@awebai/oats 0.25.8 → 0.26.0

package/lib/resolve.mjs

@@ -7,7 +7,7 @@
  * `resolveSoul(discovery, soulEntry, options)` turns a discovered soul into the
  * exact set of modules an instance will be built from: which capability comes
  * from where (a confirmed member at its latest commit, or a locked package at
- * its pinned commit), which module fills each fundamental slot, the merged
+ * its pinned commit), which module fills each core-capability slot, the merged
  * provider payload per capability, the composed skill set, the injects, and a
  * `revision` that changes whenever any of that changes.
  *
@@ -18,14 +18,16 @@
  *                         is usable only from its own repo (E_CAPABILITY_PRIVATE). It NEVER looks
  *                         inside the repo's oats-package/ (non-collapse rule): a name that exists only
  *                         there fails with details.hint "provided by package <id>; use from: package".
- *   - `from: package`   → the lock's packageProviding(name) (E_PACKAGE_MISSING), approved
- *                         (E_PACKAGE_UNAPPROVED). It NEVER looks at member capabilities, even when the
+ *   - `from: package`   → the lock's packageProviding(name) (E_PACKAGE_MISSING). There is no approval
+ *                         gate: declaring the package in `packages:` is the trust decision (human
+ *                         decision 2026-09-24). It NEVER looks at member capabilities, even when the
  *                         package's repo is a member.
  *
  * Composition order (soul wins; `off` removes):
  *   workspace.defaults.{knowledge,messaging,tasks} (slot defaults; a soul `none` drops them)
- *   ⊕ workspace.defaults.capabilities ⊕ workspace.defaults.byTeam[soul.team].capabilities
- *   ⊕ soul.capabilities
+ *   ⊕ workspace.defaults.capabilities ⊕ workspace.defaults.byTeam[<label>].capabilities for each of the
+ *   soul's team labels, in order ⊕ soul.capabilities. Two labels that give one capability different
+ *   entries → E_TEAM_CONFLICT naming both (teams contract 2026-09-25, decision 2).
  *
  * Slot `none` (contract §3, post-0.25.0 rule): a soul's `<slot>: none` EMPTIES the slot — it drops the
  * workspace's `defaults.<slot>` AND any capability of that layer the workspace defaults contributed
@@ -33,10 +35,9 @@
  * next to `none` is contradictory and stays E_SLOT_CONFLICT { reason: "none" } (spell `<cap>: off` to
  * remove a default explicitly; drop the soul's own line to fill the slot).
  *
- * Package modules are gated twice (decision 8): the lock must carry an approval AND the approval must
- * describe the package tree at the locked commit — `executablesDigestAt(...)` (the same computation
- * `oats sync` approved) must equal `approved.executables`, else E_PACKAGE_UNAPPROVED
- * { reason: "digest-mismatch", approved, executables }. An edited lock never runs unapproved hooks.
+ * Package modules are read at the locked commit, and the lock must describe that tree: the capability
+ * list `<path>/oats-package.json` declares there must equal the entry's `capabilities`, else
+ * E_PACKAGE_INTEGRITY { why: "capabilities", listed, locked }.
  *
  * Revision (decision 14 + preview): `declRevision` fingerprints the declarations (soul identity, modules
  * with their commits/versions/manifests, slots, skills, injects); `payloadRevision` fingerprints the merged
@@ -44,7 +45,8 @@
  * everything, while a preview can say WHAT changed since the previous instance (declarations | payload | both).
  *
  * Payloads (decision 14), later wins on scalars/arrays, objects deep-merge:
- *   workspace.messaging (messaging slot only) ⊕ soul.<slot> ⊕ local.settings[cap] ⊕ spawn.providers[cap]
+ *   workspace.messaging (messaging slot only; its base, `byTeam` stripped and never merged — teams amendment K)
+ *   ⊕ soul.<slot> ⊕ local.settings[cap] ⊕ spawn.providers[cap]
  *
  * This module shells out to nothing. Remote access is injected (`remote`, default
  * lib/remote.mjs; `remoteOptions` threaded into every call). `resolveSoul` is
@@ -52,10 +54,12 @@
  * over the remote; everything else is pure and exported for direct testing.
  */
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import { posix } from "node:path";
 import { oatsError as baseOatsError } from "./errors.mjs";
 import * as defaultRemote from "./remote.mjs";
-import { bindRemote, executablesDigestAt, packageProviding, readPackageManifests, validateLock } from "./packages.mjs";
+import { bindRemote, packageProviding, readPackageManifests, validateLock } from "./packages.mjs";
+import { settingValueProblems } from "./capability-contract.mjs";
 
 export const RESOLUTION_API = 1;
 export const SLOTS = Object.freeze(["knowledge", "messaging", "tasks"]);
@@ -110,6 +114,42 @@ function mergeInto(base, over) {
 }
 const clone = (v) => (v === undefined ? undefined : JSON.parse(JSON.stringify(v)));
 
