fix(cloud-connection,spec): cite the cloud control-plane decisions as cloud ADR-NNNN, not bare numbers that resolve to this repo's own records (#19119)

Fixes #18762

Clause-②: no

Prime Directive 13 requires a cloud decision to be cited as `cloud
ADR-NNNN`, "never as a bare number, which
`scripts/check-adr-anchors.mjs` resolves against *this* registry (the
two number independently)". The rule landed; the stock already in the
tree was never swept. This sweeps it, on the file surface the dispatch
named.

19 citations gain the `cloud` qualifier. No behaviour, type, export,
route or schema moves — citation spelling and prose only.

## The spelling, taken from the precedent

The same-shape card the issue names is #18685, landed in PR #18754. Its
changeset states the convention verbatim:

> AGENTS.md Prime Directive 13 is explicit — an ADR "lives in the
repository whose code it governs", and a cloud decision is cited as
`cloud ADR-NNNN`, "never as a bare number".

Mechanically, that PR inserted the qualifier adjacent to the id and
changed nothing else around it: `(cloud, post-ADR-0025)` became `(cloud,
post-cloud ADR-0025)`. This PR does the same — a bare `cloud` token
immediately before the number, on the same line, surrounding prose
byte-identical.

That form is also the only one the gate recognises.
`scripts/check-adr-anchors.mjs` parses `ADR_CITATION =
/(?:([A-Za-z0-9_./-]+)[ \t]+)?ADR-(\d{4})/g` and exempts only
`CROSS_REPO_QUALIFIERS = new Set(['objectui', 'object-ui', 'cloud'])`,
so the qualifier must be the token immediately before the id with only
spaces or tabs between. Card #18761, which measured that the exemption
face is narrower than this repo's prose habits, is open and is not
addressed here — this PR deliberately stays inside the recognised form
rather than adding to the set it reports on.

## Site one — bare `ADR-0008` in `@objectstack/cloud-connection`

The card grades this one 「成色强」.

Re-derived on `origin/main` = `07c6f822ed` with the gate's own parser,
printed per line rather than counted — 10 files name `ADR-0008`, in 17
citation rows:

| spelling | rows |
|---|---|
| already `cloud ADR-0008` | `CHANGELOG.md:5229` ·
`src/cloud-connection-ui.ts:8` · `src/connection-credential-store.ts:5`
· `src/connection-credential-store.test.ts:5` |
| bare | `CHANGELOG.md:5228` · `README.md:3` · `README.md:189` ·
`package.json:5` · `src/cloud-connection-plugin.test.ts:4` ·
`src/cloud-connection-plugin.ts:5,21,24,54` ·
`src/cloud-connection-route-ledger.ts:103,128` · `src/index.ts:5,77` |

So the defect surface is narrower than the file count suggests: 12 bare
rows in 7 files, of which 11 rows in 6 files are fixed here and one is
excluded below. Three of the ten files already used the compliant
spelling.

Bare `ADR-0008` resolves, in this repository, to
`docs/adr/0008-metadata-repository-and-change-log.md` — *Metadata
Repository, Change Log & Subscription (M0 → M4)*. Grepped in that record
and printed: zero lines matching `control plane`, zero matching
`cloud-connection`, zero matching `Phase 1` or `Phase 2`; the lit
control `change log` returns lines, so the instrument is alive and those
three zeros are real.

`README.md:189` is the row the card starred: it said "in the cloud
repository" and wrote the number bare in the same sentence. It now reads

```
See `docs/adr` in the cloud repository (cloud ADR-0008) for the full architecture
decision.
```

## Site two — bare `ADR-0003` in `platform-object-names.test.ts`

The card grades this one 「成色弱一些」, and kept its own dev's wording off the
record for overstating it. **This PR keeps the two gradings apart and
does not assert one confidence for both.**

Exactly one row, re-derived:
`packages/spec/src/system/constants/platform-object-names.test.ts:132`,
`// They live in @objectstack/service-tenant (cloud repo, ADR-0003). If
one`. The parenthetical names the cloud repo and writes the number bare,
the same shape as the precedent card.

