@@ -0,0 +1,16 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+feat(app-shell): the environment list offers only "Set up your production environment"; the development-environment door is gone
+
+Clause-②: no
+Metadata-protocol: none
+
+Each organization now has exactly one environment, its production environment: the development environment type is retired (objectstack-ai/cloud#3487, ruling D). The Console's `sys_environment` list follows.
+
+- **Toolbar.** "Set up your production environment" is the only creation path. Once the organization owns its production environment, the `create_environment` action is withheld: no "Add development environment" button, no "Development environments · Team plan and up" locked mark, no dialog and no POST. The list's other toolbar actions render as before, and the `?runAction=create_environment` deep link is consumed and runs nothing in that state. The loading skeleton and the no-signal fallback (the action's metadata label) are unchanged.
+- **Dialog.** `entitlementDialogFromError` maps `PRODUCTION_ENV_LIMIT` only. `DEV_ENV_PLAN_LOCKED`, `DEV_ENV_LIMIT` and the control plane's new `DEV_ENV_RETIRED` take the ordinary error path and show the server's own message.
+- **State.** `EnvironmentEntitlementsState` drops `canCreateDevelopmentEnv`, and the summary type drops `development`; `EnvironmentCtaKind` is now `'setup_production' | 'production_exists'`. None of these is exported from `@object-ui/app-shell`.
+- **i18n.** Removed from every locale bundle: `planTier.teamAndUp` (the namespace goes with it), `environment.addDevelopment`, `environment.developmentLocked`, and `environment.entitlement.{planLockedTitle, planLockedBody, limitTitle, limitBody, limitBodyWithCount, freePlan, namedPlan, upgradeCta}`. A host that read one of these keys through `t()` now gets the key back; there is no replacement, because nothing is left to label.
@@ -85,19 +85,9 @@
       "seeded"
     ],
     "environment": [
-      "addDevelopment",
-      "developmentLocked",
       "entitlement.contactSalesCta",
-      "entitlement.freePlan",
-      "entitlement.limitBody",
-      "entitlement.limitBodyWithCount",
-      "entitlement.limitTitle",
-      "entitlement.namedPlan",
-      "entitlement.planLockedBody",
-      "entitlement.planLockedTitle",
       "entitlement.productionLimitBody",
       "entitlement.productionLimitTitle",
-      "entitlement.upgradeCta",
       "setUpProduction"
     ],
     "organizations": [
@@ -114,9 +104,6 @@
       "subtitle",
       "title"
     ],
-    "planTier": [
-      "teamAndUp"
-    ],
     "workspace": [
       "createButton",
       "createDescription",
 
@@ -1,12 +1,12 @@
 /**
- * EnvironmentEntitlementDialog — a friendly upgrade / limit dialog shown instead
- * of a raw red error toast when an environment-create is gated by plan or
- * capacity (DEV_ENV_PLAN_LOCKED / DEV_ENV_LIMIT / PRODUCTION_ENV_LIMIT).
+ * EnvironmentEntitlementDialog — a friendly limit dialog shown instead of a raw
+ * red error toast when an environment-create is refused because the org
+ * already owns its one production environment (PRODUCTION_ENV_LIMIT).
  *
  * Driven by a single {@link EntitlementDialogSpec}, opened from one place: the
  * action runtime's apiHandler, when the create POST comes back with an
- * entitlement 403. The env-list toolbar opens no dialog: its plan-locked state
- * draws a locked mark that links to the upgrade page instead (objectui#12190).
+ * entitlement 403. The env-list toolbar opens no dialog: once the production
+ * environment exists it draws no create affordance at all.
  *
  * The CTA renders as an anchor (not an SPA navigation) so a control-plane URL
  * lands on the control plane's own page regardless of the console's router.
 
