fix(engine): six user-facing strings say "authored in this system", not "this environment" (#24401)

Fixes #24360

Clause-②: no (copy only: no accept set or public surface moves; owes the
seat's review of record at `TIER_DEFAULT` before the queue)

## What changed

objectstack-ai/cloud#3002 ruling A, read per string as triage 6250167038
does: inside the running system, a user-facing string names the system
the user is in as "this system". A string that means "made here, not
from a package" reads "authored in this system". Six strings in the
`domain:engine` lane said "authored in this environment":

| package | site (by symbol) | now reads |
|:--|:--|:--|
| `@objectstack/objectql` | `describeDefaultRecordPageHolder`
(`default-record-page.ts`) | `page "NAME", authored in this system` |
| `@objectstack/objectql` | `describeSecurityCatalogHolder`, the
`environment` case (`security-catalog-namespace.ts`) | `the environment
catalog (an item authored in this system, not shipped by a package)` |
| `@objectstack/metadata-protocol` | `protectionBlockRefusal`
(`protocol.ts`) | "... is authored in this system (ADR-0010 §3.5) ..." |
| `@objectstack/metadata-protocol` | the lock-family-key refusal
(`protocol.ts`) | "an item saved here is authored in this system
(ADR-0010 §3.5) ..." |
| `@objectstack/metadata-protocol` | the default-record-page conflict's
`describe` holder text (`protocol.ts`) | `page 'NAME', authored in this
system` |
| `@objectstack/platform-objects` | `sys_metadata_activation`,
`package_id` field description | "... Empty when no package ships it: an
item authored in this system." |

Also `sys_metadata_activation`'s object description (the claim's
optional line, about `:75`): "Packaged artifacts and positions or
permission sets authored in this system are both recorded here." It is
user-facing: it is the object's schema text shown wherever the object is
described, and the comment above it (ADR-0126 §4) already treats it as
copy, not reference. The phrase means "made here, not from a package",
so it follows row 1.

**"The environment catalog" stays.** It is the documented name of that
holder: ADR-0048 lists it as a holder by that name, the namespace's own
docblock names it, the published `@objectstack/objectql` changelog uses
it, and the envelope's `existingHolder.kind` is `'environment'`. Only
the parenthesis changes, per triage row 6.

No code, status, error code or envelope field changes. Three `patch`
changesets, one per published package.

## Pins

- `default-record-page-save-door.test.ts` (two assertions) and
`registry-default-record-page.test.ts` (one helper) pin the refusal's
first sentence, on top of `code` + `status` + the structured `existing`
/ `incoming` holders. That sentence names both holders, which is the
refusal's stated contract, so the pins move with the text rather than
being loosened.
- The flipped pins carry weight. Reverse verification on the committed
fix 2c06b1a, each leg a mutation through
`scripts/ablation-replace.mjs` that put "authored in this environment"
back:
- `default-record-page.ts` (src-resolved):
`registry-default-record-page.test.ts` went `1 failed | 21 passed`;
restored blob equals the HEAD blob (`508f9a49e1ef`).
- `protocol.ts` (resolved through `@objectstack/metadata-protocol`'s
`dist/`): rebuilt, `ablation-dist-preflight` confirmed the marker in
`dist/`, `default-record-page-save-door.test.ts` went `4 failed | 30
passed`; restored (blob `6abd847e4dfa` equals HEAD), rebuilt, preflight
`--absent` exit 0, `34 passed`.
- No test, fixture, platform-checklist item or docs page pins or quotes
the other four strings. The lock-refusal tests pin substrings that
survive (`Remove the \`protection\` block`, `code package's source`,
`They would ...`). No i18n bundle or reference page carries any of the
six, so nothing was regenerated.

## Verification (head 6ec1757, after merging origin/main d8e11b5)

- Build: `--filter` closure of the three packages, `VERDICT command-exit
0`, on the pre-merge head and again on the merged head. Full `pnpm build
--concurrency=2`: `76 successful, 76 total`.
- Typecheck, merged head: `@objectstack/objectql` exit 0
(`check:test-typecheck: OK`), `@objectstack/metadata-protocol` exit 0,
`@objectstack/platform-objects` exit 0 (`check:test-typecheck: OK`).
- Tests, on 2c06b1a (the merge brought no file in these packages or
`packages/spec`):
- `@objectstack/platform-objects`: `Test Files 76 passed (76)`, `Tests
1176 passed (1176)`.
- `@objectstack/metadata-protocol`: `Test Files 246 passed | 3 skipped
(249)`, `Tests 20655 passed | 19 skipped (20674)`.
- `@objectstack/objectql` (all vitest projects): `Test Files 445 passed
(445)`, `Tests 8359 passed (8359)`.
- Gates: `node scripts/pm/dispatch-gates.mjs --commands` (no paths) on
6ec1757 derived 71 commands; all 71 exit 0.
`check:dual-build-cjs-loads` and `check:i18n` first exited 3
(PREREQUISITE NOT MET, unbuilt packages) and exit 0 after the full
build. `--ran`: `Run reconciliation — 71 derived, 71 run, 0
NOT-MEASURED, 0 UNRUN` (all 71 carry a recorded exit code).
- `pnpm exec eslint --no-inline-config` over the six changed `.ts`
files: exit 0. `check-nul-bytes`: exit 0.
- `test:repo` not run locally (CI `Test Core`).

