@awebai/oats 0.36.1 → 0.38.0

package/lib/instance-inspect.mjs

@@ -18,7 +18,7 @@ import { capabilityManifests, sessionDefaults, homeLaunchLayers, instanceSoulDir
 import { agentDirOf, discoverOrStandalone, ensureWorkspaceSoul, findSoulEntry, liveTeams, prepareInstance } from "./instance-resolution.mjs";
 import { declaredSettings } from "./capability-contract.mjs";
 import { kernelCompatibility } from "./resolve.mjs";
-import { recordedTeams, reportRows, soulKeyOf, soulTeams, teamModel, teamProblems } from "./teams.mjs";
+import { discoveredTeamKeys, isRemovedTeamKeys, isTeamRefusal, recordedTeams, reportRows, soulKeyOf, teamKeyOf, soulTeams, teamModel, teamProblems } from "./teams.mjs";
 import { launchLayers, launchReport } from "./launch-preference.mjs";
 import { loadLocal } from "./workspace.mjs";
 import { ensureModuleTree } from "./operator-dispatch.mjs";
@@ -35,10 +35,10 @@ const obj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const real = (p) => { try { return realpathSync(p); } catch { return resolve(p); } };
 
 /** A resolution refusal that is a readiness FACT (the soul cannot resolve as the
- *  lock stands), not a failure to answer: reported as a failing `installed` item. */
-export const RESOLUTION_FACTS = new Set(["E_PACKAGE_MISSING", "E_PACKAGE_INTEGRITY", "E_CAPABILITY_MISSING", "E_LOCK_SCHEMA", "E_REQUIREMENT_INACTIVE", "E_TEAM_UNKNOWN", "E_TEAM_NOT_ELIGIBLE"]);
-/** A resolution refusal that readiness reports as a team item (checks.configured), not an install failure. */
-const TEAM_FACTS = new Set(["E_TEAM_UNKNOWN", "E_TEAM_NOT_ELIGIBLE"]);
+ *  lock stands), not a failure to answer: reported as a failing `installed` item —
+ *  or, for a refusal of the soul's teams (isTeamRefusal), as a team item in `configured`. */
+const RESOLUTION_FACTS = new Set(["E_PACKAGE_MISSING", "E_PACKAGE_INTEGRITY", "E_CAPABILITY_MISSING", "E_LOCK_SCHEMA", "E_REQUIREMENT_INACTIVE"]);
+const isResolutionFact = (e) => RESOLUTION_FACTS.has(e?.code) || isTeamRefusal(e);
 
