[objectstack-fleet]

Fixes #24405

Clause-②: no (copy only: no accept set or public surface moves; owes the seat's review of record at TIER_DEFAULT before the queue)

What changed

objectstack-ai/cloud#3002 ruling A, as triage applied it (6250167038 on #24327, 6252585695 on #24368): "made here, not from a package" reads "authored in this system"; the system the caller is in drops the noun or says "this system"; a string that means a deployment or configuration scope keeps its word. Every string the card lists was read and is either changed or left with its reason below.

site (by symbol)	before	after	reading
sys_oauth_application grid all_apps, emptyState.message (sys-oauth-application.object.ts)	... sign users in with this environment.	... sign users in with this system.	the system the user is in: "this system"
sys_sso_provider object description (sys-sso-provider.object.ts)	External SSO identity providers (OIDC / SAML) this environment federates login to	... this system federates login to	same
sys_sso_provider action register_sso_provider, param clientId help text	OAuth client ID issued by the IdP for this environment.	... for this system.	same: the relying party the IdP registered is the running system; no environment is contrasted with another
Connect-an-Agent page:header subtitle (packages/mcp/src/connect-ui.ts, CONNECT_AGENT_PAGE) and its en copy (platform-objects en.ts, pages.connect_agent.subtitle)	Give any MCP-capable AI client governed access to this environment — ...	Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security.	the sentence #24404 chose; both literals in ONE commit (317fadc)
deletePackage's retired-key refusal (packages/metadata-protocol/src/protocol.ts)	An uninstall is environment-wide — it removes every row bound to the package in this environment — so no organization scope is stated or confirmed.	kept	a deployment/configuration scope: "environment-wide" is ADR-0131 D6's name for the row scope that is not an organization's (organizationId: null), and the sentence exists to contrast that scope with the organization scope the retired key used to pick. "in this environment" restates the extent of that same scope; renaming it alone would break the contrast the refusal is built on. The sibling remedy in the same file ("the write then lands environment-wide, where every organization reads it.") uses the same vocabulary and is not on this card either.
en.metadata-forms.generated.ts, permission set packageId help text ("... created in this environment.")	—	kept, not regenerated	it follows packages/spec/src/security/permission.form.ts, which is #24406 (domain:spec, open). The spec source still says "created in this environment" on origin/main e22defb13, so regenerating changes nothing; it is never hand-edited. #24406 remains open for it.
sys_metadata_activation object description	—	untouched	already "authored in this system" on main (PR #24401); verified, not touched

Translations. The same phrase in the translated leaves is re-translated by hand, as AGENTS.md allows for translated-locale values:

• Connect-an-Agent subtitle: zh-CN 此环境 → 本系统, ja-JP この環境 → このシステム, es-ES este entorno → este sistema, in zh-CN.ts, ja-JP.ts, es-ES.ts. The recorded source hash pages.connect_agent.subtitle in the three *.source-hashes.ts files moves from 2d0f9a000824e78a to b0d7c6d174511bcb, computed with hashSource from source-hash.ts (control: the same call on the old English text returns 2d0f9a000824e78a, the recorded value).
• The three object strings in zh-CN / ja-JP / es-ES.objects.generated.ts, the same substitution. None of the three leaves has an entry in any *.source-hashes.generated.ts (they are legacy-trusted translator text), so no generated hash moves; check-i18n-bundles --write kept all six hand values and rewrote only the three en leaves.

No code, status, error code or envelope field changes. Nothing else in packages/mcp moves.

The fallback, measured

packages/cli/test/platform-page-i18n-parity.test.ts, through scripts/pm/os-verify-lock.sh, after building the CLI closure:

• Both English literals and the three translations changed, hashes NOT moved (WIP commit, since squashed): Tests 1 failed | 26 passed (27); the red test is "rewrites the page:header copy end-to-end for a non-English locale" (the zh-CN subtitle fell back to English).
• Hashes moved: Tests 27 passed (27).

So the hashes are load-bearing: without them every non-English locale silently serves English.

Pins

The parity test is the one consumer that parses this text (it holds the en bundle byte-identical to the page literal), and it is green with the new sentence on both sides. No other test, fixture, docs page, skill or platform-checklist item quotes any of the changed strings (git grep over the tree). packages/rest/src/rest.test.ts and packages/spec/src/system/i18n-resolver.test.ts carry a zh-CN fixture ending 受控访问此环境。 — it is each test's own inline translation fixture, not read from this bundle, so it pins nothing here (and packages/spec is outside this card).

