docs: retire the multi-Environment runtime model from six pages outside Deploy

[os-zhuang]

Fixes#70

Six English pages outside Deploy still taught the hosted many-Environments-per-process
model. Each row got its own decision, verified against objectstack@origin/main and
against the pages that shipped today, not a search-and-replace.

The target state, and where it is pinned

architecture.mdx (rewritten by #82, landed today) is the page these six now agree with:
a deployment serves one app, from one database, and its kernel is built during startup —
"there is no cache sizing to get right", "nothing per-request resolves which app to serve".
reference/environment-variables.mdx carries the tenancy contract: one OS_DATABASE_URL,
and a walled posture (OS_TENANCY_POSTURE) that puts up the per-organization isolation
wall as a licensed capability, on a shared database, where "metadata is scoped to the
deployment, not to an organization".

Upstream confirms the split the docs should draw. In
packages/runtime/src/http-dispatcher.ts (resolveRequestScope), multi-kernel routing runs
only when the host registers a KernelResolver, and the comment says where that lives:
"strategy lives in the cloud distribution … No resolver registered → single-environment:
every request serves from defaultKernel with no environment context."
reference/environment-variables.mdx already calls a self-hosted box "a single-environment
runtime" in the OS_ENVIRONMENT_ID row. So many-Environments-per-process is the hosted cloud
shape, which faq.mdx already says in its "Do I need an account / cloud service?" answer —
that answer was left as it stands.

Row by row

Page	Call	Verified against
resources/faq.mdx	Multi-tenancy answer rewritten	reference/environment-variables.mdx §Multi-organization deployments; architecture.mdx lines 52-57
resources/glossary.mdx	Kernel, Environment, Tenant, Project rewritten	architecture.mdx lines 86-91, 140; environment-variables.mdxOS_ENVIRONMENT_ID row
why.mdx	Fit-scenario row removed; positioning question escalated, not decided	see below
operate/observability.mdx	Kernel cold-start alert deleted, signal row replaced	packages/observability/src/semconv.ts on objectstack@origin/main
operate/troubleshooting.mdx	Wording	architecture.mdx; the same list's own OS_AUTH_SECRET bullet
build/ai-builder.mdx	Wording	architecture.mdx lines 19-21

faq.mdx — the card's sharpest claim, confirmed

The FAQ promised "each Environment has its own database, identity, and audit log". The card
asked whether the FAQ might be right and the other pages wrong. It is not: the evidence is
one-sided. A deployment gets one OS_DATABASE_URL; the env reference describes several
organizations on "a shared database"; architecture.mdx describes a walled deployment where
"several organizations share it" and share its app. The answer now describes the wall, says
what it separates (data and memberships) and what it does not (schema), and names deployment
separation as the stronger isolation.

observability.mdx — the metric does not exist

kernel_cache_misses_total is emitted by nothing: git grep kernel_cache and
git grep cache_miss over objectstack@origin/main both return zero hits. The canonical
registry, packages/observability/src/semconv.ts — which exists, in its own words, "so hosts
can wire alerts/dashboards against a stable namespace" — lists 13 metric names, and no kernel
cache metric is among them. The nearest name is cache_lookups_total{adapter,result} from
@objectstack/service-cache, which is the optional application cache capability, not a kernel
LRU. Confirming the card: OS_KERNEL_CACHE_SIZE has 0 occurrences in
reference/environment-variables.mdx against 4 for OS_ARTIFACT_URL as a control.

The alert is therefore deleted rather than reworded — there is no metric to point a corrected
alert at, and inventing one is out of bounds. The Artifact/kernel cache misses signal row is
replaced with readiness, which is the shipped mechanism for the cold-start question it was
asking (architecture.mdx measures startup as "time to a 200 from /api/v1/ready").

why.mdx — removed, not re-decided

Triage's clause on the card: do not decide the positioning claim here; flag it if simple
deletion feels lossy. It does feel lossy — a walled multi-organization deployment is a real,
shipped, licensed capability, so the scenario survives even though the mechanism the row
named ("Per-project kernel + LRU cache designed for this") does not exist. Correcting the row
would have been the deciding action the clause forbids; leaving a nonexistent mechanism on the
pitch page was not an option. So the row is removed — the reversible, non-deciding move — and
the positioning question is filed for the decision inbox. Re-adding a corrected row afterwards
is one line.

