fix(cloud-connection,mcp): in-system copy says "this system" or drops the noun, not "this environment" (cloud#3002 ruling A)

[objectstack-fleet]

Fixes #24404

Clause-②: no
Basis: copy only. Every HTTP status, error code, details object and response shape is unchanged; only human-readable text moves.

What changed

The user-facing strings in packages/cloud-connection/src and packages/mcp/src that called the running system "this environment" now follow objectstack-ai/cloud#3002 ruling A, as triage applied it (6250167038 on #24327, confirmed for this family in 6252585695 on #24368): "made here, not from a package" reads "authored in this system"; the system the caller is in drops the noun or says "this system"; a deployment or configuration scope keeps "environment".

• cloud-connection: the seven 401 UNAUTHENTICATED answers on /api/v1/cloud-connection/* drop the noun. The install-local 409 RESOURCE_CONFLICT and the unmanaged-install success note say "this system".
• mcp: the known-partial listing warning and the Connect-an-Agent bundle description say "this system".
• content/docs/deployment/cloud-connection.mdx:128: the troubleshooting table quoted the old 401 text as what "the panel says". It now quotes the new text.
• marketplace-install-local-install-modes.test.ts:409 pinned the old 409 prose. It now pins the named base ('com.example.crm-copy'), next to the code, status and details it already pinned. This is the only prose-pinning test that moved.
• Changesets: .changeset/24404-cloud-connection-this-system.md and .changeset/24404-mcp-this-system.md, both patch, both Clause-②: no.

The census, one row per string

The census covers every string literal, template literal and + chain in the 28 non-test source files of the two packages whose joined text contains "environment" (case-insensitive). It was taken by walking the TypeScript AST, so a phrase split across a concatenation is read as one string. Two strings here are split that way: the install-local 409 ('… a base authored ' + 'in this environment …') and the Connect-an-Agent subtitle. Line numbers are on origin/main 31e7d0ba2 and are unchanged at this head.

site	before	after	clause / reason
cloud-connection-plugin.ts:597 (POST bind/start, 401)	Sign in to this environment to connect a cloud account.	Sign in to connect a cloud account.	the system the caller is in: drop the noun (triage 6252585695 names this string)
cloud-connection-plugin.ts:659 (POST bind/poll, 401)	Sign in to this environment.	Sign in.	same
cloud-connection-plugin.ts:761 (POST unbind, 401)	Sign in to this environment.	Sign in.	same
cloud-connection-plugin.ts:813 (POST install, 401)	Sign in to this environment to install apps.	Sign in to install apps.	same
cloud-connection-plugin.ts:867 (GET installation, 401)	Sign in to this environment.	Sign in.	same
cloud-connection-plugin.ts:930 (GET installed, 401)	Sign in to this environment.	Sign in.	same
cloud-connection-plugin.ts:968 (GET org-packages, 401)	Sign in to this environment.	Sign in.	same
cloud-connection-plugin.ts:215 ENVIRONMENT_NOT_FOUND_MESSAGE (404)	Could not resolve an environment for this request host.	kept	configuration scope: a multi-environment runtime resolves an environment per request host, and the sentence pairs with the code ENVIRONMENT_NOT_FOUND, which is held
marketplace-install-local-plugin.ts:1497 (409 RESOURCE_CONFLICT)	… held by the environment base 'BASE' …	… held by the writable base 'BASE' …	"environment base" is not a documented name (zero hits in docs/adr, content/docs, packages/spec/src); the docs call this base a "writable base" (content/docs/deployment/install-modes.mdx:132, the package-lifecycle reference)
marketplace-install-local-plugin.ts:1497-1498, same message, split across +	… or a base authored in this environment …	… or a base authored in this system …	made here, not from a package: "authored in this system"
marketplace-install-local-plugin.ts:1498, same message	… whose items are this environment's own metadata.	… whose items are this system's own metadata.	the system the caller is in: "this system"
marketplace-install-local-plugin.ts:2562 (200 note, unmanaged install)	The package's metadata is now this environment's own, in the base 'BASE' …	The package's metadata is now this system's own, in the base 'BASE' …	same
mcp/src/metadata-completeness.ts:47 (the warning on a known-partial list_objects / objectstack://objects answer)	… this environment declares at least that many objects, possibly more.	… this system declares at least that many objects, possibly more.	the system the MCP caller is in: "this system"
mcp/src/connect-ui.ts:84 (UI bundle description)	… for connecting MCP clients to this environment.	… for connecting MCP clients to this system.	same
mcp/src/connect-ui.ts:63-64 (Connect-an-Agent page:header subtitle; split across +)	Give any MCP-capable AI client governed access to this environment — every call runs …	kept in this PR; chosen sentence below	coupled with platform-objects/src/apps/translations/en.ts:270 by a byte-identity guard (next section)
mcp/src/skill-md.ts:36-39 OBJECTSTACK_SKILL_DESCRIPTION	… change data in their ObjectStack environment.	kept	a deployment addressed from outside: the portable SKILL.md that an external coding agent installs, naming the deployment it connects to by URL (the sense triage kept for cli)
mcp/src/skill-md.ts:62 (intro, with the deployment's label)	This skill connects you to the ENV ObjectStack environment.	kept	same; it names a deployment by its label
mcp/src/skill-md.ts:63 (intro, no label)	This skill connects you to an ObjectStack environment.	kept	same
mcp/src/skill-md.ts:65 template, body	An ObjectStack environment exposes its data objects …	kept	same
mcp/src/skill-md.ts:65 template, "When to use"	… the environment is the source of truth …	kept	same
cloud-connection-route-ledger.ts:115-118 (/status row note)	… is this environment bound to a cloud account? …	kept	not user-visible: package-internal data for cloud-connection-route-ledger.conformance.test.ts, never exported or bundled (its header, :55-60). Measured: the note is in 0 of the files in packages/cloud-connection/dist, while the new 401 text is in index.js and index.cjs
cloud-connection-route-ledger.ts:157-159 (/install row note)	installs a package into this environment VIA the control plane …	kept	same
cloud-connection-route-ledger.ts:177-179 (/installed row note)	the environment's full installed list …	kept	same; it also names the control plane's per-environment record
cloud-connection-route-ledger.ts:239-241 (reseed-sample-data row note)	… trigger against a remote environment.	kept	same; a deployment addressed from outside
marketplace-install-local-plugin.ts:2533-2536 (logger.info)	… copied into the environment base …	kept	a log line, outside this card
marketplace-install-local-plugin.ts:3709-3711 (logger.warn)	… the environment's metadata is the platform operator's …	kept	a log line, outside this card
mcp/src/mcp-server-runtime.ts:905-909 (logger.warn)	… would understate the environment.	kept	a log line, outside this card
mcp/src/mcp-server-runtime.ts:1446-1451 (logger.warn, the card's :1448)	… fewer than this environment declares.	kept	a log line, outside this card
telemetry-posture.ts:98	OS_TELEMETRY_CLIENT_ERROR_REPORTING_ENVIRONMENT	kept	an environment-variable name, not copy