What was re-measured in
`docs/adr/0003-package-as-first-class-citizen.md`, printed:

- title *Package as First-Class Citizen with Versioned Releases*;
- `platform object` — zero lines;
- `service-tenant` — three lines (7, 193, 194), so it is **not**
unrelated, and the card's own downgrade holds. Line 194 is the
load-bearing one: it records that `packages/services/service-tenant/`
**left this repository** for `objectstack-ai/cloud` in `473fce590`;
- lit control `package` returns many lines.

So the local record is real and adjacent, and still is not the decision
the comment cites. The line is now `(cloud repo, cloud ADR-0003)` —
minimal insertion, per the precedent, rather than a prose rewrite.

⚠️ The other half stays **NOT MEASURED**, exactly as #18685 recorded it:
which record `cloud ADR-0003` and `cloud ADR-0008` name in
`objectstack-ai/cloud` was not read, because that repository is outside
this session's scope. What is measured is where the bare number lands
here.

## Bounded in-place fix, declared: bare `ADR-0007` and `ADR-0009` in the
same files

Not on the card's face, done here under the bounded in-place-fix
exemption and named rather than folded in silently. Same defect class,
same package, same gate family, no new verification surface, and the
dispatch measured zero open PRs holding any file under
`packages/cloud-connection/`.

Six rows, re-derived on `origin/main`:

| number | bare rows | rows in this package that already carry `cloud` |
|---|---|---|
| `ADR-0007` | `src/cloud-connection-plugin.ts:591,631` ·
`src/index.ts:39` · `src/marketplace-install-local-plugin.ts:178` |
`src/local-manifest-source.ts:5` · `src/local-manifest-source.test.ts:4`
· `CHANGELOG.md:5231` |
| `ADR-0009` | `src/marketplace-ui.ts:16,43` |
`src/cloud-connection-route-ledger.ts:192` ·
`src/marketplace-install-local-plugin.ts:219` ·
`src/marketplace-proxy-plugin.ts:203` · `src/marketplace-ui.ts:4` ·
`CHANGELOG.md:5230,5232` |

The evidence that these numbers name cloud decisions is in the tree, not
in judgement:

- `src/index.ts:39` said `// ADR-0007 step ⑤ — the local desired-state
ledger` while `src/local-manifest-source.ts:5` — the file that
*implements* that ledger — said `(cloud ADR-0007 step ⑤)`. One citation,
two spellings, same subject.
- This repo's own `docs/adr/0003-package-as-first-class-citizen.md`
status line names it directly: "**revised by cloud ADR-0007
(2026-06-12)**: `sys_package_installation` is hereby redefined as
desired state owned by the management plane … the `LocalManifestSource`
ledger in `@objectstack/cloud-connection` for self-hosted runtimes".
Read only, never edited.
- `src/marketplace-ui.ts` carried both spellings **inside one file**:
`cloud ADR-0009` in its header on line 4, bare on lines 16 and 43, with
`CHANGELOG.md:5230` spelling the very same `P2a` token qualified.

Read against this registry the bare numbers again land on real,
unrelated records — `docs/adr/0007-settings-manifest-and-kv-store.md`
(*Settings — Manifest + K/V Store + Resolver*) and
`docs/adr/0009-execution-pinned-metadata.md` (*Execution-Pinned
Metadata*).

**A neighbouring citation that was checked and left alone:**
`packages/spec/src/system/constants/platform-object-names.test.ts:202`
cites a bare `ADR-0007` too, but it means *this* repo — the comment says
so ("this repo's governed records") and the claim is true:
`docs/adr/0007-settings-manifest-and-kv-store.md` really does carry an
inventory table whose rows read `✅ exists`, printed. Left
byte-identical.

## `CHANGELOG.md` is deliberately excluded

`packages/cloud-connection/CHANGELOG.md:5228` still cites `ADR-0008`
bare. It is the one bare cloud citation left in the package, and leaving
it is the rule, not an oversight: AGENTS.md routes
`packages/*/CHANGELOG.md` as RELEASE-OWNED — "❌ Never edit in a code
PR", and a factual error in a released entry is amended "in a dedicated
docs-only PR, ⛔ never an erratum in a later entry and never a rider on
code changes". The same-class precedent did the same thing and said so
in its changeset: "Historical archives — the six package CHANGELOGs —
are deliberately untouched."

## What was measured

Verified at `f14281a519`.

