[finding] The spec's three meta-read request schemas omit organizationId, which the protocol implementation accepts and honours #9726

Observed while implementing #9454. Pre-existing drift, not introduced by that card — recording it rather than widening into packages/spec, which belongs to another seat.

The drift

packages/spec/src/api/protocol.zod.ts declares the request shapes for the metadata read verbs. None of the three declares organizationId:

• GetMetaItemsRequestSchema — type, packageId
• GetMetaItemRequestSchema — type, name, packageId
• GetMetaItemCachedRequestSchema — type, name, cacheRequest, locale

The implementation in packages/metadata-protocol/src/protocol.ts accepts and honours an organizationId on the first two, via its own inline parameter types:

async getMetaItems(request: { type: string; packageId?: string; organizationId?: string; previewDrafts?: boolean })
async getMetaItem(request: { type: string, name: string, packageId?: string, organizationId?: string, state?: 'active' | 'draft', previewDrafts?: boolean })

That member is load-bearing: it selects the org partition in the ADR-0005 overlay read order. #9454 adds the same member to getMetaItemCached, in the same inline-type style, so all three verbs now diverge from their declared request schema in the same direction.

Why it is worth a card

The declared surface understates what the protocol accepts, in the direction that makes the org dimension invisible to anyone reading the spec. Consequences already observed:

• every REST call site that threads the scope must cast (as any) to get past the declared type, so the compiler cannot check the very member that decides which tenant's row is served;
• a reader auditing tenancy from protocol.zod.ts alone would conclude the metadata read verbs have no organization dimension at all — which is how Org-overridable metadata (view, dashboard) is accepted with a 200 state:'active' receipt but served by no read door #9454's read doors went unnoticed.

getMetaItemLayered is a related but distinct case: it is not declared on the MetadataProtocol interface at all, so its callers reach it through any too.

Not asserted

⛔ No behavioural defect is claimed. The implementation is correct; this is a declared-surface gap, and the wire contract is unchanged. Whether the fix is to declare the member on all three schemas, or to state deliberately that scope is a caller-side concern outside the request shape, is the spec seat's call.

Repo: objectstack. Files: packages/spec/src/api/protocol.zod.ts, packages/metadata-protocol/src/protocol.ts.

Related: #9454.