@@ -26,6 +26,13 @@
  *  - a row stored before the member column existed (a second locale's body,
  *    no member) is backfilled at boot, so it is answered as its own member.
  *
+ * [#28576, ADR-0146 D11] A write naming no package onto the package's
+ * template is closed, so the administrator writes here go into the base's
+ * pair (`inPair`, below), where the member semantics are the same row for
+ * row; a package-less row is laid down as a release before the close stored
+ * it (`seedPackagelessRow`), served until the ceremony moves it, and its
+ * package-less write is refused.
+ *
  * ## The harness
  *
  * `environment-overlay-five-types.test.ts`'s: the real `ObjectQL` engine and
@@ -70,6 +77,8 @@ function mailManifest(): Record<string, unknown> {
         // package's protection envelope (`_packageId`, `_provenance`), which a
         // hydrated overlay of them is grafted with.
         version: '1.0.0',
+        // [#28576] A pair is formed from the base's namespace (ADR-0146 D3).
+        namespace: 'acmemail',
         emailTemplates: [
             template('en-US', 'PKG en'), template('zh-CN', 'PKG zh'),
             // [#22877 stage 2] A second template the package ships in `en-US`
@@ -182,7 +191,51 @@ async function boot(
         engine, () => new Map(), kernel === 'environment' ? 'env_prod' : undefined,
     );
     const load = await protocol.loadMetaFromDb();
-    return { engine, protocol, load };
+    await protocol.ensureCustomizationPackage({ basePackageId: PKG } as any);
+    return { engine, protocol: inPair(protocol), raw: protocol, load };
+}
+
+/**
+ * [#28576, ADR-0146 D11] A write naming no package onto the package's
+ * template is closed, so every administrator write in this file is the one
+ * that stays open: into the base's pair, `com.acme.mail.custom`, declaring
+ * what it overrides. This wrapper names the pair on each save, publish and
+ * delete that names no package, and adds the declaration to a saved body —
+ * the member semantics pinned below are the pair's, row for row, as they were
+ * the package-less row's. A write that names a package (the drafts into
+ * `PKG` below) is passed through untouched.
+ */
+const PAIR = 'com.acme.mail.custom';
+const DECLARATION = { package: PKG, basedOn: '1.0.0' };
+function inPair(protocol: ObjectStackProtocolImplementation): ObjectStackProtocolImplementation {
+    const named = (request: any) => request?.packageId !== undefined;
+    return new Proxy(protocol, {
+        get(target, key, receiver) {
+            const value = Reflect.get(target, key, receiver);
+            if (key === 'saveMetaItem') {
+                return (request: any) => (named(request) ? value.call(target, request) : value.call(target, {
+                    ...request, packageId: PAIR, item: { ...request.item, overrides: DECLARATION },
+                }));
+            }
+            if (key === 'deleteMetaItem' || key === 'publishMetaItem') {
+                return (request: any) => value.call(target, named(request) ? request : { ...request, packageId: PAIR });
+            }
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}
+
+/**
+ * [#28576] A package-less row of the package's template as a release before
+ * the close stored it, written straight to the overlay store (the write door
+ * refuses that write now): such a row is still served by every read until
+ * `os migrate packageless-overlays` moves it (ADR-0146 D11).
+ */
+async function seedPackagelessRow(raw: ObjectStackProtocolImplementation, name: string, body: Record<string, unknown>) {
+    const repo = (raw as any).getOverlayRepo();
+    await repo.put({ type: 'email_template', name, org: 'env' }, body, {
+        parentVersion: null, actor: null, source: 'older-release', intent: 'override-artifact', packageId: null,
+    });
 }
 
 const overlayRows = (stores: Map<string, Map<string, Record<string, unknown>>>) =>
@@ -308,10 +361,15 @@ describe('two locales of one email template survive a restart (#22877)', () => {
         expect(await bareNameSubject(second.protocol)).toBe('PKG en');
         expect(await servedSubjects(second.protocol)).toEqual({ 'en-US': 'PKG en', 'zh-CN': 'LEGACY zh' });
 
-        // That locale's next save updates the backfilled row — no second row.
-        await second.protocol.saveMetaItem({ type: 'email_template', name: NAME, item: template('zh-CN', 'ADMIN zh') });
+        // [#28576, ADR-0146 D11] That locale's next save naming no package is
+        // refused, naming the ceremony that moves the row; the backfilled row
+        // stays the one served — no second row.
+        const refused: any = await second.raw.saveMetaItem({ type: 'email_template', name: NAME, item: template('zh-CN', 'ADMIN zh') })
+            .then(() => undefined, (e: unknown) => e);
+        expect(refused).toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(String(refused?.message)).toContain('os migrate packageless-overlays');
         expect(overlayRows(stores).map((r) => r.id)).toEqual(['legacy_zh']);
-        expect(await servedSubjects(second.protocol)).toEqual({ 'en-US': 'PKG en', 'zh-CN': 'ADMIN zh' });
+        expect(await servedSubjects(second.protocol)).toEqual({ 'en-US': 'PKG en', 'zh-CN': 'LEGACY zh' });
     });
 });
 