+/** A manifest's declared setting defaults (`settings.<key>.default`) as a payload layer: the
+ *  intrinsic field fallbacks, merged BELOW every workspace, soul, host and spawn layer. */
+export function manifestDefaultsPayload(manifest) {
+  const out = {};
+  if (!isObject(manifest?.settings)) return out;
+  for (const [key, declaration] of Object.entries(manifest.settings)) {
+    if (isObject(declaration) && Object.hasOwn(declaration, "default") && declaration.default !== undefined) out[key] = clone(declaration.default);
+  }
+  return out;
+}
+
+/** Where each leaf of a merged payload came from: JSON pointer → the origin of the LAST layer that
+ *  set it, under mergePayload's rules (objects merge recursively; arrays and scalars replace, taking
+ *  every leaf below them with them). `layers` is [{ payload, origin }] in merge order. */
+export function payloadOrigins(layers) {
+  const origins = {};
+  const escape = (k) => String(k).replace(/~/g, "~0").replace(/\//g, "~1");
+  const dropBelow = (pointer) => { for (const p of Object.keys(origins)) if (p === pointer || p.startsWith(`${pointer}/`)) delete origins[p]; };
+  const walk = (value, pointer, origin, mergedBefore) => {
+    for (const [k, v] of Object.entries(value)) {
+      if (v === undefined) continue;
+      const at = `${pointer}/${escape(k)}`;
+      if (isObject(v) && isObject(mergedBefore?.[k])) { delete origins[at]; walk(v, at, origin, mergedBefore[k]); }
+      else if (isObject(v) && Object.keys(v).length) { dropBelow(at); walk(v, at, origin, null); }
+      else { dropBelow(at); origins[at] = origin; }
+    }
+  };
+  let merged = {};
+  for (const { payload, origin } of layers) {
+    if (!isObject(payload)) continue;
+    walk(payload, "", origin, merged);
+    merged = mergeInto(merged, payload);
+  }
+  return origins;
+}
+
 /** `byTeam` is RESERVED (decision 23): it addresses a per-team payload and is legal only at the top level of
  * workspace.messaging, where the resolver merges base ⊕ byTeam[soul.team] and strips it. In any other payload
  * layer — a soul's slot payload, local.settings[cap], spawn.providers[cap] — it would reach the provider
@@ -265,6 +305,22 @@ export function satisfiesRange(version, range) {
   return false;
 }
 
+/** The running kernel's version: a capability's `compatibility.oats` range is checked against it. */
+export const KERNEL_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+
+/** A capability manifest's own kernel range (`compatibility.oats`) against `kernel`:
+ *  `{ ok, range, kernel }`; `range: null` (always ok) when the manifest declares none. Throws
+ *  E_CAPABILITY_INCOMPATIBLE { why: "range" } for a range that is not a version range. */
+export function kernelCompatibility(manifest, kernel = KERNEL_VERSION) {
+  const range = isObject(manifest?.compatibility) && Object.hasOwn(manifest.compatibility, "oats") ? manifest.compatibility.oats : null;
+  if (range === null) return { ok: true, range: null, kernel };
+  try { return { ok: satisfiesRange(kernel, range), range, kernel }; }
+  catch (e) {
+    if (e?.code !== "E_COMPATIBILITY") throw e;
+    throw fail("E_CAPABILITY_INCOMPATIBLE", `${manifest?.capability ?? "capability"}: compatibility.oats ${show(range)} is not a version range`, { capability: manifest?.capability ?? null, range, kernel, why: "range" });
+  }
+}
+
 /* ───────────────────────────── composition ────────────────────────────── */
 
 const choiceOf = (value, path, via) => {
@@ -277,13 +333,43 @@ const choiceOf = (value, path, via) => {
   throw fail("E_WORKSPACE_SCHEMA", `${path} must be { from: <location> } or "off", got ${show(value)}`, { path, value });
 };
 
