test(metadata-protocol,objectql): the registerItem ledger records the stamped call, and the boot-order pin asserts the row's binding

The hydrator's registerItem now passes the body through withRowBinding, so
the call-site ledger records that call text with its disposition unchanged.
The boot-order no-op pin asserted _packageId absent because only an artifact
graft could set it; the row's own binding now does, and _lock absent and
_provenance org still prove no graft.

Claude-Session: https://claude.ai/code/session_01P88ehrZ6hM19hBzdpsQTTo
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.register-item-call-sites.test.ts

@@ -95,9 +95,11 @@ const SITES: ReadonlyArray<Site & {
             + 'and a row bound to another package is refused (D9.9, OBJECT_OVERLAY_PACKAGE_MISMATCH)',
     },
     {
-        member: 'hydrateOverlayIntoRegistry', args: 'type, mergeArtifactProtection(type, stateTenantAuthorship(data), envelope), \'name\' as any',
+        // [#23233] The body carries the row's package binding (`withRowBinding`); the disposition is unchanged.
+        member: 'hydrateOverlayIntoRegistry', args: 'type, mergeArtifactProtection(type, stateTenantAuthorship(withRowBinding(data, options.packageId)), envelope), \'name\' as any',
         disposition: 'yes, view only: skips a name another package ships',
-        path: 'the list\'s hydration and the write-through on an unscoped kernel; the boot\'s loadMetaFromDb on every kernel',
+        // [#23298] The write-through runs wherever the registry takes the kernel's stored rows.
+        path: 'the list\'s hydration on an unscoped kernel; the write-through on an unscoped kernel and on an environment kernel that hydrated its own store; the boot\'s loadMetaFromDb on every kernel',
         why: 'a stored row: a view row bound to a package is not registered where another package ships its name, and the '
             + 'reads answer it from its row; a package-less row, and every other type, register as before (#4624)',
         viewOnlyBy: 'const bound = canonicalType === \'view\' ? boundPackageOf(options.packageId) : undefined;',

packages/objectql/src/protocol-boot-hydration-scoped.test.ts

@@ -149,8 +149,13 @@ describe('loadMetaFromDb — ADR-0048 package-scoped protection graft at boot (#
         // it — `_provenance: 'org'`, the same one the `object` branch has
         // always stated — because every row this hydrator sees came out of a
         // `sys_metadata` write. That is a statement of authorship, not a graft
-        // from an artifact: `_lock` and `_packageId` stay absent, which is what
-        // this case is about.
+        // from an artifact: `_lock` stays absent, which is what this case is
+        // about.
+        //
+        // [#23233] `_packageId` is no longer absent: the hydrator states the
+        // row's OWN package binding (its `package_id` column), as a list read
+        // always did. That is read from the row, not grafted from an artifact —
+        // which is why `_provenance` below stays `'org'` and not `'package'`.
         const registry = new SchemaRegistry({ multiTenant: false });
         registry.logLevel = 'silent';
         const rows = [
@@ -169,7 +174,7 @@ describe('loadMetaFromDb — ADR-0048 package-scoped protection graft at boot (#
         const direct: any = registry.getItem('page', 'home');
         expect(direct.label).toBe('B Home (customized)');
         expect(direct._lock).toBeUndefined();
-        expect(direct._packageId).toBeUndefined();
+        expect(direct._packageId).toBe(PKG_B);
         // [#16702] NOT `undefined` — the hydrator states tenant authorship.
         expect(direct._provenance).toBe('org');
     });