@awebai/oats 0.29.2 → 0.29.3

package/capabilities/oats-aweb/bin/oats-aweb.mjs

@@ -45,7 +45,6 @@ import { assessCapturedSessionReadiness, querySelectedKernel } from "../lib/sess
 import { runCapturedNative } from "../lib/captured-native.mjs";
 import { CUSTODY_ATTACH_MIN, grantYamlCustodySocket, parseBindingJson } from "../lib/binding-wire.mjs";
 import { custodyPreflight } from "../lib/grant-custody.mjs";
-import { PERSONAL_ROOT_DEFERRED_WARNING, personalRootDeclared } from "../lib/personal-team.mjs";
 import { runtimeDeliveryFor, wakeRegistration } from "../lib/wake-receive.mjs";
 
 /** Run a command as ARGV — never a shell string. Team ids, aliases, instance
@@ -498,7 +497,7 @@ function globalGrantSpawn() {
   const teamWarnings = [];
   const unmappedPrimary = !team ? unmappedPrimaryRow() : undefined;
   if (!team) team = activeTeamAt(custody);
-  if (unmappedPrimary && team) teamWarnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using personal team ${team}`);
+  if (unmappedPrimary && team) teamWarnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using the default team ${team}`);
   if (!team) fatal("identity.mode \"global\" requires settings.oats.aweb.team or an active team at the resident custody root before minting a grant");
   const grantHome = join(home, ".aweb-identity");
   if (existsSync(grantHome)) fatal(`${grantHome} already exists; refusing to overwrite an existing aweb session grant home`);
@@ -758,9 +757,9 @@ function validateJoinLabels(labels, { action = "join" } = {}) {
   const eligible = eligibleTeams();
   const byLabel = new Map(eligible.map((t) => [t.label, t]));
   for (const label of labels) {
-    if (action === "leave" && label === "personal") {
-      const error = new Error(`E_TEAM_PERSONAL: ${label} is the personal team and cannot be left`);
-      error.code = "E_TEAM_PERSONAL";
+    if (action === "leave" && label === "default") {
+      const error = new Error(`E_TEAM_DEFAULT: ${label} is the workspace's default team and cannot be left`);
+      error.code = "E_TEAM_DEFAULT";
       throw error;
     }
     if (!LABEL_RE.test(label) || !byLabel.has(label)) {
@@ -801,14 +800,19 @@ function readCapabilityMeta() {
   if (process.env.OATS_META) { try { return withProviderTeams(JSON.parse(process.env.OATS_META || "{}")); } catch { return withProviderTeams({}); } }
   try { return withProviderTeams(JSON.parse(readFileSync(join(home, "instance.json"), "utf8")).capabilityMeta?.["oats.aweb"] || {}); } catch { return withProviderTeams({}); }
 }
+function defaultTeamSource(meta = {}) {
+  const recorded = meta.defaultTeam?.source;
+  if (recorded === "setting" || recorded === "root") return recorded;
+  return payloadTeam().team ? "setting" : "root";
+}
 function teamsDocument(meta = readCapabilityMeta()) {
   const teams = parseOatsTeams();
   const joined = joinedTeamsOf(meta);
   const joinedLabels = new Set(joined.map((j) => j.label));
   const primary = primaryTeamLabel();
-  const personalTeam = meta.personal?.team || meta.team || meta.identity?.team || payloadTeam().team || null;
+  const defaultTeam = meta.defaultTeam?.team || meta.team || meta.identity?.team || payloadTeam().team || null;
   return {
-    personal: { team: personalTeam, ...(meta.personal?.source ? { source: meta.personal.source } : {}) },
+    defaultTeam: { team: defaultTeam, source: defaultTeamSource(meta) },
     primary,
     eligible: teams.filter((t) => t.mapped && t.team).map((t) => ({ label: t.label, team: t.team, joined: joinedLabels.has(t.label) })),
     joined: joined.map((j) => ({ label: j.label, team: j.team, identityHome: j.identityHome, receive: j.receive || "poll", since: j.since })),
@@ -888,7 +892,7 @@ function parseHomeCommandArgs(argv = process.argv.slice(3)) {
 }
 function outputTeamsDocument(doc, json) {
   if (json) { console.log(JSON.stringify(doc)); return; }
-  console.log(`personal: ${doc.personal.team || "unknown"}`);
+  console.log(`default team: ${doc.defaultTeam.team || "unknown"}`);
   for (const row of doc.eligible) console.log(`${row.joined ? "joined" : "eligible"}: ${row.label} (${row.team})`);
   for (const label of doc.unmapped) console.log(`unmapped: ${label}`);
 }
@@ -934,9 +938,7 @@ function runTeamsCommand(kind) {
 
 /** The primary identity's team and the root that mints it, exactly as 1.14.2:
  *  the config's `team:` (id, then name) wins, else the root's active team.
- *  Per-workspace personal-team enrollment is deferred to 1.16, so this makes no
- *  `aw auth` or `aw team ensure` call and a declared roots.personal is ignored
- *  with a warning. Exits through fatal() on refusal. */
+ *  Exits through fatal() on refusal. */
 function resolvePrimaryTeam() {
   const warnings = [];
   const root = awebRoot();
@@ -945,7 +947,7 @@ function resolvePrimaryTeam() {
   const source = team ? "setting" : "root";
   const unmappedPrimary = !team ? unmappedPrimaryRow() : undefined;
   if (!team) team = JSON.parse(run(["aw", "team", "list", "--json"], root)).active_team;
-  if (unmappedPrimary && team) warnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using personal team ${team}`);
+  if (unmappedPrimary && team) warnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using the default team ${team}`);
   if (!team) fatal(`cannot determine target team, so no identity could be minted — ${teamConfigRemedy()}, or activate a team at the aweb root`);
   // A bare team name (no namespace) resolves against the root's memberships.
   if (!team.includes(":")) {
@@ -955,7 +957,6 @@ function resolvePrimaryTeam() {
     else if (match.length > 1) fatal(`team name "${team}" is ambiguous at ${root}: ${match.join(", ")}, so no identity could be minted — ${teamConfigRemedy()}`);
     else fatal(`no membership matching team "${team}" at ${root}, so no identity could be minted — join or create it first (aweb-team-membership skill), or ${teamConfigRemedy()}`);
   }
-  if (personalRootDeclared(settings)) warnings.push(`oats-aweb: personal-root-deferred — ${PERSONAL_ROOT_DEFERRED_WARNING}`);
   return { team, root, source, warnings };
 }
 