## Acceptance notes

- `protocol.ts`'s uninstall refusal ("An uninstall is environment-wide —
it removes every row bound to the package in this environment — ...") is
a client-visible string outside this card's table, split across a string
concatenation. It contrasts the deployment with an organization scope,
so its reading is a call for the family card #24368, which carries the
rest of the family. Left as is.
- `protocol.ts`'s `reassignOrphanedMetadata` `console.error` ("this
environment has NOT converged ...") is an operator log, not a
user-facing string. Left as is.
- The docblocks of `default-record-page.ts` and
`security-catalog-namespace.ts` still say "authored in this
environment". They are code comments, ruled out of this card.
- `packages/runtime` is #24327's, and `protocol.ts`'s `duplicatePackage`
region is #23561's; neither is touched.

Durable attribution: os-dev run for #24360, cloud session
`session_01Vp3Ze7Vv9L1PuejcRQC2bK`, dispatched by the `domain:engine`
seat 1 PM (`session_01JtSQQ3EWsbNPzyYMug1tXy`).

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Vp3Ze7Vv9L1PuejcRQC2bK)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/24360-metadata-protocol-this-system.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+Clause-②: no
+
+fix(metadata-protocol): the save door's lock refusals and its default-record-page refusal say "authored in this system"
+
+- **What changed.** Three refusal texts said an item saved through the metadata API is "authored in this environment". They now say "authored in this system": the `protection`-block refusal, the lock-family-key refusal, and the holder text a default-record-page conflict prints for a page no package ships (`page 'NAME', authored in this system`). Inside the running system, user-facing copy names the system the user is in as "this system".
+- **Unchanged.** Every error code (`VALIDATION_ERROR`, `DEFAULT_RECORD_PAGE_CONFLICT`), status and `issues[]` entry.

.changeset/24360-objectql-this-system.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/objectql': patch
+---
+
+Clause-②: no
+
+fix(objectql): the default-record-page and security-catalog refusals name an item made here, not shipped by a package, as "authored in this system"
+
+- **What changed.** The holder text a `DEFAULT_RECORD_PAGE_CONFLICT` refusal prints for a page no package ships now reads `page "NAME", authored in this system`, and the holder text a `NAMESPACE_CONFLICT` refusal prints for the environment catalog reads `the environment catalog (an item authored in this system, not shipped by a package)`. Both said "authored in this environment". Inside the running system, user-facing copy names the system the user is in as "this system".
+- **Unchanged.** Every error code, status and envelope field (`existing`, `incoming`, `existingHolder: { kind: 'environment' }`). "The environment catalog" is the documented name of that holder (ADR-0048), so it stays.

.changeset/24360-platform-objects-this-system.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+Clause-②: no
+
+fix(platform-objects): `sys_metadata_activation`'s description and its `package_id` field description say "authored in this system"
+
+- **What changed.** The activation ledger's object description and the description of its `package_id` field described an item no package ships as "authored in this environment". Both now say "authored in this system". Inside the running system, user-facing copy names the system the user is in as "this system".
+- **Unchanged.** The object's fields, their types and every stored value.

packages/metadata-protocol/src/protocol.ts

@@ -1140,7 +1140,7 @@ function protectionBlockRefusal(
     const err = new Error(
         `Remove the \`protection\` block from ${type} '${saveName}' and send it again. Nothing was written. `
         + 'This door does not translate the block, so it would lock nothing: an item saved through the metadata API '
-        + 'is authored in this environment (ADR-0010 §3.5). To lock an item, declare `protection` on it in a code '
+        + 'is authored in this system (ADR-0010 §3.5). To lock an item, declare `protection` on it in a code '
         + "package's source, where the package loader translates it into the item's lock (ADR-0010 Phase 4.3).",
     ) as Error & { code: 'VALIDATION_ERROR'; status: 400; issues: MetadataIssueEntry[] };
     err.code = 'VALIDATION_ERROR';
@@ -1244,7 +1244,7 @@ function authoredLockFamilyRefusal(
     const err = new Error(
         `Remove ${keys.map((key) => `\`${key}\``).join(', ')} from ${type} '${saveName}' and send it again. `
         + `Nothing was written. They would ${effect}, and the metadata API never sets, changes or removes a lock: `
-        + 'an item saved here is authored in this environment (ADR-0010 §3.5). To lock an item, declare `protection` '
+        + 'an item saved here is authored in this system (ADR-0010 §3.5). To lock an item, declare `protection` '
         + "on it in a code package's source, where the package loader translates it into the item's lock "
         + '(ADR-0010 Phase 4.3).',
     ) as Error & { code: 'VALIDATION_ERROR'; status: 400; issues: MetadataIssueEntry[] };
@@ -22212,7 +22212,7 @@ export class ObjectStackProtocolImplementation implements
             return true;
         });
         const describe = (h: Holder) =>
-            h.packageId ? `page '${h.page}' of package '${h.packageId}'` : `page '${h.page}', authored in this environment`;
+            h.packageId ? `page '${h.page}' of package '${h.packageId}'` : `page '${h.page}', authored in this system`;
         const named = unique.map(describe);
         const others = named.length === 1 ? `${named[0]} already is` : `${named.join(' and ')} already are`;
         const remedy = unique.some((h) => h.shipped)

