fix(spec): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A)

[objectstack-fleet]

Fixes #24406

Clause-②: no

What this does

Published copy in packages/spec called the running system "this environment". objectstack-ai/cloud#3002 ruling A, as the card quotes it, reads each string by its sense:

• a set "made here, not from a package" reads "authored in this system";
• "the system the caller is in" drops the noun, or says "this system";
• a string that means a deployment or configuration scope keeps its word.

This PR reads every non-test this environment hit in packages/spec/src: git grep -c answers 15 on origin/main 538f923cb9, the card's sites plus the addendum's TSDoc. 11 change and 4 keep the word, each with its reason in the table. The spelling matches what the services PR (#24407) and the cloud-connection / mcp PR (#24413) landed.

Wording only. No refusal code, status, kind, issue path, accept set or export moves.

Per-string reading

All sites are under packages/spec/src/. Line numbers are on 538f923cb9; no line moves.

site	before	after, or kept: reason
security/permission-set-owner-binding.ts:127, the packageId refusal on the save, restore and publish doors	"a set written into no package is authored in this environment, which an absent packageId states"	"… is authored in this system, …" (made here)
security/permission.form.ts:52, Setup help text for packageId	"Leave empty for a set created in this environment."	"Leave empty for a set authored in this system." (made here)
security/permission.zod.ts:680, the permission.managedBy tombstone prescription	"and a set created in this environment carries neither."	"and a set authored in this system carries neither." (made here)
migrations/entries/semantic/18.permission-set-managed-by-retired.ts:18, upgrade-guide replacement	"a set created in this environment carries neither."	"a set authored in this system carries neither." (made here; the same sentence as the tombstone)
system/auth-config.zod.ts:345, TSDoc of AudienceConfigSchema	"who may become a user of an app built on this environment"	"… an app built on this system" (the system the reader is in)
system/auth-config.zod.ts:401, TSDoc of posture	"Who may become a user of this environment's apps:"	"Who may become a user of this system's apps:" (the sentence #24407 gave Setup's Authentication group)
system/auth-config.zod.ts:417, describe of posture	"Who may self-register into this environment: invite_only …"	"Who may self-register: invite_only …" (noun dropped, as plugin-auth's self-registration refusals now read)
system/auth-config.zod.ts:581, TSDoc of audience	"who may become a user of this environment's apps"	"who may become a user of this system's apps"
system/auth-config.zod.ts:601, describe of audience	"Audience posture: who may self-register into this environment (…)"	"Audience posture: who may self-register (…)" (noun dropped)
api/protocol.zod.ts:3373, describe of AiModelsResponse.models	"Models this environment offers"	"Models this system offers" (the system the caller asks; it also holds for the adapter listModels() fallback shape, which has no plan behind it)
contracts/metadata-service.ts:393, TSDoc of IMetadataService.listDiagnosed	a consumer that renders "this environment contains N items"	"this system contains N items" (a rendering inside the running system)
data/seed-loader.zod.ts:265, TSDoc of env	"Only datasets matching this environment are loaded."	kept: names the deployment tier. env is the prod, dev or test enum, resolved from config.env or NODE_ENV (metadata-protocol SeedLoader.resolveEnvConfig)
data/seed-loader.zod.ts:269, describe of env	"Only load datasets matching this environment"	kept: the same key and the same deployment tier
migrations/entries/semantic/18.package-uninstall-environment-wide.ts:21, upgrade-guide replacement	"the uninstall removes every row bound to the package in this environment"	kept: names the ADR-0131 D6 environment-wide scope, against the organization scope the retired organizationId / allTenants keys named. The entry id and its acceptanceCriteria say "environment-wide", and so does the runtime's own remedy for a write sent with an organization
system/environment-artifact.zod.ts:155, TSDoc of the consent-record key	"no consent record exists for this environment"	kept: the environment artifact is the per-deployment envelope the control plane assembles, and the consent record it carries is per deployment

Generated outputs, by their generators only

• content/docs/references/{api/protocol,security/permission,system/auth-config}.mdx come from pnpm --filter @objectstack/spec gen:docs, after check:generated named check:docs as the one stale artifact (1 of 14).
• packages/platform-objects/src/apps/translations/en.metadata-forms.generated.ts comes from node scripts/check-i18n-bundles.mjs --write, after pnpm check:i18n reported platform-objects DRIFTED (1). One line moves, the packageId help text. The zh-CN, ja-JP and es-ES bundles are untouched, and no key is added or dropped. No packages/platform-objects source file is edited.