@@ -1110,19 +1111,19 @@ if (event === "launch") {
     const deliveryBrief = deliveryMode === "session"
       ? ` Notification delivery: external (AWEB_DELIVERY=session): the host wake broker (aw wake) is registered for this home and nudges you when mail or chat arrives; the native aweb channel is not running. If you have waited long with nothing arriving, check \`aw mail inbox\` and \`aw chat pending\` yourself at task boundaries.`
       : "";
-    let meta = { team: joined.team_id, alias, delivery: deliveryMode, personal: { team: joined.team_id, source: primary.source }, ...(process.env.OATS_RUNTIME ? { runtime: process.env.OATS_RUNTIME } : {}), identity: identityMeta({ mode: "local", alias, team: joined.team_id }) };
+    let meta = { team: joined.team_id, alias, delivery: deliveryMode, defaultTeam: { team: joined.team_id, source: primary.source }, ...(process.env.OATS_RUNTIME ? { runtime: process.env.OATS_RUNTIME } : {}), identity: identityMeta({ mode: "local", alias, team: joined.team_id }) };
     const joinFloorProblem = joinRows.length ? joinedTeamsAwFloorProblem() : undefined;
     if (joinFloorProblem) warnings.push(`oats-aweb: ${joinFloorProblem}`);
     else for (const row of joinRows) { const result = mintJoinedTeam(row, meta); meta = result.meta; spawnMeta = meta; writeProviderTeamsState(meta); if (result.warning) warnings.push(`oats-aweb: ${result.warning}`); }
     if (joinedTeamsOf(meta).length) { const synced = syncWakeReceive(meta); meta = synced.meta; for (const w of synced.warnings) warnings.push(`oats-aweb: ${w}`); }
     writeProviderTeamsState(meta);
-    const personalBrief = meta.personal.source === "setting" ? "the team this deployment configured for you" : "your personal team (the messaging root's active team)";
+    const defaultTeamBrief = meta.defaultTeam.source === "setting" ? "the team this deployment configured for you" : "the workspace's default team (the messaging root's active team)";
     const joinedNow = joinedTeamsOf(meta);
     const joinedBrief = joinedNow.length ? ` Joined teams: ${joinedNow.map((j) => `${j.label} (${j.team}, receive ${j.receive}, send with \`aw --identity-home ${j.identityHome} mail|chat ...\`)`).join("; ")}.` : "";
     out({
       meta,
       env,
-      brief: `Comms: you have an aweb identity — alias "${alias}" on team ${joined.team_id}, ${personalBrief}.${mismatch}${deliveryBrief}${joinedBrief} Load the oats-aweb skill before messaging: \`oats aweb teams --json\` shows your teams, \`oats aweb roster\` who you can reach. Coordination stays in your deployment's task layer.`,
+      brief: `Comms: you have an aweb identity — alias "${alias}" on team ${joined.team_id}, ${defaultTeamBrief}.${mismatch}${deliveryBrief}${joinedBrief} Load the oats-aweb skill before messaging: \`oats aweb teams --json\` shows your teams, \`oats aweb roster\` who you can reach. Coordination stays in your deployment's task layer.`,
       ...(launch ? { launch } : {}),
       ...(joined.team_id !== team ? { warning: `oats-aweb: team mismatch — joined ${joined.team_id}, expected ${team}` } : warnings.length ? { warning: warnings.join(" | ") } : channelWarning ? { warning: channelWarning } : {}),
     });
@@ -1206,7 +1207,7 @@ if (event === "launch") {
   // alias = instance name, so the team's member roster lists live instances
   // wherever they run (plus human members). Local liveness comes from
   // `oats status` in the deployment; this is the network view.
-  // Default: this instance's personal team, listed from the root that minted
+  // Default: this instance's default team, listed from the root that minted
   // it. `--label <label>` lists an eligible (joined or not) workspace team from
   // the host root that holds it.
   const argv = process.argv.slice(3);
@@ -1220,7 +1221,7 @@ if (event === "launch") {
     team = row.team; root = awebRootForTeam(team);
     if (!root) { console.error(`oats aweb roster: ${awebRootProblem(rootSettingCandidate(team))}, so the roster of ${label} cannot be read from this host`); process.exit(1); }
   } else {
-    team = meta.personal?.team || meta.identity?.team || meta.team || process.env.OATS_TEAM_ID;
+    team = meta.defaultTeam?.team || meta.identity?.team || meta.team || process.env.OATS_TEAM_ID;
     root = awebRoot();
     if (!root) { console.error(`oats aweb roster: ${awebRootProblem(rootSettingCandidate())}`); process.exit(1); }
     if (!team) team = JSON.parse(run(["aw", "team", "list", "--json"], root)).active_team;

package/capabilities/oats-aweb/injects/aweb.md

@@ -1,9 +1,9 @@
 ## Messaging: aweb
 
 Your messaging layer is **aweb**. Your identity's alias is your instance name,
-and it lives in the personal team of the person you work for (the `Comms:`
-line of your TASK.md names it). Wider workspace teams are joined explicitly,
-each with its own identity home.
+and it lives in the workspace's default team (the `Comms:` line of your TASK.md
+names it). Wider workspace teams are joined explicitly, each with its own
+identity home.
 
