fix(metadata-protocol): listCommits no longer hides env-wide commit history (#7779)

`protocol.listCommits` selected the ADR-0067 timeline with the strict
`organization_id` equality that #7705 (PR #7771) had just replaced one
function above it. `organization_id = '<org>'` matches no row whose
column is NULL, so a session with an active organization was shown none
of the commits recorded env-wide.

Live, not latent, and measured before the fix was written — which the
card set as step one. `recordPackageCommit` stores `request.
organizationId ?? null`, and the only door into a publish (the
dispatcher's `POST /packages/:id/publish-drafts`) forwards an org only
when `resolveActiveOrganizationId` yields one. That resolver answers
`undefined` both for a session with no active organization and for ANY
throw on the auth seam, since its whole body is `catch`-wrapped. So a
publish made before an org is selected, or during a transient auth
blip, records its commit env-wide permanently — the timeline is
append-only. Driven on a real engine over SQLite, a no-org publish
wrote `organization_id: null` and the org-scoped read of that same
package then returned `[]`.

The blast radius is wider than the audit/observability one the card
projected, and that is a finding rather than a detail:
`rollbackToPackageCommit` derives the set of commits it must undo FROM
THIS LIST. A commit the list could not see was silently never
reverted — measured pre-fix, an org-scoped rollback past an env-wide
commit answered `{success: true, revertedCommits: []}` with that
commit's changes still live. A rollback that reports success and rolls
back nothing is a correctness defect, not a reporting one.

An org-scoped read now matches its own organization OR env-wide — the
`$or` shape this package already uses for #3115, the shape #7705
applied to the sibling `deletePackage` read, and the shape the SQL
driver's own tenant wall uses (#2734).

Both directions that must not widen are pinned: another organization's
commits stay invisible, another package's are never returned, and
newest-first ordering is unchanged. The no-org branch is deliberately
left package-wide rather than narrowed to `organization_id IS NULL` —
narrowing would hide every org-scoped commit from that door instead,
re-creating the bug pointed the other way, which is why #7705 left its
own no-org branch alone. The whole shape, or none of it.

The pin uses a real engine and a real driver and asserts the
CONSEQUENCE. Both existing `deletePackage` suites stubbed
`engine.find`, which is why neither could see the sibling defect; the
question here is whether `organization_id = 'org'` matches a NULL
column, which is a property of the driver's SQL and not of a stub's
`filter()`. It seeds through the real publish path and reads back what
landed in SQLite.

Reverse-verified with the direction predicted first: restoring the
strict equality was predicted to turn exactly the two positive cases
red and leave all four others green, because strict equality is
NARROWER than the `$or` — it cannot reach another org's rows or
another package's, and does not touch the no-org branch. Measured on
revert: exactly that, 2 failed / 4 passed, both failures `[1]` vs `[2]`.

KNOWN REMAINING GAP, reported on #7779 rather than fixed here — this
card holds `protocol.ts`, a serialized file, for `listCommits` alone.
`revertCommit` and `rollbackToPackageCommit`'s own target lookups still
carry the identical strict equality. The consequence is now loud rather
than silent: the rollback above reports `success: false` naming the
commit it could not resolve, instead of claiming success over a no-op.
Strictly better and non-destructive, but not the whole repair, so the
new suite asserts it and the remainder cannot drift unnoticed.

Ratchets unchanged: runtime's TEST_DEBT measured exactly 227, its
recorded ceiling, with zero errors attributable to the new file; the
query-options-erasure ratchet holds at 67 non-test sites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kp1rUCEFGp3eYRztsRx1B1

