docs(cli): carry the runtime-state rename's breaking-ness in the changeset

The launch window refuses `major`, so the bump level is not the carrier: a
breaking change ships as `minor` and its only signals are the BREAKING banner
in the changeset body and the ADR-0087 disposition marker that
`check-adr-0087-registration.mjs` re-verifies. This diff retires a shipped
observable -- the on-disk name a supervisor opens -- and the changeset said so
in its own prose while carrying neither signal.

Adds both. The disposition is `not-required (no-migration-prescription)`,
derived from the gate's own `CATEGORIES` const rather than its prose header:
nothing authorable moves, `packages/spec` is untouched, and what is retired is
a path on disk rather than a metadata surface the ledger can project into
`spec-changes.json` or the upgrade guide. `unpublished` is false (the package
publishes), `already-registered` names no entry that covers this, and neither
`runtime-interface-only` nor `type-surface-only` has a `path#Symbol` to name.

Also ends the two names `serve.ts` was stating at once. The
`BoundPortChannels.writeRuntimeState` interface doc and the four other
current-tense sites named the retired file; they now name the shipped one,
while the measured ENOENT quote and the pre-repair collision diagram keep the
name they observed and say that is what it was. The anchoring boundary an
out-of-tree reader has to replicate -- the app root is the config's own
directory only when that config exists and that directory carries a
`package.json`, else the CWD -- is stated beside the symlink boundary.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

.changeset/runtime-state-file-project-key.md

@@ -4,6 +4,10 @@
 
 `os serve`'s runtime state file is keyed by the PROJECT, not by the environment id alone — so two projects on one machine stop overwriting each other's supervision record.
 
+<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable moves: no spec key, export, config field or stored metadata changes spelling or shape, `packages/spec` is untouched, and `objectstack migrate meta` has nothing to rewrite. What is retired is the NAME of a best-effort supervision file that `os serve` writes under the ObjectStack home — a path on disk, not a metadata surface the ledger can project into `spec-changes.json` or the generated upgrade guide. The affected party is an out-of-tree supervisor that opens that path, and the one action it takes is deleting a single stale file; there is no authored artifact for a metadata upgrader to rewrite, and no ledger entry could reach the party that is affected. -->
+
+**BREAKING** for anything that opens the runtime state file by its old name. Shipped as `minor` under the launch-window convention: while the whole workspace versions in lockstep the bump level carries no breaking-ness, so this banner and the ADR-0087 disposition above are the carriers. The file `os serve` writes under the ObjectStack home was named `runtime.<environment>.json` and is now named `runtime.<environment>.<project>.json`.
+
 `os serve` publishes `{ pid, port, url, environmentId, startedAt }` to a file under the ObjectStack home, so a supervisor can answer *"is my server running, and where?"*. That file was named `runtime.<environment>.json`, and both halves of where it lived were machine-global: `resolveObjectStackHome()` takes no arguments (it reads `OS_HOME`, else `~/.objectstack`), and an environment id is not a project identity. Two different projects on one machine, both in the ordinary `local` environment, therefore wrote one file.
 
 Driven with two real boots, two project roots and one home, that produced two failures with one cause:
@@ -15,4 +19,6 @@ The file is now `runtime.<environment>.<project>.json`, where the project compon
 
 **If you read this file:** a reader that hard-codes `runtime.<environment>.json` now gets `ENOENT` rather than a stale or foreign record — a loud, correct answer to "is my server running", where the old name could only give a confident wrong one. Readers that glob `runtime.*.json` inside a home they pinned themselves (as `scripts/publish-smoke.sh` does) are unaffected. A `runtime.<environment>.json` left over from an earlier version is no longer written or cleaned up by `os serve`; delete it once.
 
-Two boots of the *same* project still share one file, which is the same-project case and unchanged here.
+**Which root the project component is taken from**, for a supervisor that has to reconstruct the name out of tree: it is the app root `serve` anchors at, which is the config file's own directory when that file exists and that directory carries a `package.json`, and the process's working directory otherwise. Two boundaries follow, stated rather than fixed: the same app served from two working directories without a manifest keys two files, and the key is the resolved path rather than the realpath, so two symlinked spellings of one project key differently — each spelling gets its own file, and each is internally consistent.
+
+Two boots of the *same* project from the *same* anchor still share one file, which is the same-project case and unchanged here.

