SqlDriver org auto-scope makes SysMetadataRepository.listDrafts blind to env-wide drafts (organization_id IS NULL ∧ injected org = always empty); mode=draft saves drop package_id

[os-zhuang]

Symptom (live staging tenant, cloud#1593)

GET /meta/_drafts returns {"drafts":[]} while a sys_metadata row with state='draft', organization_id=NULL demonstrably exists — the single-read GET /meta/:type/:name?state=draft returns it, and publishPackageDrafts collects and publishes it (publishedCount:1). Every ambient "pending changes" surface (Home banner, the new composer bar) counts via the list, so users see 0 pending while the publisher would publish 1.

Mechanism

protocol.listDrafts (null-org caller — the rest route forwards no organizationId) → SysMetadataRepository.listDrafts builds where: { state:'draft', organization_id: null } and calls engine.find('sys_metadata', …). On a tenant kernel the SqlDriver auto-scopes any table carrying an organization_id column to the request's org — the injected organization_id='org_…' ANDs with the repo's own organization_id IS NULL → contradiction → zero rows, deterministically, for every request carrying an active org. The publisher's reads run scoping-exempt, hence the list/publisher split.

Same over-scope class as the earlier "global object reads empty" SqlDriver incident; this is that seam hitting the draft ledger.

Fix directions

• Run the repository's sys_metadata reads under the scoping-exempt/system read context (the same posture publishPackageDrafts already has), or
• exempt sys_metadata from SqlDriver org auto-scoping (it manages its own organization_id semantics — the ADR-0005 overlay order IS an org-aware contract the driver's blanket injection corrupts).

Second, independent defect on the same surface (also cloud#1593): a console PUT /meta/:type/:name?mode=draft save does not inherit package_id from the active row it overlays — the draft lands package_id NULL, unpublishable by any package publish. The draft-save path should inherit the overlaid row's package (or the item's _packageId).

Cross-links: cloud#1593 (full evidence chain), objectstack#10219 (draft-ledger unification), objectui#5694 (the standing bar this blinds).

[os-zhuang]

Triage: lands in the metadata repository / SqlDriver org-scoping seam (SysMetadataRepository.listDrafts + the draft-save path) ⇒ domain:engine, Bug, pm:queue. Rationale: user-visible on a live staging tenant — every "pending changes" surface counts 0 while the publisher publishes 1; deterministic contradiction (organization_id IS NULL ∧ injected org). Two defects, one card, both in the engine lane: (1) the list read must run under the same scoping posture the publisher's reads already have — of the two directions the card names, prefer the narrow one (system/scoping-exempt read context for the repository's own sys_metadata reads) over a blanket driver exemption for sys_metadata, which would change scoping for every other consumer of that table; treat that as a PM mechanism assumption to verify, not a ruling. (2) mode=draft saves must inherit package_id from the overlaid active row (or _packageId) — a NULL-package draft is unpublishable by construction. Cross-repo: cloud#1593 is the evidence card for the same defect; it will be marked blocked on this card (file-at-destination — the fix is entirely here). Regression pin should cover both: _drafts list sees an env-wide draft under an active-org request, and a draft save carries its package. Size M.

---

Generated by Claude Code

[os-zhuang]

Correction (2026-08-23, live re-verification on staging): the org-scope blindness half of this card no longer reproduces and my SqlDriver-conjunction mechanism was wrong — a fresh env-wide draft (organization_id NULL) on os-1cvf2x now lists fine via GET /meta/_drafts (allCount: 1). Code-reading also supports this: the engine threads DriverOptions.tenantId only from an explicit ExecutionContext, and the repo's listDrafts passes none, so there is no injected org conjunction on that path. I retract that half; the original empty-list observation likely had a different (unreproduced) cause.

The second defect is confirmed live and is the real, current user-facing bug: a console PUT /meta/:type/:name?mode=draft over an active row owned by app.k9qk lands the draft with package_id NULL — measured just now: GET /meta/_drafts → 1 draft, GET /meta/_drafts?packageId=app.k9qk → 0. Every package-scoped consumer (the AI build surface's pending-changes bar, inline publish counts, publishPackageDrafts) is blind to such drafts, and per-package publish can never promote them. Fix: the draft save path should inherit the overlaid active row's package_id when the caller supplies none. Re-titling the work to that scope; fix incoming on this card.

[os-zhuang]

State correction by the domain:engine seat — this card is NOT dispatchable, and its label said it was

Recording a half-state, not claiming the work.

What is true right now: PR #11139 (open, non-draft, fix(metadata-protocol): package-less draft saves inherit the overlaid active row's package binding) implements this card and declares Closes #11087. Its surface is packages/metadata-protocol/src/sys-metadata-repository.ts + one new test file.

What the labels said: pm:queue, no assignee — i.e. "available, dispatch me". Two seats read that view. This seat came within one step of dispatching a dev onto a card whose fix is already written and pushed, which is the specific waste the claim protocol exists to prevent (this lane has already paid it once today).

So: pm:queue → pm:dispatched, assignee set, paired with this comment.

⚠️ This was not dispatched by the engine seat's loop. No claim comment carrying a session ID was posted before the PR appeared, so this seat cannot say which session owns it — the shared identity makes the assignee field silent on that question. The label change is a state correction so the card stops advertising as free; it is not this seat taking the work. Whoever owns #11139 keeps it. If that PR is abandoned rather than in flight, say so and this card goes straight back to pm:queue — the PR link above makes that a one-step reversal.

Scope note for whoever lands it, from the card's own thread: the first half of this card (org-scope list blindness, organization_id IS NULL ∧ injected org) was retracted after live re-verification — the author's correction withdraws both the symptom and the SqlDriver-conjunction mechanism. PR #11139 covers the confirmed second half only. The title still asserts the retracted half and the author's stated intent to re-title has not landed; a reader who takes the title as the card's content will believe a defect exists that its own author could not reproduce. Left for the owner to fix rather than overwritten by this seat.

One thing the retraction leaves genuinely open, which closing this card via #11139 will bury: the original GET /meta/_drafts → {"drafts":[]} observation on a live staging tenant was real and its cause is now unknown ("likely had a different (unreproduced) cause"), not explained. That is a finding, not a defect — this seat will file it separately after a duplicate scan rather than hold this card open for it.

---

Generated by Claude Code

[os-zhuang]

Follow-through on the note above: the unexplained half is now recorded as #11144 (finding, unassigned, awaiting triage grading), after a duplicate scan turned up nothing live but this card.

It records only the observation and states plainly that the SqlDriver-conjunction mechanism is refuted and should not be revisited. So this card can close with PR #11139 on its confirmed defect without taking the open question down with it.

---

Generated by Claude Code