+/** A soul's team labels, primary first: `team` is a label or a list of distinct labels (teams
+ *  contract 2026-09-25, decision 1). A discovery SoulEntry carries them as `labels`; an entry
+ *  without them (a hand-built one) has its `team` as the only label. */
+export function teamLabelsOf(soulEntry) {
+  if (Array.isArray(soulEntry?.labels)) return soulEntry.labels.filter((l) => typeof l === "string");
+  return typeof soulEntry?.team === "string" ? [soulEntry.team] : [];
+}
+
+/**
+ * The eligible teams of a soul (teams contract, decision 3): one entry per label, in soul order,
+ * `{ label, team, mapped, payload }`. `payload` is workspace.messaging's base ⊕ byTeam[label] when the
+ * workspace maps the label, else the base alone with `mapped: false`; `team` is the payload's team id
+ * when mapped (null otherwise). Kernel-owned and delivered BESIDE a provider's settings, never inside
+ * them; joining any of them is the messaging provider's explicit act. No label → [] ("personal only").
+ * Pure: resolveSoul validates every carried label's entry (reserved byTeam, hostOnly keys) first.
+ */
+export function teamsOf(workspace, labels) {
+  const messaging = isObject(workspace?.messaging) ? workspace.messaging : {};
+  const { byTeam, ...base } = messaging;
+  return (labels || []).map((label) => {
+    const mapped = isObject(byTeam) && Object.hasOwn(byTeam, label) && isObject(byTeam[label]);
+    const payload = mapped ? mergePayload(base, byTeam[label]) : mergePayload(base);
+    return { label, team: mapped && typeof payload.team === "string" ? payload.team : null, mapped, payload };
+  });
+}
+
 /**
  * The ordered capability map of a soul BEFORE any lookup:
- *   slot defaults (dropped where the soul says `none`) ⊕ defaults.capabilities ⊕ defaults.byTeam[team] ⊕ soul.capabilities
+ *   slot defaults (dropped where the soul says `none`) ⊕ defaults.capabilities ⊕ defaults.byTeam[label] for
+ *   each label in order ⊕ soul.capabilities
  * → [{ name, from, via }] sorted by name; `off` removes the entry from every lower layer.
- * `via` is one of "defaults.<slot>" | "defaults.capabilities" | "defaults.byTeam.<team>" | "soul".
+ * `via` is one of "defaults.<slot>" | "defaults.capabilities" | "defaults.byTeam.<label>" | "soul".
+ * Two labels that give one capability different entries (`off` vs a location, or two locations) →
+ * E_TEAM_CONFLICT { capability, labels: [a, b] }; identical entries are not a conflict, and a capability
+ * the soul names itself is not one either (the soul's entry wins over both).
  */
-export function composeCapabilities(workspace, soulDefinition, { team = null } = {}) {
+export function composeCapabilities(workspace, soulDefinition, { team = null, labels = team === null ? [] : [team] } = {}) {
   const map = new Map();
   const apply = (entries, via, path) => {
     for (const [name, value] of Object.entries(entries || {})) {
@@ -301,8 +387,21 @@ export function composeCapabilities(workspace, soulDefinition, { team = null } =
     apply(d, `defaults.${slot}`, `/defaults/${slot}`);
   }
   apply(defaults.capabilities, "defaults.capabilities", "/defaults/capabilities");
-  if (team !== null && isObject(defaults.byTeam) && isObject(defaults.byTeam[team])) {
-    apply(defaults.byTeam[team].capabilities, `defaults.byTeam.${team}`, `/defaults/byTeam/${team}/capabilities`);
+  const byLabel = new Map(); // capability -> { label, choice } of the first label that set it
+  // The soul's own entry wins over every label, so a capability the soul names settles the conflict.
+  const soulNames = new Set(Object.keys(isObject(soulDefinition?.capabilities) ? soulDefinition.capabilities : {}));
+  for (const label of labels) {
+    if (!isObject(defaults.byTeam) || !Object.hasOwn(defaults.byTeam, label) || !isObject(defaults.byTeam[label])) continue;
+    const entries = defaults.byTeam[label].capabilities, path = `/defaults/byTeam/${label}/capabilities`;
+    for (const [name, value] of Object.entries(entries || {})) {
+      const choice = choiceOf(value, `${path}/${name}`, `defaults.byTeam.${label}`);
+      const seen = byLabel.get(name);
+      if (seen && !soulNames.has(name) && canonicalJson(seen.choice) !== canonicalJson(choice)) {
+        throw fail("E_TEAM_CONFLICT", `${name}: team labels ${show(seen.label)} and ${show(label)} give it different entries (${canonicalJson(seen.choice)} vs ${canonicalJson(choice)}) in defaults.byTeam — make them agree, or name ${name} in the soul`, { capability: name, labels: [seen.label, label], entries: [seen.choice, choice], paths: [`/defaults/byTeam/${seen.label}/capabilities/${name}`, `${path}/${name}`] });
+      }
+      if (!seen) byLabel.set(name, { label, choice });
+    }
+    apply(entries, `defaults.byTeam.${label}`, path);
   }
   apply(soulDefinition?.capabilities, "soul", "/capabilities");
   return [...map.values()].sort((a, b) => byCodepoint(a.name, b.name));
@@ -315,7 +414,7 @@ function memberRow(discovery, repoKey) {
 }
 
