fix(metadata-protocol): draft package inheritance reads the active base across scopes (#11087 layer 1b)

[os-zhuang]

What

The #11139 inheritance resolved the overlaid active row through whereFor, which pins organization_id to the repo's own scope. A console session carries an active org → its draft saves land in the ORG overlay scope → the inheritance looked for an org-scoped active row — but the active base is ENV-WIDE (ADR-0005 overlay order), so for exactly the saves this inheritance exists for it found nothing and the draft stayed package_id NULL (measured live on staging after the layer-1 deploy: org-scoped view draft over an env-wide active row bound to app.k9qk, _drafts?packageId= still 0). The base is now resolved with the same $or two-scope reach listDrafts applies; null-org repos keep the env-wide equality.

Tests

New pin (org repo + env-wide bound active → org-scoped draft inherits app.k9qk); suite now 5/5, full metadata-protocol green, tsc at the frozen DEBT count.

Part of #11087 (final layer). Cloud pin bump + live bar verification to follow.

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 1 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx(via sys_metadata (literal))
• content/docs/api/index.mdx(via sys_metadata (literal))
• content/docs/concepts/metadata-lifecycle.mdx(via sys_metadata (literal))
• content/docs/data-modeling/drivers.mdx(via sys_metadata (literal))
• content/docs/data-modeling/objects.mdx(via sys_metadata (literal))
• content/docs/deployment/cli.mdx(via sys_metadata (literal))
• content/docs/deployment/validating-metadata.mdx(via sys_metadata (literal))
• content/docs/kernel/services-checklist.mdx(via sys_metadata (literal))
• content/docs/permissions/authorization.mdx(via sys_metadata (literal))
• content/docs/permissions/permission-sets.mdx(via sys_metadata (literal))
• content/docs/plugins/packages.mdx(via sys_metadata (literal))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx(via sys_metadata (literal))
• content/docs/releases/v16.mdx(via sys_metadata (literal))
• content/docs/releases/v17.mdx(via sys_metadata (literal))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)

Coarse fallback — 7 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 10485009a693b07cf90c98e81a0d8b824c62be95 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2726ddf86d2d12035441f690e78fb47bee1ceacf — the merge of head 13bd431a0b6f5e1fe41d34460619cf84f4846593 into base 10485009a693b07cf90c98e81a0d8b824c62be95, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2726ddf86d2d12035441f690e78fb47bee1ceacf && git checkout 2726ddf86d2d12035441f690e78fb47bee1ceacf
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 10485009a693b07cf90c98e81a0d8b824c62be95 13bd431a0b6f5e1fe41d34460619cf84f4846593 && git checkout -B drift-repro 10485009a693b07cf90c98e81a0d8b824c62be95 && git merge --no-ff 13bd431a0b6f5e1fe41d34460619cf84f4846593
node scripts/docs-audit/affected-docs.mjs --json 10485009a693b07cf90c98e81a0d8b824c62be95

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 10485009a693b07cf90c98e81a0d8b824c62be95 → pass the list as
args.docs, on the commit named under Which tree this was computed on.