@@ -704,9 +762,10 @@ async function bootWithOverlays(
     beforeHydration?: (engine: ObjectQL) => void,
 ) {
     const first = await boot(stores);
+    // [#28576] Package-less rows a release before the close stored: the
+    // hydration of an unmigrated row is what this section pins.
     for (const locale of ['en-US', 'zh-CN']) {
-        expect(await first.protocol.saveMetaItem({ type: T, name, item: { ...template(locale, `ADMIN ${name} ${locale}`), name } }))
-            .toMatchObject({ success: true });
+        await seedPackagelessRow(first.raw, name, { ...template(locale, `ADMIN ${name} ${locale}`), name });
     }
     return boot(stores, 'environment', beforeHydration);
 }
@@ -794,32 +853,39 @@ describe('[#23074] the artifact envelope is stamped only on the member the packa
      * (`restoreArtifactRegistryView`) calls is asked about the hydrated entry,
      * on a boot of its own.
      */
-    async function resetZh(name: string, verbs: { shadow: boolean; overlayEntry: boolean }, after: string | undefined) {
+    async function resetZh(name: string, verbs: { shadow: boolean; overlayEntry: boolean }) {
         const shadowBoot = (await bootWithOverlays(new Map(), name)).engine;
         expect(shadowBoot.registry.removeRuntimeShadow(T, name, 'zh-CN'), 'removeRuntimeShadow').toBe(verbs.shadow);
         const overlayEntryBoot = (await bootWithOverlays(new Map(), name)).engine;
         expect(overlayEntryBoot.registry.removeOverlayEntry(T, name, 'zh-CN'), 'removeOverlayEntry').toBe(verbs.overlayEntry);
 
+        // [#28576, ADR-0146 D11] The reset of that unmigrated row naming no
+        // package is refused, naming the ceremony that moves it, and the row
+        // keeps serving its member — before and after a restart. The registry
+        // verbs above are what the ceremony's move leaves to the next boot.
         const stores = new Map<string, Map<string, Record<string, unknown>>>();
-        const { engine, protocol } = await bootWithOverlays(stores, name);
-        expect(await protocol.deleteMetaItem({ type: T, name, member: 'zh-CN' })).toMatchObject({ success: true });
-        expect(engine.registry.getItem<any>(T, name, undefined, 'zh-CN')?.subject).toBe(after);
+        const { engine, protocol, raw } = await bootWithOverlays(stores, name);
+        const refused: any = await raw.deleteMetaItem({ type: T, name, member: 'zh-CN' }).then(() => undefined, (e: unknown) => e);
+        expect(refused).toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403 });
+        expect(String(refused?.message)).toContain('os migrate packageless-overlays');
+        const kept = `ADMIN ${name} zh-CN`;
+        expect(engine.registry.getItem<any>(T, name, undefined, 'zh-CN')?.subject).toBe(kept);
         expect(engine.registry.getItem<any>(T, name, undefined, 'en-US')?.subject).toBe(`ADMIN ${name} en-US`);
-        expect(((await protocol.getMetaItem({ type: T, name, member: 'zh-CN' })) as any)?.item?.subject).toBe(after);
+        expect(((await protocol.getMetaItem({ type: T, name, member: 'zh-CN' })) as any)?.item?.subject).toBe(kept);
         const restarted = await boot(stores);
-        expect(((await restarted.protocol.getMetaItem({ type: T, name, member: 'zh-CN' })) as any)?.item?.subject).toBe(after);
+        expect(((await restarted.protocol.getMetaItem({ type: T, name, member: 'zh-CN' })) as any)?.item?.subject).toBe(kept);
     }
 
-    it('the reset (?member=): an unshipped member is retired by the overlay-entry tier, and nothing is left serving it', async () => {
+    it('the reset (?member=): an unshipped member is retired by the overlay-entry tier; its package-less reset door is closed', async () => {
         // No `zh-CN` artifact takes its place, so the shadow heal declines and
         // the overlay-entry retirement takes the tenant row.
-        await resetZh(DIGEST, { shadow: false, overlayEntry: true }, undefined);
+        await resetZh(DIGEST, { shadow: false, overlayEntry: true });
     });
 
-    it('CONTROL the reset (?member=): a shipped member is un-shadowed onto its artifact', async () => {
+    it('CONTROL the reset (?member=): a shipped member is un-shadowed onto its artifact; its package-less reset door is closed', async () => {
         // The shadow heal lifts the entry onto the `zh-CN` artifact, and the
         // retirement refuses it as packaged code.
-        await resetZh(NAME, { shadow: true, overlayEntry: false }, 'PKG zh');
+        await resetZh(NAME, { shadow: true, overlayEntry: false });
     });
 
     it('a registry that answers another member\'s artifact: the graft keeps it off the body', async () => {
 
