@@ -8,4 +8,5 @@ Clause-②: no
 
 - **What was wrong.** The protocol's registry write-through skipped every type except `object` whenever the protocol had an `environmentId`. A kernel that hydrates its own store at boot (the standalone stack's `env_local`, or a hosted kernel with `hydrateMetadataFromDb`) put every stored body into its registry at boot and then never updated it. A save was accepted and served by `GET /api/v1/meta/:type/:name`, but the engine registry kept the boot-time body until a restart, and held nothing for an item created after boot. The security catalog reads that registry first, so a permission set narrowed through `PUT /api/v1/meta/permission/:name` kept resolving its earlier, wider body, and a permission set published after boot was not in the catalog at all: a user granted it was refused, and an `isDefault` set recorded no `everyone` suggestion.
 - **What changed.** The write-through now asks whose registry it is, not whether the kernel has an environment. It registers the published body wherever the registry takes this kernel's stored rows: on an unscoped kernel, as before, and on an environment kernel once the boot has hydrated that kernel's own store into it (`loadMetaFromDb`). The delete's heal re-registers a MetadataService baseline on the same kernels, so a save followed by a reset does not leave the deleted body in the registry.
+- **The owner.** The registry entry of a stored row now carries the row's package binding as `_packageId` on the boot and on the write-through, as a list read already stamped it, so a runtime package's `isDefault` set published through the metadata door is owned in the security catalog at once and records its `everyone` suggestion, on a host kernel and on a hydrating environment kernel alike; a row bound to no package stays unowned, and an artifact's own envelope still wins.
 - **Unchanged.** An environment kernel whose store is never hydrated into its registry still writes nothing into it, so a registry shared with unscoped callers never receives a project-scoped row. The `object` branch and the organization-scope refusal are unchanged. What the registry holds after a save is what it holds after a restart.
@@ -2402,6 +2402,20 @@ function stateTenantAuthorship(data: unknown): unknown {
     return { ...(data as Record<string, unknown>), _provenance: 'org' };
 }
 
+/**
+ * [#23233] A stored row's body with its package binding stated as `_packageId`,
+ * the way `getMetaItems` stamps a row from its `package_id` column. The binding
+ * is read, never derived: a row bound to no package ({@link boundPackageOf}),
+ * or a body that already names a `_packageId`, is returned as it is. A copy,
+ * so the caller's body is never written.
+ */
+function withRowBinding(data: unknown, packageId: unknown): unknown {
+    const binding = boundPackageOf(packageId);
+    if (binding === undefined || !data || typeof data !== 'object' || Array.isArray(data)) return data;
+    if ((data as { _packageId?: unknown })._packageId !== undefined) return data;
+    return { ...(data as Record<string, unknown>), _packageId: binding };
+}
+
 /**
  * [#21639, #21638] Is this artifact a view ITEM — a view a package ships under
  * its own name, `viewKind` set (the spec's ViewItem) — rather than a container
@@ -19250,6 +19264,24 @@ export class ObjectStackProtocolImplementation implements
      * package-less view row, and a view row of a name only its own package
      * ships or no package ships, register as before too.
      *
+     * ## [#23233] The entry carries the row's package binding
+     *
+     * The registered body is stamped with the row's package binding as
+     * `_packageId` ({@link withRowBinding}), as `getMetaItems` stamps it from
+     * the row's `package_id` before it hydrates. This hydrator is the one the
+     * boot and the write-through share, so every registration of a stored row
+     * now names the package the row is bound to, not only the one a list read
+     * makes. Before this, the write-through and the boot registered a runtime
+     * package's body with no `_packageId`, and every registry reader that takes
+     * the owner from it (the security catalog, and through it the `everyone`
+     * suggestion of an `isDefault` set) saw the item as unowned: on a host
+     * kernel until the next list read, and on an environment kernel that
+     * hydrates its own store until never. ⛔ No owner is derived: the binding is
+     * only read, a body that already names a `_packageId` keeps it, a row with
+     * no binding stays unowned, and an artifact's envelope still wins over the
+     * stamp ({@link mergeArtifactProtection}). The expansions of a view
+     * container are registered from the unstamped row, as before.
+     *
      * ## [#9111] `type` is an ASSERTED input, not a silently-trusted one
      *
      * The spelling handed in is the spelling the registry entry is minted
@@ -19397,7 +19429,11 @@ export class ObjectStackProtocolImplementation implements
         // and its receipt rendered both as the package. Registered as the
         // tenant row it is, it is reported as one and never armed.
         const envelope = canonicalType === 'flow' ? undefined : artifact;
-        registry.registerItem(type, mergeArtifactProtection(type, stateTenantAuthorship(data), envelope), 'name' as any);
+        registry.registerItem(
+            type,
+            mergeArtifactProtection(type, stateTenantAuthorship(withRowBinding(data, options.packageId)), envelope),
+            'name' as any,
+        );
         await this.hydrateExpandedViewItems(type, data, options);
         return true;
     }
 