@@ -5,26 +5,22 @@
  * The cloud serves ONE `create_environment` action; born-with-env makes its
  * meaning depend on org state (which the action metadata can't express). This
  * component reads the resolved entitlement state and renders the right
- * affordance:
- *   • no production env          → "Set up your production environment" (primary);
- *                                  the create POST provisions the org's one
- *                                  production env — the historical-data path that
- *                                  must never error.
- *   • has prod + dev allowed     → "Add development environment" (the create POST
- *                                  makes a dev env).
- *   • has prod + dev NOT allowed → for a viewer the summary sends an `upgradeUrl`
- *                                  to, an outline, LOCKED mark naming the tier
- *                                  development environments start at, linking
- *                                  to that URL; for a viewer it sends none, no
- *                                  mark (objectui#12983). Either way no button,
- *                                  no dialog, no POST (objectui#12190).
- *   • still resolving            → a SKELETON where the create button will land —
- *                                  no label at all (see below).
- *   • settled with no signal     → the action's metadata label (neutral), with the
- *                                  apiHandler entitlement dialog as the safety net.
+ * affordance. Each organization has exactly one environment, its production
+ * environment (objectstack-ai/cloud#3487, ruling D: the development type is
+ * retired), so creating the production environment is the only creation path:
+ *   • no production env      → "Set up your production environment" (primary);
+ *                              the create POST provisions the org's one
+ *                              production env — the historical-data path that
+ *                              must never error.
+ *   • has production env     → no create affordance at all: nothing is left to
+ *                              create, so no button, no dialog, no POST.
+ *   • still resolving        → a SKELETON where the create button will land —
+ *                              no label at all (see below).
+ *   • settled with no signal → the action's metadata label (neutral), with the
+ *                              apiHandler entitlement dialog as the safety net.
  *
- * Create flows reuse the standard `action:bar` runner (name modal → apiHandler),
- * so only the label/variant changes — no duplicate POST logic here.
+ * The create flow reuses the standard `action:bar` runner (name modal →
+ * apiHandler), so only the label/variant changes — no duplicate POST logic here.
  *
  * ## Why a skeleton while resolving (cloud#1049 → objectui#3482)
  *
@@ -44,13 +40,12 @@
  * There is no longer one string with two owners — there are two DIFFERENT strings
  * for two different states, and each has exactly one owner:
  *
- *   • Every RESOLVED state → THIS package. `environment.setUpProduction` /
- *     `environment.addDevelopment` / `environment.developmentLocked` (with
- *     `planTier.teamAndUp`) in `packages/i18n/src/locales/*.ts` are the sole
- *     source of truth. The cloud
- *     action metadata's `_actions.create_environment.label` translation CANNOT
- *     reach the button here — `decideEnvironmentCta()` is total over `ready`
- *     state, so a resolved state always overrides the label.
+ *   • Every RESOLVED state → THIS package. `environment.setUpProduction` in
+ *     `packages/i18n/src/locales/*.ts` is the sole source of truth, and the
+ *     production-exists state draws no button at all. The cloud action
+ *     metadata's `_actions.create_environment.label` translation CANNOT reach
+ *     the button here — `decideEnvironmentCta()` is total over `ready` state,
+ *     so a resolved state always overrides the label.
  *   • Still resolving → nothing (skeleton).
  *   • Settled with NO usable signal (`ready: false`, `source: 'unknown'` — the
  *     summary endpoint was unusable AND the row-derivation threw) → the metadata
@@ -64,11 +59,9 @@
 import { SchemaRenderer, useCapabilityGate } from '@object-ui/react';
 import { actionRendersAt } from '@object-ui/types';
 import type { ActionBarSchema } from '@object-ui/types';
-import { Button, Skeleton } from '@object-ui/components';
-import { Lock } from 'lucide-react';
+import { Skeleton } from '@object-ui/components';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { useNavRunAction } from '../hooks/useNavRunAction.js';
-import { resolveCtaHref } from './EnvironmentEntitlementDialog.js';
 import { decideEnvironmentCta, type EnvironmentEntitlementsState } from './entitlements.js';
 
 const CREATE_ACTION = 'create_environment';
@@ -95,13 +88,11 @@ const CREATE_ACTION = 'create_environment';
  * lost, it is unrecoverable: the URL no longer carries it, so a reload cannot
  * retry. Hence both conjuncts below: the create action must actually be on the
  * bar (`hasCreateAction`), AND entitlements must have resolved — while loading
- * we must not trigger an action whose meaning (prod vs dev create) isn't known
- * yet. In the `upgrade_for_development` state arming consumes the param and
- * runs NOTHING (objectui#12190: no dialog): the server has already answered
- * "create" there (no development environment on this plan), so the intent is
- * spent on that answer rather than lost. The answer is drawn as the locked
- * mark for a viewer who can upgrade, and as no create affordance at all for
- * one who cannot (objectui#12983). When either conjunct
+ * we must not trigger an action whose meaning (whether there is anything left
+ * to create) isn't known yet. In the `production_exists` state arming consumes
+ * the param and runs NOTHING (no dialog): the org already owns its one
+ * environment, so the answer to "create" is that nothing is left to create, and
+ * the intent is spent on that answer rather than lost. When either conjunct
  * fails, the honest degradation is to leave the URL alone: the next mount that
  * CAN act on the deep link still does.
  *
@@ -131,50 +122,6 @@ function OtherActionsBar({ actions }: { actions: any[] }) {
   return <SchemaRenderer schema={bar} />;
 }
 
