`resolveDraftOrgScopeForPublish` probes without the package dimension, so a package-stating per-item publish can resolve the wrong org scope and answer `no_draft`

[os-elon]

Filed unassigned from #10350, which was scoped to publishMetaItem's declared request type plus three stale comments. This is the behavioural half that the third of those comments turned out to be sitting on. Not fixed there — it needs its own fixture and its own ruling on precedence.

What is true today

publishMetaItem resolves WHICH ORG SCOPE's draft it means before promoting, via resolveDraftOrgScopeForPublish (#10219, packages/metadata-protocol/src/protocol.ts). Both of that helper's probes read sys_metadata without the package_id dimension:

const inOrg = await this.engine.findOne('sys_metadata', {
 where: { organization_id: requestOrgId, type: singularType, name, state: 'draft' },
});
if (inOrg) return requestOrgId;
const inEnv = await this.engine.findOne('sys_metadata', {
 where: { organization_id: null, type: singularType, name, state: 'draft' },
});
return inEnv ? null : requestOrgId;

That was correct, and its in-tree comment said so, for the reason it gave: the per-item door named no package, so promoteDraft resolved with "match any package" and these reads asked the same question it would.

#10063 changed the premise. POST /meta/:type/:name/publish?package=PKG_ID now states a package, publishMetaItem forwards it, and promoteDraftForPublish threads it into repo.promoteDraft — whose whereFor does constrain package_id. So the scope probe and the promote can now ask different questions.

The consequence

With two packages holding drafts for one (type, name) in different org scopes — the ADR-0048 coexistence protocol-publish-drafts-package-scope.test.ts exists for — publishing the one that is env-wide fails:

• app.other holds a draft for (object, shared_ticket) in org1
• app.demo holds a draft for the same (object, shared_ticket) env-wide (organization_id IS NULL)
• caller: POST /meta/object/shared_ticket/publish?package=app.demo, session org org1

Probe 1 is package-agnostic, finds app.other's org1 row, and returns org1. The promote then looks in org1 with package_id = 'app.demo', finds nothing, and the door answers 404 [no_draft] — while app.demo's draft is sitting env-wide, publishable, and was the row the caller named.

The inverse shape also exists: a probe that lands env-wide because the caller's own org row belongs to another package.

Why it was not fixed in #10350

#10350's fence was the declared type and the comments; changing which scope a publish resolves is a behaviour change needing its own pins, and the correct precedence between the ADR-0005 overlay order and the ADR-0048 package key is a real decision rather than a mechanical repair. The stale claim in that comment was corrected in #10350 (it no longer tells the reader the door cannot name a package) and the comment now points here; the behaviour is untouched.

The decision this needs

Threading packageId into both probes is the obvious move, but it is not obviously right on its own:

1. Probe with the package — the probes then ask exactly the promote's question. Cost: a caller stating a package can no longer discover a draft of that (type, name) authored with no package binding, which today it can.
2. Probe with the package, falling back to package-agnostic — preserves today's reach, but reintroduces a two-question resolution, which is the shape publishPackageDrafts can promote (and drain) ANOTHER package's draft row — the promote resolves the draft without the ADR-0048 package dimension #8907 was about.
3. Leave it and refuse loudly — detect the disagreement and answer something better than a bare no_draft.

Option 1 is the contract-first reading and the one I would start from, but it is a narrowing of a live door, so it wants the maintainer's call rather than an agent's.

Re-check

sed -n '/private async resolveDraftOrgScopeForPublish/,/return inEnv ? null : requestOrgId;/p' packages/metadata-protocol/src/protocol.ts

Unassigned, concrete, awaiting first-touch grading.

---

Generated by Claude Code

[huangyiirene]

Triage: lands in packages/metadata-protocol ⇒ domain:engine, filed into the decision inbox (needs-user-decision) — option 1 narrows a live published door (which (type,name) draft a package-stating publish can reach), and the precedence between ADR-0005 overlay order and the ADR-0048 package key is a contract-shape call, i.e. the manual floor.

