fix(rest): GET /meta/_drafts reads in the caller's org scope — closes the write-org/read-null split (#11087 layer 2)

[os-zhuang]

What

The _drafts route threads ctx?.tenantId into protocol.listDrafts — symmetric with the save route's organizationId: ctx?.tenantId. SysMetadataRepository.listDrafts's existing $or contract then surfaces BOTH the caller's org overlay and env-wide drafts.

Why (live staging measurement, cloud#1593)

A view draft saved through the console landed org=org_mt42… (the session carries an active org), while GET /meta/_drafts read with NO org — getOverlayRepo(null) matches only organization_id IS NULL — so the draft was invisible to every pending-changes surface while the single read and the publisher (each threading its own scope) saw it fine. This is the second, orthogonal layer of #11087: layer 1 (merged, #11139) fixed the package_id NULL orphan; this fixes org-scope invisibility. Both are required before the pending-changes bar can count what a console session actually drafts.

Tests

New pin in rest-server-meta-org-scope-url-spelling.test.ts (drafts read carries the caller org); suite file 12/12. Full rest package: 1681/1681 executed tests pass locally (39 file-level load failures are unbuilt-sibling-dist noise on the local rig — service-analytics/service-package dists absent — CI builds the graph).

Part of #11087 / cloud#1593.

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/rest/src/rest-server.ts) — pages documenting those are invisible to this run

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c74aefe636bfa9ba68ed4a85b319db20d9cf2907 → packageMentionDocs.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 32604960585 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Console Pin Gate — 失败步骤: Build the Console SPA at the pinned objectui SHA

  ✗ Build failed in 4.04s
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 108 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)