Not copy, and held by this card: the error codes ENVIRONMENT_NOT_FOUND (cloud-connection-plugin.ts:532, :593, :655, :757, :805, :861, :924, :962) and ENVIRONMENT_BIND_FAILED (:746), and the wire paths that carry environment_id or /cloud/environments/ (:550, :891, :939, :978).

Comments, not strings, so outside the census: marketplace-install-local-plugin.ts:201, mcp-http-tools.ts:94, mcp-server-runtime.ts:863, :1558, :1590, skill-prompts.ts:61. The counts the dispatch asked about are lines: git grep -c -i 'this environment' reads 3 in marketplace-install-local-plugin.ts because :201 is a comment and :1498 carries the phrase twice; mcp-http-tools.ts (1) and skill-prompts.ts (1) are comments; mcp-server-runtime.ts (4) is the :1448 log line and three comments. The census also reads strings that a this environment grep cannot see: "the environment base" (:1497), the route-ledger notes at :177 and :239, the ENVIRONMENT_NOT_FOUND_MESSAGE at :215, the two log lines that say "the environment", and the five skill-md.ts uses.

The coupled sentence: connect-ui.ts:63 and platform-objects en.ts:270

#24405 has not landed: it is open and unclaimed, and en.ts:270 on origin/main 31e7d0ba2 still reads "this environment". The sentence chosen per the rule (the system the caller is in, "this system"):

Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security.

The plan was for whichever card lands second to match the first. Measurement shows that cannot work. packages/cli/test/platform-page-i18n-parity.test.ts holds the en bundle byte-identical to the page literal, because translatePage applies the en bundle over the literal. So neither file can change alone: the guard goes red, and the en user would see no change anyway. Measured at 9355bce52, through scripts/pm/os-verify-lock.sh, with scripts/ablation-replace.mjs doing the mutation and its restore:

• Control, unmutated: pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 test/platform-page-i18n-parity.test.ts: "Tests 27 passed (27)".
• connect-ui.ts:63 alone changed to the sentence above ("anchor 1 → 0, blob 400cf11586d7 → d9173cb002db"), @objectstack/mcp rebuilt, then ablation-dist-preflight.mjs ("marker present in 2 built files"): "Tests 2 failed | 25 passed (27)". The two that failed: "keeps the en bundle byte-identical to the metadata literals" and "holds the en bundle in verbatim parity with the page sources".
• Restored ("blob == HEAD (400cf11586d7) and git diff HEAD is empty"), rebuilt, preflight --absent ("marker absent from all 6 built files", "working tree clean against HEAD"): "Tests 27 passed (27)".