Verification (head d9ac891, after merging origin/main e22defb13)

• Build: CLI closure (--filter '@objectstack/cli^...') VERDICT command-exit 0; the check:i18n prerequisite closure 61 successful, 61 total; full turbo run build --concurrency=2 77 successful, 77 total. After the last merge: @objectstack/mcp + @objectstack/platform-objects rebuilt, exit 0.
• Typecheck (after the last merge): @objectstack/mcp exit 0, @objectstack/platform-objects exit 0, @objectstack/cli (test-only consumer) exit 0, each with check:test-typecheck green.
• Tests: @objectstack/platform-objects Test Files 77 passed (77), Tests 1184 passed (1184); @objectstack/mcp Test Files 40 passed (40), Tests 479 passed (479); @objectstack/cli test/platform-page-i18n-parity.test.ts Tests 27 passed (27) (re-run after the last merge: 27 passed).
• pnpm check:i18n: OK (10 package(s) — all bundles in sync, no undeclared authoring keys).
• Gates: node scripts/pm/dispatch-gates.mjs --commands (no paths) on d9ac891 derived 59 commands; all 59 exit 0 (check:dual-build-cjs-loads first exited 3, PREREQUISITE NOT MET, on the first run and exit 0 after the full build). --ran: Run reconciliation — 59 derived, 59 run, 0 NOT-MEASURED, 0 UNRUN.
• pnpm exec eslint --no-inline-config over the 10 changed .ts source files: exit 0.
• test:repo not run locally (CI Test Core).

Acceptance notes

• en.objects.generated.ts's sys_metadata_history description "... (environment-wide, append-only)" is the same ADR-0131 D6 scope word and not on this card's list. Left.
• packages/mcp/src/connect-ui.ts's bundle description (about :84) already reads "... to this system." on main (PR fix(cloud-connection,mcp): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24413); not touched. mcp-server-runtime.ts's :1448 text is a logger.warn line, and skill-md.ts's "ObjectStack environment" names a deployment addressed from outside; both are cloud-connection and mcp copy, the rest of cloud#3002 ruling A: 14 user-visible "this environment" strings need the per-string reading (split from #24368) #24404's readings and outside this card.
• plugin-auth's auth-schema-config.ts comment "OIDC/SAML IdP this environment federates login to" is a code comment and domain:services' (platform copy, the rest of cloud#3002 ruling A: about 50 non-comment "this environment" strings outside #24327 and #24360 (cloud-connection, plugin-auth, service-settings, platform-objects, mcp, plugin-security, spec) need the per-string reading #24368); not touched.
• spec copy, the rest of cloud#3002 ruling A: 9 published "this environment" strings in packages/spec need the per-string reading (split from #24368) #24406 is not addressed here; it remains open for the permission.form.ts help text and its generated en leaf.

Durable attribution: os-dev run for #24405, cloud session session_01QBmxwa8mRD3b48FhBBieJ9, dispatched by the domain:engine seat 1 PM (session_01JtSQQ3EWsbNPzyYMug1tXy).

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/mcp, @objectstack/platform-objects, touching 7 documentable anchor(s).

19 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json e22defb13c171900e2c1c54d1d15c24ed85fe91b.

⛔ 3 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e22defb13c171900e2c1c54d1d15c24ed85fe91b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a1676815ec3091b0f705263e3f9118282a31bffa — the merge of head d9ac89199d525c9a8b55b4b81c96fc6ce2d27a76 into base e22defb13c171900e2c1c54d1d15c24ed85fe91b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a1676815ec3091b0f705263e3f9118282a31bffa && git checkout a1676815ec3091b0f705263e3f9118282a31bffa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e22defb13c171900e2c1c54d1d15c24ed85fe91b d9ac89199d525c9a8b55b4b81c96fc6ce2d27a76 && git checkout -B drift-repro e22defb13c171900e2c1c54d1d15c24ed85fe91b && git merge --no-ff d9ac89199d525c9a8b55b4b81c96fc6ce2d27a76

node scripts/docs-audit/affected-docs.mjs --json e22defb13c171900e2c1c54d1d15c24ed85fe91b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e22defb13c171900e2c1c54d1d15c24ed85fe91b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: TIER_DEFAULT
Head-sha: d9ac89199d525c9a8b55b4b81c96fc6ce2d27a76
Local-runs: none

What this record read:

• card platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405's body and comments: triage 6256217128, the filer's addendum 6256220387, domain:cli seat 1's note 6257112504 and consent 6257116088, claim 6257471452, dispatch 6257529446, and os-dev-report 6258417881, read as claims;
• the PR body, and all 16 paths of the net diff against the merge base e22defb13c, read with git diff / git show on fetched refs;
• the 40 check-runs on this head;
• beyond the diff: a git grep of "this environment" over the head's packages/platform-objects/src and packages/mcp/src.

① Derived judgments

The changed strings: right, per objectstack-ai/cloud#3002 ruling A. Each now names the running system "this system":

• sys_sso_provider's description and its clientId help text;
• sys_oauth_application's empty-state message;
• the Connect-an-Agent subtitle.

None of them contrasts a deployment scope with another scope. The clientId reading (open question 1, A) is right: the admin filling the form is inside the running system, and no second environment is meant.

