@@ -0,0 +1,22 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/spec': patch
+---
+
+harden(metadata): a permission set's name is unique across packages
+
+Clause-②: no (narrowing) — the metadata doors now refuse a permission-set write whose name a DIFFERENT owner already holds (`PUT /api/v1/meta/permission/:name`, draft or publish; `POST /api/v1/meta/permission/:name/publish` and `POST /api/v1/packages/:id/publish-drafts`; the restore doors `rollbackMetaItem` and `revertCommit`), with `NAMESPACE_CONFLICT` / 422 and nothing written. This pulls the metadata doors back to an already-declared contract: a grant resolves its set by name alone (ADR-0131 D4), a package never writes into a record another owns (ADR-0086 D4), and the security catalog holds one name per deployment on every path — the registry already refuses a second holder of a set name at install and at cold boot with this envelope, and the Studio dialog already refuses the duplicate. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No authorable key, accepted value, metadata type, export or type changes: a write the metadata doors accepted against an already-declared contract (ADR-0086 D4, ADR-0131 D4) is now refused with the registry's own NAMESPACE_CONFLICT envelope, so there is nothing for a migration to rewrite and no tombstone; a deployment already holding one name under two owners clears it by renaming or deleting one of the two sets, which the refusal names. -->
+
+**BREAKING** accept-set narrowing at the metadata doors (`@objectstack/metadata-protocol`), served by the permission-set save door, the draft→active promotion and the restore doors.
+
+- **Before.** The metadata doors keyed a permission-set write by `(type, name, package)`, so a package could save, publish or restore a set under a name another installed package, or the environment, already held. Resolution by bare name then answered one of the two, and the create precondition (`If-None-Match: *`) was evaluated against the keyed row alone, so it did not notice the name was taken by another owner.
+- **Now.** A permission-set write whose name a different owner holds is refused — `NAMESPACE_CONFLICT` / 422, the code and status the registry answers for the same rule at install and at cold boot, nothing written — at the save door (draft and publish mode), again at the draft→active promotion (the per-item publish and the package publish), and at the restore doors, so neither a draft authored before another owner took the name nor a version of a deleted set can become a second holder. The check runs before the create precondition, so `If-None-Match: *` cannot smuggle a cross-owner create.
+- **Owner.** The owner is the binding the write lands in: the package its row is written under, or the environment for a package-unbound row. A draft save that names no package over a package's set is that package's own edit (the draft inherits the package), and a package-less row stored beside exactly one package's row is that package's, not a second owner. `permission` takes no environment overlay (ADR-0005), so the rule is symmetric on the owner; the owning package, or the environment, re-authoring its own set is unchanged, and the original holder's access is untouched.
+- **Holders.** The stored active rows, by binding, and the registry's own reading of which packages hold a name — a set a package ships in code or declares in its install — the same reading the cold boot and `os migrate security-catalog-overlays` read.
+- **Who sees it.** A deployment where two owners write one set name: the second write is refused where it used to be accepted. Three faces of the same doors see it too. `POST /api/v1/packages/:id/duplicate` copies each permission set through the save door under the target package, renaming only a name that carries the source package's namespace prefix, so a copied set whose name lacks that prefix is now reported in the response's `failed[]` with this refusal instead of being copied as a second holder — prefix the set with your own module prefix before duplicating. `os migrate meta --stored --apply` re-saves each stored row the conversion chain rewrites through the save door, so on a deployment already holding one name under two owners such a row of either owner is reported failed until one of the two sets is renamed or deleted (a package-less row stored beside exactly one package's row is that package's, and is re-saved).
+- **`@objectstack/spec`.** `ERROR_CODE_LEDGER` lists `NAMESPACE_CONFLICT` under `@objectstack/metadata-protocol` too, since that package now stamps it; the `ErrorCode` union is unchanged.
+
+**The remedy.** Rename the set to a name no other holder holds (prefix it with your own module prefix), or rename or delete the other holder's set first; to change the existing set, edit it in the package that holds it and re-publish.