- **Build** — `pnpm --workspace-concurrency=2 --filter
"@objectstack/cloud-connection..." build`, `VERDICT command-exit 0`.
- **Tests** — `@objectstack/cloud-connection`: 29 files / 374 tests
passed. `packages/spec`: `platform-object-names.test.ts` 1 file / 10
tests passed. ⚠️ The first spec attempt named `--project local` and the
repo's own guard printed `FILTER SELECTED NOTHING`; that run measured
nothing and is recorded as such. The file lives in the `repo` project
and the number above is from the re-run.
- **Typecheck** — `pnpm --filter @objectstack/spec typecheck` exit 0.
`@objectstack/cloud-connection` declares no `typecheck` script, so it
has none to run.
- **Gates** — the 91 families `node scripts/pm/dispatch-gates.mjs
--commands` derives for this change set, reconciled back through
`--ran`: 90 run green, 1 NOT MEASURED — `pnpm
check:dual-build-cjs-loads` exited 3, `PREREQUISITE NOT MET — this gate
reads built output, and some package has no dist/`. That needs a
whole-repo build and is CI's run, not a failed measurement.
- **Citation gate, before and after** — `check-adr-anchors` on
`07c6f822ed` read `36548 citation(s) across 4698 file(s)`; on this
branch it reads `36556 citation(s) across 4699 file(s)`, exit 0 both
times. The delta is fully accounted for: the sweep moves citations
between spellings without adding or dropping any, and the one new file
is this PR's changeset, whose 8 citations the same parser prints.
- **Three gates outside the derivation, run because this diff implicates
them** — `check:adr-anchors`, `check:published-readme-exports` (a
`README.md` edit) and `check:route-ledger-census` (a route-ledger edit):
all exit 0.
- **Lint, narrowed and declared** — `eslint --no-inline-config
--no-warn-ignored --format json` over all 10 changed paths. ESLint's own
resolution linted **7** of them (the JSON result array length; the three
it left out are two `.md` files and a `.json`, outside the config's
`files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}']` glob): 0 errors, 0
warnings, exit 0. The narrowing excludes nothing, and the config says
why in its own words — this repo "runs one `eslint.config.mjs`, which
never enables type-aware linting (no `parserOptions.project`, no typed
`@typescript-eslint` rules) for ANY file, test or not" — so a
comment-text edit inside these 7 files cannot move the verdict of a file
it did not touch. The repo-wide `pnpm lint` run remains CI's.
- **Control bytes** — `pnpm check:nul-bytes` exit 0, plus a direct `grep
-naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]'` over every changed path: no
hits.
- **Published surface** — `@objectstack/cloud-connection` ships
`["dist","README.md","CHANGELOG.md"]`. After the build,
`dist/index.d.ts` carries `cloud ADR-0008` and `cloud ADR-0009` and no
bare `ADR-0008`; the npm `description` and `README.md` carry the new
spelling. So this publishes, and it ships as a `patch` changeset rather
than `skip-changeset`.

## Acceptance notes

- **Noted, not filed — every remaining bare `ADR-NNNN` in this package
resolves to a record this repo really owns.** `ADR-0112`, `ADR-0120`,
`ADR-0066`, `ADR-0104`, `ADR-0105`, `ADR-0093`, `ADR-0029`, `ADR-0036`,
`ADR-0006` and `ADR-0005` carry no cloud-qualified sibling anywhere in
the package, which is the evidence used above to identify a cloud
number; with no such evidence there is no basis to re-point them.
Whoever next touches these files is the carrier.
- **Noted, not filed — the sweep is package-scoped, by dispatch.** Card
#14496 measured this population repo-wide at "60 files with a qualifier
and ~110 more times bare"; this PR's surface is
`packages/cloud-connection/**` plus the one spec test line, so the rest
of that stock is untouched and still has no carrier card. Carrier: none
— the issue this addresses says so in its own words, and choosing a
repo-wide sweep is a maintainer's call, not this PR's.
- **For the seat to file (class b, violates a declared contract) —
`scripts/check-adr-anchors.mjs`'s self-test never exercises the
spellings its own exemption misses.** Reported on the open card #18761
and not re-filed here; named only so this PR's choice of the plain
`cloud ADR-NNNN` form is traceable to it. Dedupe words:
`check-adr-anchors`, `CROSS_REPO_QUALIFIERS`, cross-repo qualifier,
self-test, line-wrapped qualifier.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-bill