 **Load the `oats-aweb` skill before your first `aw mail`/`aw chat` of a session,
 whenever an aweb wake or channel event arrives, and whenever messaging or a
@@ -14,7 +14,7 @@ memory; if a flag looks wrong run `aw <command> --help`.
 Quick crib (run from your instance home, never from `./work`):
 
 ```bash
-oats aweb teams --json                                     # personal, eligible, joined teams
+oats aweb teams --json                                     # defaultTeam, eligible, joined teams
 oats aweb roster                                           # who you can reach
 aw mail inbox                                              # UNREAD mail only (--show-all: history)
 aw mail send --to <alias> --subject "..." --body-file <f>  # recipient needs --to

package/capabilities/oats-aweb/lib/binding-wire.mjs

@@ -4,7 +4,6 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { TextDecoder } from 'node:util';
 import { assessCapturedSessionReadiness } from './session-readiness.mjs';
 import { custodyPreflight } from './grant-custody.mjs';
-import { PERSONAL_ROOT_DEFERRED_WARNING, personalRootDeclared } from './personal-team.mjs';
 import { joinedReceiveModes } from './wake-receive.mjs';
 import {
   MESSAGING_CONTRACT,
@@ -220,9 +219,8 @@ function readinessDetails(settings,{deployment,env=process.env}={}) {
   const initialTeam=typeof settings.team==='string' && settings.team.trim()?settings.team.trim():undefined;
   const candidate=rootCandidate(settings,initialTeam,{deployment,env}),team=teamFromSettings(settings,candidate,{env}),problems=[],warnings=[];
   if(!candidate.root || !isAbsolute(candidate.root) || !existsSync(join(resolve(candidate.root),'.aw'))) problems.push({code:'needs-configuration',message:`no messaging root at ${candidate.root?resolve(candidate.root):process.cwd()}: run oats aweb setup there or set ${candidate.key}`});
-  const unmapped=unmappedPrimary(env);if(unmapped&&team)warnings.push({code:'team-unmapped',message:`workspace label ${unmapped.label} is not mapped; using personal team ${team}`});
+  const unmapped=unmappedPrimary(env);if(unmapped&&team)warnings.push({code:'team-unmapped',message:`workspace label ${unmapped.label} is not mapped; using the default team ${team}`});
   if(!team) problems.push({code:'needs-configuration',message:'no team: set settings.oats.aweb.team or keep an active team at the aweb root'});
-  if(personalRootDeclared(settings)) warnings.push({code:'personal-root-deferred',message:PERSONAL_ROOT_DEFERRED_WARNING});
   return {team,candidate,warnings,result:checkProblems(problems) || {status:'ready',problems:[]}};
 }
 function readinessFromSettings(settings,options) {return readinessDetails(settings,options).result;}

package/capabilities/oats-aweb/lib/wake-receive.mjs

@@ -30,7 +30,7 @@ export function wakeRegistration({home, primaryIdentityHome, delivery, runtime,
   if (!rt || !joined.length) return null;
   const receive = joined.map((j) => ({identity_home: j.identityHome, label: j.label, event_classes: JOINED_EVENT_CLASSES}));
   const doc = rt === 'external-session'
-    ? {home, delivery: 'session', runtime_delivery: rt, identity_home: primaryIdentityHome, receive_identities: [{identity_home: primaryIdentityHome, label: 'personal', controls: true}, ...receive]}
+    ? {home, delivery: 'session', runtime_delivery: rt, identity_home: primaryIdentityHome, receive_identities: [{identity_home: primaryIdentityHome, label: 'default', controls: true}, ...receive]}
     : {home, delivery: rt, runtime_delivery: rt, primary_identity_home: primaryIdentityHome, receive_identities: receive};
   if (backend) doc.backend = backend;
   return doc;

package/capabilities/oats-aweb/oats.json

@@ -1,7 +1,7 @@
 {
   "capability": "oats.aweb",
   "command": "aweb",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "compatibility": {
     "oats": ">=0.26.0"
   },
@@ -142,7 +142,7 @@
       "description": "channel: the native aweb channel packages wake the instance (default). session: delivery is external (AWEB_DELIVERY=session), no channel flag; the host wake broker registers the instance once it exists."
     },
     "team": {
-      "description": "Target aweb team id for the primary personal identity lifecycle. In workspace v2 spawns this payload value wins over OATS_TEAM_ID; if both are set and differ the hook warns and uses this setting. Unset means the aweb root's active team."
+      "description": "Target aweb team id for the primary identity lifecycle. In workspace v2 spawns this payload value wins over OATS_TEAM_ID; if both are set and differ the hook warns and uses this setting. Unset means the aweb root's active team."
     },
     "root": {
       "hostOnly": true,
@@ -150,7 +150,7 @@
     },
     "roots": {
       "hostOnly": true,
-      "description": "Host-owned map of aweb team id to absolute directory whose .aw is that team's minting root, for deployments that mint into several teams. Put this only in oats-local.yaml settings.oats.aweb.roots. The key \"personal\" is reserved for per-workspace personal-team enrollment (oats.aweb 1.16); 1.15 ignores it with a readiness warning."
+      "description": "Host-owned map of aweb team id to absolute directory whose .aw is that team's minting root, for deployments that mint into several teams. Put this only in oats-local.yaml settings.oats.aweb.roots. Keys are team ids only."
     },
     "identity": {
       "default": {

package/capabilities/oats-aweb/skills/VENDORED.md

@@ -16,7 +16,7 @@ Vendored trees:
 - `aweb-identity/`
 
 Not vendored: `oats-aweb/` is this package's own OATS playbook (identity,
-personal and joined teams, roster, delivery and wakes, etiquette,
+default and joined teams, roster, delivery and wakes, etiquette,
 troubleshooting). Every `aw` invocation it and the vendored skills cite is
 checked against a real published aw by `test/oats-aweb-1-15.test.mjs`.
 

package/capabilities/oats-aweb/skills/aweb-team-membership/SKILL.md

@@ -23,12 +23,12 @@ retire cleanup, readiness, and Desktop operations consistent.
 Use the provider commands from the instance home (or with `--home <path>`):
 
