fix(runtime,metadata): stamp env_local as the default local environment id - #15200

Fixes #13366

Implements the domain:cli PM ruling in comment 5495605293 — option (a), in the narrow form — and nothing beyond its six-point scope.

What changes

The v5.0 project to environment rename changed the default local environment id and shipped that change on the surfaces most people meet. It never reached two stamps:

Two comments in standalone-stack.ts narrate what this stack stamps (one of them present tense, twenty lines above the line it describes). They are converted in the same edit, because leaving them would have manufactured a fresh declared != enforced inside the file this PR exists to make consistent. One of the two also carried a stale line anchor, line ~515 for what is now line 567; corrected in passing since the sentence was being edited anyway.

Published surface, and what an embedder observes (Clause-② statement)

The changed surface is createStandaloneStack / createDefaultHostConfig (@objectstack/runtime), on the DEFAULT path only — no environmentId in the config, no OS_ENVIRONMENT_ID in the environment.

• Before: that boot's kernel is stamped proj_local. The id is a row-scope key inside ObjectQLPlugin and reaches sys_metadata.environment_id, the X-Environment-Id header, and MetadataPlugin options.
• After: the same boot is stamped env_local, which is what packages/cli/CHANGELOG.md and content/docs/deployment/cli.mdx have promised as the default since the rename.
• Migration for an install that already has rows under the old id: set environmentId: 'proj_local' in the config, or OS_ENVIRONMENT_ID=proj_local in the environment. Both still outrank the default — that precedence is unchanged and is now pinned.

Two audiences reach it, and naming only the first would understate the change:

1. a host that calls createStandaloneStack / createDefaultHostConfig directly;
2. a bare os serve — one not spawned by os dev / os start. serve.ts sets no OS_ENVIRONMENT_ID for its own boot; it only READS one, to name the runtime state file. So a bare os serve used to run a kernel stamped proj_local while publishing runtime.env_local.json beside it. The two now agree, which is the split-brain the phase-1 census described closing.

Who does NOT observe it. A boot started by os dev / os start never reached the changed line: those commands export OS_ENVIRONMENT_ID=env_local into the child process (dev.ts:380, start.ts:409), and the fallback yields to it. That is why the mismatch could hold for a whole major line without one test going red.

Where the id crosses to closed cloud. The repo:cloud seat swept objectstack-ai/cloud@9b6abe0f2fd5 on the seam card: 14 proj_local hits, zero env_local, zero production-code comparisons on either literal; the one production consumer (kernel-resolver.ts:256-266) reads the id opaquely into envRegistry.resolveById(...). That repo is unreachable from this container, so it is reported as an inherited given, not as something this PR re-measured.

Deliberately NOT changed (ruling points 2, 3, 4 and 6)

• packages/cloud-connection/src/cloud-connection-plugin.ts keeps its dual accept of both spellings. It guards persisted OS_ENVIRONMENT_ID=proj_local configs in the wild, exactly as its comment says. It also puts both literals in the same arm, so it could not have changed outcome either way.
• packages/runtime/src/package-state-store.ts keeps its separate 'default' sanitiser fallback — renaming it would re-key persisted package-disable state files for a cosmetic gain.
• content/docs/deployment/seed-tenancy-repair.mdx is untouched: its text is true history, not a description of a live broken gate.
• packages/cli/src/commands/serve.ts runtime-file derivation is untouched. Supervisors pin runtime.env_local.json as a contract, and a contract move must not ride a spelling cleanup.

Evidence

Red-first, before converting. The new pin was written and run against the unconverted tree, and it failed with the value it exists to keep out:

AssertionError: expected { metadata: 'proj_local', ... } to deeply equal { metadata: 'env_local', ... }
+   "metadata": "proj_local",
+   "objectql": "proj_local",
 Tests  1 failed | 2 passed (3)

So the pin reaches the code this PR changes, rather than re-declaring a constant. It reads the id off the two plugin instances the stack composes — the last point at which the stamped value is still identifiable before it dissolves into row scoping — and covers the precedence above it.

Green after, at 389a4852:

The guard set was named in the phase-1 census as the tests that would go red if the CLI default moved. This PR does not move the CLI default, and all five stayed green — the blast radius is what the census said it was.

On the metadata site specifically, stated rather than faked. EnvironmentArtifactSchema declares environmentId: z.string() with no format constraint, and _parseAndRegisterArtifact discards the parse result (metadata = def). The literal there is a placeholder that satisfies a required key on a validation call whose output is thrown away, so it has no observable output and is given no behavioural pin. Writing one would have asserted a copy of the constant against itself.

Out of scope, filed separately

Converting the stamp leaves five comments in four other packages describing the standalone stamp with the old spelling. They are outside the ruling's scope, so they are recorded on their own card rather than fixed here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Generated by Claude Code