Tests and pins

No test in the repository pins any of the old sentences: git grep -F over the tree finds each only in its source, the generated pages and released changelogs. The tombstone test permission-set-managed-by-retirement.test.ts pins the prescription with a regex whose .* spans the changed clause, so no pin needed re-truing.

Changeset

.changeset/24406-spec-this-system-copy.md is a patch for @objectstack/spec and @objectstack/platform-objects. Both publish: neither sets private, and src/**/*.zod.ts, dist and the generated bundle ship.

Verification

Every reading below is at HEAD 9fcf38b94b, the final commit, on base 538f923cb9. Each exit code was captured before any pipe.

• pnpm --filter @objectstack/spec build, through scripts/pm/os-verify-lock.sh: VERDICT command-exit 0.
• pnpm --filter @objectstack/spec check:generated: "✓ All 14 generated artifacts are up to date". Before gen:docs it read "✗ 1 of 14 artifact(s) stale: content/docs/references/**".
• pnpm --filter @objectstack/spec test: Test Files 697 passed (697), Tests 21267 passed | 1 todo (21268), exit 0.
• pnpm --filter @objectstack/spec typecheck: exit 0.
• pnpm --filter @objectstack/platform-objects test: Test Files 77 passed (77), Tests 1184 passed (1184), exit 0.
• pnpm --filter @objectstack/platform-objects typecheck: exit 0, with "check:test-typecheck: OK". This was taken after formula, lint and core were rebuilt with declarations.
• pnpm check:i18n: before the regeneration, exit 1 with "platform-objects DRIFTED (1)". After it, exit 0 with "OK (10 package(s) — all bundles in sync, no undeclared authoring keys)".
• The derived gate families come from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 109 for this diff. The --ran reconciliation answers "109 derived famil(ies) accounted for — 107 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)". 106 exited 0.
  • NOT MEASURED: check:skill-examples and check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET). They read the declarations or built output of packages outside this diff's build closure, such as client-react and studio. CI's required jobs run them on a full build.
  • check:dts-closure exited 1, naming 53 packages with no .d.ts. Every one of them is a package this worktree built JS-only (OS_SKIP_DTS=1) so the i18n generator's CLI could run, so the reading describes the local tree, not this diff. CI measures it on its own full build.
• No ablation and no reverse verification: the diff changes copy only, and no test pins the old sentences.

Acceptance notes

These were read and are not this card's to move, being outside the census or outside this lane. Carrier for each: none.

• packages/client/src/index.ts:6702, the TSDoc of ai.models(), and content/docs/api/plugin-endpoints.mdx:112, a hand-written page listed in scripts/docs-audit/handwritten-docs.json, still say "Models this environment offers". They mirror the describe this PR moves.
• packages/metadata/src/metadata-manager.ts:1024 carries the same "this environment contains N items" rationale as the IMetadataService TSDoc, in a comment.
• security/permission-set-owner-binding.ts:103, on the build and register doors, says "environment-authored". It is outside the literal census, and "environment-authored" is the documented name for that class of metadata (content/docs/permissions/*.mdx, content/docs/deployment/install-modes.mdx). So it keeps its word, as "the environment catalog" did in the sibling PRs.
• api/protocol.zod.ts:3359 ("the environment's plan-filtered picker list") and :3371 ("Whether this is the environment default") are outside the literal census. They name the deployment's plan-scoped allowlist and its configured default. :3359 cites ADR-0028, which in this registry is the metadata-naming ADR, not a model allowlist. The record it means is probably a cloud one, which AGENTS.md cites as cloud ADR-NNNN.
• The released CHANGELOG.md entries and consumed .changeset/pre/* files keep the old sentences. They are release-owned.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/platform-objects, @objectstack/spec, touching 7 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via IMetadataService (symbol, a top-level interface))
• content/docs/kernel/contracts/cache-service.mdx (via IMetadataService (symbol, a top-level interface))
• content/docs/kernel/contracts/index.mdx (via IMetadataService (symbol, a top-level interface))
• content/docs/kernel/contracts/metadata-service.mdx (via IMetadataService (symbol, a top-level interface), packageId (literal, a string literal in sections))
• content/docs/kernel/index.mdx (via IMetadataService (symbol, a top-level interface))
• content/docs/permissions/authorization.mdx (via packageId (literal, a string literal in sections))
• content/docs/permissions/capabilities.mdx (via packageId (literal, a string literal in sections))
• content/docs/permissions/permission-sets.mdx (via packageId (literal, a string literal in sections))
• content/docs/protocol/kernel/plugin-spec.mdx (via packageId (literal, a string literal in sections))
• content/docs/ui/doc-pages.mdx (via packageId (literal, a string literal in sections))
• content/docs/ui/setup-app.mdx (via packageId (literal, a string literal in sections))