 /** The ref the workspace lists a member under (keeps the operator's spelling: ssh vs https); else from the key. */
-function memberRef(discovery, remote, repoKey) {
+export function memberRef(discovery, remote, repoKey) {
   for (const ref of discovery?.workspace?.members || []) {
     try { if (remote.parseRepoRef(ref).key === repoKey) return ref; } catch { /* validated upstream */ }
   }
@@ -338,6 +437,9 @@ function lookupMember(discovery, soul, name, from, via, lock) {
   const cap = (row.capabilities || []).find((c) => c.name === name) || null;
   if (!cap) {
     const details = { ...where, commit: row.commit };
+    // Discovery found the manifest but refused it (lib/capability-contract.mjs): say that, not "missing".
+    const refused = (discovery?.problems || []).filter((p) => p.repoKey === repoKey && typeof p.path === "string" && p.path.startsWith(`capabilities/${name}/oats.json#`));
+    if (refused.length) throw fail("E_WORKSPACE_SCHEMA", `${name}: ${repoKey}@${short(row.commit)} declares it, but its manifest is refused: ${refused.map((p) => `${p.path}: ${p.message}`).join("; ")}`, { ...details, problems: refused, reason: "manifest-contract" });
     // The name may live in a package tier: say so, but never resolve it from here (decision 19).
     const providing = safePackageProviding(lock, name);
     let hint = null;
@@ -355,44 +457,21 @@ function safePackageProviding(lock, name) {
   try { return packageProviding(lock, name); } catch { return null; }
 }
 
-/** Resolve `from: package` through the lock only — never through member capabilities. */
-function lookupPackage(lock, name, via, soul) {
+/** Resolve `from: package` through the lock only — never through member capabilities.
+ *  Declaring a package in the workspace's packages: is the trust decision (human
+ *  decision 2026-09-24), so a workspace view admits only a locked package the
+ *  workspace STILL declares: a package removed from packages: but left in a stale
+ *  lock (no `oats sync` since) is refused, never materialized. `declared` is null
+ *  for a standalone view — its lock holds only what a standalone sync wrote. */
+function lookupPackage(lock, name, via, soul, declared) {
   const where = { capability: name, from: "package", soul: soul.name, via };
   if (!isObject(lock) || !isObject(lock.packages)) throw fail("E_PACKAGE_MISSING", `${name}: from: package needs the workspace lock (oats-lock.json v3) — run \`oats sync\``, { ...where, reason: "no-lock" });
   const providing = packageProviding(lock, name);
   if (!providing) throw fail("E_PACKAGE_MISSING", `${name}: no locked package provides it — add the package to packages: and run \`oats sync\``, { ...where, locked: Object.keys(lock.packages).sort() });
-  if (!providing.entry.approved || !isObject(providing.entry.approved) || typeof providing.entry.approved.executables !== "string" || !/^sha256-[0-9a-f]{64}$/.test(providing.entry.approved.executables)) {
-    throw fail("E_PACKAGE_UNAPPROVED", `${name}: package ${providing.id} v${providing.entry.version} (${short(providing.entry.commit)}) is not approved — review its executables and approve once per version`, { ...where, id: providing.id, version: providing.entry.version, commit: providing.entry.commit, reason: "unapproved" });
-  }
+  if (declared && !Object.hasOwn(declared, providing.id)) throw fail("E_PACKAGE_MISSING", `${name}: the lock's package ${providing.id} is no longer declared in the workspace's packages: — run \`oats sync\` (or declare it again)`, { ...where, id: providing.id, reason: "undeclared" });
   return providing;
 }
 