-const DEVELOPMENT_LOCKED_MARK = 'environment-development-locked';
-
-/**
- * The plan-locked stand-in for the create action (objectui#12190): an outline
- * mark with a lock icon that names the tier development environments start at
- * ("Development environments · Team plan and up"; the zh value of the tier
- * label follows cloud's own zh bundle). The maintainer's rule is that no primary
- * button opens a paywall dialog (objectstack-ai/cloud#2775), so this is never a
- * primary button and opens nothing: it is a plain link to the upgrade page.
- *
- * The destination is the entitlement summary's `upgradeUrl`, verbatim, resolved
- * the way the entitlement dialog resolves its CTA (`resolveCtaHref`: a
- * control-plane-relative path is prefixed with the control-plane origin). The
- * URL is the control plane's to name and none is composed here (objectui#10437).
- *
- * The mark exists only as that link, so it is drawn only for a viewer the
- * summary sends an `upgradeUrl` to (objectui#12983, ruling B on
- * objectstack-ai/cloud#2917: the upsell reaches only whoever can upgrade). The
- * control plane trims `upgradeUrl` by role (cloud's `resolveSummaryCanManage`:
- * it is sent only to a viewer who manages the organization, such as its owner
- * or an admin), so its presence is the server's own answer to "can this viewer
- * upgrade?", and no viewer flag is read or added for it. A viewer it sends none
- * (a plain member) cannot upgrade, so no mark is drawn for them.
- */
-function DevelopmentLockedMark({ upgradeUrl }: { upgradeUrl: string }) {
-  const { t } = useObjectTranslation();
-  const { href, external } = resolveCtaHref(
-    upgradeUrl,
-    (import.meta.env.VITE_SERVER_URL as string | undefined) || '',
-  );
-  return (
-    <Button asChild size="sm" variant="outline" className="shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9 text-muted-foreground">
-      <a
-        href={href}
-        {...(external ? { target: '_blank', rel: 'noopener noreferrer' } : {})}
-        data-testid={DEVELOPMENT_LOCKED_MARK}
-      >
-        <Lock className="h-4 w-4" aria-hidden="true" />
-        <span>{t('environment.developmentLocked', { tier: t('planTier.teamAndUp') })}</span>
-      </a>
-    </Button>
-  );
-}
-
 interface Props {
   /** Toolbar actions already localized by the caller (ObjectView). */
   actions: any[];
@@ -235,30 +182,15 @@ export function EnvironmentListToolbar({ actions, entitlements }: Props) {
     );
   }
 
-  // Plan-locked state: a free-plan org must NOT POST-then-403, and no primary
-  // button may open a paywall dialog (objectui#12190). The create action gives
-  // way to the locked mark, drawn only for a viewer who can upgrade
-  // (objectui#12983); any other (non-create) toolbar actions still render
-  // through the normal bar, for every viewer.
-  if (ctaKind === 'upgrade_for_development') {
-    const upgradeUrl = entitlements.upgradeUrl;
-    return (
-      <>
-        <OtherActionsBar actions={otherActions(toolbarActions)} />
-        {/*
-          The mark stands in for the create action. With no create action on
-          the bar there is nothing to stand in for, so it must not appear either
-          (#4123): same one-list rule as the arming predicate above. With no
-          `upgradeUrl` the server has said this viewer cannot upgrade, and the
-          upsell is not drawn (objectui#12983; see `DevelopmentLockedMark`).
-        */}
-        {hasCreateAction && upgradeUrl ? <DevelopmentLockedMark upgradeUrl={upgradeUrl} /> : null}
-      </>
-    );
+  // The org already owns its one environment: the create action is withheld,
+  // so it can neither POST-then-403 nor open a dialog. Any other (non-create)
+  // toolbar actions still render through the normal bar.
+  if (ctaKind === 'production_exists') {
+    return <OtherActionsBar actions={otherActions(toolbarActions)} />;
   }
 
-  // setup_production / add_development: render the bar, overriding only the
-  // create action's label (and promoting production setup to a primary CTA).
+  // setup_production: render the bar, overriding only the create action's
+  // label and promoting it to a primary CTA.
   // Labels are locale-aware — the metadata label is already localized by the
   // caller, but these state-aware overrides used to be hard-coded English,
   // which flashed an English button in a zh console (#844). They now resolve
@@ -270,18 +202,10 @@ export function EnvironmentListToolbar({ actions, entitlements }: Props) {
   // the "who owns this button's text" note at the top of the file.
   const renderedActions = toolbarActions.map((a: any) => {
     if (a?.name !== CREATE_ACTION || ctaKind == null) return a;
-    if (ctaKind === 'setup_production') {
-      return {
-        ...a,
-        label: t('environment.setUpProduction'),
-        variant: 'primary',
-        ...(autoRunCreate ? { autoTrigger: true } : {}),
-      };
-    }
-    // add_development
     return {
       ...a,
-      label: t('environment.addDevelopment'),
+      label: t('environment.setUpProduction'),
+      variant: 'primary',
       ...(autoRunCreate ? { autoTrigger: true } : {}),
     };
   });
 
