@@ -0,0 +1,13 @@
+---
+'@objectstack/metadata-fs': patch
+'@objectstack/runtime': patch
+---
+
+fix(metadata-fs, runtime): metadata writes record the acting user's id or nobody, never the label `'fs'`, and a signed-in save through the runtime dispatcher records the user
+
+Clause-②: no
+
+- **What was wrong (filesystem repository).** `FileSystemRepository` named the label `'fs'` as the writer whenever no user was given. That covered every edit it saw on disk, every file it found that no recorded write produced, and an actor-less `put()`, which read back as `'fs'`. `MetadataPlugin` attaches the repository without naming a user, so this happened on every host that boots it. The contract for these fields (`PutOptions.actor`, `MetadataItem.authoredBy`, `MetadataEvent.actor`) is the acting user's id, or `null` for "nobody".
+- **What it does now.** With no user named, the repository records `null`. A write that names a user records that user, and a write that records `null` reads back as `null`. The `fsActor` option keeps its type. When it is set, it is the user id reported for changes the repository did not write itself, and it no longer replaces a writer that a write recorded. Every event still names its origin on `source: 'fs'`, as before.
+- **What was wrong (runtime dispatcher).** `PUT /api/v1/meta/:type/:name` served by the runtime dispatcher (the `@objectstack/hono` catch-all) saved without the caller's identity, so a signed-in author's save recorded `null` in `sys_metadata.updated_by` / `created_by` and `sys_metadata_history.recorded_by`. `RestServer`'s route recorded the user.
+- **What an operator sees.** Filesystem-backed metadata history and events from this release on no longer name `'fs'` as the writer. A save through the runtime dispatcher records the signed-in user's id, as the REST route does, and a system caller with no user records `null`. Entries written before this release keep what they recorded.
@@ -63,7 +63,17 @@ export interface FileSystemRepositoryOptions {
   root: string;
   /** Tenant/org. */
   org: string;
-  /** Identity reported in events that originate from external FS edits. */
+  /**
+   * The acting user id to report for a change this repository did not write
+   * itself: an edit observed on disk (a watcher or resync event), and a file
+   * with no recorded write behind it (its `authoredBy`).
+   *
+   * Omitted → `null`, "no actor": the `PutOptions.actor` contract (#4556) is
+   * the acting user's id or `null`, ⛔ never a label such as `'fs'`. Every
+   * event already names its origin as `source: 'fs'`. A write that came
+   * through `put()` / `delete()` reports its own `actor`, `null` included,
+   * and this value never replaces it.
+   */
   fsActor?: string;
   /** Disable chokidar watcher (e.g. for read-only contexts). */
   disableWatch?: boolean;
@@ -112,7 +122,8 @@ const isEnoent = (err: unknown): boolean =>
 export class FileSystemRepository implements MetadataRepository {
   private readonly layout: FsLayout;
   private readonly org: string;
-  private readonly fsActor: string;
+  /** See {@link FileSystemRepositoryOptions.fsActor}: a user id, or `null`. */
+  private readonly fsActor: string | null;
   private readonly disableWatch: boolean;
   private readonly now: () => Date;
   private readonly log: JsonlLog;
@@ -147,7 +158,8 @@ export class FileSystemRepository implements MetadataRepository {
 
   constructor(opts: FileSystemRepositoryOptions) {
     this.org = opts.org;
-    this.fsActor = opts.fsActor ?? 'fs';
+    // [#23086] No default label: with no user named, the answer is `null`.
+    this.fsActor = opts.fsActor ?? null;
     this.disableWatch = opts.disableWatch ?? false;
     this.now = opts.now ?? (() => new Date());
     this.layout = { root: path.resolve(opts.root) };
@@ -269,7 +281,7 @@ export class FileSystemRepository implements MetadataRepository {
       body: body as Record<string, unknown>,
       hash,
       parentHash: meta?.parentHash ?? null,
-      authoredBy: meta?.actor ?? this.fsActor,
+      authoredBy: this.authoredByOf(meta),
       authoredAt: meta?.ts ?? new Date(0).toISOString(),
       message: meta?.message,
       seq: meta?.seq ?? 0,
@@ -298,7 +310,7 @@ export class FileSystemRepository implements MetadataRepository {
         ref: { ...ref, version: undefined },
         hash,
         parentHash: meta?.parentHash ?? null,
-        authoredBy: meta?.actor ?? this.fsActor,
+        authoredBy: this.authoredByOf(meta),
         authoredAt: meta?.ts ?? new Date(0).toISOString(),
         message: meta?.message,
         seq: meta?.seq ?? 0,
@@ -372,7 +384,7 @@ export class FileSystemRepository implements MetadataRepository {
             body: spec as Record<string, unknown>,
             hash,
             parentHash: meta?.parentHash ?? null,
-            authoredBy: meta?.actor ?? this.fsActor,
+            authoredBy: this.authoredByOf(meta),
             authoredAt: meta?.ts ?? this.now().toISOString(),
             message: meta?.message,
             seq: meta?.seq ?? 0,
@@ -534,6 +546,20 @@ export class FileSystemRepository implements MetadataRepository {
     return last;
   }
 