-/**
- * The approval must describe THIS tree (decision 8: the lock carries the approval next to the commit it
- * approved). Recompute the executables digest over the package tree at entry.commit — the very computation
- * `oats sync` approved — and require equality with approved.executables. A lock edited to another commit
- * (same id/version, approval copied along) fails here: E_PACKAGE_UNAPPROVED { reason: "digest-mismatch" }
- * naming both digests and the executables that would have run. Cached per (remote, repo, commit, path).
- */
-async function assertApprovalDescribesTree({ remote, remoteOptions, ref, id, entry, name, via, soul }) {
-  const where = { capability: name, from: "package", soul: soul.name, via, id, version: entry.version, commit: entry.commit, path: entry.path };
-  let computed;
-  try { computed = await executablesDigestAt(remote, ref, entry.commit, entry.path, Array.isArray(entry.capabilities) ? entry.capabilities : null, { remoteOptions }); }
-  catch (e) {
-    if (e?.code === "E_PACKAGE_INTEGRITY" && (e.details ?? e.provenance)?.why === "capabilities") {
-      const d = e.details ?? e.provenance;
-      throw fail("E_PACKAGE_INTEGRITY", `${name}: the lock says package ${id} v${entry.version} provides [${d.locked.join(", ")}], but ${entry.path}/oats-package.json at ${short(entry.commit)} declares [${d.listed.join(", ")}]`, { ...where, why: "capabilities", listed: d.listed, locked: d.locked });
-    }
-    throw e;
-  }
-  if (computed.digest !== entry.approved.executables) {
-    throw fail("E_PACKAGE_UNAPPROVED",
-      `${name}: package ${id} v${entry.version} @ ${short(entry.commit)}: the recorded approval ${entry.approved.executables} does not describe this tree's executables (${computed.digest}) — the lock was edited or the approval copied from another commit; run \`oats sync\` and approve what it shows`,
-      { ...where, reason: "digest-mismatch", approved: entry.approved.executables, executables: computed.digest, targets: computed.executables.map((x) => `${x.capability}: ${x.kind} ${x.name} → ${x.target}`) });
-  }
-  return computed;
-}
-
 /** The repo ref a locked package is read from: the lock's recorded url, else the catalog's url for catalog ids, else the key for git refs. */
 export function packageRef(id, entry, catalog, remote) {
   const cat = isObject(catalog) ? (isObject(catalog.packages) && !("url" in catalog.packages) ? catalog.packages : catalog) : {};
@@ -470,28 +549,28 @@ async function enumerateSkills({ remote, ref, commit, dir, manifest, listing, mo
  * options:   { local, lock, spawn = { providers? }, catalog, remote, remoteOptions }
  *            `catalog` (package-catalog.json shape) tells which repo a `catalog:<id>` lock entry is read from.
  *
- * → Resolution { resolutionApi: 1, soul, modules[], slots, payloads, skills[], injects[], revision } — deep-frozen.
+ * → Resolution { resolutionApi: 1, soul, modules[], slots, payloads, payloadOrigins, skills[], injects[], revision } — deep-frozen.
  * Extra fields beyond the contract (recorded for materialize): module.dir (capability dir, repo-relative)
  * and from.repoKey on package modules.
  */
-export async function resolveSoul(discovery, soulEntry, { local = null, lock = null, spawn = {}, catalog = null, remote: injected, remoteOptions } = {}) {
+export async function resolveSoul(discovery, soulEntry, { local = null, lock = null, spawn = {}, catalog = null, remote: injected, remoteOptions, kernel = KERNEL_VERSION } = {}) {
   if (!isObject(soulEntry) || typeof soulEntry.name !== "string" || typeof soulEntry.repoKey !== "string") {
     throw new TypeError("resolveSoul: soulEntry must be a discovery SoulEntry { name, path, repoKey, commit, team, private, definition }");
   }
   if (!isObject(spawn)) throw new TypeError("resolveSoul: spawn must be an object");
   if (lock !== null && lock !== undefined) validateLock(lock); // E_LOCK_SCHEMA: a lock passed in memory meets the same bar as one read from disk
-  const rawRemote = injected ?? defaultRemote; // identity for the per-process digest cache (bound copies are per call)
   const remote = remoteOf({ remote: injected, remoteOptions });
   const workspace = isObject(discovery?.workspace) ? discovery.workspace : null;
   assertSoulDiscovered(discovery, soulEntry);
   const definition = isObject(soulEntry.definition) ? soulEntry.definition : {};
-  const team = typeof soulEntry.team === "string" ? soulEntry.team : null;
+  const labels = teamLabelsOf(soulEntry);
+  const team = labels[0] ?? null; // the PRIMARY label: the merged messaging payload and OATS_TEAM_LABEL follow it
   const soul = { name: soulEntry.name, repoKey: soulEntry.repoKey, commit: soulEntry.commit ?? null, team, path: soulEntry.path ?? null };
 
