test(runtime): authorize the org-scope harness for the #7043 gate; changeset to patch (#7018)

Rebased-in-place adjustments for the r2 takeover branch, on top of the prior
session's ad11fe5 + 1a01e8d:

- ctx() now grants manage_metadata: the dispatcher's /meta PUT gate (#7019,
  landed on main after the prior branch forked) 403s an unauthorized caller
  before the org-scoping decision these tests pin is ever reached.
- registry stub carries isPackageDisabled + applyNavContributions — the two
  methods getMetaItems grew on main (disabled-package filter, ADR-0029 D7 nav
  merge); without them the ADR-0045 flip cases fail on a TypeError inside the
  flip's try, not on the partition assertion.
- reverse verification re-measured on the merged #7043 base: same 4 red /
  4 green, same failure shapes (header updated in place).
- changeset level minor -> patch: behavioural fix, no new API surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGRN2cSRfggfX9B2L83bQc

Author: claude

.changeset/runtime-meta-write-org-scope.md

@@ -1,5 +1,5 @@
 ---
-"@objectstack/runtime": minor
+"@objectstack/runtime": patch
 ---
 
 fix(runtime): a metadata write carries the session's organization only for types that declare `allowOrgOverride` (#7018)

packages/runtime/src/meta-write-org-scope.test.ts

@@ -34,7 +34,8 @@
  * "fix" that simply stopped threading the org anywhere would pass every red
  * case and fail there, silently retiring ADR-0005 per-org overlays.
  *
- * Predicted 4 red / 4 green; measured 4 red / 4 green, against the real stack:
+ * Predicted 4 red / 4 green; measured 4 red / 4 green, against the real stack
+ * (re-measured 2026-08-09 on the merged #7043 base — same 4/4, same shapes):
  *
  *   with the fix          without it (origin/main)
  *   ------------------    ---------------------------------------------------
@@ -130,6 +131,10 @@ function makeEngine() {
             getArtifactItem: () => undefined,
             getObject: () => undefined,
             getPackage: () => undefined,
+            // `getMetaItems` filters every listed item through the disabled-
+            // package gate and, for apps, merges nav contributions (ADR-0029
+            // D7) — the same stubs every metadata-protocol harness carries.
+            // No package is disabled and nothing contributes nav here.
             isPackageDisabled: () => false,
             applyNavContributions: (app: unknown) => app,
             registerItem: (type: string, name: string, item: unknown) => {
@@ -210,11 +215,18 @@ function makeDispatcher(protocol: unknown, engine: any, activeOrganizationId: st
     return new HttpDispatcher(kernel);
 }
 
-/** An authenticated request context — the anonymous-deny gate (#3963) is unconditional. */
+/**
+ * An authenticated request context — the anonymous-deny gate (#3963) is
+ * unconditional, and since #7019 the dispatcher's `/meta` PUT also requires
+ * the `manage_metadata` capability (ADR-0066 D1). These tests are about which
+ * PARTITION an authorized write lands in, so the caller is authorized: without
+ * the capability every PUT 403s before the scoping decision is ever reached,
+ * and each case would pass for the wrong reason.
+ */
 const ctx = (): any => ({
     request: { headers: {} },
     environmentId: 'env_1',
-    executionContext: { userId: 'usr_1', systemPermissions: [] },
+    executionContext: { userId: 'usr_1', systemPermissions: ['manage_metadata'] },
 });
 
 function makeStack(activeOrganizationId: string | undefined) {