 /** Is `name` an executable on PATH? (manifest `requires`, no shell). */
 function onPath(name) {
@@ -89,6 +89,9 @@ export async function homeTarget(home, meta, { remoteOptions, discover = true, l
   const modules = obj(meta.modules) ? meta.modules : {};
   const agentsRoot = dirname(dirname(dirname(realHome)));
   const deployment = dirname(agentsRoot);
+  // The deployment's removed team keys (team model 3) refuse every reader of its oats-local.yaml, before
+  // anything below falls back past an unreadable local file (live teams, launch, session defaults).
+  try { loadLocal(deployment); } catch (e) { if (isRemovedTeamKeys(e)) throw e; }
   const ws = obj(meta.workspace) ? meta.workspace : {};
   const soulDir = instanceSoulDir(realHome, meta) ?? null;
   const { definition, problems } = readSoulYaml(soulDir);
@@ -111,13 +114,13 @@ export async function homeTarget(home, meta, { remoteOptions, discover = true, l
     if (external === null && (discovery.members || []).some((m) => m.key === ws.soul?.repoKey)) external = false;
   }
   const slots = Object.fromEntries(LAYERS.map((l) => [l, Object.keys(modules).find((n) => manifests[n]?.layer === l) ?? null]));
-  // The home's soul key (souls.teams / souls.default): its name, or <package>/<soul> for a package soul.
-  const teamKey = ws.soul?.package && typeof ws.soul.qualifiedName === "string" ? ws.soul.qualifiedName : meta.agent;
+  // The home's soul key in the workspace's souls: (teamKeyOf): <package>/<soul>, or <member>/<soul>.
+  const teamKey = ws.soul?.package ? teamKeyOf({ ...ws.soul, package: ws.soul.package.id }) : teamKeyOf({ name: meta.agent, repoKey: ws.soul?.repoKey ?? "" });
   let live, model = null;
   if (discovery) {
     model = teamModel(discovery.standalone === true ? null : discovery.workspace, local, { workspaceKey: discovery.key ?? null });
     try { const t = soulTeams(model, teamKey); live = { teams: reportRows(t.teams), defaultTeam: t.defaultTeam, source: "live" }; }
-    catch (e) { if (!String(e?.code).startsWith("E_TEAM_")) throw e; live = { ...recordedTeams(meta), source: "recorded" }; }
+    catch (e) { if (!isTeamRefusal(e)) throw e; live = { ...recordedTeams(meta), source: "recorded" }; }
   } else if (readLive) live = await liveTeams(realHome, meta, { remoteOptions });
   else live = { ...recordedTeams(meta), source: "recorded" };
   // Feature launch-preference: the recorded launch (frozen), and what --reselect-launch would choose now —
@@ -147,7 +150,7 @@ export async function soulTarget(contextDir, soul, { remoteOptions } = {}) {
   let prepared = null, resolutionError = null;
   try { prepared = await prepareInstance(contextDir, soul, { remoteOptions }); }
   catch (e) {
-    if (!RESOLUTION_FACTS.has(e?.code)) throw e;
+    if (!isResolutionFact(e)) throw e;
     resolutionError = { code: e.code, message: e.message, details: e.details ?? null };
   }
   const found = loadLocal(contextDir);
@@ -160,11 +163,11 @@ export async function soulTarget(contextDir, soul, { remoteOptions } = {}) {
   }
   const res = prepared?.resolution;
   // A refused resolution still names the soul's teams when they resolve (a package refusal, …); a
-  // refusal of the teams themselves (E_TEAM_UNKNOWN / E_TEAM_NOT_ELIGIBLE) names none.
+  // refusal of the teams themselves (isTeamRefusal) names none.
   const model = teamModel(discovery?.standalone === true ? null : discovery?.workspace ?? null, prepared?.local ?? found.local, { workspaceKey: discovery?.key ?? null });
-  const teamKey = soulKeyOf(soulEntry);
+  const teamKey = teamKeyOf(soulEntry);
   let teams = res?.teams ?? null, defaultTeam = res ? res.defaultTeam ?? null : null;
-  if (!res) { try { const t = soulTeams(model, teamKey); teams = reportRows(t.teams); defaultTeam = t.defaultTeam; } catch (e) { if (!String(e?.code).startsWith("E_TEAM_")) throw e; } }
+  if (!res) { try { const t = soulTeams(model, teamKey); teams = reportRows(t.teams); defaultTeam = t.defaultTeam; } catch (e) { if (!isTeamRefusal(e)) throw e; } }
   // The soul being asked about is materialised as a spawn would (ensureWorkspaceSoul: idempotent per
   // commit, never touching a directory an instance links), so its checks always get OATS_SOUL; only a
   // spawn wrote the per-commit copy before, and a provider asked about a soul not yet spawned at this
@@ -181,7 +184,7 @@ export async function soulTarget(contextDir, soul, { remoteOptions } = {}) {
   // Feature launch-preference: what a spawn with no flags would launch here.
   let launchConfigs = {};
   try { launchConfigs = launchConfigsAt(deployment); } catch { launchConfigs = {}; }
-  const launch = launchReportFor({ layers: prepared?.launch ?? launchLayers({ definition: soulEntry.definition, entry: soulEntry, key: teamKey, local: found.local }), launchConfigs, contextDir: deployment });
+  const launch = launchReportFor({ layers: prepared?.launch ?? launchLayers({ definition: soulEntry.definition, entry: soulEntry, key: soulKeyOf(soulEntry), local: found.local }), launchConfigs, contextDir: deployment });
   return {
     kind: "soul", home: null, meta: null, deployment, agentsRoot: join(deployment, "agents"), teams, defaultTeam, teamsSource: "live", teamModel: model, teamKey, launch, session: newSessionDefaults(deployment),
     subject: { kind: "soul", soul: soulEntry.name, repoKey: soulEntry.repoKey ?? null, commit: soulEntry.commit ?? null },
@@ -281,7 +284,7 @@ export function inspectDocument(t, { kernel }) {
  *  `required: false`. A home also compares its spawn-time default with the live one. */
 function teamItems(t) {
   if (!t.teamModel) return [];
-  const problems = teamProblems(t.teamModel, { key: t.teamKey, messaging: !!t.slots?.messaging });
+  const problems = teamProblems(t.teamModel, { key: t.teamKey, messaging: !!t.slots?.messaging, soulKeys: t.discovery ? discoveredTeamKeys(t.discovery) : null });
   const same = (a, b) => (a?.label ?? null) === (b?.label ?? null) && (a?.team ?? null) === (b?.team ?? null);
   if (t.home && t.teamsSource === "live" && t.meta?.defaultTeam !== undefined && !same(t.recordedDefaultTeam, t.defaultTeam)) {
     problems.push({ code: "default-team-changed", severity: "warning", recorded: t.recordedDefaultTeam, current: t.defaultTeam,
@@ -408,7 +411,7 @@ export const PROVIDER_CHECK_BUDGET_MS = 60_000;
 export async function readinessDocument(t, { selector = null, remoteOptions, catalog = null, budgetMs = PROVIDER_CHECK_BUDGET_MS } = {}) {
   const installed = [], configured = [], member = [], providers = [];
   const cap = (id) => ({ capability: { id } });
-  if (t.resolutionError && !TEAM_FACTS.has(t.resolutionError.code)) {
+  if (t.resolutionError && !isTeamRefusal(t.resolutionError)) {
     installed.push(item(t.soul.name, "fail", { producer: "workspace resolution", code: t.resolutionError.code, reason: t.resolutionError.message, evidence: t.resolutionError.details, remedy: "oats sync (the lock must provide every package capability the soul resolves)" }));
   }
   if (t.soul.copyError) {

