@@ -239,6 +239,24 @@ export function shippingPackageIds(shipped: readonly unknown[]): ReadonlySet<str
     return shippers;
 }
 
+/**
+ * [ADR-0146 D11] The READ-ONLY code packages that ship a name, sorted: the
+ * {@link shippingPackageIds} of `shipped` less every package
+ * `isWritablePackage` answers for — a writable package's item is edited in
+ * place (ADR-0070) and has no pair (ADR-0146 D3), and the pair itself is
+ * writable. ONE reading for both halves of D11: the bases
+ * `os migrate packageless-overlays` classifies a package-less row against,
+ * and the bases whose package-less write the doors close
+ * (`packagelessOverlayWriteRefusal`), so the close never reaches a name the
+ * ceremony would call environment metadata, nor misses one it would move.
+ */
+export function readOnlyShippingPackages(
+    shipped: readonly unknown[],
+    isWritablePackage: (packageId: string) => boolean,
+): string[] {
+    return [...shippingPackageIds(shipped)].filter((id) => !isWritablePackage(id)).sort();
+}
+
 /**
  * [#28409, ADR-0146 D8 items 1–2] The one code package that ships a name, or
  * `undefined` when none or several do: the case in which
 
@@ -57,7 +57,7 @@ import { expandViewContainer, isAggregatedViewContainer } from '@objectstack/spe
  */
 export interface PackagedBaseRefusalHost {
     isSealedManagedItem: ObjectStackProtocolImplementation['isSealedManagedItem'];
-    isOverlayableManagedItem: ObjectStackProtocolImplementation['isOverlayableManagedItem'];
+    overlayBaseShippers: ObjectStackProtocolImplementation['overlayBaseShippers'];
     isWritablePackage: ObjectStackProtocolImplementation['isWritablePackage'];
     packagedBaseRefusal: ObjectStackProtocolImplementation['packagedBaseRefusal'];
     packagedArtifactOwner: ObjectStackProtocolImplementation['packagedArtifactOwner'];
@@ -220,13 +220,12 @@ export type PackagelessWriteOperation = 'save' | 'publish' | 'delete' | 'rollbac
  *
  * [ADR-0146 D11] The closure of the package-less write onto a packaged item:
  * a write naming no package (`packageId` absent, `null` or empty) onto an item
- * a code package ships, of a type whose registry entry opens an overlay
- * channel ({@link PackagedBaseRefusalHost.isOverlayableManagedItem}: the five
- * `allowEnvironmentOverlay` types), is refused `403 NOT_OVERRIDABLE` — the
- * code and status the sealed write already answers, so no door gains a code.
- * Every other type's packaged item is sealed already
- * ({@link refusePackagedBaseOverride}), so after this no package-less write
- * reaches a packaged item at all.
+ * of one of the five overlay types that a read-only code package ships
+ * ({@link PackagedBaseRefusalHost.overlayBaseShippers}, the reading
+ * `os migrate packageless-overlays` classifies by), is refused
+ * `403 NOT_OVERRIDABLE` — the code and status the sealed write already
+ * answers, so no door gains a code. Every other type's packaged item is
+ * sealed already ({@link refusePackagedBaseOverride}).
  *
  * The sentence names the fix the writer has: the base's paired `.custom`
  * (`?package=<base>.custom`), where the customization is a declared override,
@@ -235,32 +234,45 @@ export type PackagelessWriteOperation = 'save' | 'publish' | 'delete' | 'rollbac
  * moved yet is still served (the read path is not this function's); only its
  * package-less write is refused, by this same sentence.
  *
- * `null` when the write names a package, or the item is no packaged item of an
- * overlay type: a name no package ships is environment metadata and keeps its
- * package-less write (ADR-0146 D11, "is not touched").
+ * `null` when the write names a package; when no read-only code package ships
+ * the name (environment metadata keeps its package-less write, ADR-0146 D11
+ * "is not touched"); and when no base that ships it has a pair at all
+ * (`customizationPackageId` refuses every one of their ids): the ceremony
+ * lists such a row `no_pair` and cannot move it, and D11 closes only what it
+ * has migrated — closing it would leave that customization no write door.
  */
 export function packagelessOverlayWriteRefusal(