@@ -77,6 +77,7 @@ export interface AuthoringGateHost {
     hierarchyResolverMounted: ObjectStackProtocolImplementation['hierarchyResolverMounted'];
     isArtifactBacked: ObjectStackProtocolImplementation['isArtifactBacked'];
     orgWallEnforced: ObjectStackProtocolImplementation['orgWallEnforced'];
+    permissionSetNameCollisionRefusal: ObjectStackProtocolImplementation['permissionSetNameCollisionRefusal'];
     refuseRestoredBodyTheSaveDoorRefuses: ObjectStackProtocolImplementation['refuseRestoredBodyTheSaveDoorRefuses'];
     resolveSduiManifest: ObjectStackProtocolImplementation['resolveSduiManifest'];
     resolveWritePackageScope: ObjectStackProtocolImplementation['resolveWritePackageScope'];
@@ -112,13 +113,15 @@ export function restoredBodyWriter(
 
 /** The body of `ObjectStackProtocolImplementation#refuseRestoredBodyTheSaveDoorRefuses`; the method's docblock there is its contract. */
 export async function refuseRestoredBodyTheSaveDoorRefuses(
-    this: Pick<AuthoringGateHost, 'anonymousElevatedFlowRefusal' | 'assertRuntimeAuthoringRules' | 'authoringChannel' | 'credentialChannelFor' | 'defaultRecordPageSaveRefusal' | 'externalBindingSaveRefusal' | 'runAuthoringGate' | 'unknownDatasourceSaveRefusal'>,
+    this: Pick<AuthoringGateHost, 'anonymousElevatedFlowRefusal' | 'assertRuntimeAuthoringRules' | 'authoringChannel' | 'credentialChannelFor' | 'defaultRecordPageSaveRefusal' | 'externalBindingSaveRefusal' | 'permissionSetNameCollisionRefusal' | 'runAuthoringGate' | 'unknownDatasourceSaveRefusal'>,
     type: string,
     name: string,
     body: unknown,
     binding: string | null,
     source: string,
 ): Promise<void> {
+    const nameCollision = await this.permissionSetNameCollisionRefusal(type, name, binding, 'restore');
+    if (nameCollision) throw nameCollision;
     const hookRefusal = runtimeHookWithoutBodyRefusal(type, body, name);
     if (hookRefusal) throw hookRefusal;
     const defaultPageRefusal = await this.defaultRecordPageSaveRefusal(type, body, name, 'restored');
 
@@ -269,6 +269,161 @@ export async function defaultRecordPageSaveRefusal(
     return err;
 }
 
+/**
+ * The packages the engine registry says hold the permission-set name `name` —
+ * the registry's OWN reading of who holds a security-catalog name: the package
+ * half of the reading its cold-boot check refuses with, a name held through an
+ * item a package registered under its id (its composite slot) or through the
+ * package's install claim, never through the bare slot, built-in names skipped.
+ * One reading of "who holds a name", never a second one beside the cold boot's
+ * (maintainer ruling letter B on #22371, record 6074838935).
+ *
+ * `@objectstack/objectql` exports that reading as
+ * `findPackageHeldSecurityCatalogNames(registry)`, which answers
+ * `registry.packageHeldSecurityCatalogNames()`. This package cannot import
+ * `@objectstack/objectql` — it would form a cycle (`host-engine.ts`) — so it
+ * asks the same member of the host's registry, the way it asks the registry's
+ * `defaultRecordPageHoldersOf` for the default-record-page rule. The objectql
+ * suite `protocol-permission-set-name-registry-reading.test.ts` holds the seam
+ * from the side that sees both: it drives the doors over a real
+ * `SchemaRegistry`, so a rename of the member reds there. A host registry with
+ * no such member answers no package-held name, as one without `getItem` did.
+ *
+ * Not caught: the reading is in memory, and a throw from it is a fault to
+ * surface, never "nobody holds the name".
