docs(adr): ADR-0150 addendum says the renamedFrom holder carry also runs after each announced reload

docs/adr/0150-behavioural-metadata-addressed-by-package-objects-keep-the-literal-prefix.md

@@ -285,7 +285,7 @@ A package that needs its permission sets on another package's position asks the
 
 `position.permissionSets` names permission sets, which are bucket 2, so each name resolves by D3 from the package that declared the position (an environment position resolves environment-wide). Every set that an administrator's overlay body names is the environment's reference (D3): it resolves as a caller with no package, never from the package the overlay customizes. So binding package Q's set, or an environment-authored set, to package P's position works as ruled.
 
-**Addendum** (2026-11-13, [#32983](https://github.com/objectstack-ai/objectstack/issues/32983), ruling A1, record [`6841971722`](https://github.com/objectstack-ai/objectstack/issues/32983#issuecomment-6841971722)): an app that renames a position to keep out of another holder's slot declares the earlier names in `PositionSchema.renamedFrom`, and at `kernel:bootstrapped` the platform moves that position's holders (`sys_user_position.position`, row R2, still a bare name) from each old name to the new one, as the system, in every organization (`plugin-security` `position-renamed-holder-carry.ts`). This is a system write that changes who holds a position. It carries holders only. It refuses an old name that two positions claim, that a position still declares, or that another package (enabled or disabled) or the environment holds or is recorded in the activation ledger as owning. It does not carry an old name that is switched off. An old name that no installed position holds and no ledger row records under another package is carried for its one claimant, whichever package that is: the platform keeps no other record of who owned a name that is no position now, and any package may already declare such a name (one slot per name). It judges the packages this boot loaded, so a package that failed to load at all holds no name it can see: a standing claim on a position name of such a package carries that package's holders to the claimant at that boot, and nothing carries them back. It runs at boot only: a package installed or upgraded into a running kernel is carried at the next restart. Every other stored reference to an old name is named in the boot log and never rewritten, and nothing is carried back on a downgrade.
+**Addendum** (2026-11-13, [#32983](https://github.com/objectstack-ai/objectstack/issues/32983), ruling A1, record [`6841971722`](https://github.com/objectstack-ai/objectstack/issues/32983#issuecomment-6841971722)): an app that renames a position to keep out of another holder's slot declares the earlier names in `PositionSchema.renamedFrom`, and at `kernel:bootstrapped`, and again on each later `metadata:reloaded` that names the position or its package as registered, the platform moves that position's holders (`sys_user_position.position`, row R2, still a bare name) from each old name to the new one, as the system, in every organization (`plugin-security` `position-renamed-holder-carry.ts`). This is a system write that changes who holds a position. It carries holders only. It refuses an old name that two positions claim, that a position still declares, or that another package (enabled or disabled) or the environment holds or is recorded in the activation ledger as owning. It does not carry an old name that is switched off. An old name that no installed position holds and no ledger row records under another package is carried for its one claimant, whichever package that is: the platform keeps no other record of who owned a name that is no position now, and any package may already declare such a name (one slot per name). It judges the packages this boot loaded, so a package that failed to load at all holds no name it can see: a standing claim on a position name of such a package carries that package's holders to the claimant at that boot, and nothing carries them back. It runs at boot over every claim, and on each `metadata:reloaded` after the boot over the claims of what the announcement names as registered (`app/ID` while the registry holds package `ID`, `position/NAME`): a hot install-local install, the runtime `POST /packages` install, a `PATCH /packages/:id/enable` that switches a disabled package on, a per-item publish of a position and the positions of a publish-drafts are carried at once; a hot upgrade over a version the running kernel still serves and an artifact reload that names only its file are carried at the next restart. Every other stored reference to an old name is named in the log of the run (at boot for every old name it carries, after a reload for the old names it moved rows of) and never rewritten, and nothing is carried back on a downgrade.
 
 ### D8 — Stored references gain a package column, backfilled from the one holder