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 143 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fa26308bb0332152a359335be27ba1a7f18574de → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2cdd13a90259cbbaa61cce133bbd169e02a24ee3 — the merge of head 9fcf38b94b7c63e6e735dc3999d60a4710d5ccdf into base fa26308bb0332152a359335be27ba1a7f18574de, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2cdd13a90259cbbaa61cce133bbd169e02a24ee3 && git checkout 2cdd13a90259cbbaa61cce133bbd169e02a24ee3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fa26308bb0332152a359335be27ba1a7f18574de 9fcf38b94b7c63e6e735dc3999d60a4710d5ccdf && git checkout -B drift-repro fa26308bb0332152a359335be27ba1a7f18574de && git merge --no-ff 9fcf38b94b7c63e6e735dc3999d60a4710d5ccdf

node scripts/docs-audit/affected-docs.mjs --json fa26308bb0332152a359335be27ba1a7f18574de

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fa26308bb0332152a359335be27ba1a7f18574de → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9fcf38b94b7c63e6e735dc3999d60a4710d5ccdf
Local-runs: none
Scope: packages/spec/src/api/protocol.zod.ts, packages/spec/src/contracts/metadata-service.ts, packages/spec/src/migrations/entries/semantic/18.permission-set-managed-by-retired.ts, packages/spec/src/security/permission-set-owner-binding.ts, packages/spec/src/security/permission.form.ts, packages/spec/src/security/permission.zod.ts, packages/spec/src/system/auth-config.zod.ts + packages/spec/src/security/permission-set-managed-by-retirement.test.ts (the tombstone's prescription pin), packages/spec/src/migrations/entries/semantic/18.package-uninstall-environment-wide.ts, packages/spec/src/data/seed-loader.zod.ts, packages/spec/src/system/environment-artifact.zod.ts (the three kept sites), packages/platform-objects/src/apps/translations/en.metadata-forms.generated.ts and its zh-CN, ja-JP, es-ES siblings (generated from permission.form.ts), content/docs/references/api/protocol.mdx, content/docs/references/security/permission.mdx, content/docs/references/system/auth-config.mdx (generated from the describes), .changeset/24406-spec-this-system-copy.md with packages/spec/package.json and packages/platform-objects/package.json (for ②), the objectui console at the pinned .objectui-sha 0707b4ae37 (consumer check), the PR #24407 and PR #24413 diffs (house spelling).

Inputs: card #24406 body and its five comments (triage 6256228241, addendum 6256303275, claim 6258987316, os-dev-report 6259796816, claim amendment 6259830280); PR #24454 body, its 12-file list and the net diff against main; the 41 check-runs on the head, read at 2026-10-19T05:13Z. Read-only throughout: files at the head and at origin/main through git show and git grep on a fetched ref; nothing built, run or re-run. The remainder of the diff (the changeset, the three content/docs/references pages, the generated en bundle) is the lane seat's ACCEPT at TIER_DEFAULT.