-    this: Pick<PackagedBaseRefusalHost, 'isOverlayableManagedItem' | 'packagedArtifactOwner'>,
+    this: Pick<PackagedBaseRefusalHost, 'overlayBaseShippers'>,
     request: { type: string; name: string; packageId?: string | null },
     operation: PackagelessWriteOperation,
 ): Error | null {
     if (typeof request.packageId === 'string' && request.packageId.length > 0) return null;
-    if (!this.isOverlayableManagedItem(request.type, request.name)) return null;
+    const shippers = this.overlayBaseShippers(request.type, request.name);
+    const pairs = shippers.flatMap((base) => {
+        const derived = customizationPackageId(base);
+        return derived.ok ? [{ base, pair: derived.value }] : [];
+    });
+    if (pairs.length === 0) return null;
     const type = PLURAL_TO_SINGULAR[request.type] ?? request.type;
     const item = `'${type}/${request.name}'`;
-    const owner = this.packagedArtifactOwner(request);
-    const pairId = typeof owner === 'string' ? customizationPackageId(owner) : undefined;
-    const pair = pairId?.ok ? `'${pairId.value}'` : "the base's paired .custom package";
-    const query = pairId?.ok ? ` (?package=${pairId.value})` : '';
-    const shipped = typeof owner === 'string' ? `ships in '${owner}'` : 'ships in an installed package';
-    const declared = typeof owner === 'string' ? `overrides: { package: '${owner}', basedOn }` : 'overrides: { package, basedOn }';
-    const ceremony = 'A package-less customization stored before this release is still served; run '
-        + `\`os migrate packageless-overlays\` first to move it into ${pair}.`;
+    const shipped = `ships in ${shippers.map((id) => `'${id}'`).join(' and ')}`;
+    const sole = pairs.length === 1 ? pairs[0]! : undefined;
+    // One base: its pair, by name. Several: the pair of the base the writer
+    // customizes, each named — never guessed (the ceremony lists such a row).
+    const into = sole
+        ? `'${sole.pair}' (?package=${sole.pair})`
+        : `the pair of the package it customizes (${pairs.map((p) => `'${p.pair}'`).join(' or ')}, as ?package=<that pair>)`;
+    const declared = sole ? `overrides: { package: '${sole.base}', basedOn }` : 'overrides: { package: <that base>, basedOn }';
+    const ceremony = sole
+        ? 'A package-less customization stored before this release is still served; run '
+            + `\`os migrate packageless-overlays\` first to move it into '${sole.pair}'.`
+        : 'A package-less customization stored before this release is still served; run '
+            + '`os migrate packageless-overlays` first: it lists a name several packages ship for you to place.';
     const fix = operation === 'delete'
-        ? `Remove it from ${pair}${query}. ${ceremony}`
+        ? `Remove it from ${into}. ${ceremony}`
         : operation === 'rollback'
-            ? `Its customization belongs in ${pair}: run \`os migrate packageless-overlays\` to move the row there, then roll it back.`
-            : `${operation === 'publish' ? 'Publish' : 'Save'} it into ${pair}${query}, declaring ${declared}. ${ceremony}`;
+            ? `Its customization belongs in ${into}: run \`os migrate packageless-overlays\` to move the row there, then roll it back.`
+            : `${operation === 'publish' ? 'Publish' : 'Save'} it into ${into}, declaring ${declared}. ${ceremony}`;
     const what = operation === 'rollback' ? 'a rollback of its package-less row' : 'a write naming no package';
     const err = new Error(
         `${item} ${shipped}, and ${what} onto a packaged item is closed: a customization of an installed package `
 
@@ -90,7 +90,7 @@ import { PLURAL_TO_SINGULAR, SINGULAR_TO_PLURAL } from '@objectstack/spec/shared
 import { storedRowDocument } from './item-lock.js';
 import { OVERLAY_MEMBER_COLUMN } from './migrations/overlay-index.js';
 import type { ObjectStackProtocolImplementation } from './protocol.js';
-import { shippingPackageIds } from './protocol-environment-rows.js';
+import { readOnlyShippingPackages } from './protocol-environment-rows.js';
 import { isServedOverrideRowOf } from './served-override.js';
 import { SysMetadataRepository } from './sys-metadata-repository.js';
 
