0,0 +1,14 @@
+---
+'@objectstack/objectql': patch
+'@objectstack/metadata-protocol': patch
+---
+
+feat(objectql, metadata-protocol): one package-scoped resolver for behavioural metadata, and one declared dependency closure for it and the save door (ADR-0150 D3/D4)
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/objectql`** exports `resolvePackageScopedName`, the resolution rule of ADR-0150 D3 for the metadata types addressed by `(package, name)` (`PACKAGE_SCOPED_TYPES`). A caller of package P is answered P's own item, else the unique holder in P's declared dependency closure plus the `sys` packages, else a refusal that names every candidate; a caller with no package is answered the environment's own item, else the unique package holder, else the refusal. Zero holders is `not-found`. The platform-requested name `guest_portal` resolves environment-wide whatever the caller. `SchemaRegistry` gains three read-only methods the resolver reads, `packageScopedHoldersOf`, `getPackageScopedItem` and `getEnvironmentScopedItem`, which apply the per-package overlay slot (ADR-0150 D4): a stored overlay binds to the package whose item it customizes, so it never shadows another package's same-named item there.
+- **`@objectstack/metadata-protocol`** exports `packageDependencyClosure`, a package's declared dependency closure (its manifest's `dependencies`, transitively, with an App's customization pair widened by the App's members). The save door's write scope now calls it, so the closure a write is judged against and the closure a name resolves in are one implementation.
+
+Nothing changes for a running deployment: no reader calls the resolver yet, `getItem` keeps serving the bare slot first to every caller, the one-holder refusal of ADR-0048 §3.4 stays in force, and the save door admits and refuses exactly what it did.
@@ -258,6 +258,11 @@ export type { PackagelessOverlayCensus, PackagelessOverlayMigration } from './pr
 // read by the automation boot pull, which judges a flow override on the
 // column (`isServedOverrideRowOf`), ⛔ never on the body's `_packageId`.
 export { bindStoredRow, storedRowBindingOf } from './stored-row-binding.js';
+
+// [#31575, ADR-0150 D3] A package's declared dependency closure: the ONE
+// function the save door's write scope (`resolveWritePackageScope`) and
+// objectql's package-scoped name resolver both ask, so the two never disagree.
+export { packageDependencyClosure } from './protocol-write-package-scope.js';
 export { shadowedStoredRowsOf } from './stored-flow-slot.js';
 
 // [ADR-0131 D6] The `unmanaged` install mode's walled-posture refusal — the
 
@@ -26,8 +26,16 @@
  * gate's host (cut 8, `protocol-authoring-gate.ts`), whose closure calls it.
  *
  * The body reads no module-level declaration of `protocol.ts`; it imports the
- * class type and the shared walk (`resolvePackageClosure`, below). Nothing
- * re-exports this module, so the published surface does not move.
+ * class type and the shared walk (`resolvePackageClosure`, below).
+ *
+ * ## One declared dependency closure for every reader (#31575, ADR-0150 D3)
+ *
+ * {@link packageDependencyClosure} is the one answer to "what may package P
+ * reach by declaration": the save door's write scope (the method above, which
+ * now only adds its silent `catch`) and objectql's package-scoped name
+ * resolver (`resolvePackageScopedName`) both ask it, so the closure a write is
+ * judged against and the closure a bare name resolves in can never disagree.
+ * It is the one export of this module the package root re-exports.
  */
 
