@@ -5,4 +5,4 @@
 The organization-scoped save check judges a view overlay against every package's environment-wide definition of its row
 
 - An organization-scoped `view` save or publish in the organization the anonymous form endpoints read is refused when it would leave open a form the environment-wide definition withdraws. Its row anchor is now resolved per package, the way the list read resolves each package's item: each package's own environment-wide row, else the package-less environment-wide row (which stands in for every package), else that package's artifact. Before, with no environment-wide row stored, it judged only the first package's artifact in registry order, and a stored row of any one package hid every package's artifact of the name.
-- The known limit stated with the public-form withdrawal ("it may over-close, never under-close") is narrowed. A withdrawal of a view name still closes that name in every package, so it may over-close. Both checks read every package's environment-wide definition of the name, except at the anonymous endpoints when two packages each have an environment-wide copy of the same view container saved: there the endpoints read one package's copy of each form those containers expand, and can miss the other package's withdrawal of that form until it is withdrawn in each package's copy. The organization-scoped save check still judges both copies.
+- The known limit stated with the public-form withdrawal ("it may over-close, never under-close") is narrowed. A withdrawal of a view name still closes that name in every package, so it may over-close. The organization-scoped save check judges every package's environment-wide definition of the name. The anonymous endpoints do too, with one exception: where a package's environment-wide copy of a view container is saved, the endpoints read that copy's expansion alone for each form it expands, and can miss another package's withdrawal of that form, whether saved or shipped, until the form is withdrawn in every saved environment-wide copy of that container as well. Reading each package's expansion separately is tracked in #21967.
@@ -68,7 +68,7 @@ A withdrawal is a kill switch across metadata layers. If the environment-wide de
 
 **Forms a package ships.** A package's form is part of the environment-wide definition, not a separate layer beneath it. A definition parsed by the stack schema (strict `defineStack`, the default) gets the schema's default `enabled: false`, so a shipped form that keeps its link without setting `enabled: true` counts as withdrawn and an organization's copy cannot open it. A definition loaded without that parse (`defineStack(..., { strict: false })` or a hand-built manifest) is judged as written: a switch it leaves out is absent, which is not a withdrawal, so set `enabled: false` explicitly to ship a form closed. The environment-wide definition is the administrator's switch: an environment-wide save may open a form that the package ships closed.
 
-**Known limit: packages and names.** A withdrawal of a view name closes that name in every package. When two packages each ship a view of the same name, one package's withdrawal also closes the other package's form of that name, so this may close more than was meant. Both checks read every package's environment-wide definition of the name, with one exception at the endpoints: when two packages each have an environment-wide copy of the same view container saved, the endpoints read only one package's copy of each form those containers expand, so they can miss the other package's withdrawal of that form. The organization-scoped save check still judges both copies. To close such a form at the endpoints, withdraw it in each package's environment-wide copy.
+**Known limit: packages and names.** A withdrawal of a view name closes that name in every package. When two packages each ship a view of the same name, one package's withdrawal also closes the other package's form of that name, so this may close more than was meant. The organization-scoped save check judges every package's environment-wide definition of the name. The endpoints do too, with one exception: where a package's environment-wide copy of a view container is saved, the endpoints read that copy's expansion alone for each form it expands, and can miss another package's withdrawal of that form, whether saved or shipped. To close such a form at the endpoints, withdraw it in every saved environment-wide copy of that container as well. Reading each package's expansion separately is tracked in #21967.
 
 **Known limit.** The save check runs only when an organization's copy is saved or published. A copy that was already stored before the environment-wide withdrawal, or that a rollback or revert restores, is judged only by the endpoints, which match by served item name. If that copy keeps the form open under a different key or place than the environment-wide definition, the endpoints can still serve it. To close it, withdraw the form in that organization's copy too; the next organization-scoped save of a copy that keeps it open is refused.
 
 
@@ -324,12 +324,14 @@ function anonymousFormExplicitWithdrawals(view: unknown): Array<{ slot: string;
  * limit that fails closed: it may over-close another package's form of the
  * same name). It judges only the bodies the layer holds, so a caller closes a
  * name in every package only when its layer holds every package's body of the
- * name: the organization-scoped write door anchors one body per package, and
- * the env-wide view list the anonymous doors read holds one item per package
- * of a name, except that it holds one package's expansion of each name that
- * stored view containers of several packages expand. A layer with no body of
- * the row, or whose body has no explicit withdrawal, withdraws nothing, so a
- * form published only in an organization stays open there.
+ * name. The organization-scoped write door anchors one body per package. The
+ * env-wide view list the anonymous doors read holds one item per package of a
+ * name, with one exception: where a package's env-wide copy of a view
+ * container is saved, the list holds that copy's expansion alone for each form
+ * it expands, so the doors can miss another package's withdrawal of that
+ * form, whether saved or shipped (per-package expansion is #21967). A layer
+ * with no body of the row, or whose body has no explicit withdrawal, withdraws
+ * nothing, so a form published only in an organization stays open there.
  */
 export function anonymousFormIntakeWithdrawnIn(
     layer: ReadonlyArray<unknown>,