.changeset/18762-cloud-adr-citation-sweep.md

@@ -0,0 +1,51 @@
+---
+'@objectstack/cloud-connection': patch
+---
+
+docs(cloud-connection): cite the cloud control-plane decisions as `cloud ADR-NNNN` instead of bare numbers that resolve to this repo's own records (#18762)
+
+AGENTS.md Prime Directive 13 is explicit — an ADR "lives in the repository whose
+code it governs", and a cloud decision is cited as `cloud ADR-NNNN`, "never as a
+bare number, which `scripts/check-adr-anchors.mjs` resolves against *this*
+registry (the two number independently)". The rule landed; the stock this
+package already carried was never swept.
+
+Read against this repository's registry, the bare numbers pointed at real but
+unrelated records:
+
+- `ADR-0008` → `docs/adr/0008-metadata-repository-and-change-log.md`, *Metadata
+  Repository, Change Log & Subscription (M0 → M4)* — zero occurrences of
+  "control plane", "cloud-connection" or "Phase 1"/"Phase 2".
+- `ADR-0007` → `docs/adr/0007-settings-manifest-and-kv-store.md`, *Settings —
+  Manifest + K/V Store + Resolver*. The cloud ADR-0007 these lines mean is the
+  one this repo's own ADR-0003 status line already names: the decision that
+  redefined `sys_package_installation` as management-plane desired state and put
+  runtime truth in the `LocalManifestSource` ledger.
+- `ADR-0009` → `docs/adr/0009-execution-pinned-metadata.md`, *Execution-Pinned
+  Metadata* — not the marketplace Setup-navigation ownership decision the lines
+  describe.
+
+That is worse than citing a number nobody has. A dangling id stops a reader; an
+id that resolves lets them believe they read the right page and walk away with
+the wrong decision.
+
+18 citations now carry the `cloud` qualifier, in the spelling this package
+already used elsewhere for the very same numbers — `cloud ADR-0008` in
+`connection-credential-store.ts`, `cloud ADR-0007 step ⑤` in
+`local-manifest-source.ts`, `cloud ADR-0009 P2a` in `marketplace-ui.ts`'s own
+header. All three numbers already carried both spellings inside this one
+package, and `marketplace-ui.ts` carried both inside a single file — qualified in
+its header on line 4, bare on lines 16 and 43.
+
+What actually reaches a consumer of this package:
+
+- The npm `description` field, which is the sentence shown on the package page.
+- `README.md`, including the closing pointer that already said "in the cloud
+  repository" while writing the number bare.
+- The published `.d.ts`, which carries the module and plugin docblocks.
+
+No behaviour moves. No type, export, route, schema or runtime path is touched —
+this is citation spelling and prose only, which is why it ships as a patch rather
+than silently. No ADR record is written or edited. `packages/cloud-connection/CHANGELOG.md`
+is deliberately untouched: it is published history, and a released entry is
+amended in a dedicated docs-only PR, never as a rider on code changes.

packages/cloud-connection/README.md

@@ -1,6 +1,6 @@
 # @objectstack/cloud-connection
 
-The runtime-side client for an ObjectStack cloud control plane (ADR-0008).
+The runtime-side client for an ObjectStack cloud control plane (cloud ADR-0008).
 
 Connects any ObjectStack runtime — vanilla `objectstack dev`, a self-hosted
 single-environment deployment, or a multi-tenant fleet — to a control plane
@@ -186,5 +186,5 @@ rules. Plan-derived feature flags are injected by the host via
 working via inline manifests handed to `install-local`, and the SPA telemetry
 sink above is refused rather than served.
 
-See `docs/adr` in the cloud repository (ADR-0008) for the full architecture
+See `docs/adr` in the cloud repository (cloud ADR-0008) for the full architecture
 decision.

