@@ -0,0 +1,16 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/metadata-core': patch
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+'@objectstack/cli': patch
+---
+
+fix(metadata-protocol): a stored-metadata migration records the user who ran it, or nobody, never a label
+
+Clause-②: no
+
+- **What was wrong.** The stored-metadata migration pass (`os migrate meta --stored`, `POST /api/v1/meta/_migrate-stored`, the runtime dispatcher's `POST /metadata/_migrate-stored`, and `migrateStoredMetadata()` called in process) recorded a label as the writer of every row it rewrote: `'os migrate meta --stored'`, `'<user id> (POST /api/v1/meta/_migrate-stored)'`, `'POST /api/v1/meta/_migrate-stored'`, or `'migrate-stored'`. The writer lands in `sys_metadata_history.recorded_by` and in the row's `updated_by`. Both columns are references to `sys_user`, so the label pointed at no user. Nothing refused it, because metadata writes run as the system.
+- **What it does now.** The pass records the id of the user who ran it, exactly as every other metadata write does. A REST or runtime call by a signed-in user with `manage_metadata` records that user's id. A run with no user records `null`, which means "system-initiated". That covers the CLI, which opens the database directly with no session, and a system caller. The pass still names itself on each history row's `source` (`migrate-stored`), as it did before.
+- **What an operator sees.** History rows and rewritten rows written by a migration from this release on name the person who ran it, or nobody. They never name a command or a route. Rows a migration rewrote before this release keep the label they were given.
+- **Contract text.** `MetadataItem.authoredBy`'s description now gives the same rule as `PutOptions.actor`: the acting user's id, or `null` for a system-initiated write, never a label such as `"system"` or `"cli"`. The schema accepts the same values as before.
@@ -110,11 +110,11 @@ describe('os migrate meta --stored — the protocol resolves the engine itself (
 
       const protocol: any = stack.kernel.getService('protocol');
 
-      // The command's exact call since #4498 — no `canonicalizeFlow`.
+      // The command's exact call since #4498 — no `canonicalizeFlow` — and,
+      // since #23068, no `actor` either (the command has no user to name).
       const report = await protocol.migrateStoredMetadata({
         apply: true,
         types: ['flow'],
-        actor: 'os migrate meta --stored',
       });
 
       // Before the resolver this row came back `skipped` with "no automation
@@ -195,7 +195,8 @@ describe('os migrate meta --stored — the protocol resolves the engine itself (
         name: 'sfs_purge',
         item: { ...item, label: 'Purge Stale Leads (edited)' },
         parentVersion: null,
-        actor: 'studio-roundtrip-probe',
+        // A user id, as a Studio save passes one — never a label (#23068).
+        actor: 'usr_studio_probe',
       });
 
       const [row] = await ql.find('sys_metadata', {
 
@@ -1555,7 +1555,12 @@ export default class MigrateMeta extends Command {
         : await protocol.migrateStoredMetadata({
             apply,
             ...(flags.type && flags.type.length > 0 ? { types: flags.type } : {}),
-            actor: 'os migrate meta --stored',
+            // [#23068] No `actor`: this command opens the database directly,
+            // with no session, so it has no user id to give — and the actor
+            // lands in `recorded_by` / `updated_by`, `lookup('sys_user')`
+            // columns, where only a user id or `null` belongs. Omitted, the
+            // rows record `null` ("system-initiated", #4556); the pass names
+            // itself on `source: 'migrate-stored'`.
           });
       const clean = storedMigrationClean(report);
       if (!clean) exitCode = 1;
 
@@ -99,7 +99,7 @@ export const MetadataItemSchema = z.object({
   body: z.record(z.string(), z.unknown()).describe('Canonical Zod-normalised spec'),
   hash: z.string().regex(/^sha256:[0-9a-f]{64}$/).describe('sha256(canonicalize(body, ref.type))'),
   parentHash: z.string().nullable().describe('Hash this version was derived from; null for first version'),
-  authoredBy: z.string().nullable().describe('Identity of the writer (user id, "cli", "ai:claude", …); null = system-initiated, no actor'),
+  authoredBy: z.string().nullable().describe('Identity of the writer: the acting user id, as PutOptions.actor records it; null = system-initiated, no actor — never a label such as "system" or "cli"'),
   authoredAt: z.string().describe('ISO-8601 timestamp'),
   message: z.string().optional().describe('Optional commit message'),
   seq: z.number().int().nonnegative().describe('Sequence number this write produced in the org log'),
 