So the two strings must move in ONE PR. This card's hold-off keeps packages/platform-objects/** out of it, so connect-ui.ts:63 is left unchanged here, with the sentence above named for the joint edit. #24405 remains open. The joint edit is also wider than two lines, read from source and not measured. The zh-CN, ja-JP and es-ES subtitles also say "this environment" (此环境, この環境, este entorno). Each locale records a source hash for the key (pages.connect_agent.subtitle in *.source-hashes.ts), and under source-hash.ts (#8765 Option B) a hash that disagrees with the new en text serves the English source. The same parity file's "rewrites the page:header copy end-to-end for a non-English locale" asserts that the zh-CN subtitle differs from the source. So the joint PR also owes the three translated values and their hashes.

Readers of the changed strings, measured

git grep over the whole tree (packages, content/docs, docs/qa, skills, examples, .changeset), and over objectui origin/main 024b7b6, for each changed string and its fragments:

• content/docs/deployment/cloud-connection.mdx:128 quoted the sign-in 401 text. It is updated here.
• marketplace-install-local-install-modes.test.ts:409 pinned the 409 prose. It now pins the named base. :321 pins the logger.info line, which is not changed, and stays as it is.
• No test pins the sign-in 401 prose, the install note, the MCP partial-listing sentence or the bundle description. The MCP partial listing is discriminated by its code SERVICE_UNAVAILABLE, which is unchanged.
• objectui packages/app-shell/src/console/marketplace/marketplaceApi.ts:32 quotes the old 401 text in a comment. Nothing there parses it: the Cloud Connection panel shows body.error.message verbatim.
• CHANGELOG.md entries that quote the old text are release-owned history, left as they are.
• No consumer parses any of these texts.

Verification

All builds and tests ran through scripts/pm/os-verify-lock.sh at head 9355bce52 (the final commit):

• pnpm exec turbo run build --filter='@objectstack/mcp...' --filter='@objectstack/cloud-connection...' --filter='@objectstack/platform-objects...' --concurrency=2: "Tasks: 35 successful, 35 total".
• pnpm --filter @objectstack/cloud-connection exec vitest run --maxWorkers=2: "Test Files 52 passed (52) · Tests 614 passed (614)".
• pnpm --filter @objectstack/mcp exec vitest run --maxWorkers=2: "Test Files 40 passed (40) · Tests 479 passed (479)".
• pnpm --filter @objectstack/cloud-connection typecheck: exit 0.
• pnpm --filter @objectstack/mcp typecheck: exit 0 ("6 file(s) / 53 error(s) / 8 pinned signature(s) held").

Gates, run after the final commit at head 9355bce52, each exit code captured before any pipe:

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 95 commands from the 8 changed paths. All 95 exited 0. Two of them first answered exit 3, PREREQUISITE NOT MET, on the closure build: check:skill-examples and check:dual-build-cjs-loads. After pnpm exec turbo run build --filter='!@objectstack/docs' --concurrency=2 ("76 successful, 75 cached") they were re-run with exit 0: "262 prose examples type-check across 3 surface(s)", and "111 published require entry point(s) across 69 package(s) load". check:dts-closure, check:sourcemap-no-sources-content, check:lean-entry-closure, check:published-files and check:published-readme-links were also re-run on the full build, all exit 0 ("76 built package(s) swept"). The --ran reconciliation: "Run reconciliation — 95 derived, 95 run, 0 NOT-MEASURED, 0 UNRUN."
• The 10 declared wide-population families, all exit 0: check:init-service-contract, check:live-db-isolation, check:meta-type-normalized, check:optional-error-sink, check:resume-authority-declared, check:runner-env-posture, check:settings-bind-window, check:startup-registry-verdict, check:verify-stand-in, check:wildcard-fallthrough.
• The artifact-roster families whose roster sits under a changed directory, plus the route-ledger census, all exit 0: check-changeset-fixed.mjs, check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check:route-ledger-census.
• pnpm exec eslint --no-inline-config over the five changed .ts files: exit 0, no output.
• test:repo was not run locally. It belongs to CI's Test Core, and this diff changes none of that project's tests.

No ablation: the change is copy, and no test pins the behaviour. The one measurement that mutated code is the coupled-sentence guard probe above.

