@@ -0,0 +1,17 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+'@objectstack/lint': patch
+'@objectstack/metadata-protocol': patch
+---
+
+fix(studio): object pickers offer only the objects the edited package may reference
+
+Clause-②: no
+Metadata-protocol: none
+
+A package may reference only the objects inside its closure: its own, those of the packages it declares as dependencies (transitively), and the platform's. The publish gate refused anything else, but Studio's object picker (a record trigger's object, a flow node's object, a lookup's related object, a new dataset's object) offered every object, so the author found out only after building on one.
+
+The picker now offers the closure. Objects outside it are listed last, disabled, in a group that starts collapsed, under the reason and a **Declare a dependency** entry that opens the package's edit dialog when the package is writable. A dependency declared there re-reads the closure, and the object becomes pickable without a reload. Where the package list cannot be read, nothing is disabled and the server judges the pick, as before. The value stays free text: a name typed and committed with Enter is still saved as typed and judged by the server.
+
+`@objectstack/lint` exports `resolvePackageClosure(packageId, getPackage)`, the dependency walk the publish gate ran inline. `@objectstack/metadata-protocol`'s gate now calls it; what the gate admits is unchanged. Studio calls the same function over `GET /api/v1/packages`, and `narrowObjectsToPackageClosure` over the object list, so the picker and the gate cannot disagree.
@@ -1112,13 +1112,14 @@ export type {
 
 // The runtime publish gate over that registry. Also published as the
 // `@objectstack/lint/runtime` subpath — the entry the kernel boot path imports.
-// That subpath narrows the EXPORT surface to these six names, not the module
+// That subpath narrows the EXPORT surface to these names, not the module
 // graph: measured, it reaches 70 of this entry's 72 modules and 93.8% of its
 // bundled bytes, and it does name the modules that reach the source parsers.
 // `runtime.ts`'s header carries the measurement and what the narrowing buys.
 export {
   buildRuntimeWriteSnapshots,
   narrowObjectsToPackageClosure,
+  resolvePackageClosure,
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
   runtimeGatedTypes,
 
@@ -0,0 +1,65 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #28240 — `resolvePackageClosure`, the one dependency walk behind both the
+ * server's publish gate (`resolveWritePackageScope`) and Studio's object
+ * pickers. Pinned here on its own, over a plain package map, so the walk's
+ * answer is fixed whichever host reads the registry.
+ */
+import { describe, expect, it } from 'vitest';
+import { resolvePackageClosure } from './runtime-gate.js';
+import * as runtimeEntry from './runtime.js';
+
+type Pkg = { manifest?: unknown };
+
+function registryOf(packages: Record<string, Record<string, string> | undefined>) {
+  return (id: string): Pkg | undefined =>
+    id in packages ? { manifest: { id, ...(packages[id] ? { dependencies: packages[id] } : {}) } } : undefined;
+}
+
+describe('resolvePackageClosure (#28240)', () => {
+  it('answers undefined, narrowing nothing, for no package id, the overlay sentinel and an unknown package', () => {
+    const get = registryOf({ 'com.acme.app': {} });
+    expect(resolvePackageClosure(undefined, get)).toBeUndefined();
+    expect(resolvePackageClosure(null, get)).toBeUndefined();
+    expect(resolvePackageClosure('', get)).toBeUndefined();
+    expect(resolvePackageClosure('sys_metadata', get)).toBeUndefined();
+    expect(resolvePackageClosure('com.acme.missing', get)).toBeUndefined();
+  });
+
+  it('a package with no declared dependencies is its own closure', () => {
+    expect(resolvePackageClosure('com.acme.app', registryOf({ 'com.acme.app': undefined }))).toEqual({
+      packageId: 'com.acme.app',
+      dependencies: [],
+    });
+  });
+
+  it('walks declared dependencies transitively, once each, through a cycle', () => {
+    const get = registryOf({
+      'com.acme.custom': { 'com.acme.crm': '^1.0.0' },
+      'com.acme.crm': { 'com.acme.core': '^1.0.0', 'com.acme.custom': '*' },
+      'com.acme.core': { 'com.acme.crm': '*' },
+      'com.acme.unrelated': {},
+    });
+    const scope = resolvePackageClosure('com.acme.custom', get);
+    expect(scope?.packageId).toBe('com.acme.custom');
+    expect([...(scope?.dependencies ?? [])].sort()).toEqual(['com.acme.core', 'com.acme.crm']);
+  });
+
+  it('keeps a declared dependency the registry cannot produce, and stops the walk there', () => {
+    const get = registryOf({ 'com.acme.app': { 'com.vendor.gone': '^2.0.0' } });
+    expect(resolvePackageClosure('com.acme.app', get)?.dependencies).toEqual(['com.vendor.gone']);
+  });
+
+  it('lets a throwing registry propagate: the host decides what an unreadable registry means', () => {
+    expect(() =>
+      resolvePackageClosure('com.acme.app', () => {
+        throw new Error('registry down');
+      }),
+    ).toThrow('registry down');
+  });
+
+  it('is named on the narrow runtime entry the server reaches lint through', () => {
+    expect(runtimeEntry.resolvePackageClosure).toBe(resolvePackageClosure);
+  });
+});
@@ -464,6 +464,50 @@ const PACKAGE_PROVENANCE_KEY = '_packageId';
  */
 const OVERLAY_PROVENANCE_SENTINEL = 'sys_metadata';
 
