@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a metadata save's audit row names the user who saved it
+
+Clause-②: no
+Metadata-protocol: none
+
+A signed-in user's metadata save (`PUT /api/v1/meta/:type/:name`, the `/automation` definition doors, a delete) wrote its `sys_audit_log` row on `sys_metadata` with `user_id` and `actor` both null, although the save named its actor and the `sys_metadata` row's `created_by` / `updated_by` recorded it. `SysMetadataRepository.put` and `delete` run their writes as the system, so the audit writer saw no session user. They now pass the save's actor as `ExecutionContext.attributedUserId`, the existing attribution channel the audit writer reads into `user_id`. The write is still authorized as the system; the actor is never presented as the caller. A save with no actor (boot sync, seeds, engine self-writes) stays unattributed, as before.
@@ -37,6 +37,9 @@ interface Row { [k: string]: unknown }
 function makeFakeEngine() {
   const rows = new Map<string, Row>();
   const historyRows: Row[] = [];
+  // [#27539] The context each WRITE verb was handed, in call order — what the
+  // engine turns into the hook's `session` / `provenance`.
+  const writes: Array<{ verb: string; table: string; context: Record<string, unknown> | undefined }> = [];
 
   const keyOf = (w: Record<string, unknown>) =>
     `${String(w.type)}|${String(w.name)}|${String(w.organization_id ?? 'null')}|${String(w.state ?? 'active')}`;
@@ -60,6 +63,7 @@ function makeFakeEngine() {
   return {
     rows,
     historyRows,
+    writes,
     async find(table: string, opts: { where: Record<string, unknown> }) {
       if (table === 'sys_metadata_history') return historyRows.filter((h) => matchesHistory(h, opts.where));
       return Array.from(rows.values()).filter((r) => {
@@ -74,7 +78,8 @@ function makeFakeEngine() {
       if (table === 'sys_metadata_history') return historyRows.find((h) => matchesHistory(h, opts.where)) ?? null;
       return findRow(opts.where)?.row ?? null;
     },
-    async insert(table: string, data: Record<string, unknown>) {
+    async insert(table: string, data: Record<string, unknown>, opts?: { context?: Record<string, unknown> }) {
+      writes.push({ verb: 'insert', table, context: opts?.context });
       if (table === 'sys_metadata_history') {
         const h: Row = { ...data };
         if (!h.id) h.id = `h_${historyRows.length + 1}`;
@@ -86,15 +91,17 @@ function makeFakeEngine() {
       rows.set(k, row);
       return { id: row.id as string };
     },
-    async update(_t: string, data: Record<string, unknown>, opts: { where: Record<string, unknown> }) {
+    async update(_t: string, data: Record<string, unknown>, opts: { where: Record<string, unknown>; context?: Record<string, unknown> }) {
       assertEngineUpdateDispatch(data, opts);
+      writes.push({ verb: 'update', table: _t, context: opts.context });
       const found = findRow(opts.where);
       if (!found) throw new Error('not found');
       rows.set(found.key, { ...found.row, ...data });
       return { id: found.row.id as string };
     },
-    async delete(_t: string, opts: { where: Record<string, unknown> }) {
+    async delete(_t: string, opts: { where: Record<string, unknown>; context?: Record<string, unknown> }) {
       assertEngineDeleteDispatch(opts);
+      writes.push({ verb: 'delete', table: _t, context: opts.context });
       const found = findRow(opts.where);
       if (!found) return { deleted: 0 };
       rows.delete(found.key);
@@ -260,3 +267,55 @@ describe('#23033 — the sys_metadata row records who created it and who last ch
     expect(drafts.map((d) => [d.name, d.updatedBy])).toEqual([['case_grid', 'usr_carol']]);
   });
 });
+
+/**
+ * [#27539, ADR-0073 D3] The save's actor reaches the AUDIT row too. Every
+ * `sys_metadata` write runs under `isSystem` (the door already authorized it),
+ * so the engine's hook carries no `session.userId`, and the audit writer's only
+ * other channel for `sys_audit_log.user_id` is `provenance.attributedUserId`,
+ * which the engine copies from `ExecutionContext.attributedUserId`. So the
+ * repository hands every write verb of `put` and `delete` the actor on that
+ * key, and never as `userId` (that would make every caller-gating hook read
+ * the actor as the caller).
+ *
+ * This fake records the context it is handed, so these pins prove the
+ * repository HANDS the engine the attribution. That the engine copies it into
+ * `provenance` and the audit writer reads it into `user_id` / `actor` is the
+ * engine's and the writer's own contract, measured end to end on the PR.
+ */
+describe('#27539 — put and delete credit the actor to the audit writer through attributedUserId', () => {
+  let engine: ReturnType<typeof makeFakeEngine>;
+  let repo: SysMetadataRepository;
+  const ref = { org: 'system', type: 'view' as const, name: 'case_grid' };
+  const contexts = () => engine.writes.map((w) => [w.verb, w.table, w.context?.isSystem, w.context?.attributedUserId, w.context?.userId]);
+
+  beforeEach(() => {
+    engine = makeFakeEngine();
+    repo = new SysMetadataRepository({ engine });
+  });
+
+  it('create, update and delete with an actor credit that actor on every write, as the system', async () => {
+    const first = await repo.put(ref, view('A'), { parentVersion: null, actor: 'usr_alice' });
+    const second = await repo.put(ref, view('B'), { parentVersion: first.version, actor: 'usr_bob' });
+    await repo.delete(ref, { parentVersion: second.version, actor: 'usr_carol' });
+    expect(contexts()).toEqual([
+      ['insert', 'sys_metadata', true, 'usr_alice', undefined],
+      ['insert', 'sys_metadata_history', true, 'usr_alice', undefined],
+      ['update', 'sys_metadata', true, 'usr_bob', undefined],
+      ['insert', 'sys_metadata_history', true, 'usr_bob', undefined],
+      ['delete', 'sys_metadata', true, 'usr_carol', undefined],
+      ['insert', 'sys_metadata_history', true, 'usr_carol', undefined],
+    ]);
+  });
+
+  it('CONTROL: with no actor the writes carry no attributedUserId key at all — unattributed, as before', async () => {
+    const first = await repo.put(ref, view('A'), { parentVersion: null, actor: null });
+    const second = await repo.put(ref, view('B'), { parentVersion: first.version, actor: null });
+    await repo.delete(ref, { parentVersion: second.version, actor: null });
+    expect(engine.writes).toHaveLength(6);
+    for (const w of engine.writes) {
+      expect(w.context?.isSystem).toBe(true);
+      expect(w.context !== undefined && 'attributedUserId' in w.context).toBe(false);
+    }
+  });
+});
@@ -1147,6 +1147,17 @@ export class SysMetadataRepository implements MetadataRepository {
       const version = await this.nextItemVersion(ref, ctx);
       // Per-org monotonic event log cursor.
       const eventSeq = await this.nextEventSeq(ctx);
+      // [#27539, ADR-0073 D3] The context every write below runs under. The
+      // write is AUTHORIZED as the system (the door already authorized the
+      // save), so the actor rides as `attributedUserId` — the attribution
+      // channel the audit writer reads into `sys_audit_log.user_id` — and
+      // never as `userId`, which every caller-gating hook would read as the
+      // caller. No actor → no key: the write stays unattributed, as before.
+      const writeContext = {
+        ...ctx,
+        isSystem: true,
+        ...(opts.actor ? { attributedUserId: opts.actor } : {}),
+      };
 