package/lib/instance-resolution.mjs

@@ -21,7 +21,7 @@ import { join, resolve as resolvePath, dirname, relative, isAbsolute, sep } from
 import { oatsError } from "./errors.mjs";
 import { loadLocal, discoverWorkspace, discoverRepo, standaloneRepo, observeWorkspace } from "./workspace.mjs";
 import { resolveSoul, kernelCompatibility } from "./resolve.mjs";
-import { BY_TEAM_REMOVED, recordedTeams, reportRows, soulKeyOf, soulTeams, teamModel } from "./teams.mjs";
+import { BY_TEAM_REMOVED, isRemovedTeamKeys, isTeamRefusal, memberNameOf, recordedTeams, reportRows, soulKeyOf, soulTeams, teamKeyOf, teamModel } from "./teams.mjs";
 import { launchLayers } from "./launch-preference.mjs";
 import { declaredSettings } from "./capability-contract.mjs";
 import { materialize, moduleSkills, MODULES_DIR, SKILLS_DIR } from "./materialize.mjs";
@@ -159,6 +159,8 @@ export function disabledEntry(local, soulEntry) {
  * host; a standalone deployment has local teams only and reads none.
  * → { teams, defaultTeam, source: "live" } — or, when that cannot answer (the host is unreachable, the
  *   deployment or its teams are unreadable), the spawn-time record: { teams, defaultTeam, source: "recorded", reason }.
+ *   An oats-local.yaml still carrying the removed team keys (isRemovedTeamKeys) is thrown, never answered
+ *   from the record: the deployment must migrate before its homes act on teams again.
  * `source` travels as OATS_TEAMS_SOURCE: a provider leaves a joined team only on a `live` answer.
  */
 export async function liveTeams(home, meta, { remoteOptions, remote } = {}) {
@@ -166,7 +168,7 @@ export async function liveTeams(home, meta, { remoteOptions, remote } = {}) {
   const soul = meta?.workspace?.soul;
   // A home without a workspace soul record has nothing to resolve.
   if (!soul || typeof meta.agent !== "string") return recorded("no-workspace-soul");
-  const key = soul.package && typeof soul.qualifiedName === "string" ? soul.qualifiedName : meta.agent;
+  const key = soul.package ? teamKeyOf({ ...soul, package: soul.package.id }) : teamKeyOf({ name: meta.agent, repoKey: soul.repoKey ?? "" });
   const deployment = dirname(dirname(dirname(dirname(resolvePath(home)))));
   try {
     const found = loadLocal(deployment);
@@ -175,7 +177,10 @@ export async function liveTeams(home, meta, { remoteOptions, remote } = {}) {
     const wsObs = standalone ? null : await observeWorkspace(found.local.workspace, { remoteOptions, remote });
     const t = soulTeams(teamModel(wsObs?.workspace ?? null, found.local, { workspaceKey: wsObs?.key ?? null }), key);
     return { teams: reportRows(t.teams), defaultTeam: t.defaultTeam, source: "live" };
-  } catch (e) { return recorded(String(e?.code).startsWith("E_TEAM_") ? "invalid-teams" : "unreadable", { code: e?.code || "E_REMOTE_UNREADABLE", message: e?.message ?? String(e) }); }
+  } catch (e) {
+    if (isRemovedTeamKeys(e)) throw e;
+    return recorded(isTeamRefusal(e) ? "invalid-teams" : "unreadable", { code: e?.code || "E_REMOTE_UNREADABLE", message: e?.message ?? String(e) });
+  }
 }
 