+/**
+ * The package closure a write by `packageId` is judged against (#9612): the
+ * package and the transitive closure of the `dependencies` its manifest
+ * declares, read through `getPackage` — the host's package registry on the
+ * server (`resolveWritePackageScope` in `@objectstack/metadata-protocol`), the
+ * served package list in Studio, whose object pickers offer what this closure
+ * admits. ONE walk for both, so the picker and the publish gate cannot
+ * disagree about what a package may reference.
+ *
+ * Answers `undefined` — narrow nothing — for no package id, the
+ * `sys_metadata` sentinel (an overlay row, not a package), and a package
+ * `getPackage` cannot produce: its manifest is the only declaration of what it
+ * may reference, and narrowing without it would be narrowing on nothing.
+ *
+ * A declared dependency `getPackage` cannot produce is still IN the closure:
+ * the package declared it, so an object stamped with it is reachable by
+ * declaration. Only the transitive walk stops there.
+ *
+ * Pure. A `getPackage` that throws propagates; the caller decides what an
+ * unreadable registry means (the server answers `undefined`).
+ */
+export function resolvePackageClosure(
+  packageId: string | null | undefined,
+  getPackage: (id: string) => { manifest?: unknown } | undefined,
+): { packageId: string; dependencies: string[] } | undefined {
+  if (typeof packageId !== 'string' || packageId === '' || packageId === OVERLAY_PROVENANCE_SENTINEL) return undefined;
+  if (!getPackage(packageId)) return undefined;
+
+  const dependencies = new Set<string>();
+  const frontier = [packageId];
+  while (frontier.length > 0) {
+    const current = frontier.pop() as string;
+    const manifest = getPackage(current)?.manifest as { dependencies?: Record<string, unknown> } | undefined;
+    const declared = manifest?.dependencies;
+    if (!declared || typeof declared !== 'object') continue;
+    for (const dep of Object.keys(declared)) {
+      if (dep === packageId || dependencies.has(dep)) continue;
+      dependencies.add(dep);
+      frontier.push(dep);
+    }
+  }
+  return { packageId, dependencies: [...dependencies] };
+}
+
 /**
  * The context collections the snapshot carries, in stack-key order — DERIVED
  * from {@link RuntimeStackContext}, not listed (#13977).
 