[facets-block]

• 实际业务需求:ADR-0048 包共存(两个应用包各持同名对象的草稿)是平台自己的测试在钉的真实场景;今天指名发布 app.demo 的草稿会得到「无草稿」404,而草稿明明在——现状是对着存在的东西说不存在,修是必须的,分歧只在语义。
• 项目长远合理性:探针与提升必须问同一个问题(方案 A);「先按包问、再退回不问包」的两问解析(方案 B)正是 publishPackageDrafts can promote (and drain) ANOTHER package's draft row — the promote resolves the draft without the ADR-0048 package dimension #8907 清理过的形态,重新引入就是走回头路。
• 防 AI 写代码犯错:调用方声明了 ?package= 就按包解析,契约收紧;fallback 是静默容错的温床——AI 写错包名时,B 会「碰巧发布到别的包的草稿」,A 会响亮地找不到。
• 创业阶段不扩散需求:A 改两个 findOne 的 where,零新机制;C(检测分歧后响亮报错)是在 A 之上加一层诊断,可作回退不作首选。

一句话问题:指名包的发布,其草稿定位探针要不要也按包问(从而放弃「发现无包绑定草稿」的既有可达性)?

选项	客户可感知代价
A 探针带包维度(=卡内 Option 1)	指名包的调用不再能「顺带」发布同名的无包草稿——它会 404,调用方须去掉 ?package= 再试
B 带包+无包兜底(Option 2)	保住旧可达性,但错包名时静默发布到非预期草稿;两问解析回归
C 保持现状+检测分歧响亮报错(Option 3)	该场景仍不可用,只是报错从误导变诚实

推荐 A(置信度中高,即卡内 filer 的起点):四轴同向,B 只在「存量调用方真的依赖无包发现」时才有业务理由。本分析看不见什么:有没有真实调用方今天依赖「stating a package 却发现 no-package draft」——本席未测调用方普查(含 cloud 侧,不在本会话授权面)。裁决格式:回「A」/「B」/「C」;A ⇒ 晋级 pm:queue 派 engine 席,派发令带 ADR-0048 coexistence fixture 义务(卡内场景即用例)+ 反向场景(org 行属他包)同批钉住。

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling recorded — A: the scope probes ask the promote's question (probe with the package)

Provenance: maintainer, 2026-08-22, live session (「同意所有」, item 7 = A).

State: needs-user-decision → pm:queue (engine lane), Bug. Scope: thread packageId into both resolveDraftOrgScopeForPublish probes so a package-stating publish resolves the scope of the draft it named. Accepted cost, on the record: a caller stating a package no longer discovers a no-package draft of the same (type,name) — it 404s and the caller retries without ?package=; that narrowing is the ruling, not a side effect. Required pins from the adjudication: the ADR-0048 coexistence scenario from the card's body (env-wide draft in app.demo, org draft in app.other — publish must find app.demo's) and the inverse shape, both against the real protocol.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 4
Session: session_01RfyXxZ2WPjcjhuXpiQQc3y
Branch: claude/issue-11003-publish-scope-probe-package-dimension
Worktree: objectstack-issue-11003
Domain: domain:engine
File surface: packages/metadata-protocol/src/protocol.ts (resolveDraftOrgScopeForPublish :4616, its single-item caller at :14654) + ADR-0048 coexistence pins + changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5
Clause-②: yes — this card narrows a live published door: a package-stating publish that resolves a draft today will 404 after it. That is the ruling's accepted cost, stated as such by the maintainer, which makes it a deliberate accept/reject change rather than a side effect. Tier read from its single source (scripts/pm/dispatch-gates.mjs:2722, CONTRACT_REVIEW_TIER) rather than recalled. The adjudication being settled does not lower the tier — the mandate is written on card CONTENT, never on who adjudicated.
Serial constraints cleared: packages/metadata-protocol is also carrying open PR #11139 (sys-metadata-repository.ts + one new test). This card is protocol.ts — file-disjoint. See the serialization note below, which is a change in this seat's own rule. In-flight siblings #11009 (metadata-core / objectql / driver-sql / service-messaging) and #11065 (driver-memory) are disjoint. Lane in-flight at claim: 2.