 /** The per-commit soul cache under an agent directory: `<agentDir>/souls/<commit12>/`.
@@ -314,9 +319,7 @@ export async function ensureWorkspaceSoul(prepared, agentsRoot) {
 /** The taught member name of a repo key: the last path segment without `.git`
  *  (`github.com/northwind/platform` → `platform`). The same rule `oats onboard`
  *  and `oats sync` print (memberLabel). */
-export function memberNameOf(key) {
-  return String(key).split("/").filter(Boolean).pop()?.replace(/\.git$/i, "") || String(key);
-}
+export { memberNameOf };
 
 /** The convention path of a member's clone: `<deployment>/<member name>` — except a
  *  member called `agents`, which is cloned as `agents-repo/` because `<deployment>/agents/`

package/lib/resolve.mjs

@@ -57,7 +57,7 @@ import { readFileSync } from "node:fs";
 import { posix } from "node:path";
 import { oatsError as baseOatsError } from "./errors.mjs";
 import * as defaultRemote from "./remote.mjs";
-import { BY_TEAM_REMOVED, reportRows, soulKeyOf, soulTeams, teamModel } from "./teams.mjs";
+import { BY_TEAM_REMOVED, reportRows, soulTeams, teamKeyOf, teamModel } from "./teams.mjs";
 import { bindRemote, packageProviding, readPackageManifests, validateLock } from "./packages.mjs";
 import { settingValueProblems } from "./capability-contract.mjs";
 import { memberRowByKey } from "./workspace.mjs";
@@ -617,9 +617,10 @@ export async function resolveSoul(discovery, soulEntry, { local = null, lock = n
   assertSoulDiscovered(discovery, soulEntry);
   const definition = isObject(soulEntry.definition) ? soulEntry.definition : {};
   const soul = { name: soulEntry.name, repoKey: soulEntry.repoKey, commit: soulEntry.commit ?? null, path: soulEntry.path ?? null };
-  // Team model v2: the soul's teams HERE (the committed shared teams + oats-local.yaml). An unknown
-  // label (E_TEAM_UNKNOWN) or an ineligible souls.default (E_TEAM_NOT_ELIGIBLE) refuses the soul.
-  const soulTeamsHere = soulTeams(teamModel(discovery?.standalone === true ? null : workspace, local, { workspaceKey: discovery?.key ?? null }), soulKeyOf(soulEntry));
+  // Team model 3: the soul's teams HERE (the workspace's teams, defaultTeam and souls:, and the local teams
+  // it allows). An undeclared local default (E_TEAM_UNKNOWN) or local teams the workspace does not allow
+  // (E_WORKSPACE_SCHEMA local-teams-closed) refuse the soul.
+  const soulTeamsHere = soulTeams(teamModel(discovery?.standalone === true ? null : workspace, local, { workspaceKey: discovery?.key ?? null }), teamKeyOf(soulEntry));
 
   // Standalone: the soul's own repo only, workspace defaults unknown (decision 10).
   // What the soul turned off (feature desktop-facts): its own `off` over a lower layer, and a `<slot>: none`

