@@ -12148,9 +12148,11 @@ export class RestServer {
                 // derivation and one reason with two copies is this lane's own
                 // recurring defect). `userMessage` has NO invariant left for a
                 // caller to re-derive. `declaredUserMessage` already decided
-                // PRESENCE — the field exists on an error only because an
-                // author deliberately wrote caller-facing text onto it, and
-                // platform and driver code never set it — and
+                // PRESENCE — the field exists on an error only because its
+                // producer deliberately wrote end-user text with no host state
+                // onto it (an application hook, or a platform refusal carrying
+                // static guidance such as the packaged-permission-set lock's;
+                // platform and driver diagnostics never set it) — and
                 // `truncateClientMessage` already applied #5423's bound to the
                 // value. Reading `refusal.body.userMessage` IS the rule; there
                 // is no second function to run it through, and running one
 
@@ -35,9 +35,11 @@
  * `object` is derived from the ROUTE, never from `details.object` (which, on a
  * cascade delete, names a CHILD the caller never addressed). `§3` drives that
  * exact fixture **with a mark present**, so the repair cannot be read as
- * loosening the withhold: the marked channel is authored end-user text,
- * carried as a declared top-level sibling of `code`/`message`, and platform and
- * driver code never set it.
+ * loosening the withhold: the marked channel is authored end-user text with
+ * no host state (an application hook's, or a platform refusal's static
+ * guidance such as the packaged-permission-set lock's), carried as a declared
+ * top-level sibling of `code`/`message`; platform and driver diagnostics never
+ * set it.
  *
  * That same ruling is also why the change is owed: it makes REST's shape the
  * contract for BOTH transports, and REST's shape has carried the mark on this
 
@@ -2828,7 +2828,10 @@ export class HttpDispatcher {
                 // SERVER-side diagnostics attached by `plugin-security` and are
                 // still dropped above. `userMessage` is the opposite by
                 // construction: it exists only because a producer wrote text
-                // FOR the caller, platform and driver code never set it, and it
+                // FOR the caller with no host state in it (an application
+                // hook, or a platform refusal carrying static guidance such as
+                // the packaged-permission-set lock's); platform and driver
+                // diagnostics never set it, and it
                 // lands as a declared top-level sibling of `code`/`message`
                 // (`ApiErrorSchema.userMessage`), never inside `details`.
                 // The mark never moves the status or the `code` (commit 79c46da90).
 
@@ -1275,9 +1275,12 @@ function safeJsonStringify(v: unknown): string {
  * writes `const e = new Error(msg); e.userMessage = msg; throw e`, and the
  * text must survive the VM flattening the throw to a string, or the marking
  * dies exactly where its primary producers live. Crossing INTO the VM is safe
- * for the same reason `code` is: the value is author-written user-facing text
- * by construction (platform and driver code never sets the field), so it
- * carries no host state a sandboxed body could exfiltrate — and it keeps the
+ * for the same reason `code` is: the value is text its producer authored for
+ * the end user (an application hook's, or a platform refusal's static
+ * guidance such as the packaged-permission-set lock's, which names no set,
+ * package, id or path), and platform and driver diagnostics never set the
+ * field, so it carries no host state a sandboxed body could exfiltrate — and
+ * it keeps the
  * established property that a body which catches, inspects and re-throws a
  * host error does not lose the structured payload.
  */
 
@@ -80,9 +80,12 @@ export const ApiErrorSchema = lazySchema(() => z.object({
    *    and the marked text are one value, so a boundary that rewraps or
    *    substitutes `message` (sanitisation, truncation, the sandbox debug
    *    wrapper) can never accidentally promote platform prose into the marked
-   *    channel. Platform/driver code never sets it. Same audience-split
-   *    precedent as `developerMessage` on the DELETE_RESTRICTED envelope
-   *    (#7307), pointed the other way.
+   *    channel. It is set only by a producer that authors end-user text with
+   *    no host state: an application hook, or a platform refusal that carries
+   *    static guidance (the packaged-permission-set lock's refusals in
+   *    `@objectstack/plugin-security`). Platform and driver diagnostics never
+   *    set it. Same audience-split precedent as `developerMessage` on the
+   *    DELETE_RESTRICTED envelope (#7307), pointed the other way.
    *
    * It never replaces `message` — the diagnostic channel keeps its own wording
    * for logs and developers.
 
@@ -672,11 +672,13 @@ export function mapDataError(error: any, object?: string): { status: number; bod
  * Why riding it across the FAULT terminals is safe rather than a #5437/#7543
  * regression: those disciplines withhold text the producer never addressed to
  * the caller — driver prose, a crash's `TypeError: …`. `userMessage` is the
- * opposite by construction: it exists on an error only because an author
- * deliberately wrote user-facing text onto it (`declaredUserMessage` answers
- * `undefined` for everything else — platform and driver code never sets the
- * field), so carrying it discloses nothing that was not authored for exactly
- * this audience. A genuine crash carries no marking and its envelope is
+ * opposite by construction: it exists on an error only because its producer
+ * deliberately wrote end-user text with no host state onto it — an
+ * application hook, or a platform refusal carrying static guidance such as
+ * the packaged-permission-set lock's (`declaredUserMessage` answers
+ * `undefined` for everything else; platform and driver diagnostics never set
+ * the field) — so carrying it discloses nothing that was not authored for
+ * exactly this audience. A genuine crash carries no marking and its envelope is
  * byte-identical to before. The one thing the marking never does is move the
  * STATUS or the `code` — a marked crash is still the sanitised 500.
  */