@@ -3,13 +3,13 @@
 '@objectstack/metadata-protocol': minor
 ---
 
-fix(runtime): `PUT` and `DELETE /api/v1/automation/:name` refuse a packaged flow, as the metadata door does (#20679)
+fix(runtime): the `/automation` write doors refuse a packaged flow, as the metadata door does (#20679)
 
 Clause-②: yes (widening)
 
-A flow that a code package ships has a locked base (ADR-0126 §2): changing or removing it in place is refused. `PUT /api/v1/meta/flow/:name` already refused it. The two `/automation` definition doors did not: an administrator holding `manage_metadata` could rewrite a packaged flow in the live engine with `PUT /api/v1/automation/:name`, or remove it with `DELETE /api/v1/automation/:name`.
+A flow that a code package ships has a locked base (ADR-0126 §2): changing or removing it in place is refused. `PUT /api/v1/meta/flow/:name` already refused it. The two `/automation` definition doors did not: an administrator holding `manage_metadata` could rewrite a packaged flow in the live engine with `PUT /api/v1/automation/:name` or with `POST /api/v1/automation` under its name (a create onto an existing name overwrites it), or remove it with `DELETE /api/v1/automation/:name`.
 
-Both doors now answer `403` `NOT_OVERRIDABLE` for a packaged flow, with the same message the metadata door gives. The refusal comes before the engine is called, so nothing is registered or removed. On `DELETE`, it also comes before the engine's own `DELETE_RESTRICTED` / `409` for a packaged subflow that packaged callers still reach.
+All three now answer `403` `NOT_OVERRIDABLE` for a packaged flow, with the same message the metadata door gives. The refusal comes before the engine is called, so nothing is registered or removed. On `DELETE`, it also comes before the engine's own `DELETE_RESTRICTED` / `409` for a packaged subflow that packaged callers still reach.
 
 What is not refused:
 
 
@@ -4,7 +4,8 @@
  * [#20679, ADR-0126 §2] Write-door parity on a PACKAGED flow: `PUT` and
  * `DELETE /automation/:name` refuse the same packaged artifact the metadata
  * door refuses — the public checklist item
- * `access-security.packaged-flow-write-door-parity`, clauses 2 and 3.
+ * `access-security.packaged-flow-write-door-parity`, clauses 2 and 3 — and so
+ * does `POST /automation` onto its name, which would otherwise overwrite it.
  *
  * ## What this pins, at door level
  *
@@ -217,6 +218,26 @@ describe('a PACKAGED flow — the base is locked at both /automation definition
         });
     });
 
+    it('POST / onto a packaged flow\'s name — a create that would overwrite — is refused as a locked base; a new name is created', async () => {
+        const h = boot();
+        const before = h.held(PACKAGED);
+
+        const overwrite = await h.dispatcher.handleAutomation(
+            '', 'POST', definitionOf(PACKAGED, 'Overwritten via create'), AUTHOR(), undefined,
+        );
+        expect(statusOf(overwrite.response)).toBe(403);
+        expect(errorOf(overwrite.response).code).toBe('NOT_OVERRIDABLE');
+        expect(h.registerFlow).not.toHaveBeenCalled();
+        expect(h.held(PACKAGED)).toBe(before);
+
+        // Control: a name no code package ships is created exactly as before.
+        const created = await h.dispatcher.handleAutomation(
+            '', 'POST', definitionOf('brand_new_flow', 'New'), AUTHOR(), undefined,
+        );
+        expect(statusOf(created.response)).toBe(200);
+        expect(h.registerFlow).toHaveBeenCalledWith('brand_new_flow', expect.objectContaining({ label: 'New' }));
+    });
+
     it('keys on the NAME the artifact loader registered — provenance stamps in the request body decide nothing', async () => {
         // The verdict is asked with `{ type, name, operation }` only: whether a
         // code package ships the name is read from the registry's loader-made
 
@@ -1448,17 +1448,18 @@ function flowDefinitionRefusal(err: any): unknown {
 
 /**
  * [#20679, ADR-0126 §2] THE LOCKED BASE at this domain's definition-write and
- * removal doors — `PUT /:name` and `DELETE /:name`.
+ * removal doors — `PUT /:name`, `DELETE /:name`, and `POST /` onto a name the
+ * engine already holds (a create onto an existing name is an overwrite).
  *
  * ADR-0126 §2 puts a packaged flow in Regime C: "the packaged base is locked —
  * in-place edit refused loudly at the write door". The metadata door kept that
  * promise (`PUT /meta/flow/:name` on a flow a code package ships answers `403`
- * `NOT_OVERRIDABLE`) and these two doors did not: behind the `manage_metadata`
+ * `NOT_OVERRIDABLE`) and these doors did not: behind the `manage_metadata`
  * authoring gate they went straight to the engine's `registerFlow` /
  * `unregisterFlow`, which hold no lock and must not grow one — the boot pull
  * registers every packaged flow through that same method. So an administrator
  * refused at one door onto the artifact could rewrite, or remove, the same
- * packaged flow in the live engine through the other.
+ * packaged flow in the live engine through another.
  *
  * ## One predicate, asked of its owner
  *
@@ -1959,6 +1960,7 @@ export async function classifyResumeResult(
  *   GET    /:name                → getFlow
  *   POST   /                     → createFlow (registerFlow)
  *                                  ⚑ authoring write — `manage_metadata` (#10145)
+ *                                  ⚑ packaged base locked — as `PUT /:name`
  *   PUT    /:name                → updateFlow
  *                                  ⚑ authoring write — `manage_metadata` (#10145)
  *                                  ⚑ packaged base locked — the `/meta` door's
@@ -2240,6 +2242,13 @@ export async function handleAutomationRequest(deps: DomainHandlerDeps, path: str
             // `edge.condition` strings lowered to their envelopes) — the same
             // shape `GET /automation/:name` serves — never an echo of the
             // caller's own pre-parse bytes.
+            // [#20679, ADR-0126 §2] Creating onto a name the engine already
+            // holds is an overwrite (below), so a packaged flow's name is
+            // locked here exactly as on `PUT /:name` — the same verdict, asked
+            // before anything is read or registered. A name no code package
+            // ships is created as before.
+            const locked = await refusePackagedFlowBaseChange(deps, context, body.name, 'save');
+            if (locked) return locked;
             // [#20552] Creating onto a name the engine already holds is an
             // overwrite, so the round-trip rule applies here as on `PUT /:name`.
             const definition = await keepStoredFlowCredentials(automationService, body.name, body);