 import { resolvePackageClosure } from '@objectstack/lint/runtime';
@@ -105,15 +113,45 @@ export function resolveWritePackageScope(
     packageId: string | null | undefined,
 ): { packageId: string; dependencies: string[] } | undefined {
     try {
-        const registry = this.engine.registry as MemberRegistry | undefined;
-        const getPackage = registry?.getPackage;
-        if (typeof getPackage !== 'function') return undefined;
-        const closure = resolvePackageClosure(packageId, (id) => getPackage.call(registry, id));
-        return closure === undefined ? undefined : widenPairClosureToAppMembers(closure, registry);
+        return packageDependencyClosure(packageId, this.engine.registry as MemberRegistry | undefined);
     } catch {
         // Context gathering must never fail a write (the same contract
         // `listCollection` above holds). An unreadable registry means an
         // unnarrowed gate, not a refused publish.
         return undefined;
     }
 }
+
+/**
+ * [#31575, ADR-0150 D3, ADR-0141] Package `packageId`'s DECLARED dependency
+ * closure, read from `registry`: the package itself and every package its
+ * manifest's `dependencies` name, transitively (`resolvePackageClosure`, the
+ * walk Studio's object pickers share), with an App's pair widened by the App's
+ * members ({@link widenPairClosureToAppMembers}). The one implementation: the
+ * save door's write scope ({@link resolveWritePackageScope}) is this call
+ * inside a silent `catch`, and objectql's package-scoped name resolver asks it
+ * for the closure a bare name resolves in.
+ *
+ * Answers `undefined` exactly where the walk does — no package id, the
+ * `sys_metadata` sentinel, a package `registry` cannot produce — and for a
+ * registry with no `getPackage` (a metadata-only test double). Each reader
+ * decides what `undefined` means for it: the save door narrows nothing, the
+ * resolver reaches nothing beyond the caller's own items and `sys`.
+ *
+ * Not a widening of anything: it adds no package the walk and the pair
+ * widening did not already add. ⛔ It does NOT add the `sys` kernel namespace
+ * ADR-0150 D3 puts in a resolution closure: the save door's scope stays as it
+ * was, so the resolver adds `sys` itself.
+ *
+ * A `getPackage` that throws propagates; the caller decides what an unreadable
+ * registry means.
+ */
+export function packageDependencyClosure(
+    packageId: string | null | undefined,
+    registry: MemberRegistry | undefined,
+): { packageId: string; dependencies: string[] } | undefined {
+    const getPackage = registry?.getPackage;
+    if (typeof getPackage !== 'function') return undefined;
+    const closure = resolvePackageClosure(packageId, (id) => getPackage.call(registry, id));
+    return closure === undefined ? undefined : widenPairClosureToAppMembers(closure, registry);
+}
@@ -440,6 +440,10 @@ const READERS: Record<string, Row> = {
   },
   'assignment-rules.ts#<module> :: owner_id': { disposition: 'not-a-read', why: VOCABULARY },
   'assignment-rules.ts#<module> :: queue': { disposition: 'not-a-read', why: VOCABULARY },
+  'package-scoped-resolver.ts#<module> :: queue': {
+    disposition: 'not-a-read',
+    why: 'the metadata TYPE `queue` (ADR-0150 D1 bucket 2) in the list of types addressed by package, not the column; it reads no row',
+  },
   'assignment-rules.ts#carriesQueueColumn :: resolveInjectedColumnProvenance()': {
     disposition: 'excludes',
     why: 'an object whose queue column is unprovisioned (federated) evaluates no assignment rule',
 
@@ -96,6 +96,35 @@ export {
 // stay private to the engine.
 export { findPackageHeldSecurityCatalogNames } from './registry.js';
 
+// [#31575, ADR-0150 D3/D4] The ONE package-scoped resolver for behavioural
+// metadata: the caller package's own item, else the unique holder in its
+// declared dependency closure (plus `sys`), else a refusal naming every
+// candidate. Exported for the readers epic #31527's later children switch to
+// it (runtime indexes, doors, stored references); no reader calls it yet. On
+// this barrel only: it reads `@objectstack/metadata-protocol`'s closure, which
+// the lean `./core` entry never imports (ADR-0076 D2).
+export {
+  resolvePackageScopedName,
+  packageResolutionClosure,
+  packageScopedRefusalMessage,
+  describePackageScopedHolder,
+  isPackageScopedType,
+  isPlatformRequestedBareName,
+  PACKAGE_SCOPED_TYPES,
+  PLATFORM_REQUESTED_BARE_NAMES_BY_TYPE,
+  KERNEL_NAMESPACE,
+} from './package-scoped-resolver.js';
+export type {
+  PackageScopedType,
+  PackageScopedHolder,
+  PackageScopedQuery,
+  PackageScopedRegistry,
+  PackageScopedResolution,
+  PackageScopedResolutionStep,
+  PackageScopedRefusal,
+  PackageScopedRefusalReason,
+} from './package-scoped-resolver.js';
+
 // [#15204 W2] Every `(type, name)` a manifest declares, read from the sources
 // the engine's registration seams read. Exported for the install-local door
 // (`@objectstack/cloud-connection`), which refuses a catalog-carrying package