fix(spec): published copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A)

Per-string reading of every non-test "this environment" hit in
packages/spec/src: eleven change (a set made here is "authored in this
system"; the system the reader is in is "this system" or the noun is
dropped), four keep the word because it names a deployment or
configuration scope (the seed loader's prod/dev/test tier, the ADR-0131
environment-wide uninstall scope, the environment artifact's consent
record). Wording only: no code, kind, path, accept set or export moves.

Claude-Session: https://claude.ai/code/session_01WnW7HvfnfHbLg1fpkHX3Mu
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24406-spec-this-system-copy.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': patch
+'@objectstack/platform-objects': patch
+---
+
+Clause-②: no
+
+fix(spec): published copy that names the running system says "this system", or drops the noun, not "this environment"
+
+- **What changed.** Inside the running system, user-facing copy names the system the reader is in as "this system", or drops the noun. A permission set made here, not shipped by a package, is "authored in this system".
+  - The permission-set `packageId` refusal on the save, restore and publish doors now reads "a set written into no package is authored in this system, which an absent `packageId` states".
+  - The permission set's `packageId` help text in Setup ends "Leave empty for a set authored in this system." The English Setup forms bundle of `@objectstack/platform-objects` is regenerated from it.
+  - The `permission.managedBy` tombstone prescription, and the `permission-set-managed-by-retired` protocol-18 upgrade-guide entry, say "a set authored in this system carries neither".
+  - The `AudienceConfig.posture` and `AuthConfig.audience` describes say "who may self-register", with no noun. Their TSDoc says "who may become a user of this system's apps", the sentence the Setup Authentication group already reads.
+  - `AiModelsResponse.models` describes "Models this system offers". The `IMetadataService.listDiagnosed` TSDoc example reads "this system contains N items".
+- **Kept "environment", where the word names a deployment or configuration scope.** `SeedLoaderConfig.env` ("Only load datasets matching this environment", the `prod | dev | test` tier), the `package-uninstall-environment-wide` upgrade-guide entry (the ADR-0131 environment-wide scope, as against an organization), and the environment artifact's consent-record TSDoc.
+- **Unchanged.** Every error code, status, issue path, accepted value and export. Only the human-readable text moves.

packages/spec/src/api/protocol.zod.ts

@@ -3370,7 +3370,7 @@ export const AiModelsResponseSchema = lazySchema(() => z.object({
       label: z.string().describe('Display label for the picker'),
       default: z.boolean().describe('Whether this is the environment default'),
     }),
-  ])).describe('Models this environment offers'),
+  ])).describe('Models this system offers'),
   defaultModel: z.string().optional().describe('Default model id, when the service reports one'),
 }));
 

packages/spec/src/contracts/metadata-service.ts

@@ -390,7 +390,7 @@ export interface IMetadataService {
      * read a MISS and an OUTAGE arrive as the same `undefined`; on the plural
      * read they arrive as the same *array*, and an array carries a **count**.
      * A count is the strongest positive claim a read can make — a consumer that
-     * renders `list(t).length` as "this environment contains N items" states,
+     * renders `list(t).length` as "this system contains N items" states,
      * positively and numerically, something no read established. `list` cannot
      * be fixed in place (every caller would have to change at once, and most
      * are right to keep ignoring the verdict), so the verdict is offered

packages/spec/src/migrations/entries/semantic/18.permission-set-managed-by-retired.ts

@@ -15,7 +15,7 @@ export const entry: SemanticMigration = {
   surface: 'permissions[].managedBy — the authored per-record provenance (package / platform / user) on a '
     + 'permission set',
   replacement: 'Nothing: delete the key. A set\'s provenance is the package that ships it, decided from that '
-    + 'package\'s artifact and recorded as packageId; a set created in this environment carries neither. The '
+    + 'package\'s artifact and recorded as packageId; a set authored in this system carries neither. The '
     + 'sys_permission_set.managed_by column the platform keeps is a different surface and is unchanged.',
   reason: 'The D2 conversion `permission-set-managed-by-removed` deletes `managedBy` from every permission set '
     + 'in author sources, stored permission rows and built artifacts, and the delete is lossless: no seeder, '