Author: claude

.changeset/list-commits-env-wide-org-scope.md

@@ -0,0 +1,63 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol): `listCommits` no longer hides a package's env-wide commit history (#7779)
+
+`protocol.listCommits` selected the ADR-0067 timeline with the same strict
+`organization_id` equality that #7705 (PR #7771) had just replaced one function
+above it:
+
+```ts
+const where = { package_id: request.packageId };
+if (request.organizationId) where.organization_id = request.organizationId;
+```
+
+`organization_id = '<org>'` matches no row whose column is NULL, so a session
+with an active organization was shown **none** of the commits recorded
+env-wide. The commits were in `sys_metadata_commit` the whole time; the read
+could not see them.
+
+**Env-wide commit rows are actually written — this was live, not latent, and
+that was measured before the fix was written.** `recordPackageCommit` stores
+`organization_id: request.organizationId ?? null`, and the only door into a
+publish (the dispatcher's `POST /packages/:id/publish-drafts`) forwards an
+organization only when `resolveActiveOrganizationId` yields one. That resolver
+answers `undefined` both for a session with no active organization and for *any*
+throw on the auth seam, since its whole body is `catch`-wrapped. A publish made
+before an organization is selected — or during a transient auth failure — is
+therefore recorded env-wide permanently, because the timeline is append-only.
+Driven on a real engine over SQLite, a no-org publish wrote
+`organization_id: null` and the org-scoped read of that same package then
+returned `[]`.
+
+**The blast radius is wider than audit.** `rollbackToPackageCommit` derives the
+set of commits it must undo *from this list*, so a commit the list could not see
+was a commit the rollback silently skipped: measured before the fix, an
+org-scoped rollback past an env-wide commit answered
+`{success: true, revertedCommits: []}` while that commit's changes stayed live.
+A rollback that reports success and rolls back nothing is a correctness defect,
+not a reporting one.
+
+An org-scoped read now matches its own organization **or** env-wide — the
+`$or [{organization_id: oid}, {organization_id: null}]` shape this package
+already uses for the #3115 "orphaned draft" fix, the shape #7705 applied to the
+sibling `deletePackage` read, and the shape the SQL driver's own implicit tenant
+wall uses (`field = :tenant OR field IS NULL`, #2734).
+
+Both directions that must not widen are pinned: another organization's commits
+stay invisible to an org-scoped read, and another package's commits are never
+returned. Newest-first ordering is unchanged. The **no-org** branch is
+deliberately left package-wide rather than narrowed to `organization_id IS
+NULL` — narrowing it would hide every org-scoped commit from that door instead,
+re-creating this bug pointed the other way, which is exactly why #7705 left its
+own no-org branch alone.
+
+**Known remaining gap, reported on #7779 rather than fixed here** (this card
+holds `protocol.ts`, a serialized file, for `listCommits` alone): `revertCommit`
+and `rollbackToPackageCommit`'s own target lookups still carry the identical
+strict equality. The consequence is now *loud* instead of silent — the rollback
+above reports `success: false` naming the commit it could not resolve, rather
+than claiming success over a no-op. That is strictly better and non-destructive,
+but it is not the whole repair, and the new suite asserts it so the remainder
+cannot drift unnoticed before its own card lands.

packages/metadata-protocol/src/protocol.ts

@@ -12114,7 +12114,42 @@ export class ObjectStackProtocolImplementation implements
     }>> {
         try {
             const where: Record<string, unknown> = { package_id: request.packageId };
-            if (request.organizationId) where.organization_id = request.organizationId;
+            // [#7779] Surface BOTH org-scoped and env-wide (`organization_id IS
+            // NULL`) commit rows to an org-scoped caller — the same defect and
+            // the same remedy as the sibling {@link deletePackage} read one
+            // function above (#7705), and as {@link
+            // SysMetadataRepository.listDrafts} (#3115) in this package.
+            //
+            // Env-wide commit rows are not hypothetical: {@link
+            // recordPackageCommit} stores `organization_id: request.
+            // organizationId ?? null`, and the ONLY door into a publish — the
+            // dispatcher's `POST /packages/:id/publish-drafts` — forwards an
+            // org only when `resolveActiveOrganizationId` yields one. That
+            // resolver answers `undefined` for a session with no active
+            // organization AND for every failure on the auth seam (it is
+            // `catch`-wrapped). So a publish made before an org was selected —
+            // or during a transient auth blip — lands its commit env-wide,
+            // permanently, and the strict equality then hid it from every
+            // org-scoped read of that package's timeline.
+            //
+            // This is NOT merely an observability miss. {@link
+            // rollbackToPackageCommit} derives the set of commits to undo from
+            // this list, so an invisible commit was silently never reverted:
+            // measured pre-fix, a rollback past an env-wide commit answered
+            // `{success: true, revertedCommits: []}` while that commit's
+            // changes stayed live.
+            //
+            // The no-org branch is deliberately NOT narrowed to
+            // `organization_id IS NULL`, exactly as #7705 left its own: a
+            // caller with no active org reads the package's whole timeline,
+            // and restricting it to env-wide rows would hide every org-scoped
+            // commit instead — the same bug pointed the other way.
+            if (request.organizationId) {
+                where.$or = [
+                    { organization_id: request.organizationId },
+                    { organization_id: null },
+                ];
+            }
             const rows = (await this.engine.find('sys_metadata_commit', {
                 where,
                 ...(request.limit ? { limit: request.limit } : {}),