docs(spec): the security-catalog migration entry and the D6 gloss stop saying a permission set holds one name per deployment

.changeset/33388-security-catalog-entry-reason.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): the security-catalog overlay migration entry says the environment catalog and a package never hold one name, not that a permission set holds one name per deployment
+
+Clause-②: no
+Metadata-protocol: none
+
+The `security-catalog-environment-overlay-refused` semantic migration entry's `reason` opened "Positions, permission sets and capabilities hold one name per deployment", which stopped being true for permission sets when a permission-set name became one holder per namespace (ADR-0150 D2/D9). It now opens with the entry's own subject: the environment catalog and a package never hold one name. Its `id`, `surface`, `replacement` and `acceptanceCriteria` are unchanged, and so is the cold-boot refusal it records. The `adr_0146_d6_security_catalog` gloss on `OverrideClassificationBasis` now says the security catalog takes no override, and the permission sets guide lists the environment among a name's one-holder cases and says a grant names its set by its package and name. No schema, rule or runtime behaviour changes.

content/docs/permissions/permission-sets.mdx

@@ -421,7 +421,8 @@ as a projection is retired, its object is no longer registered, and no data
 route serves it (ADR-0131 D3). Studio's All metadata area lists the catalog
 (`/studio/~all/metadata/permission?scope=environment`; Setup's old
 `/apps/setup/metadata/permission` address redirects there), a grant
-names its set by name (`sys_user_permission_set.permission_set`), and a write
+names its set by its package and name (`sys_user_permission_set.permission_set_package`
+and `permission_set`), and a write
 goes through the metadata door (`PUT` or `DELETE /api/v1/meta/permission/:name`),
 which requires `manage_metadata` — and, under a `group` or `isolated` tenancy
 posture, the platform operator. This has three author-visible consequences:
@@ -441,7 +442,8 @@ posture, the platform operator. This has three author-visible consequences:
   has one holder per namespace: packages of two namespaces may each ship a set
   of one name, each granted by its own package and name, while two packages of
   one namespace, a package with no namespace, a platform package (`base`,
-  `system`, `sys`) and the platform-requested `guest_portal` keep one holder.
+  `system`, `sys`), the environment and the platform-requested `guest_portal`
+  keep one holder.
   Positions and capabilities keep one name per deployment. Every other set
   (one authored in this system, a clone, or one saved into a writable runtime package) is edited in place: the edit
   lands on its one stored definition.

packages/spec/src/kernel/customization-package.ts

@@ -249,8 +249,8 @@ export type OverrideCondition =
 /**
  * Where a classification comes from:
  * - `adr_0146_d2_listed` — named in D2's "Which types" list;
- * - `adr_0146_d6_security_catalog` — D6: one name per deployment (permission
- *   sets, positions, capabilities);
+ * - `adr_0146_d6_security_catalog` — D6: the security catalog takes no override
+ *   (permission sets, positions, capabilities);
  * - `adr_0146_d10_extended` — D10: objects are extended, never replaced;
  * - `adr_0126_code_only` — D2 and D6: the types ADR-0126 §3 places outside the
  *   regimes as code gain no override channel;

packages/spec/src/migrations/entries/semantic/18.security-catalog-environment-overlay-refused.ts

@@ -24,9 +24,8 @@ export const entry: SemanticMigration = {
     + 'package. Nothing is adopted: an item the environment needs under its own name is re-created '
     + 'under a name no package holds',
   reason:
-    'Positions, permission sets and capabilities hold one name per deployment, and a package '
-    + 'registering a name the environment catalog already holds was already refused on a hot '
-    + 'install. A cold boot now refuses it too, right after the stored rows load: the stored row '
+    'The environment catalog and a package never hold one name: a package registering a name '
+    + 'the environment catalog already holds was already refused on a hot install. A cold boot now refuses it too, right after the stored rows load: the stored row '
     + 'used to be served in place of the package\'s definition, with only a collision warning. '
     + 'Rows like this exist on deployments that saved over a package-held name before the packaged '
     + 'locks refused such saves, and over the security plugin\'s own sets, which it declares only '