 ```bash
-oats aweb teams --json                  # personal, eligible, joined, unmapped
+oats aweb teams --json                  # defaultTeam, eligible, joined, unmapped
 oats aweb join --labels <label>[,<label>]   # join eligible workspace labels
 oats aweb leave --labels <label>[,<label>]  # leave joined wider-team labels
 ```
 
-- The personal team cannot be left; attempting it is `E_TEAM_PERSONAL`.
+- The workspace's default team cannot be left; attempting it with label `default` is `E_TEAM_DEFAULT`.
 - A label that is not eligible for this soul/workspace is `E_TEAM_NOT_ELIGIBLE`.
 - Joined wider teams use a local identity home such as
   `<home>/.aweb-identity-<label>`. Joined teams require aw >= 1.36.12. The
@@ -62,15 +62,15 @@ aw id cert show
 
 Interpret common states:
 
-- `teams.personal.team` is the primary identity's team, wired to the harness:
-  the aweb root's active team (`personal.source: root`) or a deployment-pinned
-  team (`setting`). A team per workspace arrives in oats.aweb 1.16.
+- `teams.defaultTeam.team` is the primary identity's team, wired to the harness:
+  the aweb root's active team (`defaultTeam.source: root`) or a deployment-pinned
+  team (`setting`).
 - `eligible[]` are labels this soul/workspace may explicitly join; the primary
   label may appear here and is joinable/leavable like any other wider team.
 - `joined[]` are provider-created wider-team memberships; each has an
   `identityHome`, `since`, and `receive` (`native` or `poll`).
 - `unmapped[]` labels are present on the soul but not mapped by the workspace.
-  An unmapped primary falls back to the personal/root active team with a
+  An unmapped primary falls back to the default/root active team with a
   `team-unmapped` warning; it is not a spawn blocker.
 - `teams-unverified` on launch means the kernel supplied recorded/unknown team
   data, so the provider kept memberships instead of leaving anything.
@@ -81,9 +81,9 @@ Interpret common states:
   `default:oats.aweb.ai`).
 - **Team certificate**: a signed membership statement for an identity; stored in
   `.aw/team-certs/` for native identities.
-- **Personal team**: the default team for the instance's primary identity: the
-  aweb root's active team, or `settings.oats.aweb.team` when the deployment
-  pins one. Per-workspace personal-team enrollment arrives in oats.aweb 1.16.
+- **Default team**: the workspace default team for the instance's primary identity:
+  the aweb root's active team, or `settings.oats.aweb.team` when the deployment
+  pins one.
 - **Joined team**: an explicit wider team joined through `oats aweb join`, with a
   separate local identity home.
 

package/capabilities/oats-aweb/skills/aweb-team-membership/references/team-membership-reference.md

@@ -13,7 +13,7 @@ These layers can combine in multiple ways. Do not assume one from another. The c
 
 Fully Hosted means aweb operates namespace and team authority for hosted domains such as `*.aweb.ai`. It can mint hosted team certificates and provide simple onboarding. This is the simple default for most users.
 
-Hosted OAuth/MCP flows provision custodial addressed/global identities, personal team membership, and harness credentials before a local CLI workspace exists. Team API-key CLI bootstrap is different: it creates a local self-custodial CLI workspace in a hosted team. In OAuth/MCP flows, use CLI checks for diagnosis only when a local workspace is actually involved; do not force BYOT setup.
+Hosted OAuth/MCP flows provision custodial addressed/global identities, default team membership, and harness credentials before a local CLI workspace exists. Team API-key CLI bootstrap is different: it creates a local self-custodial CLI workspace in a hosted team. In OAuth/MCP flows, use CLI checks for diagnosis only when a local workspace is actually involved; do not force BYOT setup.
 
 ## BYOT
 

package/capabilities/oats-aweb/skills/oats-aweb/SKILL.md

@@ -23,16 +23,16 @@ joined team, put `--identity-home <identityHome>` before the subcommand.
 | Fact | Where to read it |
 |---|---|
 | Your alias | your instance name; the `Comms:` line of `TASK.md`; `aw whoami` |
-| Your personal team | `oats aweb teams --json` → `personal.team` (`personal.source`) |
+| Your default team | `oats aweb teams --json` → `defaultTeam.team` (`defaultTeam.source`) |
 | Teams you may join | `oats aweb teams --json` → `eligible[]` |
 | Teams you have joined | `oats aweb teams --json` → `joined[]` (each with `identityHome`, `receive`) |
 | How mail reaches you | the `Comms:` line of `TASK.md` (see section 4) |
 
-- **Personal team.** Your primary identity lives in the personal team of the
-  person you work for: the aweb root's active team (`personal.source: root`),
-  or the team the deployment pinned (`source: setting`). Everyone this
-  deployment spawns into that team is there with you. (A separate team per
-  workspace arrives in oats.aweb 1.16.)
+- **Default team.** Your primary identity lives in the workspace's default team:
+  the aweb root's active team (`defaultTeam.source: root`), or the team the
+  deployment pinned (`defaultTeam.source: setting`). `defaultTeam.source` is
+  always present and is only `root` or `setting`. Everyone this deployment
+  spawns into that team is there with you.
 - **Joined teams.** A wider team the workspace defines, joined explicitly. Each
   gives you a **separate identity** with the same alias in that team, kept
   under `<home>/.aweb-identity-<label>`. You act as that team only with
@@ -42,7 +42,7 @@ joined team, put `--identity-home <identityHome>` before the subcommand.
 ## 2. Find who to talk to
 
 ```bash
-oats aweb roster                 # your personal team's members (instances + humans), across machines
+oats aweb roster                 # your default team's members (instances + humans), across machines
 oats aweb roster --label <label> # an eligible workspace team's members
 oats status                      # live OATS instances on this machine
 ```
@@ -52,7 +52,7 @@ oats status                      # live OATS instances on this machine
 - Outside your team use a full address, `namespace/alias` (`--to-address`), only
   when you were given one.
 - A name that is not on the roster of the team you send from will not resolve:
-  pick the identity (personal or joined) whose team holds the recipient.
+  pick the identity (default-team or joined) whose team holds the recipient.
 
 ## 3. Send, reply, chat
 
@@ -126,7 +126,7 @@ mail (`--show-all`).
 ## 5. Teams: join and leave
 
