fix: judge the anonymous intake refusal only where a tenancy posture exists

Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts

@@ -579,11 +579,10 @@ describe('org-scoped anonymous form intake changes the anonymous doors cannot se
         config: { sharing: sharing(allowAnonymous) },
     });
 
-    /** `defaultOrgId` answers what the anonymous doors resolve; `undefined` = no tenancy service. */
-    function makeTenancyProtocol(defaultOrgId: string | null | undefined) {
+    /** `defaultOrgId` answers what the anonymous doors resolve. */
+    function makeTenancyProtocol(defaultOrgId: string | null) {
         const { engine, rows } = makeStubEngine();
-        const services = new Map<string, unknown>();
-        if (defaultOrgId !== undefined) services.set('tenancy', { defaultOrgId: async () => defaultOrgId });
+        const services = new Map<string, unknown>([['tenancy', { defaultOrgId: async () => defaultOrgId }]]);
         const protocol = new ObjectStackProtocolImplementation(engine, () => services, 'env_prod') as any;
         return { protocol, rows };
     }
@@ -638,15 +637,6 @@ describe('org-scoped anonymous form intake changes the anonymous doors cannot se
         expect(orgRows(rows).filter((r) => r.org === 'org_a' && r.state === 'active')).toEqual([]);
     });
 
-    it('no tenancy service: the doors read env-wide, so the org-scoped withdrawal is refused', async () => {
-        const { protocol } = makeTenancyProtocol(undefined);
-        await publishEnvWide(protocol);
-
-        await expect(protocol.saveMetaItem({
-            type: 'view', name: 'task.intake_form', item: FORM_VIEW(false), organizationId: 'org_a',
-        })).rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403 });
-    });
-
     it('control (walled): an org-scoped edit that leaves the anonymous intake alone still saves', async () => {
         const { protocol, rows } = makeTenancyProtocol(null);
         await publishEnvWide(protocol);

packages/metadata-protocol/src/protocol.ts

@@ -14528,9 +14528,10 @@ export class ObjectStackProtocolImplementation implements
      * The doors resolve the form in `tenancy.defaultOrgId()`'s organization
      * (`registerFormEndpoints` in `@objectstack/rest`). Where that is not the
      * write's organization (every walled posture, degraded or not, answers
-     * `null`; so does a composition with no tenancy service), the doors read
-     * the env-wide definition, so the write is refused and the author is
-     * pointed at the env-wide save, which every door honours.
+     * `null`), the doors read the env-wide definition, so the write is refused
+     * and the author is pointed at the env-wide save, which every door
+     * honours. A composition with no tenancy service has no posture to judge
+     * (and no session to carry an organization over HTTP), so it is left as is.
      *
      * Judged on the anonymous slug set alone ({@link anonymousFormIntakeSlugs}):
      * an organization-scoped edit that leaves it as the env-wide definition has
@@ -14549,9 +14550,8 @@ export class ObjectStackProtocolImplementation implements
         const tenancy = this.getServicesRegistry?.().get('tenancy') as
             | { defaultOrgId?: () => Promise<string | null> }
             | undefined;
-        const doorOrganization = typeof tenancy?.defaultOrgId === 'function'
-            ? await tenancy.defaultOrgId()
-            : null;
+        if (typeof tenancy?.defaultOrgId !== 'function') return null;
+        const doorOrganization = await tenancy.defaultOrgId();
         if (doorOrganization === args.organizationId) return null;
         const proposed = anonymousFormIntakeSlugs(args.body);
         const served = anonymousFormIntakeSlugs(