   // Standalone: the soul's own repo only, workspace defaults unknown (decision 10).
   const declared = discovery?.standalone === true
-    ? composeCapabilities(null, { ...definition, capabilities: soulEntry.capabilities ?? definition.capabilities }, { team })
-    : composeCapabilities(workspace, definition, { team });
+    ? composeCapabilities(null, { ...definition, capabilities: soulEntry.capabilities ?? definition.capabilities }, { labels })
+    : composeCapabilities(workspace, definition, { labels });
 
   const modules = [];
   const skills = [];
@@ -504,12 +583,15 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
   for (const { name, from, via } of declared) {
     let module;
     if (from === "package") {
-      const { id, entry } = lookupPackage(lock, name, via, soul);
+      const { id, entry } = lookupPackage(lock, name, via, soul, discovery?.standalone === true ? null : (isObject(workspace?.packages) ? workspace.packages : {}));
       const ref = packageRef(id, entry, catalog, remote);
       const details = { capability: name, id, version: entry.version, commit: entry.commit, path: entry.path };
-      // M3: the approval must describe the tree at entry.commit (the digest `oats sync` approved), else refuse.
-      await assertApprovalDescribesTree({ remote: rawRemote, remoteOptions, ref, id, entry, name, via, soul });
       const { capabilities } = await readPackageManifests(remote, ref, entry.commit, entry.path, details);
+      // The lock must describe the tree it names: its capability list is what the package declares there.
+      const listed = capabilities.map((c) => c.name).sort(), locked = [...entry.capabilities].sort(); // validateLock guarantees the array
+      if (listed.length !== locked.length || listed.some((c, i) => c !== locked[i])) {
+        throw fail("E_PACKAGE_INTEGRITY", `${name}: the lock says package ${id} v${entry.version} provides [${locked.join(", ")}], but ${entry.path}/oats-package.json at ${short(entry.commit)} declares [${listed.join(", ")}]`, { ...details, why: "capabilities", listed, locked });
+      }
       const cap = capabilities.find((c) => c.name === name);
       if (!cap) throw fail("E_PACKAGE_INTEGRITY", `${name}: the lock says package ${id} v${entry.version} provides it, but ${entry.path}/oats-package.json at ${short(entry.commit)} does not`, { ...details, listed: capabilities.map((c) => c.name) });
       const layer = layerOf(cap.manifest);
@@ -545,6 +627,7 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
   // the soul's own contradiction → E_SLOT_CONFLICT { reason: "none" } — judged FIRST, so it is never reported
   // as a two-module clash.
   const slots = { knowledge: null, messaging: null, tasks: null };
+  const slotsFrom = { knowledge: null, messaging: null, tasks: null };
   const viaOf = new Map(declared.map((d) => [d.name, d.via]));
   for (const m of modules) {
     const via = viaOf.get(m.name);
@@ -557,6 +640,7 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
     if (emptied.has(m.layer)) throw fail("E_SLOT_CONFLICT", `slot ${m.layer}: the soul says ${m.layer}: none but itself names ${m.name}, which declares layer ${m.layer} — drop one of the two (a workspace default of that layer would have been dropped by none; this one is the soul's own)`, { slot: m.layer, modules: [m.name], soul: soul.name, reason: "none", via });
     if (slots[m.layer]) throw fail("E_SLOT_CONFLICT", `slot ${m.layer}: both ${slots[m.layer]} and ${m.name} declare layer ${m.layer}; a soul fills each slot with at most one capability`, { slot: m.layer, modules: [slots[m.layer], m.name], soul: soul.name });
     slots[m.layer] = m.name;
+    slotsFrom[m.layer] = fromOfVia(via);
   }
 
   // Duplicate skill names within the composed set (decision 16).
@@ -569,7 +653,8 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
     seenSkills.set(s.name, s);
   }
 