@@ -1,36 +1,37 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #23298 — on an environment kernel that hydrates its own `sys_metadata`, a
- * permission set published through the metadata door is in the security
- * catalog at once: the engine registry holds it, the catalog resolves it, and
- * an `isDefault` set declared by its package records its `everyone`
- * suggestion. No list read and no rebuild happen in between.
+ * #23298 and #23233 — a permission set published through the metadata door is
+ * in the security catalog at once, under the package it is bound to, on a host
+ * kernel and on an environment kernel that hydrates its own `sys_metadata`. The
+ * engine registry holds it, the catalog resolves it with its owner, and an
+ * `isDefault` set records its one `everyone` suggestion. No list read and no
+ * rebuild happen in between.
  *
  * ## Why this lives here
  *
  * The suggestion collector (`syncAudienceBindingSuggestions`) is this
- * package's. The write that feeds it is `metadata-protocol`'s registry
- * write-through (aliased to source in `vitest.config.ts`), so the suite runs
- * the protocol in this checkout. The engine is the real `ObjectQL` (aliased to
- * source too) with its real `SchemaRegistry`, over an in-memory driver.
+ * package's. The writes that feed it are `metadata-protocol`'s (aliased to
+ * source in `vitest.config.ts`), so the suite runs the protocol in this
+ * checkout. The engine is the real `ObjectQL` (aliased to source too) with its
+ * real `SchemaRegistry`, over an in-memory driver.
  *
- * ## The topology
+ * ## The two halves of the write
  *
- * An ENVIRONMENT kernel (`environmentId` set) booted as `ObjectQLPlugin.start()`
- * boots one with `hydrateMetadataFromDb`: the protocol's own store hydrated
- * into the engine's own registry (`loadMetaFromDb`). The catalog reads that
- * registry first, and the door's own registry write-through is what puts a
- * saved set there. Before #23298 that write-through skipped every type but
- * `object` on any kernel with an `environmentId`; with the plugin's
- * permission-set echo no longer registered, a set published after boot was
- * then in no reader at all.
- *
- * The set's body declares the spec's `packageId` (ADR-0086 D3), as the input
- * that was measured does. A set whose body names no package is served by the
- * catalog without an owner, because the registry entry carries no
- * `_packageId`: that is the open host-kernel remainder of the permission-set
- * owner card, which this suite neither pins nor changes.
+ *  - **#23298, the body.** The registry write-through skipped every type but
+ *    `object` on any kernel with an `environmentId`, so on an environment
+ *    kernel a set published after boot was in no reader at all (the plugin's
+ *    permission-set echo is no longer registered). It now registers wherever
+ *    the registry takes the kernel's stored rows: an unscoped kernel, or an
+ *    environment kernel that hydrated its own store (`loadMetaFromDb`, which
+ *    `ObjectQLPlugin.start()` calls under `hydrateMetadataFromDb`).
+ *  - **#23233, the owner.** The hydrator the boot and the write-through share
+ *    registered the body without the row's package binding, so the catalog
+ *    served a runtime package's set unowned (on a host kernel until a list
+ *    read stamped it), and the suggestion collector, which reads the owner
+ *    from the catalog entry alone, skipped it. The hydrator now stamps the
+ *    binding as `_packageId`. The bodies below name no `packageId` of their
+ *    own: the owner comes from the binding only.
  */
 
 import { randomUUID } from 'node:crypto';
@@ -137,12 +138,23 @@ function makeMetadataService() {
   return { get: (_type: string, _name: string) => undefined, list: (_type: string) => [] };
 }
 
