[objectstack-fleet]

Fixes #350

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：Deploy 下新增两页，仅 Enterprise 徽章：Licensing（取证、在线/离线验证、启动横幅、续期、到期后怎样、单机版与 Enterprise 对比）与 Multi-organization（三种 posture、许可证门禁与拒启、运行形态、Community 镜像、小规模用 Cloud）。
• 为什么改：Deploy and Operate become one self-managed handbook for Community and Enterprise: each page written once, "Enterprise adds" sections for the private image and license, plus Licensing and Business Self-Managed vs Enterprise pages #345 把这两页拆给 cloud 车道；事实按今天 cloud main 的代码和功能目录写。卡上的「到期永不版本锁定」已不完全成立：订阅（含单机版）到期降级，买断（永久）证保留维保期内发布的版本（cloud#3583）。页面写的是后者，并且不写任何价格。
• 风险与回滚：纯文档改动，合并即发布生产站点；只新增两页并改一行 deploy/meta.json，回滚 = revert 这一个 squash commit。已知不一致：editions/license、editions/compare 仍写「完整部署续费失败保留最后付费版本」，由 Docs: ObjectOS Enterprise has no public price (drop Enterprise Single-Node $540), and a lapsed licence follows cloud#3583 (subscription degrades, perpetual keeps its version) #439 第二个 PR 改。
• 先看：content/docs/deploy/licensing.mdx 的「When a license ends」（三种到期后会拒启的配置）、同页的对比表（多节点与 HA 的措辞）、content/docs/deploy/multi-organization.mdx 的「On the Community image」（开源多组织运行时的那句话）。
• 两分钟验证：打开预览站 /docs/deploy/licensing，侧栏 Deploy 下应出现 Licensing 与 Multi-organization 两项，徽章只有 Enterprise；对比表里 Single-Node 一列是一台节点、最多 25 个 AI 席位、只能在线验证。
• 需要你做的：确认 Multi-organization 页「多组织运行时本身在 ObjectStack 框架里是开源的」这句保留还是删掉（见 Acceptance notes 第一条）。

What changes

• New deploy/licensing.mdx (editions: [enterprise]): obtaining a license (what the license mail carries, edition / mode / kind fixed at issue), Enterprise Single-Node vs Enterprise (a feature table plus the honest scope of each row), online vs air-gap (72 h entitlement, 24 h refresh, 7-day grace, the online-plus-off refusal, the composed shape's air-gap-only rule, the 10 s first-boot wait), what the boot banner shows (a licensed and a Community example, line by line, the GRACE / PERPETUAL / BUILD STAMP states), license-check.sh, renewal, and what a license that ends does: a subscription degrades to Community, a perpetual license keeps the images released during maintenance, and three configurations refuse to start instead (walled posture, customer-managed keys, declared multi-node).
• New deploy/multi-organization.mdx (editions: [enterprise]): which edition fits (Enterprise for several organizations self-managed, Cloud for small scale), the three postures, the license gate and its refusal text, lapse behaviour on a walled deployment, the Community image, the three run shapes, the three decisions a walled deployment must declare, what the wall separates, and the two per-organization protections (SSO domain verification on by default, customer-managed keys).
• deploy/meta.json: the two pages appended to the Deploy group.

No locale file is touched. The locale meta.*.json files keep their own page lists, so the two pages appear in the English sidebar now and in the other locales' sidebars at the next translation pass.

The card's sentence that changed

The card says non-renewal "never version-locks". On cloud main that holds for subscriptions, Enterprise Single-Node included, and not for the perpetual licence cloud#3583 / PR #3589 added: an image built no later than the maintenance end stays licensed (VERSION-LOCKED), a later image runs as Community. The page states that rule. Per the maintainer's 2026-11-04 ruling on cloud#3583 it names no perpetual price or SKU and calls the perpetual licence contract-only. It also names no Enterprise price, per the same thread's "Enterprise has no public price" (docs#439).