@@ -1,6 +1,6 @@
 /**
- * EnvironmentEntitlementDialog renders the friendly upgrade/limit dialog and a
- * CTA that lands on the (control-plane-resolved) upgrade URL.
+ * EnvironmentEntitlementDialog renders the friendly limit dialog and a CTA that
+ * lands on the (control-plane-resolved) URL the server named.
  */
 
 import { describe, it, expect, vi } from 'vitest';
@@ -33,34 +33,32 @@ describe('EnvironmentEntitlementDialog', () => {
         state={{
           open: true,
           spec: {
-            code: 'DEV_ENV_PLAN_LOCKED',
-            title: 'Development environments are a paid feature',
-            message: 'Upgrade to add them.',
-            cta: { label: 'Upgrade plan', url: '/settings/billing' },
+            code: 'PRODUCTION_ENV_LIMIT',
+            title: 'You already have your production environment',
+            message: 'Each organization includes exactly one production environment.',
+            cta: { label: 'Contact sales', url: '/contact-sales' },
           },
         }}
       />,
     );
-    expect(await screen.findByText('Development environments are a paid feature')).toBeTruthy();
+    expect(await screen.findByText('You already have your production environment')).toBeTruthy();
     const cta = screen.getByTestId('entitlement-cta-primary');
-    expect(cta.getAttribute('href')).toBe('/settings/billing');
+    expect(cta.getAttribute('href')).toBe('/contact-sales');
     fireEvent.click(cta);
     expect(onOpenChange).toHaveBeenCalledWith(false);
   });
 
   it('renders nothing when closed', () => {
     render(<EnvironmentEntitlementDialog apiBase="" onOpenChange={vi.fn()} state={{ open: false }} />);
-    expect(screen.queryByText('Development environments are a paid feature')).toBeNull();
+    expect(screen.queryByText('You already have your production environment')).toBeNull();
   });
 });
 
 // objectui#10437 — the dialog renders the spec the builder produces, so these
 // pins go through the REAL builder: a spec hand-written without a `cta` would
-// pass whether or not the builder still synthesizes a default URL. (The
-// proactive builder is gone since objectui#12190; the plan-locked toolbar draws
-// a mark, not this dialog.)
-describe('EnvironmentEntitlementDialog — no server URL, no upgrade CTA (objectui#10437)', () => {
-  const SERVER_UPGRADE_URL = 'https://cloud.example.com/_console/apps/cloud_control/page/pricing';
+// pass whether or not the builder still synthesizes a default URL.
+describe('EnvironmentEntitlementDialog — no server URL, no CTA (objectui#10437)', () => {
+  const SERVER_CONTACT_URL = 'https://cloud.example.com/contact-sales';
 
   const renderSpec = (spec: EntitlementDialogSpec | null) =>
     render(
@@ -71,18 +69,18 @@ describe('EnvironmentEntitlementDialog — no server URL, no upgrade CTA (object
       />,
     );
 
-  it('a 403 without upgrade_url opens the dialog with no upgrade anchor', async () => {
-    renderSpec(entitlementDialogFromError({ error: { code: 'DEV_ENV_PLAN_LOCKED', details: { plan: 'free' } } }));
-    expect(await screen.findByText('Development environments are a paid feature')).toBeTruthy();
+  it('a 403 without contact_url opens the dialog with no anchor', async () => {
+    renderSpec(entitlementDialogFromError({ error: { code: 'PRODUCTION_ENV_LIMIT', details: { current: 1, limit: 1 } } }));
+    expect(await screen.findByText('You already have your production environment')).toBeTruthy();
     expect(screen.queryByTestId('entitlement-cta-primary')).toBeNull();
     expect(screen.queryByRole('link')).toBeNull();
   });
 
-  it('control: a server-supplied upgrade_url renders the anchor to exactly that URL', async () => {
+  it('control: a server-supplied contact_url renders the anchor to exactly that URL', async () => {
     renderSpec(
-      entitlementDialogFromError({ error: { code: 'DEV_ENV_PLAN_LOCKED', details: { upgrade_url: SERVER_UPGRADE_URL } } }),
+      entitlementDialogFromError({ error: { code: 'PRODUCTION_ENV_LIMIT', details: { contact_url: SERVER_CONTACT_URL } } }),
     );
-    expect(await screen.findByText('Development environments are a paid feature')).toBeTruthy();
-    expect(screen.getByTestId('entitlement-cta-primary').getAttribute('href')).toBe(SERVER_UPGRADE_URL);
+    expect(await screen.findByText('You already have your production environment')).toBeTruthy();
+    expect(screen.getByTestId('entitlement-cta-primary').getAttribute('href')).toBe(SERVER_CONTACT_URL);
   });
 });