+/** An installed code package that ships its own default set. */
+const CODE_PKG = 'com.example.crm';
+const CODE_SET = 'crm_readonly';
+
+type Kernel = 'host' | 'environment';
+
 /**
- * One environment kernel: the engine with the tables this flow writes, the
- * protocol's own store hydrated into the engine's own registry, the catalog
- * bound to the engine, and the built-in `everyone` position declared.
+ * One kernel: the engine with the tables this flow writes and a code package
+ * installed, the protocol (an `environmentId` for an environment kernel),
+ * booted as `ObjectQLPlugin.start()` boots it (`loadMetaFromDb`: a host
+ * kernel always, an environment kernel under `hydrateMetadataFromDb`), the
+ * catalog bound to the engine, and the built-in `everyone` position declared.
  */
-async function bootEnvironmentKernel(stores: Stores) {
+async function boot(kind: Kernel) {
+  const stores: Stores = new Map([
+    ['sys_organization', new Map([[DEFAULT_ORG, { id: DEFAULT_ORG, slug: 'default', name: 'Default' }]])],
+  ]);
   const engine = new ObjectQL();
   engine.registerDriver(makeMemoryDriver(stores), true);
   await engine.init();
@@ -152,32 +164,40 @@ async function bootEnvironmentKernel(stores: Stores) {
   ]) {
     engine.registry.registerObject(o as any, 'test-package');
   }
+  engine.registerApp({
+    id: CODE_PKG,
+    name: 'example_crm',
+    version: '1.0.0',
+    permissions: [{ name: CODE_SET, label: 'CRM read-only', isDefault: true, objects: {} }],
+  });
   const metadata = makeMetadataService();
   const protocol = new ObjectStackProtocolImplementation(
     engine as never,
     () => new Map<string, unknown>([['metadata', metadata]]),
-    ENV,
+    kind === 'environment' ? ENV : undefined,
   );
-  // `ObjectQLPlugin.start()` on a kernel with `hydrateMetadataFromDb`.
   expect(await protocol.loadMetaFromDb()).toMatchObject({ errors: 0, storeUnavailable: false });
   const catalog = createSecurityCatalogReader({ registry: engine.registry as never, metadata });
   bindSecurityCatalogReader(engine, catalog);
   declareEveryoneBaseline(engine.registry, SECURITY_PACKAGE, ['member_default']);
-  return { engine, protocol, catalog };
+  return { stores, engine, protocol, catalog };
 }
 
 const suggestionRows = (stores: Stores, set: string) =>
   Array.from(stores.get('sys_audience_binding_suggestion')?.values() ?? [])
     .filter((row) => row.permission_set_name === set);
 
-/** A new default set, its body declaring the package it is published into. */
-const newDefaultSet = (): Row => ({
-  name: SET,
-  label: 'Workspace member',
-  isDefault: true,
-  packageId: RUNTIME_PKG,
-  objects: {},
-});
+/** A runtime package's new default set. Its body names no `packageId`: the owner is the row's binding. */
+const newDefaultSet = (): Row => ({ name: SET, label: 'Workspace member', isDefault: true, objects: {} });
+
+/** The metadata-door publish of the set, bound to the runtime package. */
+async function publishIntoRuntimePackage(protocol: ObjectStackProtocolImplementation) {
+  const body = newDefaultSet();
+  expect(body, 'precondition: the body names no package').not.toHaveProperty('packageId');
+  expect(await protocol.saveMetaItem({
+    type: 'permission', name: SET, item: body, packageId: RUNTIME_PKG, mode: 'publish',
+  })).toMatchObject({ success: true });
+}
 
 const savedWritable = process.env.OS_METADATA_WRITABLE;
 beforeEach(() => {
@@ -193,22 +213,16 @@ afterEach(() => {
 });
 
 describe('#23298 — a NEW permission set published on an environment kernel is in the security catalog at once', () => {
-  it('the registry holds it, the catalog resolves it, and its isDefault records one pending everyone suggestion', async () => {
-    const stores: Stores = new Map([
-      ['sys_organization', new Map([[DEFAULT_ORG, { id: DEFAULT_ORG, slug: 'default', name: 'Default' }]])],
-    ]);
-    const { engine, protocol, catalog } = await bootEnvironmentKernel(stores);
+  it('the registry holds it, the catalog resolves it under its package, and its isDefault records one pending everyone suggestion', async () => {
+    const { stores, engine, protocol, catalog } = await boot('environment');
     expect(await catalog.resolve('permission', SET), 'precondition: a new set').toBeUndefined();
 