-  // Payloads (decision 14): workspace.messaging (messaging slot) ⊕ soul.<slot> ⊕ local.settings[cap] ⊕ spawn.providers[cap].
+  // Payloads (decision 14; addendum 5): manifest defaults ⊕ workspace.messaging (messaging slot) ⊕ soul.<slot>
+  // ⊕ local.settings[cap] ⊕ spawn.providers[cap], each leaf's origin kept in payloadOrigins.
   const settings = isObject(local?.settings) ? local.settings : {};
   const providers = isObject(spawn.providers) ? spawn.providers : {};
   const moduleNames = new Set(modules.map((m) => m.name));
@@ -580,28 +665,63 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
     assertNoReservedKey(value, `/spawn/providers/${cap}`);
     if (!moduleNames.has(cap)) throw fail("E_CAPABILITY_MISSING", `--provider ${cap}: the soul ${soul.name} does not resolve a capability named ${show(cap)} (modules: ${[...moduleNames].sort().join(", ") || "none"})`, { capability: cap, soul: soul.name, hint: "a provider payload targets one of the soul's resolved capabilities", modules: [...moduleNames].sort() });
   }
-  const payloads = {};
+  const payloads = {}, origins = {};
   // The soul's slot payloads are checked whether or not the slot resolves to a module: a reserved key is a
   // schema fault of the soul, not of the spawn that happened to fill the slot.
   for (const slot of SLOTS) if (isObject(definition[slot])) assertNoReservedKey(definition[slot], `/${slot}`);
   for (const m of modules) {
-    const layers = [];
+    // Addendum 5: the manifest's declared defaults are the LOWEST layer, so the preview shows (and the
+    // provider receives) e.g. identity.mode = local with its origin, not an absent key.
+    const layers = [], sourced = [];
+    const add = (payload, origin) => { layers.push(payload); sourced.push({ payload, origin }); };
+    for (const [key, value] of Object.entries(manifestDefaultsPayload(m.manifest))) {
+      add({ [key]: value }, { kind: "manifest-default", at: `oats.json#/settings/${key.replace(/~/g, "~0").replace(/\//g, "~1")}/default` });
+    }
     // Decision 27 (K1″): a manifest may mark a settings key `hostOnly` — a host fact (a custody
     // path, a state directory) that only the deployment's own oats-local.yaml may supply. Every
     // committed or per-spawn layer is refused with that key present, BEFORE the merge, because the
     // provider receives one merged payload without provenance and cannot enforce this itself.
     const hostOnly = hostOnlyKeys(m.manifest);
-    const committed = (payload, path) => { assertNoHostOnlyKey(payload, path, hostOnly, m.name); layers.push(payload); };
+    const committed = (payload, path, origin) => { assertNoHostOnlyKey(payload, path, hostOnly, m.name); add(payload, origin); };
     if (m.layer === "messaging" && isObject(workspace?.messaging)) {
-      // Decision 23: base ⊕ byTeam[soul.team]; `byTeam` never reaches the provider (nor may a team's own payload nest one).
+      // Decision 23 as amended by K (teams contract, co-lead ruling): the provider's settings are
+      // base ⊕ soul ⊕ host ⊕ spawn. No byTeam[<label>] is merged, the primary's included: each
+      // label's base ⊕ byTeam[label] is delivered only in its `teams` entry (teamsOf → OATS_TEAMS),
+      // so settings.team is the personal team a host, soul or spawn set. `byTeam` never reaches the
+      // provider, and the primary team's own payload may still not nest one.
       const { byTeam, ...base } = workspace.messaging;
-      committed(base, "/messaging");
-      if (team !== null && isObject(byTeam) && isObject(byTeam[team])) { assertNoReservedKey(byTeam[team], `/messaging/byTeam/${team}`); committed(byTeam[team], `/messaging/byTeam/${team}`); }
+      committed(base, "/messaging", { kind: "workspace", at: "oats-workspace.yaml#/messaging" });
+      // Every label's entry still reaches the provider, in OATS_TEAMS (teamsOf), so each one the soul
+      // carries — the primary's and every other — may nest no byTeam and carry no hostOnly key.
+      for (const label of labels) {
+        if (!isObject(byTeam) || !Object.hasOwn(byTeam, label) || !isObject(byTeam[label])) continue;
+        assertNoReservedKey(byTeam[label], `/messaging/byTeam/${label}`);
+        assertNoHostOnlyKey(byTeam[label], `/messaging/byTeam/${label}`, hostOnly, m.name);
+      }
     }
-    if (m.layer && isObject(definition[m.layer])) { assertNoReservedKey(definition[m.layer], `/${m.layer}`); committed(definition[m.layer], `/${m.layer}`); }
-    if (Object.hasOwn(settings, m.name) && isObject(settings[m.name])) { assertNoReservedKey(settings[m.name], `/settings/${m.name}`); layers.push(settings[m.name]); } // the host layer: hostOnly keys are legal here
-    if (Object.hasOwn(providers, m.name) && isObject(providers[m.name])) committed(providers[m.name], `/spawn/providers/${m.name}`);
+    if (m.layer && isObject(definition[m.layer])) { assertNoReservedKey(definition[m.layer], `/${m.layer}`); committed(definition[m.layer], `/${m.layer}`, { kind: "soul", at: `soul.yaml#/${m.layer}` }); }
+    if (Object.hasOwn(settings, m.name) && isObject(settings[m.name])) { assertNoReservedKey(settings[m.name], `/settings/${m.name}`); add(settings[m.name], { kind: "host", at: `oats-local.yaml#/settings/${m.name}` }); } // the host layer: hostOnly keys are legal here
+    if (Object.hasOwn(providers, m.name) && isObject(providers[m.name])) committed(providers[m.name], `/spawn/providers/${m.name}`, { kind: "spawn", at: `--provider ${m.name}` });
     payloads[m.name] = mergePayload(...layers);
+    origins[m.name] = payloadOrigins(sourced);
+    // A value outside the manifest's `settings.<key>.values` is refused where it was set: a
+    // conditional `requires` row reads it, so a typo would silently skip every such row.
+    for (const { key, value, values } of settingValueProblems(m.manifest, payloads[m.name])) {
+      const at = origins[m.name][`/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`]?.at ?? null;
+      throw fail("E_WORKSPACE_SCHEMA", `${m.name}: setting ${show(key)} is ${show(value)}, not one of ${values.map(show).join(", ")}${at ? ` (set at ${at})` : ""}`, { capability: m.name, key, value, values, at, reason: "setting-value" });
+    }
+  }
+
+  // Each capability's own kernel range (its manifest's compatibility.oats) must admit the running
+  // kernel: a package or member capability written for another kernel is refused before anything
+  // is composed from it, never discovered at its first hook.
+  for (const m of modules) {
+    const c = kernelCompatibility({ ...m.manifest, capability: m.name }, kernel);
+    if (c.ok) continue;
+    const remedy = m.from.kind === "package"
+      ? `pin a release of ${m.from.package} whose range admits ${kernel} in the workspace's packages:, or run a kernel the range admits`
+      : `update ${m.name} in ${m.from.repoKey}, or run a kernel the range admits`;
+    throw fail("E_CAPABILITY_INCOMPATIBLE", `${m.name} requires oats ${c.range}; this kernel is ${kernel} — ${remedy}`, { capability: m.name, range: c.range, kernel, from: m.from });
   }
 