Where each fact comes from (objectstack-ai/cloud main @ 9e71fd6a, objectstack-ai/objectstack main @ 8ef4d309)

Claim on the pages	Source
Single-Node: maxNodes: 1, up to 25 AI seats, online only, features aiStudio, governance; clustering, multi-org, SCIM, air-gap, hierarchy, CMK excluded; no version-lock	docs/design/ee-feature-catalog.md:28-35; docs/adr/0085-brand-split-pricing-and-business-self-managed.md:51-65, :71-80
Feature wording (AI preview not in contract, governance scope, multi-node is not HA, SCIM default, hierarchy scopes, multiOrg, CMK scope)	ee-feature-catalog.md:41-47, :54-80
License mail contents	apps/objectos-ee/deploy/INSTALL.md:21-31
Online: 72 h entitlement, 24 h refresh, 7-day grace; air-gap local only	INSTALL.md:177-180; packages/security-enterprise/src/license/online-client.ts:24, :59, :65; ADR-0022 decision point 1 (docs/adr/0022-enterprise-license-model.md:194-195)
Online license with OS_CLOUD_URL=off refused; quoted first line	INSTALL.md:182-183; packages/security-enterprise/src/license/online-posture-gate.ts:168
First boot waits 10 s; late validation mounts on next restart	apps/objectos-ee/objectstack.config.ts:481, :683-685, :693-697
Banner lines quoted verbatim	packages/security-enterprise/src/license/entitlement.ts:955 (preview label), :966, :1012-1013, :1017-1021, :1043-1053, :1064-1075, :1086-1103
No banner on the artifact-pinned shape (config does not run)	objectstack.config.ts:437 (banner printed by the config); apps/objectos-ee/deploy/artifact-pinned-boot.md:114-129
license-check.sh behaviour, business edition name, 30-day warning, pre-perpetual images boot licensed	apps/objectos-ee/deploy/license-check.sh:84-113
Subscription lapse = Community at next start; perpetual version-lock; manifest mount warning; upgrade.sh preflight stops	INSTALL.md:204-220; ADR-0022 D5 and D9 (:76-80, :116-148)
Online perpetual still needs the control plane after maintenance	ADR-0022 consequences (:181)
Walled posture refuses without a license, also at lapse	INSTALL.md:222-223; packages/organizations/src/multi-org-license-gate.ts:231-251 (quoted); artifact-pinned-boot.md:119-121 (MULTI_ORG_NOT_LICENSED)
CMK refuses the boot when unlicensed or unreachable	ee-feature-catalog.md:47, :62-67
Declared multi-node refused without a multi-node license; EE kit runs one node today	content/docs/reference/environment-variables.mdx (this site, OS_CLUSTER_REPLICAS row); apps/objectos-ee/deploy/README.md:105-137
Postures single / group / isolated; unset is silent, typo refuses	docs/deployment/multi-tenant.md:31-37, :88-104
Composed shape: air-gap only, OS_CLOUD_URL=off, build agent closable; artifact-pinned lacks the EE wiring	apps/objectos-ee/deploy/composed-artifact-boot.md:20-45
SSO domain verification on by default, config-authored and composed shapes only	objectstack.config.ts:795-828; INSTALL.md Single sign-on section
Community image: walled posture refuses ("could not be loaded"), degraded flag boots with the wall inactive	objectstack docker/Dockerfile (installs @objectstack/cli only); packages/cli/src/commands/serve.ts:4504-4545, :6960-6967, :6978-6980
Multi-organization runtime is open source	objectstack docs/adr/0132-multi-organization-runtime-is-open-core.md D1, D2
Availability: perpetual banner states, CMK and the SSO default are newer than 4.3.1	ee-v4.3.1 = 2577f17c; git merge-base --is-ancestor 2577f17c exits 0 for d4aa3a7f (cloud#3583), 7031d56a (cloud#3573) and 343a2c00 (cloud#3679), so all three land after the tag

Tests

Docs-only. No ts / js sample blocks added.