       const parentRowData: Record<string, unknown> = {
         type: ref.type,
@@ -1203,14 +1214,14 @@ export class SysMetadataRepository implements MetadataRepository {
         }
         await this.engine.update('sys_metadata', parentRowData, {
           where: { id: existingId },
-          context: { ...ctx, isSystem: true },
+          context: writeContext,
         });
       } else {
         parentRowData.created_at = now;
         // [#23033] Who created the row: the first write's actor, set on the
         // insert only — an update never names `created_by`, so it keeps it.
         parentRowData.created_by = opts.actor ?? null;
-        await this.engine.insert('sys_metadata', parentRowData, { context: { ...ctx, isSystem: true } });
+        await this.engine.insert('sys_metadata', parentRowData, { context: writeContext });
       }
 
       // Durable history append — same transaction, so the parent write
@@ -1235,7 +1246,7 @@ export class SysMetadataRepository implements MetadataRepository {
           recorded_by: opts.actor ?? null,
           recorded_at: now,
         },
-        { context: { ...ctx, isSystem: true } },
+        { context: writeContext },
       );
 
       const item: MetadataItem = {
@@ -1356,9 +1367,16 @@ export class SysMetadataRepository implements MetadataRepository {
         eventSeq = await this.nextEventSeq(ctx);
       }
 
+      // [#27539, ADR-0073 D3] As `put`'s: authorized as the system, the
+      // actor credited through `attributedUserId`; no actor → no key.
+      const writeContext = {
+        ...ctx,
+        isSystem: true,
+        ...(opts.actor ? { attributedUserId: opts.actor } : {}),
+      };
       await this.engine.delete('sys_metadata', {
         where: { id: existingId },
-        context: { ...ctx, isSystem: true },
+        context: writeContext,
       });
 
       if (state === 'active') {
@@ -1383,7 +1401,7 @@ export class SysMetadataRepository implements MetadataRepository {
             recorded_by: opts.actor ?? null,
             recorded_at: now,
           },
-          { context: { ...ctx, isSystem: true } },
+          { context: writeContext },
         );
       }