packages/objectql/src/default-record-page-save-door.test.ts

@@ -208,7 +208,7 @@ describe.each(TOPOLOGIES)('%s kernel — a page saved as a second default record
         const { save, storedPages } = await boot(topology);
         expect((await save('env_task_a', recordPage('env_task_a', 'acme_task'))).ok).toBe(true);
         const outcome = await save('env_task_b', recordPage('env_task_b', 'acme_task'));
-        expectRefusal(outcome, 'env_task_b', 'acme_task', "page 'env_task_a', authored in this environment");
+        expectRefusal(outcome, 'env_task_b', 'acme_task', "page 'env_task_a', authored in this system");
         expect(String((outcome as { error?: any }).error?.message)).toContain(
             "Save 'env_task_b' with `isDefault: false`, or first save 'env_task_a' with `isDefault: false` to make "
             + "'env_task_b' the default instead.",
@@ -232,7 +232,7 @@ describe.each(TOPOLOGIES)('%s kernel — a page saved as a second default record
         expect({ code: err?.code, status: err?.status }).toEqual({ code: 'DEFAULT_RECORD_PAGE_CONFLICT', status: 422 });
         expect(String(err.message).split('. ')[0]).toBe(
             "Default record page conflict: page 'env_task_a' cannot be published as the default record page of object "
-            + "'acme_task': page 'env_task_b', authored in this environment already is",
+            + "'acme_task': page 'env_task_b', authored in this system already is",
         );
     });
 

packages/objectql/src/default-record-page.ts

@@ -160,7 +160,7 @@ export function misplacedDefaultPages(manifest: unknown): MisplacedDefaultPage[]
 export function describeDefaultRecordPageHolder(holder: DefaultRecordPageHolder): string {
   return holder.kind === 'package'
     ? `page "${holder.page}" of package "${holder.packageId}"`
-    : `page "${holder.page}", authored in this environment`;
+    : `page "${holder.page}", authored in this system`;
 }
 
 /** A stable identity for de-duplicating holders. */

packages/objectql/src/registry-default-record-page.test.ts

@@ -102,7 +102,7 @@ function expectRefusal(err: Refusal | undefined, object: string, incoming: Holde
   expect(err!.incoming).toEqual(incoming);
   expect(err!.existing).toEqual(existing);
   const name = (h: Holder) =>
-    h.kind === 'package' ? `page "${h.page}" of package "${h.packageId}"` : `page "${h.page}", authored in this environment`;
+    h.kind === 'package' ? `page "${h.page}" of package "${h.packageId}"` : `page "${h.page}", authored in this system`;
   expect(err!.message.split('. ')[0]).toBe(
     `Default record page conflict: ${name(incoming)} cannot be the default record page of object "${object}": ${name(existing)} already is`,
   );

packages/objectql/src/security-catalog-namespace.ts

@@ -209,7 +209,7 @@ export function describeSecurityCatalogHolder(holder: SecurityCatalogHolder): st
     case 'package':
       return `package "${holder.packageId}"`;
     case 'environment':
-      return 'the environment catalog (an item authored in this environment, not shipped by a package)';
+      return 'the environment catalog (an item authored in this system, not shipped by a package)';
     case 'built-in':
       return 'the platform, as a built-in name no package can declare';
   }

packages/platform-objects/src/system/sys-metadata-activation.object.ts

@@ -72,7 +72,7 @@ export const SysMetadataActivation = ObjectSchema.create({
   managedBy: 'engine-owned',
   // ADR-0126 §4 — the reference lives in the docblock above, not in the copy.
   description:
-    'Activation ledger for metadata artifacts: one row per artifact whose armed state has been changed from its default. No row means the default — active. Packaged artifacts and positions or permission sets authored in this environment are both recorded here.',
+    'Activation ledger for metadata artifacts: one row per artifact whose armed state has been changed from its default. No row means the default — active. Packaged artifacts and positions or permission sets authored in this system are both recorded here.',
   displayNameField: 'name',
   nameField: 'name', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   highlightFields: ['metadata_type', 'name', 'package_id', 'active'],
@@ -148,7 +148,7 @@ export const SysMetadataActivation = ObjectSchema.create({
       label: 'Package',
       maxLength: 255,
       description:
-        'The package that ships the artifact. Empty when no package ships it: an item authored in this environment.',
+        'The package that ships the artifact. Empty when no package ships it: an item authored in this system.',
       group: 'Identity',
     }),