 ```bash
-oats aweb teams --json                  # {personal, primary, eligible, joined, unmapped}
+oats aweb teams --json                  # {defaultTeam, primary, eligible, joined, unmapped}
 oats aweb join --labels <label>[,<label>]
 oats aweb leave --labels <label>[,<label>]
 ```
@@ -134,7 +134,7 @@ oats aweb leave --labels <label>[,<label>]
 - Join only when your human, coordinator or task asks you to work with that
   team. Joining mints a new identity for you in that team.
 - You may join only `eligible[]` labels; anything else is `E_TEAM_NOT_ELIGIBLE`.
-- Your personal team cannot be left (`E_TEAM_PERSONAL`).
+- The workspace's default team cannot be left (`E_TEAM_DEFAULT` when the label is `default`).
 - When the workspace stops mapping a team, your next session start leaves it.
 - Do not run native `aw team join|switch|leave|invite` for your identities; the
   provider keeps homes, broker registration and retire cleanup consistent.
@@ -165,7 +165,7 @@ Check your own state first:
 ```bash
 aw whoami                          # identity you act as here
 aw workspace status                # connection of the primary identity
-oats aweb teams --json             # personal/joined teams and receive modes
+oats aweb teams --json             # defaultTeam/joined teams and receive modes
 oats readiness --home "$PWD" --json   # the provider's readiness answer for this home
 ```
 
@@ -173,8 +173,7 @@ oats readiness --home "$PWD" --json   # the provider's readiness answer for this
 
 | Code | Meaning | Who fixes it |
 |---|---|---|
-| `personal-root-deferred` | the host set `settings.oats.aweb.roots.personal`; 1.15 ignores it (per-workspace enrollment arrives in 1.16) | nobody; the host may remove the setting |
-| `team-unmapped` | your soul's primary label is not mapped by the workspace; you are in the personal team | workspace owner, if a shared team was meant |
+| `team-unmapped` | your soul's primary label is not mapped by the workspace; you are in the default team | workspace owner, if a shared team was meant |
 | `joined-team-receive` | a joined team receives live through the broker (informational) | nobody |
 | `joined-team-poll-only` | a joined team does not wake you; the message says why | poll that team at task boundaries; human may start the wake daemon |
 | `wake-daemon-not-running` / `-outdated` / `-version-unknown` | host wake broker is down or older than 1.36.5 | human: upgrade aw, restart the host wake daemon |
@@ -185,7 +184,7 @@ oats readiness --home "$PWD" --json   # the provider's readiness answer for this
 
 - `E_TEAM_NOT_ELIGIBLE` — the label is not one of your eligible teams; the
   message lists them. Check the spelling against `oats aweb teams --json`.
-- `E_TEAM_PERSONAL` — the personal team cannot be left.
+- `E_TEAM_DEFAULT` — the workspace's default team cannot be left.
 - `E_TEAM_GLOBAL_MODE` — this home acts as a resident identity through a
   session grant; joined teams need local identities. Report it.
 - `E_TEAM_AW_FLOOR` — the host `aw` is too old: joined teams need aw >= 1.36.12.

package/docs/capabilities.md

@@ -216,13 +216,12 @@ team: [engineering, reviewers]
 
 - `OATS_TEAM_LABEL` is the primary label. The merged messaging payload takes
   **no** label's `byTeam` entry, the primary's included (teams amendment K), so
-  `OATS_TEAM_ID` (the payload's `team`) is the personal team a host, soul or
-  spawn set; empty means the provider's default.
+  `OATS_TEAM_ID` (the payload's `team`) is the default team a host, soul or spawn set; empty means the provider's default.
 - Every label is an **eligible team**: the kernel hands the messaging provider
   `teams`, one `{ label, team, mapped, payload }` per label in order. `payload`
   is `workspace.messaging` ⊕ `byTeam[<label>]` when the workspace maps the
   label (`team` is then its team id), else the base alone with `mapped: false`
-  and `team: null`. A soul with no label gets `[]` (personal only).
+  and `team: null`. A soul with no label gets `[]` (the workspace's default team only).
 - `teams` travels **beside** a provider's settings, never inside them:
   `OATS_TEAMS` (the JSON), `OATS_TEAM_LABELS` (comma-joined) and
   `OATS_TEAMS_SOURCE` in the environment of every hook, home command and
@@ -518,7 +517,7 @@ passed as arguments; no shell is involved.
   - `OATS_CLI_BIN`;
   - `OATS_WORKSPACE` (the deployment);
   - the team variables `OATS_TEAM_ID` (the messaging payload's `team`: the
-    personal team if one is set; empty = the provider's default),
+    workspace's default team if one is set; empty = the provider's default),
     `OATS_TEAM_SCOPE`, `OATS_TEAM_LABEL`, `OATS_TEAM_NAME`,
     `OATS_TEAM_LABELS`, `OATS_TEAMS`, `OATS_TEAMS_SOURCE`, `OATS_WORKSPACE_NAME` and
     `OATS_WORKSPACE_KEY`;

package/docs/design/2026-09-24-desktop-phase-f-boundary.md

@@ -1,5 +1,7 @@
 # Desktop Phase F — the Desktop is built FOR workspace model v2
 
+> **Vocabulary (2026-09-26):** there is no "personal team". Read it below as **the workspace's default team**. See the AMENDMENT at the top of [the teams contract](2026-09-25-teams-contract.md). This document is a record and keeps its original wording.
+
 **Status**: boundary for the Desktop engineer, issued 2026-09-24 by the lead under
 the human's direction: *"the desktop should not just adapt to the new version,
 it should be natively built for it."* Supersedes the Phase 3 parity plan's

package/docs/design/2026-09-24-phase-d-plan.md

@@ -1,5 +1,7 @@
 # Phase D — the OATS project runs on the architecture it offers (plan)
 
+> **Vocabulary (2026-09-26):** there is no "personal team". Read it below as **the workspace's default team**. See the AMENDMENT at the top of [the teams contract](2026-09-25-teams-contract.md). This document is a record and keeps its original wording.
+
 **Status**: plan, 2026-09-24, lead. Decisions 18–22 of the workspace model, the
 five-soul roster and its 2026-09-24 amendment, the human's sequencing
 ("knowledge centralisation first"; "do not retire live souls until their

package/docs/design/2026-09-25-teams-contract.md

@@ -7,6 +7,31 @@ This document is the kernel half; the provider half (oats.aweb) is the
 messaging lane's. Co-lead review (9a18a381): agreed, with three additions,
 folded in below.
 
+## AMENDMENT 2026-09-26 (Juan, a total blocker): there is no "personal team"
+
+There is **no "personal team" concept**, in aweb or in OATS. **A workspace has its
+DEFAULT TEAM** (the team for the workspace key in its owner's namespace);
+agents can join other teams. Nothing is "personal". Everywhere below, read
+"personal team" as **"the workspace's default team"** (short: "default team").
+The rename is applied everywhere, with no compatibility aliases:
+
+- **Prose:** docs, skills, injects, READMEs, release notes (from 0.29.3 on), the
+  knowledge base. Past release notes and append-only logs stay as history.
+- **Wire names (the oats.aweb 1.16.0 release; the co-lead's lane):**
+  - the teams operation's JSON field `personal` → `defaultTeam` (`{team, source}`);
+  - `E_TEAM_PERSONAL` → `E_TEAM_DEFAULT` (leaving the workspace's default team);