裁决(照抄不译)

维护者 2026-08-22 live session,「同意所有」,item 7 = A,由分诊席记录于 issuecomment-5380749352:

A: the scope probes ask the promote's question (probe with the package) … Scope: thread packageId into both resolveDraftOrgScopeForPublish probes so a package-stating publish resolves the scope of the draft it named. Accepted cost, on the record: a caller stating a package no longer discovers a no-package draft of the same (type,name) — it 404s and the caller retries without ?package=; that narrowing is the ruling, not a side effect.

⛔ Options B and C are closed. B (package-first with a package-agnostic fallback) was rejected by name — it reintroduces the two-question resolution #8907 removed, and its failure mode is the dangerous one (a mistyped package silently publishes another package's draft instead of failing loudly). C (detect-and-refuse) is a diagnostic layer over A, available as a fallback only, never as the answer. ⛔ Do not silently substitute an option: if implementation makes A untenable, stop and report the fork — the card returns to needs-user-decision, it is not re-decided by the dev or by this seat.

Required pins — named by the adjudication, not optional

Both against the real protocol, not a hand-built double:

1. The card's own ADR-0048 coexistence scenario: app.other holds an org1 draft for (object, shared_ticket); app.demo holds an env-wide draft (organization_id IS NULL) for the same (type,name); POST /meta/object/shared_ticket/publish?package=app.demo with session org org1 must find app.demo's draft. Today probe 1 is package-agnostic, matches app.other's org1 row, returns org1, and the promote then answers 404 [no_draft] over a draft that is sitting there publishable.
2. The inverse shape — the probe landing env-wide because the caller's own org row belongs to another package.

protocol-publish-drafts-package-scope.test.ts already exists for this coexistence family; extend it rather than starting a parallel harness, unless you can say why it is the wrong home.

⚠️ Read PR #11139 before writing the fixtures — the premise moved today

PR #11139 (open, same package, sys-metadata-repository.ts) makes a package-less ?mode=draft save inherit the overlaid active row's package_id, and additionally adopts pre-existing NULL-package draft rows for the same (org, type, name) instead of forking a second row.

That is complementary to this card, not in conflict — #11139 shrinks the population of package-less drafts, and this card makes the publish probe package-exact — but it moves the ground your fixtures stand on: a fixture that seeds a package-less draft by calling put(…, {state:'draft'}) over a package-bound active row will no longer produce a package-less draft once #11139 lands. Seed such rows explicitly rather than through a save path whose binding behaviour is changing under you, and say in your report which method you used. ⛔ Do not edit sys-metadata-repository.ts.

⛔ Boundaries

• ⛔ packages/spec is off limits — the ADR-0005 overlay order and the ADR-0048 package key are contract surfaces; if A cannot be expressed without touching spec, stop and report (that is a domain:spec seat card, not yours).
• ⛔ Do not widen the change beyond the two probes and their caller. The promoteDraft / whereFor side already constrains package_id correctly — this card makes the probe agree with it, it does not renegotiate either.
• ⛔ Never edit content/docs/releases/; breaking changes ship as minor under this repo's launch-window convention.

Serialization rule change — recorded because this seat publicly committed to the stricter one

This card would not have been dispatched an hour ago. This seat has been serializing on same package, and said so on the record while asking the maintainer whether to relax it to same-file. The question is now answered by the repo instead, and against the rule this seat was holding — scripts/check-single-claim-paths.mjs carries the measurement:

any shared changed path (repo-wide) -> 68 concurrent pairs / the declared list below -> 0 concurrent pairs … "Those are ordinary concurrent work in a repo taking ~18 merges a day, so a gate keyed that way is ~68 false accusations per 300 PRs"

and its declared at-most-one-writer list has exactly one entry, .objectui-sha, with the explicit instruction that anything "merely hot (a lock file, a root manifest, a shared registry)" does not belong on it. So the repo's landing discipline treats shared-path concurrency as ordinary and names the one surface that is genuinely single-writer. Same-package serialization has no measurement, mechanism or ruling behind it, and it was blocking three cards in this lane today for no established benefit.

New standing rule for this seat: serialize on same FILE (rework between this lane's own concurrently-dispatched devs is real), plus a hard single-claim on .objectui-sha. Same-package alone no longer blocks. The maintainer question is withdrawn as answered by evidence; if the maintainer prefers the stricter rule anyway, that ruling overrides this note.

---

Generated by Claude Code