packages/cli/src/commands/serve.ts

@@ -392,9 +392,9 @@ export function formatExhaustedPortSearchNotice(requestedPort: number, cause: un
  * `serve` used to publish the port it was ASKED for on all three of the
  * channels that ANNOUNCE an address — the `objectstack:listening` IPC message,
  * the ready banner's `API:` row (through {@link resolveAuthBaseUrl}), and
- * `runtime.<environment>.json`. For every port but one the requested and the
- * bound value coincide, which is why it stayed invisible; for `0` they CANNOT
- * coincide. `MIN_PORT = 0` is legal on purpose — `utils/port-contract.ts` says
+ * `runtime.<environment>.<project>.json`. For every port but one the requested
+ * and the bound value coincide, which is why it stayed invisible; for `0` they
+ * CANNOT coincide. `MIN_PORT = 0` is legal on purpose — `utils/port-contract.ts` says
  * so in its own words, from its own measurement, that 0 is "a REQUEST, not an
  * error", and `listen(0)` binds a kernel-assigned port. So `os serve --port 0`
  * announced `{ port: 0 }`, printed `API: http://localhost:0/` and wrote
@@ -460,8 +460,8 @@ export interface ListeningMessage {
  */
 export interface BoundPortChannels {
   /**
-   * Writes `runtime.<environment>.json`. ⛔ Must COMPLETE before either
-   * announcement below: it is the file both of them send a consumer to.
+   * Writes `runtime.<environment>.<project>.json`. ⛔ Must COMPLETE before
+   * either announcement below: it is the file both of them send a consumer to.
    */
   writeRuntimeState: (published: { port: number; url: string }) => void;
   /** Sends {@link ListeningMessage}, when an IPC channel is open. */
@@ -476,14 +476,14 @@ export interface BoundPortChannels {
  * ## The bug this shape exists to make impossible
  *
  * `os serve` announces its address on three channels: the runtime state file
- * `runtime.<environment>.json`, the `objectstack:listening` IPC message, and
- * the ready banner. Two of those are ANNOUNCEMENTS a consumer reacts to; the
- * third is the FILE those consumers then open. Published in the order they
+ * `runtime.<environment>.<project>.json`, the `objectstack:listening` IPC
+ * message, and the ready banner. Two of those are ANNOUNCEMENTS a consumer
+ * reacts to; the third is the FILE those consumers then open. Published in the order they
  * happened to be written — banner, IPC, file — every consumer that believes an
  * announcement races a file that is not there yet:
  *
  * ```text
- * banner  ─▶ a supervisor sees "ready" and opens runtime.env_local.json
+ * banner  ─▶ a supervisor sees "ready" and opens runtime.env_local.<project>.json
  * IPC     ─▶ the `os dev` parent sees the port
  * file    ─────────────────────────▶ ...written here. The ENOENT already happened.
  * ```
@@ -492,10 +492,11 @@ export interface BoundPortChannels {
  * claim (`serve-publishes-bound-port.e2e.test.ts`) is an ORDINARY consumer — it
  * waits for the banner AND the IPC message, then reads the file — and it
  * ejected 14 PRs from the shared merge queue in a rolling 24 hours (10
- * independent hits, #13158) with `ENOENT: ... runtime.env_local.json`. A real
- * supervisor written the same way loses the same race; all a loaded machine
- * does is deschedule the child between the announcement and the write, which is
- * why it read as a flake for a day.
+ * independent hits, #13158) with `ENOENT: ... runtime.env_local.json` — the
+ * name that file carried then, before {@link runtimeStateFileName} keyed it by
+ * project as well. A real supervisor written the same way loses the same race;
+ * all a loaded machine does is deschedule the child between the announcement
+ * and the write, which is why it read as a flake for a day.
  *
  * ⛔ The repair is NOT to make the reader poll. A consumer that must poll after
  * being told "ready" was told "ready" too early — polling spreads the defect
@@ -572,6 +573,17 @@ export function publishBoundPort(boundPort: number, channels: BoundPortChannels)
  * spelling gets its own file, and each is internally consistent). Two boots of
  * the SAME project also still share a file — that is the same-project case,
  * which is #15374's in-process watch, not this one.
+ *
+ * ⚠️ Second boundary, and the one an OUT-OF-TREE reader has to replicate to
+ * find the record: WHICH root this is handed is {@link servedAppRootOrCwd},
+ * which {@link anchorServedApp} sets to the CONFIG'S OWN DIRECTORY only when
+ * that config exists and that directory carries a `package.json`, and to
+ * `process.cwd()` otherwise. So one app served from two working directories
+ * with no manifest beside its config keys TWO files, and a supervisor that
+ * reconstructs the name out of tree has to apply that same rule rather than
+ * assume the config's directory. That fallback is #11185's and is deliberate:
+ * a directory that declares nothing is not anchored at, because anchoring
+ * there could only turn a working boot into an `undeclared` refusal.
  */
 export function projectStateKey(servedAppRoot: string): string {
   const absolute = path.resolve(servedAppRoot);
@@ -4741,9 +4753,9 @@ export default class Serve extends Command {
       // ── The port this process ACTUALLY bound (#13062) ─────────────
       // Read ONCE, here, and handed to every channel that announces an address:
       // the ready banner below, the `objectstack:listening` IPC message and
-      // `runtime.<environment>.json`. Those three were three outputs of ONE
-      // number, and that number was the port that had been REQUESTED — equal to
-      // the bound one for every value except the one where it can never be
+      // `runtime.<environment>.<project>.json`. Those three were three outputs
+      // of ONE number, and that number was the port that had been REQUESTED
+      // — equal to the bound one for every value except the one where it can never be
       // (`--port 0`), which is how all three came to announce `localhost:0`
       // with nothing erroring.
       //