+  - the broker receive label `personal` → `default`;
+  - `settings.oats.aweb.roots.personal` is removed (enrollment is 1.16+ and uses
+    the enrolled-root model);
+  - readiness codes/messages lose "personal".
+- **aweb** renames its `personal-workspace` endpoints, auth scope, CLI help and
+  flags, and binding file likewise (aweb's lane).
+- **The kernel** carries no wire name with "personal" (only prose/comments,
+  renamed). The Desktop reads `defaultTeam`.
+
+The model below is otherwise unchanged: the default team only, by default;
+joining is explicit; only the soul's labels that the workspace maps.
+
 ## The model (human, 2026-09-25)
 
 - **Default: the personal team only.** Every instance is in its person's
@@ -143,11 +168,18 @@ folded in below.
 7. **Explicit join, spawn choice, Desktop.**
    - The join/leave/list verbs are the provider's (oats.aweb 1.14.0), run
      inside a home or with `--home <abs>`, all idempotent, all with `--json`:
-     - `oats aweb teams` answers
-       `{ personal: {team}, primary, eligible: [{label, team, joined}], joined: [{label, team, since, identityHome, receive}], unmapped: [label], at }`, where `receive` is `native` or `poll`;
+     - `oats aweb teams` answers (oats.aweb ≥1.16.0 names; see the AMENDMENT at the top)
+       `{ defaultTeam: {team, source}, primary, eligible: [{label, team, joined}], joined: [{label, team, since, identityHome, receive}], unmapped: [label], at }`, where `receive` is `native` or `poll`, and `source` is always `setting` (the team a setting named) or `root` (the messaging root's active team);
      - `oats aweb join <label>[,<label>]` and
-       `oats aweb leave <label>[,<label>]` answer the same document. The
-       personal team can't be left (`E_TEAM_PERSONAL`).
+       `oats aweb leave <label>[,<label>]` answer the same document **plus**
+       `actions: [{action: "join"|"leave", label, released?, receipt?}]`,
+       one row per label acted on, in order (since oats.aweb 1.15.0; added
+       here 2026-09-26 after the Desktop's real-provider capture found it).
+       `released` is the provider's word for what a leave did (e.g.
+       `released`); `receipt` is opaque provider evidence (alias release),
+       for logs, never shown as UI. A consumer accepts `actions` on
+       join/leave answers only, and repaints from the document itself.
+       The workspace's default team can't be left (`E_TEAM_DEFAULT`).
      - The same verbs are declared as home-context operations
        `messaging:teams|join|leave`, so the Desktop uses `oats operation run`
        and needs no new kernel surface.

package/docs/design/2026-09-26-desktop-design-brief-architecture.md

@@ -90,7 +90,7 @@ An unconfirmed member contributes **nothing**: its souls and capabilities are in
 - A soul has one team or several (the first is its **primary**). A repo can set a default team for its souls.
 - A team label can **add default capabilities** for its souls (e.g. every `engineering` soul gets the release tooling).
 - A team label **never** restricts, gates or changes trust. It's organisation, plus optional defaults.
-- For **messaging**, each label a soul carries is a team it's *eligible* to join. By default an instance is only in its person's **personal team**, and joining others is an explicit choice, at spawn or later.
+- For **messaging**, each label a soul carries is a team it's *eligible* to join. By default an instance is only in the workspace's **default team**, and joining others is an explicit choice, at spawn or later.
 
 ---
 
@@ -136,7 +136,7 @@ Plus one **default capability** almost every soul has: **`oats.core`**, which te
 ### 5.2 Messaging, specifically
 
 - Each instance gets a messaging **identity** (its address).
-- By default it's in the person's **personal team**. It can **join** other eligible teams (from its labels) at spawn or later, and **leave** them. The personal team can't be left.
+- By default it's in the workspace's **default team**. It can **join** other eligible teams (from its labels) at spawn or later, and **leave** them. The default team can't be left.
 - Joined teams currently **check mail between tasks**; live delivery for joined teams is **(planned)**.
 - A stopped agent can be **woken** by a message.
 
@@ -196,7 +196,7 @@ When the workspace moves on (a member pushes, a package version is bumped), exis
 2. **Who are my agents?** Souls (what roles exist, grouped by team/repo) and instances (what's running, their hierarchy, their state).
 3. **What is this agent made of, and why?** Its composition, with each capability's source and reason (workspace/team/soul), its core capabilities, harness and work mode.
 4. **Where does it work?** Its work mode, branch, and repo; its Git state and pull requests.
-5. **Who can it talk to?** Its messaging identity, its personal team, eligible teams, joined teams.
+5. **Who can it talk to?** Its messaging identity, the workspace's default team, eligible teams, joined teams.
 6. **What does it know?** Its knowledge nodes (owned/read). **(planned)** A live browser of them.
 7. **Is anything wrong?** Unconfirmed members, missing clones, team conflicts, drift, readiness problems, each with the plain cause and the fix.
 
@@ -231,7 +231,7 @@ When the workspace moves on (a member pushes, a package version is bumped), exis
 - **Official catalog**: the reviewed list of official packages and versions.
 - **Lock**: the exact commit + fingerprint of each package, per deployment.
 - **Team (label)**: an organising label; supplies defaults and eligible messaging teams.
-- **Personal team**: the messaging team every instance is in by default.
+- **Default team**: the workspace's messaging team, which every instance is in by default.
 - **Harness**: what runs the agent session (Claude, Codex, Pi).
 - **Work mode**: where an instance works (worktree, checkout, attached, directory, workspace).
 - **Drift**: an instance built from an older state than the workspace's current one.

package/docs/official-catalog.md

@@ -69,7 +69,7 @@ this policy does not invent new catalog or manifest fields.
   `oats.aweb`, `oats.authoring`, `oats.jira`, `oats.linear`, `oats.dev`,
   `oats.knowledge-theory`, `oats.core` and `oats.setup`. `oats.okf-harvest` and
   `oats.okf-maintenance` select the `oats.okf` package (4.0.0).
-- **`oats.framework` 1.3.0** is listed at tag `oats-framework/v1.3.0` in
+- **`oats.framework` 1.3.1** is listed at tag `oats-framework/v1.3.1` in
   `awebai/oats`, payload root `oats-package`. The `oats.core`, `oats.setup` and
   `oats.knowledge-theory` aliases select that distribution; package identity is
   distinct from capability identity. Core supplies operation/soul guidance;

package/docs/packages.md

@@ -74,9 +74,9 @@ members:
   - git:github.com/acme/agents
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.3.0
+  oats.framework: v1.3.1
   oats.okf: v4.0.0
-  oats.aweb: v1.15.0
+  oats.aweb: v1.16.0
 teams:
   global: { description: Org-wide }
   engineering: { description: Platform }
@@ -344,8 +344,8 @@ A soul that names one of the package's capabilities with
 }
 ```
 