package/lib/schedule.mjs

@@ -516,7 +516,7 @@ export function childEnv() {
   for (const key of [...RESERVED_LAUNCH_ENV,
     "OATS_DEPLOYMENT", "OATS_RESOLUTION", "OATS_CAPABILITY", "OATS_LAYER", "OATS_LEVEL", "OATS_META", "OATS_OPERATION",
     "OATS_REPO", "OATS_BRANCH", "OATS_WORK", "OATS_KIND", "OATS_TASK",
-    "OATS_HARNESS", "OATS_PREVIOUS_HARNESS", "OATS_RUNTIME", "OATS_PREVIOUS_RUNTIME", "OATS_RETIRE_INTENT",
+    "OATS_HARNESS", "OATS_PREVIOUS_HARNESS", "OATS_RUNTIME", "OATS_PREVIOUS_RUNTIME", "OATS_LAUNCH_PREVIEW", "OATS_RETIRE_INTENT",
     "OATS_TEAM_NAME", "OATS_TEAM_SCOPE", "OATS_TEAM_ID", "OATS_TEAM_LABEL", "OATS_TEAM_LABELS", "OATS_DEFAULT_TEAM", "OATS_DEFAULT_TEAM_ID", "OATS_DEFAULT_TEAM_FROM", "OATS_TEAMS", "OATS_TEAMS_SOURCE", "OATS_TRIGGER_EVENT_FILE",
   ]) delete env[key];
   return env;

package/lib/teams-verbs.mjs

@@ -1,18 +1,21 @@
 /**
- * The team model v2 verbs (docs/desktop-cli-api.md, `oats teams`, `oats soul teams`): CONFIG ONLY — they
- * never call a provider. Each reads the deployment's oats-local.yaml and the committed shared teams, and a
- * mutation rewrites oats-local.yaml in place (comments and every other key kept), after validating the
- * result: the local schema, and no label reference the write would leave unknown or ineligible.
+ * The team model 3 verbs (docs/desktop-cli-api.md, `oats teams`, `oats soul teams`): CONFIG ONLY — they
+ * never call a provider. Each reads the deployment's oats-local.yaml and the committed workspace file. The
+ * mutations (`oats teams add|remove|default`) edit the deployment's LOCAL teams and default, so they run only
+ * where the workspace allows local teams (`localTeams: true`, or the standalone view); they rewrite
+ * oats-local.yaml in place (comments and every other key kept), after validating the result: the local
+ * schema, and no label reference the write would leave unknown. A soul's teams are the workspace's
+ * `souls:`, edited by a PR to that file: `oats soul teams` only reads them.
  */
 import { readFileSync } from "node:fs";
 import YAML from "yaml";
 import { parseConfigData } from "./config-data.mjs";
 import { oatsError } from "./errors.mjs";
 import { validateLocal } from "./workspace.mjs";
-import { LOCAL_FILE, TEAM_ID_RE, pointerKey, soulTeams, teamModel, teamProblems, teamReferences } from "./teams.mjs";
+import { TEAM_ID_RE, localTeamsClosed, soulTeams, teamModel, teamProblems, teamReferences } from "./teams.mjs";
 import { writeFileAtomic } from "./packages.mjs";
 
-export const TEAMS_API = 1, SOUL_TEAMS_API = 1;
+export const TEAMS_API = 2, SOUL_TEAMS_API = 2;
 const LABEL_RE = /^[a-z0-9][a-z0-9._-]*$/;
 const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const byCodepoint = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
@@ -21,44 +24,46 @@ function fail(code, message, details) { const e = oatsError(code, message, detai
 /** Whether a messaging layer is active in this deployment: the workspace fills the messaging slot. */
 const messagingActive = (workspace) => isObject(workspace?.defaults?.messaging);
 
-/** `oats teams --json`. `ctx`: { deployment, local, workspace (the committed file, or null), workspaceKey }. */
+/** The default a soul without a `souls:` default gets here: the local one (where local teams are allowed),
+ *  else the workspace's → DefaultTeam | null. */
+function deploymentDefault(model) {
+  const [label, from] = model.localDefault !== null && model.labels.has(model.localDefault) ? [model.localDefault, "deployment"]
+    : model.workspaceDefault !== null ? [model.workspaceDefault, "workspace"] : [null, null];
+  return label === null || !model.labels.has(label) ? null : { label, team: model.labels.get(label).team, from };
+}
+
+/** `oats teams --json`. `ctx`: { deployment, local, workspace (the committed file, or null: standalone), workspaceKey,
+ *  soulKeys (the discovered souls' keys, for the `team-soul-unknown` typo guard; null when not known) }. */
 export function teamsDocument(ctx) {
   const model = teamModel(ctx.workspace, ctx.local, { workspaceKey: ctx.workspaceKey });
+  const def = deploymentDefault(model);
   const teams = [...model.labels.values()].sort((a, b) => byCodepoint(a.label, b.label))
-    .map((d) => ({ label: d.label, team: d.team, description: d.description, from: d.from, default: d.label === model.defaultTeam, at: d.at }));
+    .map((d) => ({ label: d.label, team: d.team, description: d.description, from: d.from, default: d.label === def?.label, at: d.at }));
   return {
-    teamsApi: TEAMS_API, deployment: ctx.deployment, defaultTeam: model.defaultTeam, teams,
-    souls: { teams: structuredClone(model.souls.teams), default: structuredClone(model.souls.default) },
-    problems: teamProblems(model, { messaging: messagingActive(ctx.workspace) }),
+    teamsApi: TEAMS_API, deployment: ctx.deployment, localTeams: model.localTeams, defaultTeam: def, teams,
+    souls: structuredClone(model.souls),
+    problems: teamProblems(model, { messaging: messagingActive(ctx.workspace), soulKeys: ctx.soulKeys ?? null }),
   };
 }
 