+ */
+function registryPackageHoldersOf(registry: unknown, name: string): readonly string[] {
+    const read = (registry as { packageHeldSecurityCatalogNames?: unknown } | null | undefined)
+        ?.packageHeldSecurityCatalogNames;
+    if (typeof read !== 'function') return [];
+    const held: unknown = read.call(registry);
+    if (!Array.isArray(held)) return [];
+    const holders = new Set<string>();
+    for (const entry of held as Array<{ catalogType?: unknown; name?: unknown; packageIds?: unknown } | null>) {
+        if (entry?.catalogType !== 'permission' || entry.name !== name || !Array.isArray(entry.packageIds)) continue;
+        for (const id of entry.packageIds) if (typeof id === 'string' && id !== '') holders.add(id);
+    }
+    return [...holders];
+}
+
+/**
+ * The body of `ObjectStackProtocolImplementation#permissionSetNameCollisionRefusal`;
+ * the method's docblock there is its contract.
+ *
+ * A `permission` set's name is its identity across the whole deployment: a
+ * grant (`sys_user_permission_set.permission_set`) resolves its set by that
+ * name alone (ADR-0131 D4), so positions, permission sets and capabilities each
+ * hold one name per deployment (maintainer ruling Q4 = A on #15196, record
+ * 6050490870). A write that would make a set of a name ACTIVE under an owner
+ * other than the one already holding the name is refused here, with nothing
+ * written — a package never writes into a record another owns (ADR-0086 D4).
+ *
+ * ## The owner
+ *
+ * `owner` is the binding the write LANDS IN: the package its row is written
+ * under, or `null` for the package-unbound (environment) row. Each door hands
+ * the binding its own write resolves, never the request's spelling.
+ * `permission` takes no environment overlay (`allowEnvironmentOverlay: false`,
+ * ADR-0005), so a name a package holds is never an environment author's to
+ * re-use either, and the predicate is symmetric on the owner: a write by the
+ * owner already holding the name — the owning package, or the environment,
+ * re-authoring its own set — is untouched.
+ *
+ * ## The holders: two readings, met
+ *
+ *  - **The stored active rows** of the environment (ADR-0131 D6), by
+ *    `package_id`. A set published through the metadata door is stored, and
+ *    the registry holds it in the bare slot with no package (hydration and the
+ *    write-through register a stored row without one), so only the row says
+ *    which package it belongs to — the half the registry's reading cannot see,
+ *    and why this door's reading is wider than the cold boot's.
+ *  - **The registry's package half** ({@link registryPackageHoldersOf}): a set
+ *    a package ships in code, or names in its install claim, read through the
+ *    registry's own reading and never re-derived (ruling letter B on #22371).
+ *
+ * A package-less row stored beside the rows of exactly ONE package is that
+ * package's, not a second owner — #23165's rule for the write address ("a
+ * package-less row beside the package's row is not a second package", which
+ * `packagelessAddress` resolves), applied to ownership: the direct save that
+ * minted such a row was re-addressed into the package. It is read as that
+ * package's on both sides, so it makes no foreign holder of the package's own
+ * edit, and a write that lands in it is the package's write. Beside two or
+ * more packages' rows, or none, a package-less row is the environment's.
+ *
+ * An UNPROVISIONED store counts as "no stored sets"; any other read failure
+ * propagates — answering "no other owner" from a read that never happened
+ * would accept the very second set this exists to refuse.
+ *
+ * ## The envelope
+ *
+ * `NAMESPACE_CONFLICT` / 422, worded as the registry's own refusal of a second
+ * holder is (`SecurityCatalogNameConflictError`, `@objectstack/objectql`): the
+ * rulings fix this rule's envelope at that code and status on every path a
+ * second holder can arrive by (ruling A on #22307, record 6063176077: "one
+ * name, one holder, on every path"), and the metadata doors are such paths. A
+ * client reads one code for the rule whichever door it met. The prescription
+ * precedes the reason because a 4xx message crosses the REST boundary bounded
+ * at 500 characters with its tail truncated.
