fix(metadata-protocol): a package-scoped list slot serves the package-less row getMetaItem naming the package serves

.changeset/21817-scoped-list-fallback.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol): a package-scoped metadata list serves a package-less customization of an item the package ships, as `getMetaItem` naming the package does (#21817)
+
+Clause-②: no
+
+ADR-0048 lets one item hold a package-less stored `sys_metadata` row, an ordinary customization, beside the package's own artifact or row. `getMetaItem` naming the package serves the package's own row, else the package-less row, the organization's rows before the env-wide rows (ADR-0005). A list scoped to the package (`getMetaItems({ type, packageId })`, `GET /api/v1/meta/:type?package=`, and the `getMetaItemsForExecution` view of it) read only the package's own rows. So it served the package's artifact over a package-less customization of it, and an env-wide row of the package over the organization's package-less row, while `getMetaItem` naming the package served the customization.
+
+Now each slot of a package-scoped list resolves the way `getMetaItem` naming the package does: the package's own row, else the package-less row, by the same order the unscoped list uses. This holds over a registry item, a MetadataService item and a view the package's stored container expands, and in the `previewDrafts` list, where a package-less draft stands in when the package has none. The list's membership is unchanged: it still lists only the items the package ships, and a package-less row of an item the package does not ship adds no item to it. The lock each item reports is unchanged.
+
+No key, export, status or error code changes.

packages/metadata-protocol/src/protocol.list-slot-prefer-local.test.ts

@@ -35,10 +35,9 @@
  *  5. The draft preview: A's draft and a package-less draft, both orders. The
  *     previewed slot is A's draft, as `getMetaItem` with `previewDrafts`.
  *
- * Out of this card: a list scoped to a package (`packageId` on the list
- * request) reads only that package's rows, so a package-less row never
- * reaches its merge. That is the row read, not the merge, and these pins do
- * not cover it.
+ * A list scoped to a package (`packageId` on the list request) is pinned in
+ * `protocol.scoped-list-fallback.test.ts` (#21817): its package-less rows
+ * reach the merge as stand-ins, so its slot takes the same order.
  */
 import { describe, expect, it } from 'vitest';
 import { assertEngineFindOnePredicate, isCodeArtifactBody } from '@objectstack/metadata-core';