-/** `oats soul teams <soul>|'*' --json`: `key` is the soul's key ("*" for every soul), `soul` its name. */
+/** `oats soul teams <soul>|'*' --json`: `key` is the soul's key (teamKeyOf; "*" for the "*" pattern), `soul` its name. */
 export function soulTeamsDocument(ctx, { soul, key }) {
-  const model = teamModel(ctx.workspace, ctx.local, { workspaceKey: ctx.workspaceKey });
-  const t = soulTeams(model, key);
-  const list = (v) => (Array.isArray(v) ? [...v] : []);
-  return {
-    soulTeamsApi: SOUL_TEAMS_API, soul, key, defaultTeam: t.defaultTeam, teams: t.teams,
-    local: { teams: list(model.souls.teams[key]), default: key === "*" ? null : model.souls.default[key] ?? null },
-    all: list(model.souls.teams["*"]),
-  };
+  const t = soulTeams(teamModel(ctx.workspace, ctx.local, { workspaceKey: ctx.workspaceKey }), key);
+  return { soulTeamsApi: SOUL_TEAMS_API, soul, key, match: t.match, defaultMatch: t.defaultMatch, defaultTeam: t.defaultTeam, teams: t.teams };
 }
 
 /* ───────────────────────────── writing oats-local.yaml ─────────────────── */
 
 const clone = (v) => (v === undefined ? undefined : structuredClone(v));
-/** The four team keys of a local value, as plain data. */
+/** The two team keys of a local value, as plain data. */
 const teamState = (local) => ({
   teams: clone(isObject(local?.teams) ? local.teams : {}),
   defaultTeam: typeof local?.defaultTeam === "string" ? local.defaultTeam : null,
-  soulsTeams: clone(isObject(local?.souls?.teams) ? local.souls.teams : {}),
-  soulsDefault: clone(isObject(local?.souls?.default) ? local.souls.default : {}),
 });
 const modelOf = (ctx, local) => teamModel(ctx.workspace, local, { workspaceKey: ctx.workspaceKey });
-/** The refusals a state carries (unknown / ineligible references), keyed so a write can tell new ones. */
+/** The refusals a state carries (unknown references), keyed so a write can tell new ones. */
 const refusals = (ctx, local) => new Map(teamProblems(modelOf(ctx, local))
-  .filter((p) => p.code === "E_TEAM_UNKNOWN" || p.code === "E_TEAM_NOT_ELIGIBLE").map((p) => [`${p.code} ${p.at}`, p]));
+  .filter((p) => p.code === "E_TEAM_UNKNOWN").map((p) => [`${p.code} ${p.at}`, p]));
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 const readLocal = (ctx) => {
   const text = readFileSync(ctx.localPath, "utf8");
@@ -69,8 +74,7 @@ const readLocal = (ctx) => {
 