Acceptance notes

• For the maintainer: one sentence about open source. Framework ADR-0132 (2026-09-07) made @objectstack/organizations Apache-2.0, and objectstack#16137 (closed) proved an open-only install can raise the wall. The published Community image does not ship that package, so a walled posture there refuses to start. The cloud catalog still says "ObjectStack self-host is single-org", and its multiOrg row still describes the runtime as moved into closed source. The page scopes its claim to ObjectOS and keeps one sentence saying the runtime itself is open source in the framework, which this site's changelog already says. Deleting that sentence leaves the page correct.
• docs(deploy, operate): one self-managed handbook for Community and Enterprise #352's two open items for this card. (1) Prometheus /metrics and trace export on the Enterprise image: on cloud main there is no /metrics route and no Prometheus or OTLP wiring in apps/objectos-ee, packages/security-enterprise, packages/objectos-runtime or the deploy kit, so docs(deploy, operate): one self-managed handbook for Community and Enterprise #352's removal stands and Enterprise adds nothing there. No page change, and Observability is outside this PR's files. (2) A walled posture on the Community image: answered on the Multi-organization page, as described above.
• Known inconsistency, carried by Docs: ObjectOS Enterprise has no public price (drop Enterprise Single-Node $540), and a lapsed licence follows cloud#3583 (subscription degrades, perpetual keeps its version) #439: editions/license and editions/compare still say a full Enterprise deployment keeps "the last paid version perpetually" on non-renewal. Docs: ObjectOS Enterprise has no public price (drop Enterprise Single-Node $540), and a lapsed licence follows cloud#3583 (subscription degrades, perpetual keeps its version) #439's second PR rewrites that wording.
• Noted, not changed here (outside this PR's files): deploy/docker.mdx "Multi-node on Enterprise" says to turn on the Redis cluster driver, while the EE kit README (README.md:107-137) says no cluster driver is wired today and one node is the only supported shape. deploy/index.mdx and editions/license list "high availability", which the catalog says not to promise (ee-feature-catalog.md:42). The site's Upgrade page does not carry the open cloud#3588 known issue: walled deployments should not upgrade from 4.2.x to 4.3.x yet.
• The banner's AI Builder preview label is printed in Chinese in an otherwise English banner (entitlement.ts:955, verbatim from the cloud#3538 ruling). The page quotes it and translates it.
• The commit's Co-Authored-By trailer names a model. The pushed history was not rewritten.

Verification

All on 73d9274, foreground, exit codes captured to files before reading.

Gates

Step	Exit	Reading
pnpm install --frozen-lockfile	0
pnpm turbo run type-check --filter=@objectos/docs --force	0	frontmatter valid on 391 pages (negative control refused, as it must be)
pnpm turbo run build --filter=@objectos/docs --force (NEXT_PRIVATE_STANDALONE=true)	0	both pages prerendered for every locale route (English fallback). The sandbox could not fetch OG fonts (self-signed proxy), which is not an error.
check-translation-ownership.mjs --files (name-status vs origin/main, --no-renames)	0	0 translation artifacts, 3 other files
check-positioning.mjs	0	no stale sentence in 100 English sources
check-locale-surface.mjs	0	every advertised URL has a source file and vice versa
check-translations.mjs	0	gate passed
gen-zh-hant.mjs --check	0	114 generated files match
check-doc-samples.mjs	0	100 English pages, 105 pass

Browser check (Chromium against next start of that build)

/docs/deploy/licensing and /docs/deploy/multi-organization both answer 200 at 1280 px and 390 px with no horizontal page scroll (scrollWidth equals the viewport). Both appear in the Deploy sidebar with the Enterprise badge only. Every in-page anchor resolves. All 17 cross-page links with anchors resolve to an element id (docker, kubernetes, air-gapped, environment-variables, hierarchy-visibility, plans-and-seats, production, troubleshooting, editions/license, and the two new pages' own anchors).

🤖 Generated with Claude Code

https://claude.ai/code/session_012dn2AdARJtc4RgABPH7PHk