fix(metadata-protocol): hand the credentialsRef judge the write-address read only

The save door binds its repository under the one spelling the stored-row
write census reads, and the judge receives only `headAt`, so it can read
the save's own row and write nothing.

Claude-Session: https://claude.ai/code/session_016WV4cx2wNeyC4kD8R4P7Ns
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol-datasource-credentials-ref.ts

@@ -59,7 +59,8 @@ function namedCredentialsRef(body: unknown): unknown {
  * See the module header for the rule, the row it reads and who passes.
  */
 export async function datasourceCredentialsRefSaveRefusal(args: {
-    repo: SysMetadataRepository;
+    /** The repository's write-address read — the one store access this judge makes; it writes nothing. */
+    headAt: SysMetadataRepository['headAt'];
     /** Singular type name. */
     type: string;
     name: string;
@@ -75,10 +76,10 @@ export async function datasourceCredentialsRefSaveRefusal(args: {
     const ref = { type: args.type, name: args.name, org: 'env' } as Parameters<SysMetadataRepository['headAt']>[0];
     const state: 'active' | 'draft' = args.mode === 'draft' ? 'draft' : 'active';
     const member = itemDiscriminator(args.type, args.item);
-    const target = await args.repo.headAt(ref, { state, packageId: args.packageId ?? null, member });
+    const target = await args.headAt(ref, { state, packageId: args.packageId ?? null, member });
     let head = target.head;
     if (!head && state === 'draft') {
-        head = (await args.repo.headAt(ref, { state: 'active', packageId: target.packageId, member })).head;
+        head = (await args.headAt(ref, { state: 'active', packageId: target.packageId, member })).head;
     }
     const own = namedCredentialsRef(head?.body);
     if (typeof own === 'string' && own === named) return undefined;

packages/metadata-protocol/src/protocol.ts

@@ -21287,8 +21287,9 @@ export class ObjectStackProtocolImplementation implements
         // [#27762] A `datasource` body may name, in `external.credentialsRef`, only the reference its own stored row
         // holds: refused 400 before the authoring gate and every write. See {@link datasourceCredentialsRefSaveRefusal}.
         {
+            const repo = this.getOverlayRepo();
             const credentialsRefRefusal = await datasourceCredentialsRefSaveRefusal({
-                repo: this.getOverlayRepo(), type: singularType, name: request.name, item: request.item,
+                headAt: (...a) => repo.headAt(...a), type: singularType, name: request.name, item: request.item,
                 mode, packageId: request.packageId, source: request.source,
             });
             if (credentialsRefRefusal) throw credentialsRefRefusal;