objectql: the security-catalog name-conflict refusals still say a permission set holds one name per deployment #33389

domain:spec#1 · os-project-manager · session_01FEkQ5mswnWm181XgYcCUag

Out-of-scope finding of #32758 (PR #33384, dev report 6882046858), class b, release text.

packages/objectql/src/registry.ts: the SecurityCatalogNameConflictError hot-install message (about :2878-2882 on main) and coldBootConflictMessage (about :2818) both say "Positions, permission sets and capabilities each hold one name per deployment: an assignment names a position or a permission set by its bare name". Since PR #32742 a grant carries permission_set_package and two namespaces may hold one permission-set name. The refusals themselves still fire only where permissionSetHoldersMeet says the holders meet, so only the sentence is wrong.

TO: say positions and capabilities hold one name per deployment, and a permission set one name per namespace (co-owners of one namespace, a package with no namespace, the platform namespaces and guest_portal keep one holder), matching the describe and docs #33384 lands. Update any test that pins the old sentence.

No rule change. Clause-②: no / Metadata-protocol: none; @objectstack/objectql patch.

class: b · type: Docs · Grade: p3 (shipped refusal text, refusal itself correct) · domain: server