docs(core,rest): one adjective for what cloud mounts — licence-gated, not cloud-private

[huangyiirene]

Fixes #18542

Clause-②: no

#17379's census (comment 5704455410) left one five-sentence family that is neither "now
false" nor "still true". Five measurement narratives in packages/core/src/security and
packages/rest/src call the thing cloud's own app mounted "the real cloud-private
@objectstack/organizations" (or "Organizations plugin"). Under ADR-0132 D3 — one name,
two packages — that adjective never says which of the two it means: it is true of the
licence-gated subclass a commercial deployment resolves the name to, and false of the
package name, which in this workspace resolves to an Apache-2.0 member of it.

Triage kept the five on one card so the adjective is chosen once. This is that choice.

The adjective: licence-gated

It is the tree's own established spelling for cloud's variant, and it is the property that
DISCRIMINATES: the open-core build in this repository is not gated, the subclass cloud
resolves the same name to is. Measured on this head: 16 live occurrences of licence-gated
and zero of license-gated — packages/plugins/plugin-security/README.md,
packages/plugins/plugin-auth/src/tenancy-service.ts,
packages/services/service-cluster/src/multi-node-gate-mount.ts,
packages/spec/src/kernel/platform-capabilities.ts (a runtime string),
packages/cli/src/commands/serve.ts and four CHANGELOGs, all reading "a private,
licence-gated subclass".

Where the old adjective sat on the bare package NAME (the three packages/rest sites), the
referent noun subclass is added with it, so the gate attaches to the variant and never to
the Apache-2.0 package — otherwise the repair would trade one false reading ("this package
is private") for another ("this package needs a licence"). The two packages/core sites
already had a noun denoting the mounted instance ("Organizations plugin"), so they take
the adjective alone.

Why the alternatives lose

• enterprise — it does not discriminate. packages/spec/src/security/tenancy-posture.ts
  uses "the enterprise @objectstack/organizations runtime" for the package required to
  ACTIVATE a multi-org posture, which since ADR-0132 is the open-core one. Picking it would
  relabel the ambiguity instead of removing it, and add five lines to the 107-line population
  the census already flagged as true-but-for-a-stale-reason.
• Keeping cloud-private (the census's option C) — true of what cloud mounted, but it
  states the package is private: the exact claim ADR-0132 falsified and that a six-PR campaign
  (feat(organizations): bring the multi-organization runtime back to open core — the org-scoping registrar ships open, the licence gate stays in cloud (ADR-0132) #16215, dogfood: the enterprise-organizations declared-unresolvable CONTROL flips red once packages/plugins/organizations is BUILT — its premise died when the package moved to open core #16539, types: the node.test.ts host-only-package pin is green in CI only while packages/plugins/organizations/dist is absent on the shard that runs it — #16215 made its example package a workspace member #16552, docs(organizations): stop calling the open multi-org runtime enterprise/closed-source (#16718) #17371, verify's cross-tenant proofs are skipped for a reason ADR-0132 falsified — but the obvious fix is pinned shut by the entitlement boundary #17369, docs(organizations): state ADR-0132's entitlement boundary as the reason the cross-tenant proofs stand in #17910) removed everywhere else. Five surviving
  instances re-seed that population.
• Dropping the adjective entirely — right for an operator-facing message, and already
  ruled so for one: packages/cli/src/commands/serve-organizations-message-spelling.test.ts
  records "a commercial deployment resolves the same package name to a private licence-gated
  subclass, so any adjective this message picks is wrong for one of the two installs reading
  it". That ruling is about a message whose READER is unknown. These five are measurement
  narratives whose subject is named (apps/objectos-ee, cloud#1982): two of them contrast
  "objectstack#15163 measured it on the framework" with "cloud#1982 reproduced it with the
  real X", and with no adjective that contrast collapses into the same artifact twice — which
  is exactly the distinction ADR-0132 D3 exists to keep readable.
• entitled — already carries a different job: tenancy-posture.ts uses it for
  ACTIVATION ("Open code, entitled activation") and doctor's roster pin for "the ENTITLED
  variant" of a roster row.

The five sites

Taken from #17379's census, comment 5704455410 — not from the card body, and no fresh sweep
was run. Line numbers are readings at this head, not identifiers.

#	file	the adjective as it stood
1	packages/core/src/security/resolve-authz-context.ts:483	"the real cloud-private Organizations plugin"
2	packages/core/src/security/resolve-authz-context.test.ts:1604	same sentence, the test twin
3	packages/rest/src/rest-api-plugin.ts:300	"the real, cloud-private @objectstack/organizations"
4	packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts:21	"the REAL cloud-private @objectstack/organizations"
5	packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts:11	same shape

File surface as declared in the claim: packages/core/src/security/ and packages/rest/src/.
The diff is those 5 files, both halves of the cross-domain surface, nothing outside it. No
other session's edit was found in either file.