Folded in, and why

• The /health adjacency the card named.faq.mdx told the reader to point a monitor at
  /health while deploy/docker.mdx:121 and deploy/kubernetes.mdx:38 name /api/v1/health
  for liveness and /api/v1/ready for readiness. Folded in, not split: it is in a file
  already being edited, it is the same defect class (page disagrees with the deploy pages that
  shipped), and the correct shape is pinned by two shipped pages rather than needing a
  decision. Note that /health is not a dead route — it is registered in
  packages/runtime/src/http-dispatcher.ts:512 and the route ledger calls it a "liveness probe
  for orchestrators". The defect is that it is liveness-only, so a monitor wired to it alone
  never sees the readiness 503 that a stopped data driver produces.

Three further edits inside the six declared files, same defect class, each mechanically pinned:

• faq.mdx "serverless / Lambda" answer said "the kernel cache … depend[s] on warm in-process
  state" — same retired vocabulary, now the kernel built at startup.
• faq.mdx "What metrics should I monitor?" listed "kernel cache miss rate", a metric nothing
  emits; replaced with readiness.
• glossary.mdxEnvironment and Tenant carried the identical load-bearing false claim
  ("its own database" / "data is scoped per Environment"). Project changed only because the
  Environment rewrite removed the "v4.x / v5.0" sentence it referred back to; its version claims
  were removed, not restated, since @objectstack/spec is at 17.0.0 and no OS_PROJECT*
  variable exists upstream.

Observed, deliberately not fixed

• auth_failures_total is also a phantom metric — the alert directly above the one deleted
  here. Zero hits across objectstack@origin/main, and absent from SEMCONV. Left alone on
  purpose: unlike the kernel alert, the correct shape is not pinned — with no auth metric in
  the registry at all, the fix is either deleting a genuinely useful alert or asking the runtime
  to emit one, which is a product call. Filed separately rather than decided in a docs PR.
• quickstart.mdx labels /health a "Liveness probe" — the same defect folded in above, but
  outside this card's declared file surface. Filed.
• glossary.mdx carries two separate ### Console entries, each saying "Distinct from Console".
  Pre-existing, unrelated to this card, and adjacent to queued work on Console naming. Filed.
• operate/troubleshooting.mdx settings cascade (Environment -> Tenant -> User -> Default) was
  not touched: its "Environment" means the env-var override, matching
  configure/system-settings.mdx, not the retired concept.

Verification

Both turbo tasks run with --force, because turbo.json declares no inputs covering
content/docs/** and the cache is shared across sibling worktrees — a FULL TURBO replay
would prove nothing here. Both logged cache bypass, force executing, on acc5b6a:

• pnpm turbo run type-check --force — 1 successful, 0 cached, 9.763s
• pnpm turbo run build --force — 1 successful, 0 cached, 1m7.67s

All three translation checks, invoked exactly as translations.yml invokes them:

• Ownership (--actor os-zhuang --files changed.txt) — exit 0: "touches 0 translation
  artifact(s) and 6 other file(s)". Still inert pending TRANSLATION_BOT_LOGIN.
• Freshness — exit 0, "translations gate passed". The six pages moved to stale in all six
  locales (18 stale per locale); reported, not blocking, per AGENTS.md.
• Output validator self-test — exit 0, 20 cases, every rule demonstrated able to fail.
• Output validator, PR-scoped — exit 0: "translation output gate passed (110 pre-existing
  finding(s) reported)". None attributable to this diff, which changes no locale file.

Rendered HTML was read out of .next/server/app/en/docs/** for all six pages — not just the
diff — and every changed passage was confirmed in the built output, including that the removed
why.mdx row is gone from the fit table and that the alert block dropped only the kernel alert.

English only. No locale sibling is touched; no page is retired or renamed, so no locale sibling
is deleted either.

---

Generated by Claude Code