+  /**
+   * `authoredBy` for a HEAD, read off the log record that produced it.
+   *
+   * [#23086] A record answers with the actor it recorded, and a recorded `null`
+   * stays `null`: `meta?.actor ?? fallback` read a `put()` with `actor: null`
+   * back as the fallback, so an actor-less write came back authored by the
+   * `'fs'` default. The fallback answers only when no record exists (a file
+   * placed on disk outside this repository), and it is `fsActor`, which is a
+   * user id or `null`.
+   */
+  private authoredByOf(meta: MetadataEvent | null): string | null {
+    return meta ? (meta.actor ?? null) : this.fsActor;
+  }
+
   /**
    * Register a path this repository just wrote with the watcher (#7282).
    *
 
@@ -0,0 +1,107 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#23086] `FileSystemRepository` reports the acting user's id, or `null` —
+ * never the label `'fs'`.
+ *
+ * The contract is `PutOptions.actor` (`@objectstack/metadata-core`, #4556):
+ * the acting user id, or `null` for a write with no actor. `authoredBy` and
+ * `MetadataEvent.actor` carry the same rule. The repository broke it twice:
+ *
+ *  - its constructor defaulted `fsActor` to `'fs'`, and `MetadataPlugin`
+ *    attaches it without one, so every edit observed on disk and every file
+ *    with no recorded write reported the label;
+ *  - every `authoredBy` read was `meta?.actor ?? fsActor`, and `??` treats a
+ *    recorded `null` as absent, so a `put()` with `actor: null` read back as
+ *    authored by the fallback.
+ *
+ * The origin stays named, on `source: 'fs'`. These cases read every surface a
+ * caller sees: the `put()` receipt, `get()`, the `list()` header and the
+ * `history()` event. The watcher face (an edit made on disk) is pinned by the
+ * `actor` assertions in this package's watcher suites.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import type { MetaRef, MetadataEvent, MetadataItemHeader } from '@objectstack/metadata-core';
+import { FileSystemRepository } from '../src/index.js';
+
+const ref = (name: string): MetaRef => ({ org: 'system', type: 'view', name });
+
+async function collect<T>(it: AsyncIterable<T>): Promise<T[]> {
+  const out: T[] = [];
+  for await (const x of it) out.push(x);
+  return out;
+}
+
+describe('[#23086] FileSystemRepository: the acting user id, or null, never the label "fs"', () => {
+  let root: string;
+  let repo: FileSystemRepository | undefined;
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'objectstack-fs-actor-'));
+  });
+
+  afterEach(async () => {
+    if (repo) await repo.close().catch(() => undefined);
+    repo = undefined;
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  /** What every read surface reports as the writer of `name`'s HEAD. */
+  async function writerSeenBy(r: FileSystemRepository, name: string) {
+    const got = await r.get(ref(name));
+    const headers: MetadataItemHeader[] = await collect(r.list({ org: 'system', type: 'view', nameContains: name }));
+    const events: MetadataEvent[] = await collect(r.history(ref(name)));
+    return {
+      get: got?.authoredBy,
+      list: headers.map((h) => h.authoredBy),
+      history: events.map((e) => e.actor),
+    };
+  }
+
+  it('a write with no actor records null on every surface, never "fs"', async () => {
+    repo = new FileSystemRepository({ root, org: 'system', disableWatch: true });
+    await repo.start();
+    const put = await repo.put(ref('nobody'), { label: 'v1' }, { parentVersion: null, actor: null });
+    expect(put.item.authoredBy).toBeNull();
+    expect(await writerSeenBy(repo, 'nobody')).toEqual({ get: null, list: [null], history: [null] });
+
+    // A no-op write (same content) reads the recorded writer back too.
+    const again = await repo.put(ref('nobody'), { label: 'v1' }, { parentVersion: put.version, actor: null });
+    expect(again.item.authoredBy).toBeNull();
+  });
+
+  it('a write with an actor records that actor on every surface', async () => {
+    repo = new FileSystemRepository({ root, org: 'system', disableWatch: true });
+    await repo.start();
+    const put = await repo.put(ref('mine'), { label: 'v1' }, { parentVersion: null, actor: 'usr_alice' });
+    expect(put.item.authoredBy).toBe('usr_alice');
+    expect(await writerSeenBy(repo, 'mine')).toEqual({
+      get: 'usr_alice', list: ['usr_alice'], history: ['usr_alice'],
+    });
+  });
+
+  it('a file no recorded write produced reports null as its writer', async () => {
+    // Placed on disk before `start()`, as an editor or a checkout leaves it:
+    // the boot scan indexes it, and the log holds no record for it.
+    await fs.mkdir(path.join(root, 'view'), { recursive: true });
+    await fs.writeFile(path.join(root, 'view', 'placed.json'), JSON.stringify({ label: 'from disk' }));
+    repo = new FileSystemRepository({ root, org: 'system', disableWatch: true });
+    await repo.start();
+    expect(await writerSeenBy(repo, 'placed')).toEqual({ get: null, list: [null], history: [] });
+  });
+
+  it('a named fsActor answers only where no write is recorded; a recorded null stays null', async () => {
+    await fs.mkdir(path.join(root, 'view'), { recursive: true });
+    await fs.writeFile(path.join(root, 'view', 'placed.json'), JSON.stringify({ label: 'from disk' }));
+    repo = new FileSystemRepository({ root, org: 'system', disableWatch: true, fsActor: 'usr_operator' });
+    await repo.start();
+    expect((await repo.get(ref('placed')))?.authoredBy).toBe('usr_operator');
+
+    await repo.put(ref('nobody'), { label: 'v1' }, { parentVersion: null, actor: null });
+    expect(await writerSeenBy(repo, 'nobody')).toEqual({ get: null, list: [null], history: [null] });
+  });
+});
@@ -167,7 +167,7 @@ describe('#7369 an external delete is published only for an item that is really
     expect(events[0]!.op).toBe('update');
     expect(events[0]!.ref.name).toBe('case_grid');
     expect(events[0]!.source).toBe('fs');
-    expect(events[0]!.actor).toBe('fs');
+    expect(events[0]!.actor).toBeNull();
     expect(events[0]!.parentHash).toBe(first.version);
     expect(events[0]!.hash).not.toBeNull();
 