@@ -22,9 +22,11 @@
  *
  *  - the card's three reads answer base / dependent / base, and the layered
  *    read's `effective` and the list scoped to the base agree with them;
- *  - the write address does not move: a save naming no package still
- *    addresses the dependent package's row, as {@link packagelessAddress}
- *    resolves it — and since #28410 that write is refused (ADR-0146 D2);
+ *  - the write address does not move to the dependent package: a save naming
+ *    no package is refused before any address is resolved — since #28576 a
+ *    write naming no package onto a name the base ships is closed, naming the
+ *    base's pair (ADR-0146 D11; #28410 refused it as the dependent's
+ *    same-named item before that);
  *  - CONTROL: a writable package's OWN item, a name no code package ships,
  *    is still served to the read naming no package (#23291);
  *  - CONTROL: a package-unbound row (the ADR-0005 overlay Setup writes) still
@@ -275,19 +277,19 @@ describe('[#28238] a dependent package\'s row under a name the base ships is not
         expect(listed.items.filter((i: any) => i.name === VIEW).map((i: any) => columnsOf(i))).toEqual([BASE_COLUMNS]);
     });
 
-    it('the write address does not move: a save naming no package still addresses the dependent package\'s row, which the override gate refuses', async () => {
+    it('the write address does not move: a save naming no package is refused, naming the base\'s pair, and the dependent package\'s row is untouched', async () => {
         const { protocol, rowsOf } = await boot();
         await installDependent(protocol);
         await saveIntoDependentBeforeTheGate(protocol, DEPENDENT_COLUMNS);
         expect((await (protocol as any).packagelessAddress('view', VIEW)).packageId).toBe(DEPENDENT);
 
-        // [#28410, ADR-0146 D2, ruling A on #28390] The save naming no package
-        // resolves to the dependent package's row — the address does not move
-        // — and that write is a dependent's same-named item, which the
-        // override write gate refuses (rename): the refusal names the
-        // dependent package, and the stored row is untouched.
+        // [#28576, ADR-0146 D11] The save naming no package is a write onto a
+        // name the base ships, which is closed: the refusal names the base's
+        // pair and the ceremony, ahead of the override write gate that refused
+        // it as the dependent's same-named item (#28410). The stored row is
+        // untouched.
         await expect(protocol.saveMetaItem({ type: 'view', name: VIEW, item: listBody(['title']) } as any))
-            .rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403, message: expect.stringContaining(`'${DEPENDENT}'`) });
+            .rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403, message: expect.stringContaining(`'${BASE}.custom' (?package=${BASE}.custom)`) });
 
         const rows = rowsOf(VIEW).filter((r) => r.state === 'active');
         expect(rows.map((r) => r.package_id)).toEqual([DEPENDENT]);
 
@@ -49,7 +49,8 @@ const PACKAGE_ID = 'com.test.artifact-reload';
 
 /** One artifact, every display string carrying `v`. */
 const artifact = (v: string) => ({
-  manifest: { id: PACKAGE_ID, name: 'artifact_reload', type: 'app', version: '1.0.0' },
+  // [#28576] `namespace`: the base's `.custom` pair is formed from it (ADR-0146 D3).
+  manifest: { id: PACKAGE_ID, name: 'artifact_reload', type: 'app', version: '1.0.0', namespace: 'arl' },
   objects: [{
     name: 'arl_note',
     label: `Note ${v}`,
@@ -208,7 +209,10 @@ describe('an artifact hot reload refreshes every read of every item the boot reg
     expect(await read()).toEqual(boot);
   }, BOOT_TIMEOUT);
 
-  it('an environment save of the template still wins on every read after a reload re-registers the package', async () => {
+  // [#28576, ADR-0146 D11] The environment's customization of a packaged
+  // template is written into the base's pair, declaring what it overrides: the
+  // package-less save onto it is closed.
+  it('a customization of the template saved into its pair still wins on every read after a reload re-registers the package', async () => {
     const { protocol, reload } = await bootOverArtifact();
     const subjects = async () => {
       const pick = (res: any) => (res?.items ?? []).filter((i: any) => i?.name === 'arl_mail').map((i: any) => i.subject);
@@ -218,10 +222,15 @@ describe('an artifact hot reload refreshes every read of every item the boot reg
         byName: (await protocol.getMetaItem({ type: 'email_template', name: 'arl_mail' }))?.item?.subject,
       };
     };
+    await protocol.ensureCustomizationPackage({ basePackageId: PACKAGE_ID });
     await protocol.saveMetaItem({
       type: 'email_template',
       name: 'arl_mail',
-      item: { name: 'arl_mail', label: 'Mail', locale: 'en-US', subject: 'Saved subject', bodyHtml: '<p>saved</p>' },
+      packageId: `${PACKAGE_ID}.custom`,
+      item: {
+        name: 'arl_mail', label: 'Mail', locale: 'en-US', subject: 'Saved subject', bodyHtml: '<p>saved</p>',
+        overrides: { package: PACKAGE_ID, basedOn: '1.0.0' },
+      },
     });
     const saved = { list: ['Saved subject'], execution: ['Saved subject'], byName: 'Saved subject' };
     // Positive control: the save is live before any reload.