Check-runs on the head: 41, all completed. 36 success, 5 skipped by design (Console Pin Gate, Temporal Conformance, Dogfood Verify CLI, the dogfood matrix shard, Packed-tarball smoke). The five required contexts are success: Lint and Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard. No failure, nothing in progress. Head repo equals base repo; no governed path; 51 changed lines.

① Derived judgments

Each line the diff moves, judged against the rule the card quotes (cloud#3002 letter A: made here, not from a package, reads "authored in this system"; the system the caller is in drops the noun or says "this system"; a deployment or configuration scope keeps its word) and against the house spelling PR #24407 and PR #24413 landed.

1. security/permission-set-owner-binding.ts:127, the save, restore and publish message for an absent binding, now "authored in this system". RIGHT. The sense is "made here, not from a package"; fix(cloud-connection,mcp): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24413 and engine copy: six user-facing strings in objectql, metadata-protocol and platform-objects still say "authored in this environment" — the domain:engine half of #24327 (cloud#3002 ruling A) #24360 spell the same class "authored in this system". The refusal's declared, bound, issueMessage and the door set are untouched (read at the head, lines 94 to 150); the console at the pin parses none of the sentence. No accept set moves.
2. security/permission.form.ts:52, the packageId help text, "Leave empty for a set authored in this system." RIGHT, the same arm. Field, type and colSpan unchanged; the en bundle line 2337 is regenerated from it and matches it byte for byte.
3. security/permission.zod.ts:680, the managedBy tombstone prescription, "a set authored in this system carries neither". RIGHT. retiredKey() still refuses the key; the pin in permission-set-managed-by-retirement.test.ts:57 is a regex whose .* spans the changed clause (nothing ever read the authored key .* Delete the key; a set's provenance is the package that ships it .* Run os migrate meta), so it holds without an edit, and Test Core is green on it.
4. migrations/entries/semantic/18.permission-set-managed-by-retired.ts:18, the upgrade-guide replacement, the same sentence as the tombstone. RIGHT. The entry's id, surface, reason and acceptanceCriteria are untouched; the registry projection gates (check:spec-changes and check:upgrade-guide, inside Lint and Repo Gates) are green. The tombstone and the entry still read identically, as before.
5. system/auth-config.zod.ts:345, :401, :581, TSDoc: "an app built on this system" and "this system's apps". RIGHT. :401 and :581 are the sentence PR fix(services): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24407 gave the Setup Authentication group in auth.manifest.ts, so the spec's reference text and the console's help now read the same.
6. system/auth-config.zod.ts:417, :601, the posture and audience describes drop the noun ("Who may self-register: ...", "who may self-register (...)"). RIGHT, the form PR fix(services): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24407 gave plugin-auth's two self-registration refusals. Enum, default and optionality unchanged; the JSON-schema description moves, the shape does not; content/docs/references/system/auth-config.mdx follows in three rows.
7. api/protocol.zod.ts:3373, the AiModelsResponse.models describe, "Models this system offers". RIGHT under the second arm, and the spelling fix(cloud-connection,mcp): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24413 used for the MCP listing warning. The union shape is unchanged. Observation, not a defect: the adjacent default describe (:3371, "the environment default") and the TSDoc (:3359, "the environment's plan-filtered picker list") keep the word, so one shape now carries both nouns; the dev's reason (a deployment's plan-scoped allowlist and its configured default) is sound, and both lines sit outside the card's census.
8. contracts/metadata-service.ts:393, a TSDoc example rendering inside IMetadataService.listDiagnosed. RIGHT; comment only, no interface member changes. Added to the file surface by the claim amendment 6259830280.
9. Kept with the word, all three RIGHT under the third arm and verified in the cited code: data/seed-loader.zod.ts:265 and :269 (env is the prod | dev | test enum, a deployment tier); migrations/entries/semantic/18.package-uninstall-environment-wide.ts:21 (the ADR-0131 D6 environment-wide scope as against an organization; the entry's id and acceptanceCriteria say "environment-wide"); system/environment-artifact.zod.ts:155 (a per-deployment consent record the control plane writes).
10. Census arithmetic: git grep "this environment" over non-test packages/spec/src answers 15 at origin/main and 4 at the head, and the 4 are exactly the kept sites. No test in the tree pins any old sentence (a grep over the head tree for each of the seven old sentences finds no test file), and no "created in this system" spelling leaks in.
11. Public surface: no export, authorable key, refusal code, status, issue path or default moves; check:api-surface and check:authorable-surface ran inside the green TypeScript Type Check job. The generated outputs were moved by their generators only and match their sources line for line.