-    expect(await protocol.saveMetaItem({
-      type: 'permission', name: SET, item: newDefaultSet(), packageId: RUNTIME_PKG, mode: 'publish',
-    })).toMatchObject({ success: true });
+    await publishIntoRuntimePackage(protocol);
 
     // No list read, no rebuild: straight to the readers.
     expect(engine.registry.getItem('permission', SET)).toMatchObject({ name: SET, isDefault: true });
     expect(await catalog.resolve('permission', SET)).toMatchObject({
-      source: 'registry',
-      definition: { name: SET, isDefault: true, packageId: RUNTIME_PKG },
+      source: 'registry', packageId: RUNTIME_PKG, definition: { name: SET, isDefault: true },
     });
 
     await syncAudienceBindingSuggestions(engine);
@@ -219,3 +233,58 @@ describe('#23298 — a NEW permission set published on an environment kernel is
     ]);
   });
 });
+
+describe('#23233 — on a host kernel, the set is owned from the publish onward, with no list read in between', () => {
+  it('records exactly one pending everyone suggestion, under the package the set is bound to', async () => {
+    const { stores, engine, protocol } = await boot('host');
+    await publishIntoRuntimePackage(protocol);
+
+    await syncAudienceBindingSuggestions(engine);
+    expect(suggestionRows(stores, SET)).toEqual([
+      expect.objectContaining({
+        package_id: RUNTIME_PKG, anchor: 'everyone', status: 'pending', deployment_decision: false,
+      }),
+    ]);
+  });
+
+  it('the catalog read and the protocol read name the same owner', async () => {
+    const { protocol, catalog } = await boot('host');
+    await publishIntoRuntimePackage(protocol);
+
+    // The catalog first: the protocol's by-name read is not a list read, but
+    // it is read second so nothing it does can stand in for the publish.
+    const resolved = await catalog.resolve('permission', SET);
+    const served: any = await protocol.getMetaItem({ type: 'permission', name: SET });
+
+    expect(resolved).toMatchObject({ source: 'registry', packageId: RUNTIME_PKG });
+    expect(served?.item?._packageId).toBe(RUNTIME_PKG);
+  });
+});
+
+describe('#23233 — controls: the owner is the binding, never invented', () => {
+  it.each(['host', 'environment'] as const)(
+    'a code package\'s default set is unchanged (%s kernel): its artifact, its owner and its suggestion',
+    async (kind) => {
+      const { stores, engine, catalog } = await boot(kind);
+
+      expect(await catalog.resolve('permission', CODE_SET)).toMatchObject({ source: 'registry', packageId: CODE_PKG });
+      await syncAudienceBindingSuggestions(engine);
+      expect(suggestionRows(stores, CODE_SET)).toEqual([
+        expect.objectContaining({ package_id: CODE_PKG, anchor: 'everyone', status: 'pending' }),
+      ]);
+    },
+  );
+
+  it('a set saved into no package stays unowned and records no suggestion', async () => {
+    const { stores, engine, protocol, catalog } = await boot('host');
+    expect(await protocol.saveMetaItem({
+      type: 'permission', name: 'org_member_default', item: { ...newDefaultSet(), name: 'org_member_default' },
+    })).toMatchObject({ success: true });
+
+    const resolved = await catalog.resolve('permission', 'org_member_default');
+    expect(resolved).toMatchObject({ source: 'registry' });
+    expect(resolved).not.toHaveProperty('packageId');
+    await syncAudienceBindingSuggestions(engine);
+    expect(suggestionRows(stores, 'org_member_default')).toEqual([]);
+  });
+});