test(metadata-protocol): the hydrated flow body's _packageId is the column since #28594

Main's #28671 (#28594) made storedOverlayEntries serve a stored row's
_packageId from its package_id column and drop the body's own stamp, so
the hydration pin that expected the body stamp on the registry body now
reads the pair. The assertion follows main's column-wins rule; the
storedRowBindingOf and not-serialized assertions, the #28412 binding
contract, are unchanged. The stored-row-binding header no longer says the
hydrated body keeps the stored stamp.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.flow-stored-row-shipped-name.test.ts

@@ -280,7 +280,10 @@ describe('[#28412] the flow view admits exactly the shipping package\'s declared
         await protocol.getMetaItemsForExecution({ type: 'flow' });
         const hydrated = registry.bare('flow', SHIPPED)!;
         expect(storedRowBindingOf(hydrated)).toBe(PAIR);
-        expect(hydrated._packageId).toBe(PACKAGE_ID); // the body's own stamp, kept and never read for the binding
+        // [#28594] The served stamp is the column too (`storedOverlayEntries`
+        // replaces the body's own `PACKAGE_ID` stamp); the binding above is
+        // still read from the symbol, never from this enumerable key.
+        expect(hydrated._packageId).toBe(PAIR);
         expect(JSON.parse(JSON.stringify(hydrated))).not.toHaveProperty('storedRowBinding');
 
         const packageless = harness([storedRow('flow', SHIPPED, flowBody(SHIPPED, 'STAMPED', { ...DECLARED, _packageId: PAIR }))]);

packages/metadata-protocol/src/stored-row-binding.ts

@@ -5,13 +5,13 @@
  *
  * A stored `sys_metadata` row is bound to a package by its `package_id`
  * COLUMN. The body the protocol hydrates into the SchemaRegistry for it
- * (`hydrateOverlayIntoRegistry`) carries no trustworthy copy of that column:
- * `_packageId` on such a body is whatever the stored bytes said, or the column
- * when they said nothing (`withRowBinding` keeps a body's own stamp). A body
- * can carry a `_packageId` copied from a read of the base package, so a stamp
- * names the base while the row belongs to another package (the shape #28238
- * measured), and a package-less row can carry a stamp naming a package it is
- * not bound to.
+ * (`hydrateOverlayIntoRegistry`) states it as `_packageId` since #28594
+ * (`storedOverlayEntries` serves the column and drops a body's own stamp),
+ * but `_packageId` is still no proof of the column: it is an ordinary JSON
+ * key, so a stored body, a request body or an import can carry one copied
+ * from a read of the base package (the shape #28238 measured), and every
+ * writer that does not go through that reader keeps it (`withRowBinding`
+ * keeps a body's own stamp).
  *
  * ADR-0146 D9 item 1 arms a flow over the code package's name only when the
  * row that declares it is bound to the base's paired `<base>.custom` — by the