② Semver level

.changeset/24406-spec-this-system-copy.md declares patch for @objectstack/spec and @objectstack/platform-objects. RIGHT. Both manifests at the head carry no private, both sit at 18.0.0-next.3, and both ship the moved text (src/**/*.zod.ts and dist for spec; the generated en bundle for platform-objects). Prose only; no accept set widens or narrows, so patch is the level. Clause-②: no sits on the PR body's first lines and in the changeset, with no arm: well-formed and consistent with the diff. The changeset body states FROM and TO for every moved sentence. Check Changeset is green. The content/docs/references/** pages are generator-owned and need no declaration of their own.

③ Boundary flags

open_questions: none declared. Each dev deviation and out-of-scope finding, answered:

• Fence reading (contracts/metadata-service.ts changed though the claim listed it by count only): answered. The claim amendment 6259830280 added it to the file surface; no open PR touches it.
• Local build shape (OS_SKIP_DTS=1; check:dts-closure red locally; check:skill-examples and check:dual-build-cjs-loads not measured): answered by the head's check-runs. TypeScript Type Check, Build Core and Lint and Repo Gates are success on CI's full build.
• test:repo not run locally: answered. Test Core, all six shards, is success.
• No main merge; PR feat(metadata-protocol): the draft save records draftChanges per key path; the save declares its surface (?surface=studio|api, copilot in-process only) #24418 also edits api/protocol.zod.ts and the generated references/api/protocol.mdx: mergeable_state reads clean at this read. For the landing seat: if a merge round comes, regenerate that page with gen:docs and never text-merge it.
• Attribution form: the AGENTS.md footer and trailer pair were used. Correct; AGENTS.md outranks the harness reminder.
• :103 "environment-authored" on the build and register doors, kept: accepted. It is outside the census, and it is the class noun the packageId describe itself still uses ("absent = env-authored", unchanged in this PR and in permission.mdx). Noted for the family carrier: the save door and the build door now name the same provenance class with two spellings.
• api/protocol.zod.ts:3359 cites a bare ADR-0028, which this registry resolves to metadata naming: escalated. A pre-existing citation defect outside this card; the seat should file it, or fold it into the family's closing card, spelled cloud ADR-NNNN if that is the record meant.
• metadata-manager.ts:1024, a code comment: accepted; triage 6250167038 put code comments outside the family.
• The packages/client ai.models() TSDoc and content/docs/api/plugin-endpoints.mdx:112: filed as client and docs copy, the rest of cloud#3002 ruling A: ai.models() TSDoc and the /ai/models docs row still say "Models this environment offers", which the spec describe now says as "this system" #24456 per the claim amendment.

Reviewer-found, not in the dev's report. None blocks this PR; each needs a carrier:

• content/docs/permissions/permission-sets.mdx:369, :387, :422: hand-written published docs still say "authored in this environment" and "created in this environment" for the very provenance class this PR renames. Same class as client and docs copy, the rest of cloud#3002 ruling A: ai.models() TSDoc and the /ai/models docs row still say "Models this environment offers", which the spec describe now says as "this system" #24456 (published docs); escalate to that card or to the family's closing card.
• The translated packageId help texts in packages/platform-objects/src/apps/translations/{zh-CN,ja-JP,es-ES}.metadata-forms.generated.ts:2337 still read 在本环境中创建 / この環境で作成した / creado en este entorno while the en line now reads "authored in this system". The claim's hold-off on every platform-objects source kept them out of this PR, and the i18n gates are green because translated values are hand-written; PR fix(services): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24407 moved its own translated bundles to 本系统 in-lane. Escalate to the platform-objects lane (platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405 / PR fix(mcp,platform-objects): SSO provider, OAuth application and Connect-an-Agent copy says "this system" (cloud#3002 ruling A) #24432) or the family's closing card, so the four locales read the same.
• objectui at the pinned sha 0707b4ae37 carries its own "authored in this environment" copy (packages/app-shell/src/views/metadata-admin/i18n.ts:2564, :2571, :2573, :2592; permission-set-clone.ts:15), and PermissionMatrixEditor.cloneToCustomize.test.tsx:55 quotes the runtime's clone notice in its old wording (the sentence runtime copy: the permission-set clone notice says "authored in this environment" beside the console's new "this system" — server-side user-facing strings still use the cloud noun (cloud#3002 ruling A) #24327 moved). Sibling repo, same family, no carrier known. The console parses none of the sentences this PR moves, so no pin breaks here.