packages/spec/src/security/permission-set-owner-binding.ts

@@ -124,7 +124,7 @@ export function judgePermissionSetOwnerBinding(
     : `, or ${door === 'save' ? 'save the set' : 'save it'} into package '${declared}' `
       + `(?package=${declared} on the REST door, packageId in process)`;
   const owner = bound === null
-    ? 'a set written into no package is authored in this environment, which an absent `packageId` states'
+    ? 'a set written into no package is authored in this system, which an absent `packageId` states'
     : 'the package a set is written into is its owner';
   const tail = `and ${owner} (ADR-0086 D3): a \`packageId\` that disagrees is refused, never silently overridden.`;
   const message = door === 'save'

packages/spec/src/security/permission.form.ts

@@ -49,7 +49,7 @@ export const permissionForm = defineForm({
         //    (`judgePermissionSetOwnerBinding`).
         { field: 'description', type: 'textarea', colSpan: 2, helpText: 'Human-readable description shown in Setup.' },
         { field: 'isDefault', type: 'boolean', colSpan: 1, helpText: 'Gives this set to everyone who signs in, through the built-in everyone position. A set the app itself declares is granted at startup; a set from an installed package becomes a suggestion an admin confirms in Setup. A set with high-privilege permissions is never granted this way. Default false.' },
-        { field: 'packageId', type: 'text', colSpan: 2, helpText: 'The package that ships this set; a value naming any other package is refused. Leave empty for a set created in this environment.' },
+        { field: 'packageId', type: 'text', colSpan: 2, helpText: 'The package that ships this set; a value naming any other package is refused. Leave empty for a set authored in this system.' },
       ],
     },
     {

packages/spec/src/security/permission.zod.ts

@@ -677,7 +677,7 @@ const PERMISSION_SET_MANAGED_BY_REMOVED =
   + 'nothing ever read the authored key: no seeder, package upgrade or lock consulted it, so `package` never made '
   + 'a set upgrade-owned and `platform` or `user` never shielded one from an upgrade. Delete the key; a set\'s '
   + 'provenance is the package that ships it, decided from that package\'s artifact and recorded as `packageId`, '
-  + 'and a set created in this environment carries neither. '
+  + 'and a set authored in this system carries neither. '
   + 'Run `os migrate meta --from 17` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand.';
 
 /**

packages/spec/src/system/auth-config.zod.ts

@@ -342,7 +342,7 @@ export const EmailVerificationConfigSchema = lazySchema(() => z.object({
 
 /**
  * Audience posture — the ONE declaration answering "who may become a user of
- * an app built on this environment" (#11739 / epic #11723).
+ * an app built on this system" (#11739 / epic #11723).
  *
  * Before this existed, the answer was an emergent property of
  * `emailAndPassword.disableSignUp` + `emailVerification` + `ssoOnlyMode` +
@@ -398,7 +398,7 @@ const AUDIENCE_EMAIL_DOMAIN_SHAPE = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[
  */
 export const AudienceConfigSchema = lazySchema(() => z.object({
   /**
-   * Who may become a user of this environment's apps:
+   * Who may become a user of this system's apps:
    *
    * - `invite_only` (default): self-registration is CLOSED. A user comes into
    *   existence only through an operator-side act — a pending invitation
@@ -414,7 +414,7 @@ export const AudienceConfigSchema = lazySchema(() => z.object({
    *   console cannot turn it off.
    */
   posture: z.enum(AUDIENCE_POSTURES).default('invite_only').describe(
-    'Who may self-register into this environment: invite_only (default — operator acts only), ' +
+    'Who may self-register: invite_only (default — operator acts only), ' +
     'email_domain (allowlisted email domains), or open (anyone). ' +
     'email_domain forces email verification on; open forces it on unless the deployment explicitly ' +
     'sets emailAndPassword.requireEmailVerification to false.',
@@ -578,7 +578,7 @@ export const AuthConfigSchema = lazySchema(() => z.object({
   emailAndPassword: EmailAndPasswordConfigSchema,
   emailVerification: EmailVerificationConfigSchema,
   /**
-   * Audience posture (#11739) — who may become a user of this environment's
+   * Audience posture (#11739) — who may become a user of this system's
    * apps. Undeclared ⇒ `invite_only` (the safe default; maintainer ruling
    * 2026-08-24 on epic #11723 — no legacy/undeclared limbo).
    *
@@ -598,7 +598,7 @@ export const AuthConfigSchema = lazySchema(() => z.object({
    *   A `false` stored only through the settings console is still refused.
    */
   audience: AudienceConfigSchema.optional().describe(
-    'Audience posture: who may self-register into this environment ' +
+    'Audience posture: who may self-register ' +
     '(invite_only — the default — | email_domain | open). See AudienceConfigSchema.',
   ),
   advanced: AdvancedAuthConfigSchema,