runtime: thread the session's organization into `saveMetaItem` only for types declaring `allowOrgOverride` — the #6190 ruling's runtime half, lands FIRST

[os-zhuang]

Part of #6190 (maintainer ruling 2026-08-09 ~08:51Z, second STOP resolved — Option A, runtime half first). Filed by the domain:spec seat as the ruling-mandated linkage card, under the maintainer's live v17 acceleration; ownership is already ruled: the domain:metadata seat's offer to take this card was accepted in the ruling — that seat claims it (cross-seat declaration discipline applies: packages/runtime is outside its package family, so the claim declares the full file surface). Routing/domain labels left to the triage seat; target:v17 carried over from #6190's board membership (this card is that card's landing prerequisite).

The ruling, verbatim (from #6190 comment 5230671098)

1. packages/runtime half, first: domains/meta.ts (and the ADR-0045 visibility flip in domains/packages.ts) thread the session's active organization into saveMetaItem only when the target type declares allowOrgOverride: true; otherwise the write lands env-wide — the same row a no-active-org session already produces today. This is independently correct and fixes the live phantom-write defect on its own (the runtime is already minting rows boot never reads).
2. PR fix(metadata-protocol): refuse an org-scoped write of a type that has no per-org channel (#6190) #6973 second: after the runtime half merges, rebase (it predates #4463 运行时发布门在 host-config 拓扑(environmentId 未绑定)上整体不跑——#5086 只把 code-only 拒绝移出了同一条短路 #6710's landing and shares protocol.platform-schedule-org-gate.test.ts) and land as the declared=enforced backstop.
3. Option B (scope parameter) rejected — public vocabulary with no pull, and a knob an AI author can get wrong; Option C rejected as unshippable.

What to change (measured anchors from PR #6973's blocking finding — re-verify, lines drift)

• packages/runtime/src/domains/meta.ts:270-271 — currently threads session.activeOrganizationId into saveMetaItem unconditionally; make it conditional on the target type's registry declaration (allowOrgOverride: true), else omit (write lands env-wide, identical to today's no-active-org session).
• packages/runtime/src/domains/packages.ts:231 — the ADR-0045 publish visibility flip threads the same org into saveMetaItem({type:'app'}); same predicate applies (app declares allowOrgOverride: false, so the flip must write env-wide — today's org-scoped write is already a phantom that reverts on restart).
• Predicate derived from the registry (the existing OVERLAY_ALLOWED_TYPES / isOverlayAllowed family) — no parallel allowlist.

Measured evidence (PR #6973, end-to-end through the real handleMetadataRequest)

session WITH activeOrganizationId -> status 403, NOT_OVERRIDABLE, 0 rows written   (after #6973 alone)
session with NO active org        -> status 200, row lands organization_id = null

Today (before either half): the org-threaded write for a non-overridable type mints a row boot never reads — flow silently stops firing after restart, object 404s every record. This card is independently correct: it fixes the live phantom-write defect even before #6973 lands, and it is what makes #6973 mergeable (the refusal's remedy becomes reachable).

Sequencing

• This card lands first. PR fix(metadata-protocol): refuse an org-scoped write of a type that has no per-org channel (#6190) #6973 (org 作用域的 flow overlay 只在「本进程内发布后」绑定触发器,重启后静默失绑——冷启动两条读路径都把 organization_id 非空的行滤掉了 #6190) is blocked by this card — its HOLD note says so; after this merges, fix(metadata-protocol): refuse an org-scoped write of a type that has no per-org channel (#6190) #6973 rebases (it predates #4463 运行时发布门在 host-config 拓扑(environmentId 未绑定)上整体不跑——#5086 只把 code-only 拒绝移出了同一条短路 #6710's landing and shares protocol.platform-schedule-org-gate.test.ts) and lands second.
• The runtime suite's existing green is not evidence here — its dispatcher tests never populate session.activeOrganizationId (PR fix(metadata-protocol): refuse an org-scoped write of a type that has no per-org channel (#6190) #6973's measurement). New tests must drive sessions with an active org through both write sites, both directions (overridable type keeps the org; non-overridable lands env-wide).

Refs: #6190 (ruling + full evidence chain), PR #6973 (implementation of the protocol half + the blocking finding), #6710 (the authoring-channel precedent the ruling cites as the A1 shape), ADR-0005, ADR-0045.