@@ -35,7 +35,7 @@
  *
  * ## Why it exists anyway
  *
- * So the kernel boot path can name only the five gate functions below, and so a
+ * So the kernel boot path can name only the gate functions below, and so a
  * test can prove it named nothing else. `@objectstack/metadata-protocol`'s
  * runtime gate must reach this package through this entry rather than the root
  * barrel, and `authoring-rule-wiring.test.ts` fails if it ever does otherwise.
@@ -64,6 +64,7 @@
 export {
   buildRuntimeWriteSnapshots,
   narrowObjectsToPackageClosure,
+  resolvePackageClosure,
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
   runtimeGatedTypes,
 
@@ -8,9 +8,10 @@
  * wherever that cannot be read. Moved out of `protocol.ts` whole.
  *
  * A MOVE, not a redesign. The function below is the body of the
- * `ObjectStackProtocolImplementation` method of the same name as it stood,
- * re-indented one level and otherwise unedited: the same guards, the same
- * dependency walk, and the same silent `catch` answering `undefined`.
+ * `ObjectStackProtocolImplementation` method of the same name: the same
+ * guards, the same dependency walk (since #28240 the shared
+ * `resolvePackageClosure`, unchanged), and the same silent `catch` answering
+ * `undefined`.
  *
  * ## How the moved body reaches the class
  *
@@ -24,11 +25,12 @@
  * calling the class method: `tenantAuthoredWriteRefusal`, and the authoring
  * gate's host (cut 8, `protocol-authoring-gate.ts`), whose closure calls it.
  *
- * The body reads no module-level declaration of `protocol.ts` and no import,
- * so this module imports only the class type. Nothing re-exports this module,
- * so the published surface does not move.
+ * The body reads no module-level declaration of `protocol.ts`; it imports the
+ * class type and the shared walk (`resolvePackageClosure`, below). Nothing
+ * re-exports this module, so the published surface does not move.
  */
 
+import { resolvePackageClosure } from '@objectstack/lint/runtime';
 import type { ObjectStackProtocolImplementation } from './protocol.js';
 
 /**
@@ -42,43 +44,26 @@ export interface WritePackageScopeHost {
     readonly engine: ObjectStackProtocolImplementation['engine'];
 }
 
-/** The body of `ObjectStackProtocolImplementation#resolveWritePackageScope`; the method's docblock there is its contract. */
+/**
+ * The body of `ObjectStackProtocolImplementation#resolveWritePackageScope`; the method's docblock there is its contract.
+ *
+ * [#28240] The dependency walk itself is `resolvePackageClosure` in
+ * `@objectstack/lint`, the same function Studio's object pickers call over
+ * the served package list, so the picker offers exactly what this gate
+ * admits. This body keeps the two host guards: a registry with no
+ * `getPackage`, and the silent `catch` answering `undefined`.
+ */
 export function resolveWritePackageScope(
     this: Pick<WritePackageScopeHost, 'engine'>,
     packageId: string | null | undefined,
 ): { packageId: string; dependencies: string[] } | undefined {
-    if (typeof packageId !== 'string' || packageId === '' || packageId === 'sys_metadata') return undefined;
     try {
         const registry = this.engine.registry as
             | { getPackage?: (id: string) => { manifest?: unknown } | undefined }
             | undefined;
-        if (typeof registry?.getPackage !== 'function') return undefined;
-        // The written package itself must be readable: its manifest is the
-        // ONLY declaration of what it may reference, and narrowing without
-        // it would be narrowing on nothing.
-        if (!registry.getPackage(packageId)) return undefined;
-
-        const dependencies = new Set<string>();
-        const frontier = [packageId];
-        while (frontier.length > 0) {
-            const current = frontier.pop() as string;
-            const manifest = registry.getPackage(current)?.manifest as
-                | { dependencies?: Record<string, unknown> }
-                | undefined;
-            const declared = manifest?.dependencies;
-            if (!declared || typeof declared !== 'object') continue;
-            for (const dep of Object.keys(declared)) {
-                // A dependency the registry cannot resolve is still IN the
-                // closure: the package declared it, so an object stamped
-                // with it is reachable by declaration. Only the transitive
-                // walk stops there — `getPackage` returns undefined and the
-                // loop above simply contributes nothing further.
-                if (dep === packageId || dependencies.has(dep)) continue;
-                dependencies.add(dep);
-                frontier.push(dep);
-            }
-        }
-        return { packageId, dependencies: [...dependencies] };
+        const getPackage = registry?.getPackage;
+        if (typeof getPackage !== 'function') return undefined;
+        return resolvePackageClosure(packageId, (id) => getPackage.call(registry, id));
     } catch {
         // Context gathering must never fail a write (the same contract
         // `listCollection` above holds). An unreadable registry means an