From 88df1306ac90e9944e3bb1466b0ca866e6224b55 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 17 Sep 2026 18:41:35 +0000
Subject: [PATCH] docs(core,rest): name cloud's mounted variant
 "licence-gated", not "cloud-private"

Five measurement narratives in packages/core/src/security and
packages/rest/src said the reproduction ran with "the real cloud-private
`@objectstack/organizations`" (or "`Organizations` plugin"). Under
ADR-0132 D3 "one name, two packages" that adjective is ambiguous, not
simply false: it is true of the licence-gated subclass cloud's own app
mounts, and false of the package name, which resolves in this workspace
to an Apache-2.0 member of it.

All five take the same adjective, chosen once: `licence-gated`, the
tree's established spelling for cloud's variant (plugin-security
README.md, plugin-auth/src/tenancy-service.ts,
service-cluster/src/multi-node-gate-mount.ts,
spec/src/kernel/platform-capabilities.ts, and the CHANGELOGs of four
packages all read "a private, licence-gated subclass"). Where the
adjective sat on the bare package NAME the referent noun `subclass` is
added with it, so the gate attaches to the variant and never to the
Apache-2.0 package.

Comment prose only: no runtime string, no export, no test assertion and
no behaviour moves.

Claude-Session: https://claude.ai/code/session_01CqmCgU5RGDoJYhHUMVp2af
Co-authored-by: Claude <noreply@anthropic.com>
---
 packages/core/src/security/resolve-authz-context.test.ts  | 2 +-
 packages/core/src/security/resolve-authz-context.ts       | 2 +-
 packages/rest/src/rest-api-plugin.ts                      | 6 +++---
 .../src/single-kernel-isolated-api-key-matrix.test.ts     | 8 ++++----
 ...ingle-kernel-isolated-session-org-claim-matrix.test.ts | 7 ++++---
 5 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/packages/core/src/security/resolve-authz-context.test.ts b/packages/core/src/security/resolve-authz-context.test.ts
index b8d3ef24600..f4787821c08 100644
--- a/packages/core/src/security/resolve-authz-context.test.ts
+++ b/packages/core/src/security/resolve-authz-context.test.ts
@@ -1601,7 +1601,7 @@ describe('the in-memory ObjectQL double honours `limit` (#10978)', () => {
  *
  * ## What was measured, before the guard existed
  *
- * On a live `isolated` boot with the real cloud-private `Organizations` plugin
+ * On a live `isolated` boot with the real licence-gated `Organizations` plugin
  * and a file-backed sqlite store, a session whose owner had been removed
  * through better-auth's OWN `/organization/remove-member` — driven by the org
  * owner, 200, the `sys_member` row really deleted — went on READING that
diff --git a/packages/core/src/security/resolve-authz-context.ts b/packages/core/src/security/resolve-authz-context.ts
index 112da35d248..a0f4b12c76c 100644
--- a/packages/core/src/security/resolve-authz-context.ts
+++ b/packages/core/src/security/resolve-authz-context.ts
@@ -480,7 +480,7 @@ export async function resolveAuthzContext(input: ResolveAuthzInput): Promise<Res
   // The block above asks "is this stamped organization still backed by a
   // membership?" and, until this card, asked it ONLY of an API key. A browser
   // session's `activeOrganizationId` reached `ctx.tenantId` unread: measured on
-  // a live `isolated` boot with the real cloud-private `Organizations` plugin,
+  // a live `isolated` boot with the real licence-gated `Organizations` plugin,
   // a session whose owner had been removed through better-auth's OWN
   // `/organization/remove-member` (driven by the org owner, 200, the
   // `sys_member` row really deleted) went on READING that organization's rows
diff --git a/packages/rest/src/rest-api-plugin.ts b/packages/rest/src/rest-api-plugin.ts
index 6e67a2e27a9..bb752517b7e 100644
--- a/packages/rest/src/rest-api-plugin.ts
+++ b/packages/rest/src/rest-api-plugin.ts
@@ -297,9 +297,9 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
             // organization's rows (GET 200) and WROTE a new one into it (POST
             // 201, the row read back from the store carrying the other
             // organization's id). objectstack#15163 measured it on the
-            // framework; cloud#1982 reproduced it with the real, cloud-private
-            // `@objectstack/organizations` mounted, which adds no request-time
-            // refusal of its own.
+            // framework; cloud#1982 reproduced it with the real, licence-gated
+            // `@objectstack/organizations` subclass mounted, which adds no
+            // request-time refusal of its own.
             //
             // ## Why this is NOT `authServiceProvider`'s catch-all
             //
diff --git a/packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts b/packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts
index 6b595fb8852..7455da3372f 100644
--- a/packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts
+++ b/packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts
@@ -18,10 +18,10 @@
  * | organization-less key             | **200 total 0 (silent) · 403** | **401** |
  *
  * objectstack#15163 measured it on the framework; cloud#1982 reproduced it on
- * `apps/objectos-ee` with the REAL cloud-private `@objectstack/organizations`
- * mounted, reading the written row back out of the sqlite file — the enterprise
- * plugin adds no request-time refusal, so the blast radius was every walled
- * deployment.
+ * `apps/objectos-ee` with the REAL licence-gated `@objectstack/organizations`
+ * subclass mounted, reading the written row back out of the sqlite file — the
+ * enterprise plugin adds no request-time refusal, so the blast radius was
+ * every walled deployment.
  *
  * ## Why the fixture is shaped the way it is
  *
diff --git a/packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts b/packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts
index 996d4f1f9e3..143f444d05b 100644
--- a/packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts
+++ b/packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts
@@ -8,9 +8,10 @@
  * ## What was measured, before this guard existed
  *
  * On a real `objectstack serve` of cloud's `apps/objectos-ee` — 44 plugins, the
- * REAL cloud-private `@objectstack/organizations`, `Tenancy: isolated`,
- * `SqlDriver(better-sqlite3)` on a FILE — a browser session whose
- * `activeOrganizationId` pointed at an organization its owner had LEFT:
+ * REAL licence-gated `@objectstack/organizations` subclass,
+ * `Tenancy: isolated`, `SqlDriver(better-sqlite3)` on a FILE — a browser
+ * session whose `activeOrganizationId` pointed at an organization its owner
+ * had LEFT:
  *
  * | after the membership ended | GET | POST | the row, read back from the sqlite file |
  * |:--|:--|:--|:--|