+ */
+export async function permissionSetNameCollisionRefusal(
+    this: Pick<SaveDoorRefusalHost, 'engine' | 'readActiveOverlayRows' | 'rethrowUnlessMetadataStoreUnprovisioned' | 'storedOverlayEntries'>,
+    singularType: string,
+    name: string,
+    owner: string | null | undefined,
+    verb: 'save' | 'publish' | 'restore',
+): Promise<(Error & { code: 'NAMESPACE_CONFLICT'; status: 422 }) | undefined> {
+    if (singularType !== 'permission') return undefined;
+
+    let records: any[] = [];
+    try {
+        // [ADR-0131 D6] A write lands environment-wide, so the sets it meets
+        // are the environment-wide rows.
+        records = await this.readActiveOverlayRows({ type: singularType });
+    } catch (error) {
+        this.rethrowUnlessMetadataStoreUnprovisioned(error, 'sys_metadata');
+    }
+    const storedPackages = new Set<string>();
+    let storedUnbound = false;
+    for (const entry of this.storedOverlayEntries({ type: singularType }, records)) {
+        if (entry.name !== name) continue;
+        if (typeof entry.packageId === 'string' && entry.packageId !== '') storedPackages.add(entry.packageId);
+        else storedUnbound = true;
+    }
+    // [#23165] A package-less row beside exactly one package's row is that package's.
+    const residueOf = storedUnbound && storedPackages.size === 1 ? [...storedPackages][0] : undefined;
+
+    const holders = new Set<string | null>(storedPackages);
+    for (const packageId of registryPackageHoldersOf(this.engine?.registry, name)) holders.add(packageId);
+    if (storedUnbound && residueOf === undefined) holders.add(null);
+
+    const written = typeof owner === 'string' && owner !== '' ? owner : residueOf ?? null;
+    const foreign = [...holders]
+        .filter((holder) => holder !== written)
+        // Packages by id, the environment last, so the sentence is the same on every driver.
+        .sort((a, b) => (a === b ? 0 : a === null ? 1 : b === null ? -1 : a < b ? -1 : 1));
+    if (foreign.length === 0) return undefined;
+
+    const holderPhrase = (holder: string | null) => (holder === null ? 'the environment catalog' : `package "${holder}"`);
+    const writer = written === null ? 'this environment' : `package "${written}"`;
+    const releases = foreign
+        .map((holder) => (holder === null ? 'rename or delete the environment catalog\'s set' : `rename it in package "${holder}"`))
+        .join(', or ');
+    const remedy = verb === 'restore'
+        ? `Restore it once the name is free (${releases} first), or save this version's body as a set of a name no other `
+          + 'holder holds.'
+        : `Rename this set to a name no other holder holds (prefix it with your own module prefix), or ${releases} first.`;
+    const err = new Error(
+        `Security catalog name conflict: ${writer} cannot ${verb} the permission set "${name}" — it is already held by `
+        + `${foreign.map(holderPhrase).join(' and ')}. Nothing was ${verb === 'publish' ? 'published' : 'written'}. ${remedy} `
+        + 'Positions, permission sets and capabilities each hold one name per deployment: an assignment names a '
+        + 'permission set by its bare name, with no package to tell two definitions apart, so with two holders which '
+        + 'definition grants would depend on registration order. See ADR-0048.',
+    ) as Error & { code: 'NAMESPACE_CONFLICT'; status: 422 };
+    err.code = 'NAMESPACE_CONFLICT';
+    err.status = 422;
+    return err;
+}
+
 /** The body of `ObjectStackProtocolImplementation#externalBindingSaveRefusal`; the method's docblock there is its contract. */
 export async function externalBindingSaveRefusal(
     this: Pick<SaveDoorRefusalHost, 'externalBindingDatasourceDefinition' | 'objectsBoundExternallyTo'>,