packages/cloud-connection/package.json

@@ -2,7 +2,7 @@
   "name": "@objectstack/cloud-connection",
   "version": "17.4.0",
   "license": "Apache-2.0",
-  "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.",
+  "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (cloud ADR-0008): the hub service, plan policy, and entitlements stay server-side.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

packages/cloud-connection/src/cloud-connection-plugin.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * CloudConnectionPlugin — route mounting + mode behavior (ADR-0008 Phase 1).
+ * CloudConnectionPlugin — route mounting + mode behavior (cloud ADR-0008 Phase 1).
  *
  * Exercises the consolidated /api/v1/cloud-connection/* surface in both
  * resolution modes:

packages/cloud-connection/src/cloud-connection-plugin.ts

@@ -2,7 +2,7 @@
 
 /**
  * CloudConnectionPlugin — the runtime-side client surface for a cloud
- * control plane (ADR-0008 Phase 1).
+ * control plane (cloud ADR-0008 Phase 1).
  *
  * Mounts the same-origin `/api/v1/cloud-connection/*` routes the Console
  * marketplace depends on:
@@ -18,10 +18,10 @@
  * History: these routes started as app-level wiring in
  * `apps/objectos/cloud-runtime-plugins.ts` (two ad-hoc plugins; every
  * `apps/` path named in this paragraph lives in the separate
- * `objectstack-ai/cloud` repo, never in this one). ADR-0008 Phase 1
+ * `objectstack-ai/cloud` repo, never in this one). cloud ADR-0008 Phase 1
  * consolidates them here as ONE plugin so both deployment shapes —
  * `apps/objectos` (multi-tenant) and `apps/objectos-ee` (single-environment)
- * — wire the same canonical implementation. ADR-0008 Phase 2 moves this
+ * — wire the same canonical implementation. cloud ADR-0008 Phase 2 moves this
  * surface into the open `@objectstack/cloud-connection` package; keep this
  * file dependency-light (structural Plugin types, no @objectstack/core) so
  * the move is mechanical.
@@ -51,7 +51,7 @@
  */
 
 // Minimal structural plugin contract — keep this module independent of
-// @objectstack/core so the ADR-0008 Phase 2 move to the open package stays
+// @objectstack/core so the cloud ADR-0008 Phase 2 move to the open package stays
 // mechanical (mirrors the other plugins in this package).
 interface PluginContext {
     hook(event: string, handler: (...args: any[]) => any): void;
@@ -588,7 +588,7 @@ export class CloudConnectionPlugin implements Plugin {
             // GET /installed — env's FULL installed set from the control
             // plane's `sys_package_installation`, so the Console "Installed"
             // view reflects packages installed via ANY path (CLI, marketplace,
-            // REST) — ADR-0007 step ①. Degrades to an empty list when the
+            // REST) — cloud ADR-0007 step ①. Degrades to an empty list when the
             // runtime is not cloud-connected or the control plane is
             // unreachable (never hard-fails the page).
             rawApp.get(`${CLOUD_CONNECTION_PREFIX}/installed`, async (c: any) => {
@@ -628,7 +628,7 @@ export class CloudConnectionPlugin implements Plugin {
             });
 
             // GET /org-packages — org-scoped catalog for the in-env
-            // Marketplace's "Your organization" layer (ADR-0007 step ②): the
+            // Marketplace's "Your organization" layer (cloud ADR-0007 step ②): the
             // env's owning org's own packages (visibility org/private), so a
             // publisher can discover + install their private apps from inside
             // the environment. Forwards (service-key) to the control plane,

packages/cloud-connection/src/cloud-connection-route-ledger.ts

@@ -100,7 +100,7 @@ export interface CloudConnectionRouteLedgerEntry {
 }
 
 export const CLOUD_CONNECTION_ROUTE_LEDGER: readonly CloudConnectionRouteLedgerEntry[] = [
-    // ── cloud binding + install proxy (ADR-0008 Phase 1) ───────────────
+    // ── cloud binding + install proxy (cloud ADR-0008 Phase 1) ───────────────
     // Same-origin doors for the Console's Setup surface. The SPA cannot call
     // the control plane from a tenant subdomain (cross-origin, cross-site
     // cookie), so the runtime answers on its own origin and talks to cloud
@@ -125,7 +125,7 @@ export const CLOUD_CONNECTION_ROUTE_LEDGER: readonly CloudConnectionRouteLedgerE
         note:
             'begins an RFC 8628 device-code bind — the RUNTIME is the genuine device-flow client; it asks cloud for a device '
             + 'and user code and hands them to the Setup UI for an operator to approve in the cloud console. An SDK method '
-            + 'here would put the device-flow client in the browser, which is the opposite of what ADR-0008 Phase 1 wires.',
+            + 'here would put the device-flow client in the browser, which is the opposite of what cloud ADR-0008 Phase 1 wires.',
     },
     {
         route: 'POST /api/v1/cloud-connection/bind/poll',