   // Compatibility floors (soul.compatibility) are constraints on PACKAGE versions.
@@ -630,7 +750,23 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
   const declRevision = revisionOf(decl);
   const payloadRevision = revisionOf(payloads);
   const revision = revisionOf({ declRevision, payloadRevision });
-  return deepFreeze({ ...decl, payloads, declRevision, payloadRevision, revision });
+  // payloadOrigins is provenance only: it is derived from the same inputs the two revisions already
+  // bind, so it does not enter either fingerprint. `teams` (the eligible teams, teams contract
+  // decision 3) is live messaging state, not composition: it stays out of both fingerprints too, so a
+  // single-label soul's revision is what it was.
+  // `slotsFrom` (where each filled slot's capability came from) is provenance, like payloadOrigins: outside
+  // both fingerprints, so the same capability reached another way is not a composition change.
+  const teams = teamsOf(discovery?.standalone === true ? null : workspace, labels);
+  return deepFreeze({ ...decl, payloads, payloadOrigins: origins, teams, slotsFrom, declRevision, payloadRevision, revision });
+}
+
+/** Where a composed capability came from, as the Desktop names it (`layers.<layer>.from`): the soul's own
+ *  entry → "soul"; defaults.<slot> or defaults.capabilities → "workspace"; defaults.byTeam.<label> → "team:<label>". */
+export function fromOfVia(via) {
+  if (via === "soul") return "soul";
+  if (typeof via === "string" && via.startsWith("defaults.byTeam.")) return `team:${via.slice("defaults.byTeam.".length)}`;
+  if (typeof via === "string" && via.startsWith("defaults.")) return "workspace";
+  return null;
 }
 
 function layerOf(manifest) {