@@ -298,9 +298,7 @@ export async function listPackagelessOverlays(
         // The read-only code packages that ship the name: a writable package's
         // item is edited in place (ADR-0070) and has no pair (ADR-0146 D3), and
         // the pair itself is writable — the write gate's own narrowing.
-        const shippers = [...shippingPackageIds(this.shippedArtifactsOf(type, name))]
-            .filter((id) => !this.isWritablePackage(id))
-            .sort();
+        const shippers = readOnlyShippingPackages(this.shippedArtifactsOf(type, name), (id) => this.isWritablePackage(id));
         if (shippers.length === 0) {
             environmentRows += 1;
             continue;
 
@@ -285,12 +285,16 @@ describe('[#22220] controls: the gates still judge what the door does not refuse
         }
     });
 
-    it('a packaged item of a type that allows overlays (view) with a body the spec parse refuses → 422 INVALID_METADATA (both kernels)', async () => {
+    it('[#28576, ADR-0146 D11] a packaged item of a type that allows overlays (view), saved naming no package, with a body the spec parse refuses → 403 NOT_OVERRIDABLE (both kernels)', async () => {
+        // Was a control (422 INVALID_METADATA): the overlay type's package-less
+        // write reached the gates. That write onto a packaged item is closed
+        // now, so the door answers first, whatever the body.
         for (const [kernel, environmentId] of KERNELS) {
             const result = await probe(environmentId, {
                 type: 'view', name: 'pkg_view', item: specRefused({ name: 'pkg_view', label: 'Pkg' }),
             });
-            expect(result.envelope, kernel).toEqual(INVALID_METADATA);
+            expect(result.envelope, kernel).toEqual(NOT_OVERRIDABLE);
+            expect(result.gateReached, kernel).toBe(false);
             expect(result.persistedRows, kernel).toBe(0);
         }
     });
 
@@ -669,10 +669,13 @@ describe('the override write gate — only the base\'s paired .custom declares a
         expect(stored()).toEqual([{ type: 'view', name: 'task.crm_list', package_id: UNRELATED, state: 'active' }]);
     });
 
-    it('control: a package-less overlay row is not this gate\'s question (the migration card closes it)', async () => {
+    it('[#28576, ADR-0146 D11] a package-less save is not this gate\'s question: the close refuses it first, naming the pair, and nothing is stored', async () => {
         const { protocol, stored } = gateProtocol();
-        await protocol.saveMetaItem({ type: 'view', name: 'task.crm_list', item: body('view', 'task.crm_list') });
-        expect(stored()).toEqual([{ type: 'view', name: 'task.crm_list', package_id: null, state: 'active' }]);
+        const e = await thrown(protocol.saveMetaItem({ type: 'view', name: 'task.crm_list', item: body('view', 'task.crm_list') }));
+        expect(shape(e)).toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(String((e as Error).message)).toContain(`'${PAIR}' (?package=${PAIR})`);
+        expect(String((e as Error).message)).toContain('os migrate packageless-overlays');
+        expect(stored()).toEqual([]);
     });
 
     // ── the admit ────────────────────────────────────────────────────────────
 
@@ -432,7 +432,7 @@ describe('an item a CODE package ships: the package-less write is closed (ADR-01
         const name = 'showcase_task_grid';
         const { protocol, rows } = makeProtocol([packagedView(name)]);
 
-        const refused = await protocol.saveMetaItem({ type: 'view', name, item: viewBody(name, 'Overlaid') }).then(() => undefined, (e) => e);
+        const refused = await protocol.saveMetaItem({ type: 'view', name, item: viewBody(name, 'Overlaid') }).then(() => undefined, (e: unknown) => e);
 
         closed(refused);
         expect(rows('view', name)).toEqual([]);
@@ -450,7 +450,7 @@ describe('an item a CODE package ships: the package-less write is closed (ADR-01
         // A save naming the package names a package: not the write D11 closes.
         await protocol.saveMetaItem({ type: 'view', name, item: viewBody(name, 'Named'), packageId: CODE_PACKAGE });
 
-        const refused = await protocol.saveMetaItem({ type: 'view', name, item: viewBody(name, 'Unnamed') }).then(() => undefined, (e) => e);
+        const refused = await protocol.saveMetaItem({ type: 'view', name, item: viewBody(name, 'Unnamed') }).then(() => undefined, (e: unknown) => e);
 
         closed(refused);
         expect(rows('view', name).map((r) => r.package_id ?? null)).toEqual([CODE_PACKAGE]);
 