 /**
  * Edit `doc` from `before` to `next` SURGICALLY: only the entries that change are touched, so comments and
- * styles on everything else (inline comments on sibling entries, flow sequences) are kept. A map or list
- * left empty is removed, and so is an empty `souls`.
+ * styles on everything else (inline comments on sibling entries) are kept. A map left empty is removed.
  */
 function applyState(doc, before, next) {
   const map = (path, from, to, entry) => {
@@ -86,16 +90,6 @@ function applyState(doc, before, next) {
     for (const [k, v] of Object.entries(now)) if (!same(was[k], v)) doc.setIn([...path, k], v);
   });
   if (next.defaultTeam !== before.defaultTeam) { if (next.defaultTeam === null) doc.deleteIn(["defaultTeam"]); else doc.setIn(["defaultTeam"], next.defaultTeam); }
-  // A soul's list, item by item (its style — flow or block — and the other items' comments stay).
-  map(["souls", "teams"], before.soulsTeams, next.soulsTeams, (path, was, now) => {
-    const seq = doc.getIn(path, true);
-    if (!Array.isArray(was) || !YAML.isSeq(seq)) { doc.setIn(path, now); return; }
-    seq.items = seq.items.filter((item) => now.includes(YAML.isScalar(item) ? item.value : item));
-    for (const label of now) if (!was.includes(label)) seq.items.push(doc.createNode(label));
-  });
-  map(["souls", "default"], before.soulsDefault, next.soulsDefault, (path, _was, now) => doc.setIn(path, now));
-  const souls = doc.get("souls");
-  if (YAML.isMap(souls) && souls.items.length === 0) doc.delete("souls");
 }
 
 /**
@@ -103,14 +97,18 @@ function applyState(doc, before, next) {
  * refusal; both come from the file AS IT IS NOW (re-read here, never the command's startup snapshot), so
  * two verbs running together cannot drop each other's change: the write is compare-and-swap — when the
  * file changed after this read, the edit is redone on the new content (a few times, then E_LOCAL_CHANGED).
- * `check(local)` may refuse the result before anything is written. → { changed, local } (the value now).
+ * `verb` names the command and `writes` the keys it adds, for the refusal where the workspace does not
+ * allow local teams (local-teams-closed); a verb that only takes local teams away (`writes: null`) runs
+ * there too, since it moves the file toward what the workspace allows. → { changed, local } (the value now).
  */
-function editLocal(ctx, mutate, { check } = {}) {
+function editLocal(ctx, { verb, writes }, mutate) {
   for (let attempt = 0; attempt < 5; attempt++) {
     const { text, doc, local: current } = readLocal(ctx);
+    const model = modelOf(ctx, current);
+    if (model.localTeams === false && writes !== null) throw localTeamsClosed(writes, { verb });
     const before = teamState(current);
     const next = teamState(current);
-    mutate(next, modelOf(ctx, current));
+    mutate(next, model);
     if (same(next, before)) return { changed: false, local: current };
     applyState(doc, before, next);
     const out = doc.toString();
@@ -119,7 +117,6 @@ function editLocal(ctx, mutate, { check } = {}) {
     if (problems.length) throw fail("E_WORKSPACE_SCHEMA", `the rewritten oats-local.yaml would be invalid (${problems.map((p) => `${p.path || "/"}: ${p.message}`).join("; ")}); nothing was written`, { problems });
     const had = refusals(ctx, current);
     for (const [k, p] of refusals(ctx, local)) if (!had.has(k)) throw fail(p.code, `${p.message}; nothing was written`, Object.fromEntries(Object.entries(p).filter(([key]) => !["code", "severity", "message", "fix"].includes(key))));
-    if (check) check(local);
     if (readFileSync(ctx.localPath, "utf8") !== text) continue; // changed under us: redo on the new content
     writeFileAtomic(ctx.localPath, out);
     return { changed: true, local };
@@ -136,7 +133,7 @@ export function teamsAdd(ctx, label, { team, description } = {}) {
   assertLabel(label);
   if (typeof team !== "string" || !team.trim()) throw fail("E_BAD_ARGS", "oats teams add needs --team <provider team id>", { label });
   if (!TEAM_ID_RE.test(team.trim())) throw fail("E_BAD_ARGS", `${JSON.stringify(team)} is not a team id: it must match ${TEAM_ID_RE.source} (a letter or digit first; no whitespace or control characters; at most 256 characters)`, { label, team });
-  return editLocal(ctx, (s, model) => {
+  return editLocal(ctx, { verb: "oats teams add", writes: ["teams"] }, (s, model) => {
     if (model.labels.has(label)) {
       const from = model.labels.get(label).from;
       throw fail("E_TEAM_EXISTS", `team ${label} is already declared (${from === "shared" ? "shared, in oats-workspace.yaml" : "local, in oats-local.yaml"})${from === "local" ? ": remove it first (`oats teams remove`) to redefine it" : ""}`, { label, from });
@@ -147,9 +144,10 @@ export function teamsAdd(ctx, label, { team, description } = {}) {
   });
 }
 
