[2 of #7891] `permission`/`book` wiring: `TYPE_TO_STACK_KEY` entries + the cross-collection snapshot the three comparison rules need

[hotlong]

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2).

Scope (RE-PRICED 2026-08-13 — see the audit comment; the original Blocked-by: #4463 was stale at filing)

Blocker B of the parent card, now including the snapshot enrichment itself: RuntimeStackContext carries objects only (measured by PR #7886, 2026-08-12 — AFTER #4463 closed), so the three cross-collection rules judge against a missing collection — measured 38 phantom security-master-detail-ungranted findings per-write vs 4 whole-stack. permission/book also have no TYPE_TO_STACK_KEY entries (pinned).

This slice delivers BOTH halves, bounded to what the three cross-collection rules need:

1. Snapshot enrichment: the runtime gate's stack view gains the sibling collections those rules compare against (permissions/positions/books as required — measure which), per [runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463's own D2 design note (registry snapshot, built per-write or cached; measure the cost).
2. The wiring: TYPE_TO_STACK_KEY entries for permission/book, consuming the fuller snapshot.

History note — why this is no longer "reference #4463"

#4463 closed 2026-08-02 (PR #4715) delivering its P1 (flow/approval/expression families at the runtime door) + the surfaces registry dimension. The P2 full-snapshot remainder (RUNTIME_NEEDS_FULL_SNAPSHOT) was NOT delivered by that PR and has no other open tracker — #7886's measurement six days later confirms the gap is live. This card is now that remainder's tracker, bounded to the #7891 programme's need.

Re-check commands (premises age)

• git grep -n "TYPE_TO_STACK_KEY" origin/main -- packages/lint/ (entries still absent?)
• git grep -n "RUNTIME_NEEDS_FULL_SNAPSHOT\|RuntimeStackContext" origin/main -- packages/lint/ packages/metadata-protocol/ (snapshot still objects-only?)
• git log --oneline -5 origin/main -- packages/lint/src/runtime-gate.ts

Notes

• ⛔ No partial security-role-word wiring — whole family or not at all (slice 3 / [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310's call).
• Serial constraint: touches packages/lint's runtime gate — serialize behind PR feat(lint): ADR-0091 seed pair crosses the runtime publish gate (#8307) #8390 ([0 of #7891] ADR-0091 seed pair crosses the publish door: runtimeTypes: ['seed'] — measured trip-free first slice #8307) landing.
• Sizing: M–L; acceptance-surface change at the publish door once [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 flips ⇒ price the fable clause at dispatch.

Part of #7891.

[hotlong]

Audit — stale dependency repaired by the domain:spec seat (session session_01Euoy6wyfzgiWtgCg4s6JK2), under the standing lane-triage authorization.

The original body carried Blocked-by: #4463, inherited from the parent card's "already tracked as #4463 P2 — reference it, do not duplicate". Verified today: #4463 closed 2026-08-02 as completed (PR #4715) — before this card was even filed — but its P2 full-snapshot remainder was NOT delivered by that PR: PR #7886's measurement of 2026-08-12 (ten days after the close) found RuntimeStackContext still carries objects only. A Blocked-by: pointing at a closed card whose remaining work has no tracker is a hold nobody can legally release, so per the re-price-on-unblock rule the body is rewritten: the Blocked-by line is removed and this card ABSORBS the bounded snapshot-enrichment remainder (what the three cross-collection rules need — not #4463's full P2/P3 vision, which stays unowned unless the maintainer wants it revived).

Now dispatchable once PR #8390 (#8307, same packages/lint runtime-gate surface) merges. #8310's Blocked-by: #8308 #8309 is unaffected (#8308 done, this card now the live half).

---

Generated by Claude Code