@@ -21185,7 +21185,9 @@ export class ObjectStackProtocolImplementation implements
      *   are about to write (the same conversion). It is empty by construction,
      *   and there is no author here for a confirmation prompt to reach.
      * - `source: 'migrate-stored'` — so a history diff distinguishes a
-     *   canonicalization pass from an edit someone made.
+     *   canonicalization pass from an edit someone made. This is the ONLY
+     *   place the pass names itself: `actor` (below) is the user who ran it
+     *   or nobody, never a label (#23068).
      *
      * ## What it lists and never writes
      *
@@ -21279,7 +21281,16 @@ export class ObjectStackProtocolImplementation implements
         apply?: boolean;
         /** Restrict to these metadata types (singular or plural spelling). */
         types?: string[];
-        /** Recorded as the writer on the history + audit rows. */
+        /**
+         * The id of the user running the pass — omit it when no user is
+         * (a CLI run against the database, an `isSystem` caller). It becomes
+         * each rewrite's `PutOptions.actor`, so it lands in
+         * `sys_metadata_history.recorded_by` and the row's `updated_by`, both
+         * `lookup('sys_user')`: omitted, they record `null`, #4556's
+         * "system-initiated". ⛔ Never a label naming the door or the pass —
+         * that is a reference to no user, and `source: 'migrate-stored'`
+         * already says where the write came from (#23068).
+         */
         actor?: string;
         /**
          * Canonicalize a stored `flow` body (#4454). **Optional override** —
@@ -21611,7 +21622,10 @@ export class ObjectStackProtocolImplementation implements
                     packageId,
                     force: true,
                     source: 'migrate-stored',
-                    actor: request.actor ?? 'migrate-stored',
+                    // [#23068] The user who ran the pass, or none — and none
+                    // reaches `PutOptions.actor` as `null` (`saveMetaItem`'s
+                    // #4556 default). The pass's name is on `source` above.
+                    ...(request.actor ? { actor: request.actor } : {}),
                 });
                 record({ ...base, notices: flattened, todos: flattenedTodos, outcome: 'rewritten' });
             } catch (e: any) {
 
@@ -2772,7 +2772,8 @@ export class RestServer {
     /**
      * [#7749] The acting identity recorded on a metadata WRITE — the single
      * producer for every `/meta` route that stamps an `actor` (save, delete,
-     * publish, rollback, compound save).
+     * publish, rollback, compound save, and — since #23068, which retired the
+     * route-name label it stamped inline — `POST /_migrate-stored`).
      *
      * ## What was wrong
      *
@@ -5925,15 +5926,19 @@ export class RestServer {
                         // Preview by default — `apply` must be explicitly true,
                         // the same posture the CLI takes. A caller who sends an
                         // empty body gets a report and no writes.
+                        // Attributed to the caller: this writes history rows,
+                        // and "who ran the migration" is the question they
+                        // exist to answer. [#23068] By user id alone — the
+                        // identity this request was authorized as, read by the
+                        // producer every `/meta` write door shares — or by
+                        // nobody. It lands in `recorded_by` / `updated_by`,
+                        // `lookup('sys_user')` columns, so ⛔ never the route's
+                        // name: the pass records its origin on `source`.
+                        const actor = await this.resolveMetaWriteActor(environmentId, req);
                         const report = await (p as any).migrateStoredMetadata({
                             apply: (req.body as any)?.apply === true,
                             ...(types.length > 0 ? { types } : {}),
-                            // Attributed to the caller: this writes history +
-                            // audit rows, and "who ran the migration" is the
-                            // question those rows exist to answer.
-                            actor: ctx?.userId
-                                ? `${ctx.userId} (POST ${metadata.prefix}/_migrate-stored)`
-                                : `POST ${metadata.prefix}/_migrate-stored`,
+                            ...(actor ? { actor } : {}),
                         });
                         res.json(report);
                     } catch (error: any) {
 
@@ -1832,14 +1832,18 @@ export async function handleMetadataRequest(deps: DomainHandlerDeps, path: strin
         const types = Array.isArray(body?.types)
             ? body.types.filter((t: unknown): t is string => typeof t === 'string' && t.length > 0)
             : undefined;
+        // Attributed to the caller, not to the route: this writes history
+        // rows, and "who ran the migration" is the question they exist to
+        // answer. [#23068] By the caller's user id alone, or by nobody (an
+        // `isSystem` caller): it lands in `recorded_by` / `updated_by`,
+        // `lookup('sys_user')` columns, so ⛔ never the route's name — the
+        // pass records its origin on `source: 'migrate-stored'`.
+        const actor = typeof ec?.userId === 'string' && ec.userId ? ec.userId : undefined;
         try {
             const report = await protocol.migrateStoredMetadata({
                 apply: body?.apply === true,
                 ...(types && types.length > 0 ? { types } : {}),
-                // Attributed to the caller, not to the route: this writes
-                // history + audit rows, and "who ran the migration" is the
-                // question those rows exist to answer.
-                actor: ec?.userId ? `${ec.userId} (POST /metadata/_migrate-stored)` : 'POST /metadata/_migrate-stored',
+                ...(actor ? { actor } : {}),
             });
             return { handled: true, response: deps.success(report) };
         } catch (e: any) {