-/** `oats teams remove <label>`: a LOCAL team nothing references (no cascade). */
+/** `oats teams remove <label>`: a LOCAL team nothing references (no cascade). Allowed where the workspace
+ *  does not allow local teams: removing them is the last step of committing them there. */
 export function teamsRemove(ctx, label) {
-  return editLocal(ctx, (s, model) => {
+  return editLocal(ctx, { verb: "oats teams remove", writes: null }, (s, model) => {
     if (!model.local.has(label)) {
       if (model.shared.has(label)) throw fail("E_TEAM_SHARED", `team ${label} is shared (declared in oats-workspace.yaml): it is edited by a PR to that file, never removed here`, { label, at: model.shared.get(label).at });
       throw fail("E_TEAM_UNKNOWN", `team ${JSON.stringify(label)} is not declared`, { label });
@@ -157,39 +155,15 @@ export function teamsRemove(ctx, label) {
     // A label also declared in the committed file still resolves after the local copy goes (the
     // collision's fix): its references stay valid, so only a purely local label must be unreferenced.
     const usedBy = model.shared.has(label) ? [] : teamReferences(model, label);
-    if (usedBy.length) throw fail("E_TEAM_IN_USE", `team ${label} is still referenced (${usedBy.join(", ")}): remove the references first (\`oats teams default\`, \`oats soul teams … --remove ${label}\`)`, { label, usedBy });
+    if (usedBy.length) throw fail("E_TEAM_IN_USE", `team ${label} is still referenced (${usedBy.join(", ")}): choose another default first (\`oats teams default\`)`, { label, usedBy });
     delete s.teams[label];
   });
 }
 
 /** `oats teams default <label>`: a label of either file. */
 export function teamsDefault(ctx, label) {
-  return editLocal(ctx, (s, model) => {
+  return editLocal(ctx, { verb: "oats teams default", writes: ["defaultTeam"] }, (s, model) => {
     if (!model.labels.has(label)) throw fail("E_TEAM_UNKNOWN", `team ${JSON.stringify(label)} is not declared: \`oats teams add\` it first`, { label });
     s.defaultTeam = label;
   });
 }
-
-/**
- * `oats soul teams <soul>|'*' [--add a,b] [--remove a,b] [--default <l> | --clear-default]`.
- * `key` is the soul's key ("*" for every soul). → { changed, local }.
- */
-export function soulTeamsEdit(ctx, key, { add = [], remove = [], setDefault = null, clearDefault = false } = {}) {
-  if (key === "*" && (setDefault !== null || clearDefault)) throw fail("E_BAD_ARGS", "a default is per soul: --default / --clear-default need a soul, not '*' (the deployment's default is `oats teams default`)", { soul: key });
-  if (setDefault !== null && clearDefault) throw fail("E_BAD_ARGS", "choose --default <label> or --clear-default, not both");
-  // --default must name one of the soul's teams after the write.
-  const check = setDefault === null ? undefined : (local) => {
-    try { soulTeams(modelOf(ctx, local), key); }
-    catch (e) { if (e.code === "E_TEAM_NOT_ELIGIBLE") throw fail("E_TEAM_NOT_ELIGIBLE", `${e.message}; nothing was written`, { soul: key, label: setDefault, at: `${LOCAL_FILE}#/souls/default/${pointerKey(key)}` }); throw e; }
-  };
-  return editLocal(ctx, (s, model) => {
-    for (const label of [...add, ...remove, ...(setDefault !== null ? [setDefault] : [])]) {
-      if (!model.labels.has(label)) throw fail("E_TEAM_UNKNOWN", `team ${JSON.stringify(label)} is not declared: \`oats teams add\` it first`, { label });
-    }
-    const list = Array.isArray(s.soulsTeams[key]) ? s.soulsTeams[key] : [];
-    const next = [...list.filter((l) => !remove.includes(l)), ...add.filter((l) => !list.includes(l) && !remove.includes(l))].filter((l, i, a) => a.indexOf(l) === i);
-    if (next.length) s.soulsTeams[key] = next; else delete s.soulsTeams[key];
-    if (clearDefault) delete s.soulsDefault[key];
-    if (setDefault !== null) s.soulsDefault[key] = setDefault;
-  }, { check });
-}