@@ -26,8 +26,8 @@ Clause-②: yes (narrowing: a configuration whose mail or SMS settings, or the O
 - a configuration whose `email` or `sms` settings, or the `OS_EMAIL_*` / `OS_SMS_*` environment of the test process, name a transport that cannot deliver (`provider: 'smtp'` with no host, `resend` / `postmark` with no API key, an unknown provider tag) is refused with the reader's own remedy. Set `OS_EMAIL_PROVIDER=log` / `OS_SMS_PROVIDER=log` in the test environment if it is not meant to send mail or SMS;
 - an `analyticsCubes` entry the analytics service refuses (a cube over an object the API does not serve) fails the boot with the analytics service's own refusal, where the cubes were never handed to it.
 
-**`@objectstack/core`** exports the rule both boots read: `resolveServedCapabilities` (which capability tokens a served boot mounts providers for — the declared `requires`, `email` for a declared `auth`, the host's own defaults, the always-on slate unless the preset is `minimal`, and `job` / `queue` ahead of what schedules background work) and `resolveCapabilityArgument` (what each provider is constructed with), with their `ServedCapabilities`, `CapabilityArgumentInput` and `CapabilityArgument` types; and `resolveStorageCapabilityArg`, `resolveStorageLocalRootEnv` and `StorageCapabilityArg`, moved here from the CLI.
+**`@objectstack/core`** exports the rule both boots read: `resolveServedCapabilities` (given the tokens a stack declares, which capability tokens a served boot mounts providers for — those, `email` for a declared `auth`, the host's own defaults, the always-on slate unless the preset is `minimal`, and `job` / `queue` ahead of what schedules background work) and `resolveCapabilityArgument` (what each provider is constructed with), with their `ServedCapabilities`, `CapabilityArgumentInput` and `CapabilityArgument` types; and `resolveStorageCapabilityArg`, `resolveStorageLocalRootEnv` and `StorageCapabilityArg`, moved here from the CLI.
 
 **`@objectstack/plugin-email`** exports `resolveEmailCapabilityArg`, `resolveDeploymentAppName` and `EmailCapabilityArg`, and **`@objectstack/service-sms`** exports `resolveSmsCapabilityArg` and `SmsCapabilityArg` — the readers that build each provider from the deployment's configuration, moved from the CLI to sit beside the transport vocabulary they refuse against. `resolveCapabilityArgument` reads each off the provider module it is handed.
 
-**`@objectstack/cli`**: `serve` reads both rules from `@objectstack/core` and composes exactly what it composed before. `os verify` boots through `bootStack`, so it now mounts the always-on slate and builds the providers from the app's configuration. The moved functions stay importable from the `serve` command module.
+**`@objectstack/cli`**: `serve` reads both rules from `@objectstack/core` and composes exactly what it composed before. `os migrate plan` / `apply`'s declaration boot reads the same token rule for the providers it composes (the same set as before; a declared `auth` now places `email` right after the declared tokens, as `serve` does). `os verify` boots through `bootStack`, so it now mounts the always-on slate and builds the providers from the app's configuration. The moved functions stay importable from the `serve` command module.
@@ -117,6 +117,7 @@ import {
   stackDeclaresMetadata,
   bundleDeclaresTranslations,
   resolveStackCollection,
+  stackDeclaredCapabilities,
   stackBootPlugins,
 } from '../utils/stack-collections.js';
 import { redactConnectionUrl, describeDriverConnection, describeDriverSqliteFile } from '../utils/connection-display.js';
@@ -2700,10 +2701,11 @@ export default class Serve extends Command {
       // instance wins over the auto-loader).
       const presetName = flags.preset ?? (isDev ? 'default' : 'default');
       // [#22301] WHICH tokens a served boot mounts providers for is ONE rule,
-      // `resolveServedCapabilities` (`@objectstack/core`), read by this command
-      // and by `@objectstack/verify`'s `bootStack`, so an app's tests mount the
-      // services its users' server mounts. In its order: the tokens the stack
-      // declares (`stackDeclaredCapabilities` — the top-level list, otherwise
+      // `resolveServedCapabilities` (`@objectstack/core`), read by this command,
+      // by `@objectstack/verify`'s `bootStack` and by `os migrate plan`'s
+      // declaration boot, so an app's tests mount the services its users'
+      // server mounts. In its order: the tokens the stack declares, as
+      // `stackDeclaredCapabilities` reads them (the top-level list, otherwise
       // each package body's, #22288), deduplicated; `email` when `auth` is
       // declared; the host defaults below; the always-on slate
       // (`Serve.ALWAYS_ON_CAPABILITIES`) unless `--preset minimal`; and `job`
@@ -2735,7 +2737,7 @@ export default class Serve extends Command {
       const hostDefaults: string[] = [];
       if (isMcpServerEnabled()) hostDefaults.push('mcp');
       if (stampSearchPinyinEnabled((config as any).i18n)) hostDefaults.push('pinyin-search');
-      const served = resolveServedCapabilities(config, { preset: presetName, hostDefaults });
+      const served = resolveServedCapabilities(stackDeclaredCapabilities(config), { preset: presetName, hostDefaults });
       const requires: string[] = [...served.tokens];
       const declaredRequires: ReadonlySet<string> = served.declared;
       // Capability → tier: any capability that is gated by a tier
 