-`ref` carries the tag convention: a workspace's `oats.framework: v1.3.0`
-resolves to tag `oats-framework/v1.3.0`. Resolving through the catalog never
+`ref` carries the tag convention: a workspace's `oats.framework: v1.3.1`
+resolves to tag `oats-framework/v1.3.1`. Resolving through the catalog never
 advances a lock by itself — `oats sync` does, and
 says so.
 

package/docs/release-notes/v0.29.3.md

@@ -0,0 +1,53 @@
+# OATS 0.29.3
+
+## Changed
+
+- **There is no "personal team"; a workspace has its default team.** The
+  vocabulary follows the teams contract's amendment of 2026-09-26: a workspace
+  has its **default team** (the team for the workspace key in its owner's
+  namespace), and agents may join other teams. The model is unchanged:
+  - an instance is in the workspace's default team only, by default;
+  - joining an eligible team is an explicit act;
+  - `OATS_TEAMS` is `[]` for a soul with no label.
+
+  The kernel's docs, comments and the `unmapped-team-label` warning use the
+  new words. The warning now reads "… fall back to the workspace's default team
+  for it". The oats.framework skills (oats.core 2.1.1, oats.setup 2.1.2,
+  oats.framework 1.3.1) teach the same model. The kernel carries no wire name
+  with "personal", and there are no compatibility aliases.
+- **The messaging provider uses the same words** (oats.aweb 1.16.0, below).
+
+## oats.aweb 1.16.0 (catalog pin and bundled mirror)
+
+- **The catalog and this repo's workspace pin `oats.aweb` to `v1.16.0`, and
+  the bundled `capabilities/oats-aweb` is the tag's tree.** It renames the
+  provider's wire names to the default-team vocabulary:
+  - the teams operation's `personal` field becomes `defaultTeam`
+    (`{ team, source }`, where `source` is `setting` or `root`);
+  - `E_TEAM_PERSONAL` becomes `E_TEAM_DEFAULT`;
+  - the broker receive label `personal` becomes `default`;
+  - `settings.oats.aweb.roots.personal` is removed: `roots` keys are team ids
+    only, and the `personal-root-deferred` warning is gone.
+
+  There are no aliases: a reader of the old names must move to the new ones,
+  as the Desktop does in this release. A home spawned under 1.15 still resolves
+  its default team from its recorded team. Per-workspace default-team
+  enrollment is still deferred.
+
+## oats.framework 1.3.1 (catalog pin)
+
+- **The catalog and this repo's workspace pin `oats.framework` to
+  `oats-framework/v1.3.1`.** Its only change is the default-team vocabulary
+  above, in `oats.core` 2.1.1 and `oats.setup` 2.1.2. A deployment on
+  `oats.framework: v1.3.0` keeps working, and moving the pin to `v1.3.1` picks
+  up the new skill text.
+
+## Desktop
+
+- **"Default team" everywhere** (#252). The teams panel reads oats.aweb 1.16's
+  `defaultTeam` and says where the team comes from: the workspace or host
+  setting, or the messaging root's active team. The spawn dialog, the soul
+  inspector and the teams panel say "Default team" in place of "Personal".
+  A 1.15 `personal` document no longer decodes, so this Desktop needs the
+  oats.aweb 1.16.0 pin.
+- The Desktop still accepts OATS CLIs `>=0.25.8 <0.30.0`.

package/docs/workspaces.md

@@ -59,7 +59,7 @@ members:                                   # repo refs, NO @revision (E_WORKSPAC
   - git:github.com/acme/tools              # a member that ALSO publishes a package (see below)
 
 packages:                                  # the ONLY versioned things
-  oats.framework: v1.3.0                   # bare version → resolves through the official catalog
+  oats.framework: v1.3.1                   # bare version → resolves through the official catalog
   oats.okf: v4.0.0
   acme.tools: git:github.com/acme/tools@v0.4.0   # outside the catalog → git:<repo>@<tag|OID>; still a package
 
@@ -399,7 +399,7 @@ keys, with `byTeam` stripped) ⊕ soul slot payload ⊕ `local.settings[cap]`
 **No `byTeam[<label>]` is merged into it, the primary's included** (teams
 amendment K): each label's `base ⊕ byTeam[label]` reaches the provider only as
 that label's entry in `OATS_TEAMS` (the preview's `teams`). So `settings.team`
-(and `OATS_TEAM_ID`) is the personal team if the host, the soul or the spawn
+(and `OATS_TEAM_ID`) is the workspace's default team if the host, the soul or the spawn
 set one; empty means the provider's own default. The provider's own `binding` contract
 (`normalize → bind → check`) runs over the merged payload exactly as before.
 Two teams, two messaging identities, one workspace:
@@ -420,7 +420,7 @@ one. A label under `byTeam` that is not declared in `teams:` is
 act.** `spawn --preview` shows the merged `settings.<cap>` and the `teams`, so
 the delivery is verifiable, and `instance.json` records both. With oats.aweb
 1.13.1 (which reads `team` from its settings and ignores `OATS_TEAMS`) the
-primary identity therefore mints into the personal team: the `.aw` root's
+primary identity therefore mints into the workspace's default team: the `.aw` root's
 active team, or the one the host set. What the payload does not change is
 **where the `.aw` root is found**: the hook still searches
 bounded candidates, first hit wins — the instance home, the Git repository

