test(rest,runtime): the every-type org-scope fixtures hold the datasource write capability

Claude-Session: https://claude.ai/code/session_01MRdbfpy4sQT8bUjmMhxsN7
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/rest/src/rest-server-meta-org-scope-url-spelling.test.ts

@@ -132,7 +132,9 @@ function boot(execCtx: any) {
 /** The request object the route handed to the protocol. */
 const requestFrom = (fn: any) => fn.mock.calls[0][0];
 
-const AUTHORIZED = { userId: 'u1', systemPermissions: ['manage_metadata'], tenantId: ORG };
+// [#21124] `manage_platform_settings` too: these suites iterate every registered type, and a
+// `datasource` write is admitted only with it (`metaTypeWriteRefusal`, the type-level write admission).
+const AUTHORIZED = { userId: 'u1', systemPermissions: ['manage_metadata', 'manage_platform_settings'], tenantId: ORG };
 
 async function writeWith(type: string) {
     const b = boot(AUTHORIZED);

packages/rest/src/rest-server-meta-write-org-scope.test.ts

@@ -126,8 +126,10 @@ function boot(execCtx: any) {
 /** The request object the route handed to the protocol. */
 const requestFrom = (fn: any) => fn.mock.calls[0][0];
 
-const AUTHORIZED = { userId: 'u1', systemPermissions: ['manage_metadata'], tenantId: ORG };
-const AUTHORIZED_NO_ORG = { userId: 'u1', systemPermissions: ['manage_metadata'] };
+// [#21124] `manage_platform_settings` too: these suites iterate every registered type, and a
+// `datasource` write is admitted only with it (`metaTypeWriteRefusal`, the type-level write admission).
+const AUTHORIZED = { userId: 'u1', systemPermissions: ['manage_metadata', 'manage_platform_settings'], tenantId: ORG };
+const AUTHORIZED_NO_ORG = { userId: 'u1', systemPermissions: ['manage_metadata', 'manage_platform_settings'] };
 
 /** Drive one write door with the given type + execution context. */
 async function writeWith(type: string, execCtx: any) {

packages/runtime/src/meta-write-org-scope.test.ts

@@ -263,9 +263,12 @@ const ctx = (activeOrganizationId?: string): any => ({
     // dropped). The dispatcher's `/meta` doors scope by THIS value — the vetted
     // one `RestServer`'s doors read — never the claim as stored, so a case whose
     // session has an active organization hands the same one in here.
+    // [#21124] `manage_platform_settings` too: the URL-contract case below drives
+    // every registered type, and a `datasource` write is admitted only with it
+    // (`metaTypeWriteRefusal`, the type-level write admission).
     executionContext: {
         userId: 'usr_1',
-        systemPermissions: ['manage_metadata'],
+        systemPermissions: ['manage_metadata', 'manage_platform_settings'],
         ...(activeOrganizationId ? { tenantId: activeOrganizationId } : {}),
     },
 });