The coupled subtitle: right, in one commit. packages/mcp/src/connect-ui.ts:63 and apps/translations/en.ts carry #24404's sentence byte for byte, under domain:cli's consent (6257116088), with nothing else in packages/mcp moved. The three locale values are re-translated, and pages.connect_agent.subtitle's recorded hash moves 2d0f9a000824e78a → b0d7c6d174511bcb in all three *.source-hashes.ts. The dev measured the fallback this prevents: with the hashes not moved, platform-page-i18n-parity.test.ts went red, 1 of 27, because zh-CN fell back to English. With them moved it passes, 27 of 27. The old hash was checked against the method (hashSource of the old English equals the recorded value).

Kept, right (open question 2, A): the uninstall refusal in protocol.ts. "environment-wide" is ADR-0131 D6's name for the non-organisation row scope; the sentence exists to contrast it with an organisation scope, and the same file's live remedy text uses the same word. That is ruling A's keep-clause.

Left, right:

• en.metadata-forms.generated.ts:2337 follows packages/spec/src/security/permission.form.ts, which is spec copy, the rest of cloud#3002 ruling A: 9 published "this environment" strings in packages/spec need the per-string reading (split from #24368) #24406 (open). It is generated and regenerates when spec copy, the rest of cloud#3002 ruling A: 9 published "this environment" strings in packages/spec need the per-string reading (split from #24368) #24406 lands.
• sys-metadata-activation.object.ts's description already landed in PR fix(engine): six user-facing strings say "authored in this system", not "this environment" #24401.

What still says "this environment" on the head, none of it this card's:

• code comments in packages/mcp;
• the activation object's DEPLOYMENT-scope comment;
• one string in packages/mcp/src/mcp-server-runtime.ts:1448 ("…fewer than this environment declares."). That is a domain:cli file, outside cloud-connection and mcp copy, the rest of cloud#3002 ruling A: 14 user-visible "this environment" strings need the per-string reading (split from #24368) #24404's PR fix(cloud-connection,mcp): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A) #24413; it goes to that lane as a pointer.

② Semver level

Two patch changesets (@objectstack/mcp, @objectstack/platform-objects), Clause-②: no. Copy only: no code, error code, envelope or stored value moves. Right.

③ Boundary flags

• Deviations, all accepted:
  • the detached shared checkout, with no edit made there;
  • one --force-with-lease push before the PR existed, on a branch only this worktree pushed, which squashed the measurement WIP into the coupled commit (AGENTS.md §3's criteria held);
  • no protocol.ts commit, the kept reason being recorded instead;
  • the model-free trailer pair.
• open_questions: both settled A and accepted, as above.
• out_of_scope_findings: the #24406 carrier is right. The plugin-auth code comment is not served copy. The inline zh-CN test fixtures pin nothing. sys_metadata_history's "environment-wide" is the D6 scope word, kept.
• CI: 40 check-runs on d9ac891, 34 success, 6 skipped (the rostered path and opt-in skips), 0 failed.

Implemented-by: claude/issue-24405-platform-objects-this-system
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T03:03Z · ACCEPT

Head: d9ac89199d (the coupled subtitle, the object strings and bundles, then a merge of main). Card #24405 (p2, area:i18n), claim 6257471452, dispatch 6257529446. Dev report: 6258417881.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24405. 16 files, +44 / −23. Not governed (check-governed-merges.mjs --pr 24432: 0 of 16 paths hit the register).
Scope	sys-sso-provider.object.ts (the description and clientId help text) and sys-oauth-application.object.ts (the empty state) now say "this system", with their bundles. The Connect-an-Agent subtitle changes in one commit across en.ts, packages/mcp/src/connect-ui.ts:63 (under domain:cli's consent 6257116088), the three locale values and their recorded hashes. Two patch changesets.
Kept	The uninstall refusal's "environment-wide" / "in this environment": ADR-0131 D6's scope word, ruling A's keep-clause. en.metadata-forms.generated.ts:2337 waits for #24406.
Measured	platform-page-i18n-parity.test.ts went red, 1 of 27 (zh-CN fell back to English), with the hashes unmoved; with them moved it passes, 27 of 27.
Review	TIER_DEFAULT record of record 6258708367 on this head: PASS, in-seat.
Declaration	Clause-②: no on the claim, the PR body and both changesets. Copy only.
Gates	Dev at d9ac89199d: 59 derived, 59 run, 0 NOT MEASURED. Typecheck exit 0 for mcp, platform-objects and cli.
CI	40 check-runs on d9ac89199d: 34 success, 6 skipped, 0 failed.

Disposition:

• open_questions: both settled A and accepted. The clientId help text reads "this system"; the uninstall refusal is kept.
• deviations: all accepted, as the record's ③ judges them: the detached shared checkout; one pre-PR --force-with-lease squash on this worktree's own branch; no protocol.ts commit, the reason recorded; the trailers.
• out_of_scope_findings: the spec copy, the rest of cloud#3002 ruling A: 9 published "this environment" strings in packages/spec need the per-string reading (split from #24368) #24406 carrier is right. The rest are code comments, inline test fixtures and the D6 scope word, which are kept. The packages/mcp/src/mcp-server-runtime.ts:1448 string went to domain:cli as a pointer.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). Fixes #24405 then closes the card.

---

Generated by Claude Code