@@ -469,7 +469,7 @@ import { refuseUnmintableMetaType } from './protocol-unmintable-meta-type.js';
 // [#25467 cut 33] The deployment's SDUI component manifest, and the load-time page `requires` report against it.
 import { reportPageRequiresAbsentAtLoad, resolveSduiManifest } from './protocol-sdui-manifest.js';
 // [#25467 cut 35] The environment's own `sys_metadata` rows: the family read, the one-row read, the served row and the package-less address.
-import { findEnvironmentRow, findEnvironmentRows, findServedOverlayRow, packagelessAddress, packagelessContentPackage, soleShippingPackage } from './protocol-environment-rows.js';
+import { findEnvironmentRow, findEnvironmentRows, findServedOverlayRow, packagelessAddress, packagelessContentPackage, readOnlyShippingPackages, soleShippingPackage } from './protocol-environment-rows.js';
 // [#25467 cut 35] The stored rows of a collection, folded over the registered ones.
 import { foldStoredCollection } from './protocol-stored-collection-fold.js';
 // [#25467 cut 35] The environment-wide package uninstall verb.
@@ -16217,17 +16217,21 @@ export class ObjectStackProtocolImplementation implements
     }
 
     /**
-     * [ADR-0146 D11] The other half of {@link isSealedManagedItem}: an item a
-     * managed package ships ({@link isArtifactBacked}) of a type whose registry
-     * entry opens an overlay channel ({@link registryAllowsOverlay}: the five
-     * `allowEnvironmentOverlay` types). The flag no longer opens a write onto
-     * such an item that names no package
-     * ({@link packagelessOverlayWriteRefusal}); it stays the predicate the
-     * migration reads and the read of a row not migrated yet honours.
+     * [ADR-0146 D11] The bases of an item of one of the five overlay types
+     * ({@link registryAllowsOverlay}: the `allowEnvironmentOverlay` types): the
+     * READ-ONLY code packages that ship the name ({@link shippedArtifactsOf}
+     * less {@link isWritablePackage}), sorted — `[]` for every other type, and
+     * for a name no read-only package ships. The reading
+     * `os migrate packageless-overlays` classifies a package-less row by
+     * (`readOnlyShippingPackages`), so the close
+     * ({@link packagelessOverlayWriteRefusal}) and the ceremony agree on what
+     * is a packaged item. The flag no longer opens a package-less write onto
+     * one; it stays the predicate the migration reads and the read of a row not
+     * migrated yet honours.
      */
-    private isOverlayableManagedItem(type: string, name: string): boolean {
-        return this.isArtifactBacked(type, name)
-            && ObjectStackProtocolImplementation.registryAllowsOverlay(type);
+    private overlayBaseShippers(type: string, name: string): string[] {
+        if (!ObjectStackProtocolImplementation.registryAllowsOverlay(type)) return [];
+        return readOnlyShippingPackages(this.shippedArtifactsOf(type, name), (id) => this.isWritablePackage(id));
     }
 
     /**
@@ -17077,11 +17081,13 @@ export class ObjectStackProtocolImplementation implements
     /**
      * [ADR-0146 D11] The package-less write onto a packaged item, closed: the
      * refusal of a save, a publish, a delete (either state) or a rollback that
-     * names no package, of an item a managed package ships, on a type whose
-     * registry entry opens an overlay channel ({@link isOverlayableManagedItem}).
+     * names no package, of an item of one of the five overlay types a
+     * read-only code package ships ({@link overlayBaseShippers}).
      * `null` when the write is not refused on that ground: it names a package
      * (`?package=<base>.custom` stays open, as does every other package's own
-     * door), or no package ships the name (environment metadata).
+     * door), no read-only package ships the name (environment metadata), or no
+     * base that ships it can form a pair (the ceremony's `no_pair`: it cannot
+     * move that row, so D11 does not close its write).
      *
      * Every other type's packaged item is sealed already
      * ({@link refusePackagedBaseOverride}, {@link refusePackagedBaseRemoval}),
@@ -17108,8 +17114,7 @@ export class ObjectStackProtocolImplementation implements
         operation: PackagelessWriteOperation,
     ): Error | null {
         const host: ThisParameterType<typeof packagelessOverlayWriteRefusal> = {
-            isOverlayableManagedItem: (...a) => this.isOverlayableManagedItem(...a),
-            packagedArtifactOwner: (...a) => this.packagedArtifactOwner(...a),
+            overlayBaseShippers: (...a) => this.overlayBaseShippers(...a),
         };
         return packagelessOverlayWriteRefusal.call(host, request, operation);
     }