package/lib/core.mjs

@@ -1485,17 +1485,17 @@ export function instanceSoulDir(home, meta = undefined) {
 /** The team facts a lifecycle hook receives (workspace model only, lead decision
  * c3-7): the team SCOPE is the deployment directory, the team ID is the messaging
  * slot's merged payload `team` (workspace base ⊕ soul ⊕ host ⊕ spawn; no byTeam entry
- * is merged since teams amendment K): the personal team if one is set; empty = the
+ * is merged since teams amendment K): the workspace's default team if one is set; empty = the
  * provider's default (for oats.aweb, the root's active team). The provider also gets
  * the soul's primary team LABEL and the workspace's name and canonical key, so it can
- * derive a per-person, per-workspace personal team; each label's mapped payload is in
+ * derive the workspace's default team; each label's mapped payload is in
  * OATS_TEAMS.
  * OATS_TEAM_NAME (the 0.25 `team:` block's name) is always empty, so an ambient
  * value never reaches a hook. Human decision 2026-09-24 (messaging default).
  *
  * Teams contract 2026-09-25 (decision 4): `resolved.teams` is the ELIGIBLE teams,
  * `[{ label, team, mapped, payload }]` in soul order. OATS_TEAM_LABELS is their
- * labels comma-joined and OATS_TEAMS their JSON (`[]` = no label: personal only).
+ * labels comma-joined and OATS_TEAMS their JSON (`[]` = no label: the workspace's default team only).
  * Both are empty when the teams are not known (a home spawned before 0.26.0 whose
  * workspace cannot be read now) — empty means "unknown", never "none".
  * OATS_TEAMS_SOURCE says where the list came from: `live` (the workspace read now,

package/lib/resolve.mjs

@@ -346,7 +346,7 @@ export function teamLabelsOf(soulEntry) {
  * `{ label, team, mapped, payload }`. `payload` is workspace.messaging's base ⊕ byTeam[label] when the
  * workspace maps the label, else the base alone with `mapped: false`; `team` is the payload's team id
  * when mapped (null otherwise). Kernel-owned and delivered BESIDE a provider's settings, never inside
- * them; joining any of them is the messaging provider's explicit act. No label → [] ("personal only").
+ * them; joining any of them is the messaging provider's explicit act. No label → [] (the workspace's default team only).
  * Pure: resolveSoul validates every carried label's entry (reserved byTeam, hostOnly keys) first.
  */
 export function teamsOf(workspace, labels) {
@@ -731,7 +731,7 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
       // Decision 23 as amended by K (teams contract, co-lead ruling): the provider's settings are
       // base ⊕ soul ⊕ host ⊕ spawn. No byTeam[<label>] is merged, the primary's included: each
       // label's base ⊕ byTeam[label] is delivered only in its `teams` entry (teamsOf → OATS_TEAMS),
-      // so settings.team is the personal team a host, soul or spawn set. `byTeam` never reaches the
+      // so settings.team is the default team a host, soul or spawn set. `byTeam` never reaches the
       // provider, and the primary team's own payload may still not nest one.
       const { byTeam, ...base } = workspace.messaging;
       committed(base, "/messaging", { kind: "workspace", at: "oats-workspace.yaml#/messaging" });

package/lib/workspace.mjs

@@ -753,8 +753,8 @@ export function workspaceWarnings(workspace, members, externalRows, packageSouls
 
 /** Teams contract decision 5: a soul label the workspace declares in `teams:` but does not map in
  *  `messaging.byTeam` is a WARNING, not a problem — the label stays eligible-but-unmapped and the
- *  messaging provider falls back to the personal team for it. (An undeclared label is E_TEAM_UNKNOWN.)
- *  ONE warning per unmapped label, naming its souls (a personal-only workspace would otherwise print
+ *  messaging provider falls back to the workspace's default team for it. (An undeclared label is E_TEAM_UNKNOWN.)
+ *  ONE warning per unmapped label, naming its souls (a workspace on its default team alone would otherwise print
  *  a line per soul): { code, label, souls, paths, message }, sorted by label. */
 const byCodepointOrder = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 function unmappedLabelWarnings(workspace, members, externalRows, teams) {
@@ -774,7 +774,7 @@ function unmappedLabelWarnings(workspace, members, externalRows, teams) {
     const order = names.map((n, i) => i).sort((x, y) => byCodepointOrder(names[x], names[y]) || byCodepointOrder(paths[x], paths[y]));
     const sorted = order.map((i) => names[i]);
     return { code: "unmapped-team-label", label, souls: sorted, paths: order.map((i) => paths[i]),
-      message: `team ${show(label)} has no messaging.byTeam entry; its souls (${sorted.join(", ")}) fall back to the personal team for it` };
+      message: `team ${show(label)} has no messaging.byTeam entry; its souls (${sorted.join(", ")}) fall back to the workspace's default team for it` };
   });
 }
 

package/package-catalog.json

@@ -8,7 +8,7 @@
     },
     "oats.aweb": {
       "url": "https://github.com/awebai/oats-aweb.git",
-      "ref": "v1.15.0",
+      "ref": "v1.16.0",
       "path": "oats-package"
     },
     "oats.jira": {
@@ -33,7 +33,7 @@
     },
     "oats.framework": {
       "url": "https://github.com/awebai/oats.git",
-      "ref": "oats-framework/v1.3.0",
+      "ref": "oats-framework/v1.3.1",
       "path": "oats-package"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.29.2",
+  "version": "0.29.3",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/capabilities/oats-aweb/lib/personal-team.mjs

@@ -1,19 +0,0 @@
-// Per-workspace personal team: deferred to oats.aweb 1.16.
-//
-// A host's `aw auth` login is one file per OS user, and `aw auth status` does not
-// name the account, so enrolling a workspace's personal team from that login could
-// mint it (and every instance) into whichever account logged in last. 1.16 brings
-// a per-deployment credential location and an expected owner. Until then oats.aweb
-// makes no `aw auth` or `aw team ensure` call on any path, the primary team
-// resolves as in 1.14.2 (settings.team, else the root's active team), and a
-// declared settings.oats.aweb.roots.personal is ignored with a readiness warning.
-
-export const PERSONAL_ROOT_KEY = 'settings.oats.aweb.roots.personal';
-export const PERSONAL_ROOT_DEFERRED_WARNING = `${PERSONAL_ROOT_KEY} is ignored: per-workspace personal-team enrollment arrives in oats.aweb 1.16; the primary team is settings.oats.aweb.team, else the aweb root's active team`;
-
-const obj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-/** True when the host declared roots.personal (any value): 1.15 ignores it and says so. */
-export function personalRootDeclared(settings) {
-  return obj(settings?.roots) && Object.hasOwn(settings.roots, 'personal');
-}