packages/cloud-connection/src/index.ts

@@ -2,7 +2,7 @@
 
 /**
  * @objectstack/cloud-connection — the runtime-side client for an ObjectStack
- * cloud control plane (ADR-0008).
+ * cloud control plane (cloud ADR-0008).
  *
  * Connects any ObjectStack runtime — vanilla `objectstack dev`, a self-hosted
  * single-environment deployment, or a multi-tenant fleet — to a control plane
@@ -36,7 +36,7 @@ export { MarketplaceProxyPlugin } from './marketplace-proxy-plugin.js';
 export type { MarketplaceProxyPluginConfig } from './marketplace-proxy-plugin.js';
 export { MarketplaceInstallLocalPlugin } from './marketplace-install-local-plugin.js';
 export type { MarketplaceInstallLocalPluginConfig } from './marketplace-install-local-plugin.js';
-// ADR-0007 step ⑤ — the local desired-state ledger, exported as a first-class
+// cloud ADR-0007 step ⑤ — the local desired-state ledger, exported as a first-class
 // seam so hosts/reconcilers can read the same ledger without going through HTTP.
 export { LocalManifestSource, DEFAULT_INSTALLED_PACKAGES_DIR } from './local-manifest-source.js';
 // The RETURN CONTRACTS of both read paths are part of that seam. `list()`
@@ -74,7 +74,7 @@ export {
     DEFAULT_REPLAYS_ON_ERROR_SAMPLE_RATE,
 } from './telemetry-posture.js';
 export type { RuntimeTelemetryPosture, ClientErrorReportingConfig } from './telemetry-posture.js';
-// ADR-0008 consumption side — the self-hosted credential ledger (bind
+// cloud ADR-0008 consumption side — the self-hosted credential ledger (bind
 // persists the oscc_ bearer here; forwards present it to the control plane).
 export { ConnectionCredentialStore, DEFAULT_CONNECTION_CREDENTIAL_PATH } from './connection-credential-store.js';
 export type { StoredConnectionCredential } from './connection-credential-store.js';

packages/cloud-connection/src/marketplace-install-local-plugin.ts

@@ -175,7 +175,7 @@ export interface MarketplaceInstallLocalPluginConfig {
 }
 
 // Desired-state entry shape — owned by the LocalManifestSource ledger
-// (ADR-0007 step ⑤: the ledger is the named local desired-state owner;
+// (cloud ADR-0007 step ⑤: the ledger is the named local desired-state owner;
 // this plugin is its HTTP mutation surface).
 type InstalledEntry = InstalledManifestEntry;
 

packages/cloud-connection/src/marketplace-ui.ts

@@ -13,7 +13,7 @@
  *   - no MarketplaceInstallLocalPlugin → no "Installed Apps" entry.
  *
  * The URLs still point at the console's existing marketplace routes; the
- * pages themselves migrate to plugin-carried metadata in later ADR-0009
+ * pages themselves migrate to plugin-carried metadata in later cloud ADR-0009
  * stages (Installed Apps first).
  */
 
@@ -40,7 +40,7 @@ export const MARKETPLACE_BROWSE_UI_BUNDLE = {
     ],
 };
 
-/** "Installed Apps" — owned by the local-install capability (ADR-0009 P2a:
+/** "Installed Apps" — owned by the local-install capability (cloud ADR-0009 P2a:
  *  the page itself is now metadata; the console provides only the
  *  `marketplace:installed-list` widget).
  *

packages/spec/src/system/constants/platform-object-names.test.ts

@@ -129,7 +129,7 @@ describe('PLATFORM_PROVIDED_OBJECT_NAMES — conformance with what packages regi
   });
 
   it('cloud-only names are registered but not declared in this repo', () => {
-    // They live in @objectstack/service-tenant (cloud repo, ADR-0003). If one
+    // They live in @objectstack/service-tenant (cloud repo, cloud ADR-0003). If one
     // ever moves here, the group assertions above would flag it as unregistered.
     const allDeclared = new Set([...declared.values()].flatMap((s) => [...s]));
     for (const name of CLOUD_PROVIDED_OBJECT_NAMES) {