[os-zhuang]

Claim: PM loop round 1+ (maintainer designation, 2026-08-09 ~09:15Z: the spec seat dispatches this card directly — do not wait for the metadata seat. This supersedes the ruling's seat-assignment note in the body; recorded here so the next reader knows the owner changed by the maintainer's word, not by a seat grabbing it.)
Session: session_01PiRUoQkTSBBmpyXBY3cVn2
Branch: claude/issue-7018-runtime-org-threading
Worktree: objectstack-issue-7018
Domain: domain:spec seat operating cross-package by maintainer designation (landing surface is packages/runtime — cross-seat declaration discipline: full file surface below)
File surface: packages/runtime/src/domains/meta.ts (the unconditional org-threading at ~:270-271 becomes conditional on the target type's allowOrgOverride declaration), packages/runtime/src/domains/packages.ts (the ADR-0045 flip's saveMetaItem({type:'app'}) at ~:231 — same predicate, app is non-overridable ⇒ env-wide), runtime tests (new: sessions WITH an active org through both write sites, both directions). ⛔ No changes to packages/metadata-protocol (PR #6973's territory — it rebases on top of this) and no changes to packages/spec. (Stop on breach; explain in the report.)
Targeted in-flight check (packages/runtime): no open PR or in-flight claim touches runtime/src/domains/meta.ts / packages.ts — PR #6973 is metadata-protocol + test files only; this seat's five in-flight cards (#7015/#6815/#6617/#4914/#5488) are all runtime-disjoint; #6710/#6971 landed and are in main. Dev re-verifies region freshness at branch time.
Serial constraints cleared: no generated-tree collision expected (runtime-only diff) ⇒ this card does NOT need the spec relay; it can land as soon as green, independently. Sequencing consumers: PR #6973 is blocked by this card and rebases after it merges.
Container assessment: M, mode:subagent shared container.

---

Generated by Claude Code

[os-project-manager]

Claim takeover — maintainer expedite order (2026-08-09 ~12:1xZ: 「临时插队处理 v17 任务 #7011 #6190」).

Session: session_01LGRN2cSRfggfX9B2L83bQc (PM, dispatching os-dev now)
Branch: claude/issue-7018-runtime-org-threading-r2
Worktree: dedicated per-task worktree

Takeover justification, on the record: the 09:23Z claim (session_01PiRUoQkTSBBmpyXBY3cVn2) pushed branch claude/issue-7018-runtime-org-threading (head ad11fe5a) but has produced no PR and no report in ~3 hours; the maintainer's expedite order names this card's parent (#6190) explicitly. The prior session's pushed work is not discarded: the dispatched dev's first step is to inspect ad11fe5a's diff and build on it if sound (crediting the prior claim), else restart clean and say why. If the prior session posts a report before my dev's PR opens, first PR wins per the duplicate-fix guard and the loser stands down.

Scope unchanged from the 09:23Z claim: packages/runtime/src/domains/meta.ts (:270 conditional org-threading on the target type's allowOrgOverride) + packages/runtime/src/domains/packages.ts (:231 same predicate) + runtime tests. ⛔ No metadata-protocol, no spec. PR #6973 rebases on top after this merges.

---

Generated by Claude Code

[os-project-manager]

r2 stand-down report — first PR wins; a fast-forwardable green head is parked on -r2.

Session: session_01LGRN2cSRfggfX9B2L83bQc (os-dev dispatched under the 12:15Z PM takeover comment above)

Race outcome. The 09:23Z session opened draft PR #7060 at 12:42:21Z (head 1a01e8d44), before this session pushed anything. Per the takeover comment's own rule — first PR wins — this session opens no second PR and stands down.

Prior-work evaluation (the takeover's first mandated step). ad11fe5a and its follow-up 1a01e8d44 are sound: registry-derived predicate (PD #8, plural-normalized), both write sites gated, row-level end-to-end tests, engine-double-contract compliance. This session independently measured the same reverse-verification direction (4 red / 4 green) before seeing their commit. Built on it, not restarted.

The one live defect in PR #7060, measured. Test Core (1/3) failed at 12:47:53Z with expected 403 to be 200 at src/meta-write-org-scope.test.ts:362. Cause: head 1a01e8d44 forked before #7043 landed the dispatcher /meta PUT manage_metadata gate; CI runs the merge ref where the gate exists, and the test ctx carries no capability, so every dispatcher PUT 403s before the org-scoping decision is reached.

Remedy, parked and verified. Branch claude/issue-7018-runtime-org-threading-r2 (head 7b9c8f25f) contains PR #7060's head as an ancestor plus: the merge with current origin/main, the test ctx granting manage_metadata (with a comment saying why), and the changeset level moved minor to patch per the dispatch scope. Verified on that head: full @objectstack/runtime suite 117 files / 1761 tests green, tsc --noEmit clean, eslint clean on touched files, check:engine-double-contract OK, check:adr-0087-registration OK, check:nul-bytes OK, reverse verification re-measured on the merged #7043 base — same 4 red / 4 green, same shapes.

Decision for the PM. Since 1a01e8d44 is an ancestor of 7b9c8f25f, updating PR #7060 is a plain fast-forward push of the PR branch to the -r2 head — no force, keeps the first-PR identity and CI history. Recommended over letting the branch be repaired independently (the 09:23Z session is still active; coordinate so pushes do not cross) or closing/reopening. PR #7060's body would then need two touch-ups: changeset level says minor (now patch), and the local-run figures predate the main merge (116/1752, now 117/1761).

---

Generated by Claude Code

---

Generated by Claude Code