@@ -238,7 +238,7 @@ describe('#7369 an external delete is published only for an item that is really
     expect(events[0]!.hash).toBeNull();
     expect(events[0]!.parentHash).toBe(first.version);
     expect(events[0]!.source).toBe('fs');
-    expect(events[0]!.actor).toBe('fs');
+    expect(events[0]!.actor).toBeNull();
 
     expect(await repo!.get(r)).toBeNull();
   });
 
@@ -168,7 +168,7 @@ describe('FileSystemRepository — external writes survive a lost watcher event
     // The backstop must be indistinguishable from the fast path: a subscriber
     // cannot be made to care which one noticed.
     expect(created[0]!.source).toBe('fs');
-    expect(created[0]!.actor).toBe('fs');
+    expect(created[0]!.actor).toBeNull();
     expect(created[0]!.parentHash).toBeNull();
 
     // ── update ───────────────────────────────────────────────────────────
 
@@ -128,7 +128,7 @@ describe('FileSystemRepository — on-disk semantics', () => {
     expect(collected).toHaveLength(1);
     expect(collected[0]!.op).toBe('update');
     expect(collected[0]!.source).toBe('fs');
-    expect(collected[0]!.actor).toBe('fs');
+    expect(collected[0]!.actor).toBeNull();
   }, WATCHER_CASE_TIMEOUT_MS);
 
   it('chokidar: own writes do not re-trigger events (self-write suppression)', async () => {
 
@@ -196,6 +196,6 @@ describe('FileSystemRepository — attaching creates nothing on disk (#7000)', (
     expect(collected).toHaveLength(1);
     expect(collected[0]!.op).toBe('update');
     expect(collected[0]!.source).toBe('fs');
-    expect(collected[0]!.actor).toBe('fs');
+    expect(collected[0]!.actor).toBeNull();
   }, WATCHER_CASE_TIMEOUT_MS);
 });
@@ -170,7 +170,7 @@ describe('#7335 self-write suppression is keyed on observed content, not on a cl
       expect(added).toHaveLength(1);
       expect(added[0]!.op).toBe(expectedOp);
       expect(added[0]!.source).toBe('fs');
-      expect(added[0]!.actor).toBe('fs');
+      expect(added[0]!.actor).toBeNull();
       expect(added[0]!.hash).toBe(hashSpec(externalSpec));
     });
 
@@ -306,7 +306,7 @@ describe('#7856 a self-written spec is never republished as an external edit', (
     const added = (await readLog(root)).slice(before.length);
     expect(added).toHaveLength(1);
     expect(added[0]!.op).toBe('update');
-    expect(added[0]!.actor).toBe('fs');
+    expect(added[0]!.actor).toBeNull();
     expect(added[0]!.hash).toBe(hashSpec(externalSpec));
   });
 });
 
@@ -268,7 +268,7 @@ describe('FileSystemRepository watcher — dot-rooted watch root (#7150)', () =>
     expect(sink.events[0]!.op).toBe('update');
     expect(sink.events[0]!.ref.name).toBe('case_grid');
     expect(sink.events[0]!.source).toBe('fs');
-    expect(sink.events[0]!.actor).toBe('fs');
+    expect(sink.events[0]!.actor).toBeNull();
   }, CASE_TIMEOUT_MS);
 
   it('still ignores dot entries UNDER the root, including its own bookkeeping', async () => {
 
@@ -203,6 +203,6 @@ describe('FileSystemRepository watcher — writes register their own path (#7282
     const updates = events.filter((e) => e.ref.name === 'fresh' && e.op === 'update');
     expect(updates).toHaveLength(1);
     expect(updates[0]!.source).toBe('fs');
-    expect(updates[0]!.actor).toBe('fs');
+    expect(updates[0]!.actor).toBeNull();
   }, CASE_TIMEOUT_MS);
 });