Implemented-by: claude/issue-24406-spec-this-system-copy
Reviewed-by: session_01WnW7HvfnfHbLg1fpkHX3Mu

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:spec seat 1 · os-warren · session session_01WnW7HvfnfHbLg1fpkHX3Mu · 2026-10-19T05:15Z · head 9fcf38b94b · card #24406 (claim 6258987316, amended 6259830280).

• Form: first line Fixes #24406, no other closing keyword. Clause-②: no at line start, matching the claim. Assignee os-warren.
• Path face (check-governed-merges.mjs --pr 24454): NOT governed; 51 changed lines. The 12 files are the claim's surface plus the amended contracts/metadata-service.ts, and the platform-objects en bundle line regenerated by check-i18n-bundles --write. No platform-objects source moves.
• Contract review of record: 6260189675: Served-tier: CONTRACT_REVIEW_TIER, Head-sha = this head, Local-runs: none, PASS. It judges all 11 changes right and the 4 kept sites justified in the cited code; non-test this environment hits in packages/spec/src fall from 15 to the 4 kept.
• Prose face (the changeset, sentence by sentence):
  • "A permission set made here, not shipped by a package, is 'authored in this system'" matches the four refusal and help strings at the head.
  • "Kept 'environment', where the word names a deployment or configuration scope" matches the reviewer's reading of seed-loader, package-uninstall-environment-wide and environment-artifact.
  • "Unchanged. Every error code, status, issue path, accepted value and export" holds (check:api-surface unchanged, the tombstone pin's regex spans the clause).
  • Both packages get patch. Neither is private, and both ship the text.
• Gates: 41 check-runs on 9fcf38b94b: 36 success, 5 skipped by design (read 2026-10-19T05:15Z); mergeable_state: clean.
• Out of scope:
  • The packages/client TSDoc and plugin-endpoints.mdx row: filed client and docs copy, the rest of cloud#3002 ruling A: ai.models() TSDoc and the /ai/models docs row still say "Models this environment offers", which the spec describe now says as "this system" #24456.
  • The reviewer's permission-sets.mdx :369 / :387 / :422 and the three hand-written translated packageId help texts: added to client and docs copy, the rest of cloud#3002 ruling A: ai.models() TSDoc and the /ai/models docs row still say "Models this environment offers", which the spec describe now says as "this system" #24456 (6260201382), the family's open card.
  • The bare ADR-0028 citation is in client and docs copy, the rest of cloud#3002 ruling A: ai.models() TSDoc and the /ai/models docs row still say "Models this environment offers", which the spec describe now says as "this system" #24456's body.
  • objectui's remaining "authored in this environment" on objectui main 4016370: two code comments and three test files. objectui#12956 / docs(stall-guard): state the boundary of a green budget line, and what the guard never sees #12960 closed the user-visible ones. Comments are outside the family by triage 6250167038, so noted, not filed.
• Landing: ready and auto-merge through the relay; MERGED confirmed on the queue branch and origin/main; then pm:dispatched comes off. If PR feat(metadata-protocol): the draft save records draftChanges per key path; the save declares its surface (?surface=studio|api, copilot in-process only) #24418 lands first, the second lander regenerates references/api/protocol.mdx with gen:docs.

---

Generated by Claude Code