Prose, not pins

The three machine assertions the card names are NOT in this diff.
serve-capability-vocabulary.test.ts:92 and doctor-organizations-message-spelling.test.ts:197
(edition === 'enterprise') and harness.host-resolution.test.ts:288,319 (operator strings in
a regex) are class-3 enterprise sites in packages/cli and packages/verify; this card is
the class-1-ambiguous cloud-private family in packages/core + packages/rest.

doctor-organizations-message-spelling.test.ts:188-194 was read before deciding, as the card
requires. It argues that the roster row edition: 'enterprise' records the ENTITLED variant
and is "deliberately not relaxed to match the prose reword". Nothing here disturbs it, and its
reasoning is the one this diff applies — one name, two packages, and the roster names the
entitled variant. No argument to move it is made.

All five edited sites are comment prose. Nothing asserts their text: the three tests that read
these two source files as TEXT (authz-store-unavailable.test.ts,
execctx-authz-input-seam-reachability.test.ts, objectql-slot-consumer-census.test.ts)
assert code shapes only — imports, catch patterns, and field reads whose scanner excludes
comment lines by construction.

Evidence

• pnpm --filter '@objectstack/rest...' --filter '@objectstack/core...' build — exit 0 (both dependency closures).
• pnpm --filter @objectstack/core test — 51 files / 1316 tests passed.
• pnpm --filter @objectstack/rest test — 194 files / 3236 passed, 1 skipped.
• pnpm --filter @objectstack/core typecheck && pnpm --filter @objectstack/rest typecheck — exit 0, each including its test layer.
• pnpm lint (repo-wide eslint . --no-inline-config) — exit 0 in 86s, so no narrowing was needed and none is declared.
• Gate families derived by scripts/pm/dispatch-gates.mjs --commands at this head: 53 derived, 51 run green, 2 NOT MEASURED — check:dual-build-cjs-loads and check:type-check-debt both exit 3, PREREQUISITE NOT MET: they read a whole-repo dist/ this worktree does not have, and CI builds before running them. Reconciled with --ran: "53 derived famil(ies) accounted for — 51 run, 2 NOT-MEASURED".

skip-changeset, measured rather than assumed

Both packages publish, so the label was measured. After the build,
grep -rn "licence-gated" packages/core/dist packages/rest/dist returns zero hits (exit 1,
captured before any pipe). Positive control on the same channel: comment prose DOES reach
published output — cloud#1982 appears at packages/rest/dist/index.d.ts:421, out of a JSDoc
on an exported declaration in rest-server.ts — and the exported symbols (resolveAuthzContext,
RestApiPlugin) hit in dist as expected. The channel exists, the control fires on it, and
none of the five edited comments is on it: nothing published moves. Clause-②: no holds for
the same reason — no accept set, no authorable key and no export moves.

Acceptance notes

• noted, not filed — packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts
  calls the same mounted runtime "the enterprise plugin" two lines below the edited sentence.
  That is a class-3 line (true under ADR-0132 D3, stale reason), and Sweep the remaining @objectstack/organizations enterprise/cloud-private spellings that #16718's pattern could not see #17379's class-3
  population is out of this card's scope by the triage ruling, so it is left exactly as it was.
  Successor: none queued — the census's class-3 lane table lists no packages/rest lane.
• noted, not filed — two shorter siblings of the same family already carry no adjective at
  all: packages/rest/src/rest-server.ts (the published JSDoc above) and
  packages/core/src/security/api-key.ts. Both are correct as written — they name the package,
  not a variant — and are unchanged. Recorded so the next reader does not read that absence as
  drift from this ruling.
• The census's own out-of-scope finding about ADR-0132's Status: Proposed line is already
  reported on Sweep the remaining @objectstack/organizations enterprise/cloud-private spellings that #16718's pattern could not see #17379 and is not refiled here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/core, @objectstack/rest, touching 2 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/runtime-services/sharing-service.mdx (via resolveAuthzContext (symbol, a top-level function))
• content/docs/permissions/authentication.mdx (via createRestApiPlugin (symbol, a top-level function))
• content/docs/permissions/authorization.mdx (via resolveAuthzContext (symbol, a top-level function))
• content/docs/plugins/packages.mdx (via createRestApiPlugin (symbol, a top-level function))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via resolveAuthzContext (symbol, a top-level function))
• content/docs/releases/v17/17-1.mdx (via resolveAuthzContext (symbol, a top-level function))
• content/docs/releases/v17/17-3.mdx (via resolveAuthzContext (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 32 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09e16a5745b66ca4e5cdddb6248551d1761f0ddd → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d9deeb6769693f03b06c26124b54dea6cccaa47d — the merge of head 88df1306ac90e9944e3bb1466b0ca866e6224b55 into base 09e16a5745b66ca4e5cdddb6248551d1761f0ddd, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d9deeb6769693f03b06c26124b54dea6cccaa47d && git checkout d9deeb6769693f03b06c26124b54dea6cccaa47d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09e16a5745b66ca4e5cdddb6248551d1761f0ddd 88df1306ac90e9944e3bb1466b0ca866e6224b55 && git checkout -B drift-repro 09e16a5745b66ca4e5cdddb6248551d1761f0ddd && git merge --no-ff 88df1306ac90e9944e3bb1466b0ca866e6224b55

node scripts/docs-audit/affected-docs.mjs --json 09e16a5745b66ca4e5cdddb6248551d1761f0ddd

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09e16a5745b66ca4e5cdddb6248551d1761f0ddd → pass the list as
args.docs, on the commit named under Which tree this was computed on.