Acceptance notes

• The logger.info line at marketplace-install-local-plugin.ts:2534 still says "environment base" while the 409 now says "writable base". Log lines are outside this card. Not filed.
• The objectui comment at marketplaceApi.ts:32 quotes the old 401 text. It is a comment, and per triage 6252585695 the objectui mirror is a pointer, not a card here.
• packages/plugins/plugin-auth/src/auth-manager.ts:2527 ("You are not authorized to sign in to this environment.") sits in platform copy, the rest of cloud#3002 ruling A: about 50 non-comment "this environment" strings outside #24327 and #24360 (cloud-connection, plugin-auth, service-settings, platform-objects, mcp, plugin-security, spec) need the per-string reading #24368's plugin-auth scope, not this card's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

3 anchor(s) derived from 2 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ee882b845fc44a72fcdc85d6eb1ab251ee7462c0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from dd2ca3f02db89f8d6581dabbc94ddc138a0b4b68 — the merge of head 9355bce5235e141b0659806cc4bfc6ce58a3c2bd into base ee882b845fc44a72fcdc85d6eb1ab251ee7462c0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin dd2ca3f02db89f8d6581dabbc94ddc138a0b4b68 && git checkout dd2ca3f02db89f8d6581dabbc94ddc138a0b4b68
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ee882b845fc44a72fcdc85d6eb1ab251ee7462c0 9355bce5235e141b0659806cc4bfc6ce58a3c2bd && git checkout -B drift-repro ee882b845fc44a72fcdc85d6eb1ab251ee7462c0 && git merge --no-ff 9355bce5235e141b0659806cc4bfc6ce58a3c2bd

node scripts/docs-audit/affected-docs.mjs --json ee882b845fc44a72fcdc85d6eb1ab251ee7462c0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

席位核对

ACCEPT (lane review) · domain:cli seat 1 (seat post #6024) · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T00:32Z · on head 9355bce52 · #24404 (p2, claim 6256630713, amended in place; report 6257088525). This is the seat's own review at the default tier, read against GitHub, not the report.

1. Shape:
   • Draft against main, Fixes #24404, a line-initial Clause-②: no (copy only).
   • 8 files, +34 / −14. Two patch changesets (@objectstack/cloud-connection, @objectstack/mcp). Not governed, under 3,000.
2. The strings, read on the diff against cloud#3002 ruling A (triage 6250167038, 6252585695):
   • The seven 401 UNAUTHENTICATED texts drop the noun ("Sign in to connect a cloud account.", "Sign in to install apps.", "Sign in.").
   • The install-local 409 says "the writable base", the documented name (concepts/metadata-lifecycle.mdx, deployment/install-modes.mdx), and "authored in this system" / "this system's own metadata". The unmanaged-install note says "this system's own".
   • metadata-completeness.ts:47 and connect-ui.ts:84 say "this system".
   • No status, code, details or shape moves.
3. Kept, each with its reason in the PR body:
   • ENVIRONMENT_NOT_FOUND_MESSAGE: a configuration scope, paired with its held code.
   • The route-ledger notes: package-internal guard data, absent from dist.
   • The skill-md.ts uses: a deployment addressed from outside.
   • Log lines: outside the card.
   • The census came from an AST walk of the 28 non-test sources, so concatenated strings were read whole.
4. The breach, accepted: connect-ui.ts:63 is unchanged.
   • Measured: platform-page-i18n-parity.test.ts holds it byte-identical to platform-objects' en.ts:270. Changing it alone reds 2 of 27, so the two must move in one PR. platform-objects was this claim's hold-off.
   • The dev's open question is answered A: platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405 carries the joint edit (both halves, the three locale values and their hashes), with the sentence named here. See note 6257112504 on platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405 and this lane's consent on [PM seat] domain:engine — 🟢 os-project-manager #6367 6257116088.
   • This PR stays Fixes #24404, because the card's "Done when" is each string "changed per the rule or left with its reason".
5. The out-of-surface file, accepted: content/docs/deployment/cloud-connection.mdx:128 quoted the old 401 text, which this change makes false. The claim was amended in place to name it, and it is declared on [PM seat] domain:devx @ objectstack — 🟢 os-warren · session_01FM29ZqLTrnPNXxijioZwMp #6023 6257119858.
6. Tests and gates, from the report:
   • cloud-connection: 52 files, 614 tests. mcp: 40 files, 479 tests. Both typechecks exit 0. eslint exits 0.
   • The one prose pin (install-modes.test.ts:409) now pins the named base beside the code it already pinned.
   • dispatch-gates: 95 derived, 95 run, 0 NOT-MEASURED. The wide families exit 0.
   • CI on this head was running at this stamp, with none red.
7. Findings:
   • plugin-auth's auth-manager.ts:2527 sign-in text is platform copy, the rest of cloud#3002 ruling A: about 50 non-comment "this environment" strings outside #24327 and #24360 (cloud-connection, plugin-auth, service-settings, platform-objects, mcp, plugin-security, spec) need the per-string reading #24368's (its census names it as :2434 at an older commit).
   • The environment base log line and objectui's code comment → Acceptance notes.
8. Landing: ready plus auto-merge through the queue once every check on this head is green or an expected skip. The card closes on the merge.

---

Generated by Claude Code