@@ -61,6 +61,7 @@ import {
   providesCapability,
   resolveAuthSecret,
   resolvePlatformAuthComposition,
+  resolveServedCapabilities,
   resolveStackTiers,
 } from '@objectstack/core';
 import { createStandaloneStack } from '@objectstack/runtime';
@@ -110,6 +111,9 @@ const STEPS: readonly Step[] = [
       stackDeclaresMetadata,
       resolveStackCollection,
       stackDeclaredCapabilities,
+      // [#22301] Which tokens get a provider — the declared ones, `email` for
+      // `auth`, the always-on slate, `job` / `queue` ahead — read by both boots.
+      resolveServedCapabilities,
       stampSearchPinyinEnabled,
       providesCapability,
     ],
@@ -156,6 +160,11 @@ const SERVE_ONLY: Record<string, string> = {
   stackSuppliesAuthPlugin:
     'serve\'s own "is an AuthPlugin already composed" read ahead of its auth block; the auth-family gate '
     + '(resolvePlatformAuthComposition, called by both boots) asks the same predicate first',
+  resolveCapabilityArgument:
+    'what serve constructs each capability provider WITH (the app\'s cubes, its mail and SMS configuration, '
+    + 'the storage root; [#22301], shared with @objectstack/verify\'s bootStack): the declaration boot constructs '
+    + 'each provider for its declarations only, with a measured posture per token '
+    + '(DECLARATION_PROVIDER_POSTURES), and runs no start() that would read a configuration',
   findSqlDriverForKernel:
     'the artifact boot migration gate, a kernel:ready hook over a booted kernel — a serving-boot policy that '
     + 'runs after preparation, not a step that shapes what is prepared',
 
@@ -1864,12 +1864,17 @@ async function materializeHostPlugins(
  *    host plugins, so a config's own instance of the same name supersedes it.
  *  - **The capability providers** (`serve` 5): the stack's `requires`, read by
  *    `serve`'s rule (a host config's own; otherwise the compiled artifact's when
- *    it declares any; otherwise the config's), plus the always-on slate every
- *    served boot mounts (`PLATFORM_ALWAYS_ON_CAPABILITIES`, `@objectstack/spec`)
- *    — looked up in `CAPABILITY_PROVIDERS` and skipped when already held, by
- *    `providesCapability`'s exact identity match (`@objectstack/core`). The
+ *    it declares any; otherwise the config's), expanded by the rule `serve`
+ *    and `@objectstack/verify`'s `bootStack` read — `resolveServedCapabilities`
+ *    (`@objectstack/core`, #22301): `email` for a declared `auth`, the
+ *    always-on slate every served boot mounts (`PLATFORM_ALWAYS_ON_CAPABILITIES`,
+ *    `@objectstack/spec`), `job` / `queue` ahead of what schedules background
+ *    work — looked up in `CAPABILITY_PROVIDERS` and skipped when already held,
+ *    by `providesCapability`'s exact identity match (`@objectstack/core`). The
  *    slate is `serve`'s with no `--preset`: these commands take no preset, as
- *    they take no `--dev`.
+ *    they take no `--dev`; and no host default (MCP, pinyin search), as
+ *    `bootStack` passes none. Each provider is still constructed for its
+ *    declarations only (below), never from the deployment's configuration.
  *  - **The REST API plugin**, which `serve` composes on every boot and whose
  *    `init()` declares `sys_import_job` (#22202).
  *
@@ -1902,8 +1907,7 @@ async function composeServedPlatform(input: {
   artifactRequires?: readonly string[];
   packageRoot: string;
 }): Promise<{ authFamily: unknown[]; plugins: unknown[]; notes: string[] }> {
-  const { CAPABILITY_PROVIDERS, providesCapability } = await import('@objectstack/core');
-  const { PLATFORM_ALWAYS_ON_CAPABILITIES } = await import('@objectstack/spec/kernel');
+  const { CAPABILITY_PROVIDERS, providesCapability, resolveServedCapabilities } = await import('@objectstack/core');
   const config = input.config ?? {};
   // `serve`'s `requires` — the rule {@link composeAuthGatedSecurity} states.
   const requires = !isHostConfig(config) && Array.isArray(input.artifactRequires)
@@ -1954,7 +1958,7 @@ async function composeServedPlatform(input: {
     }
     return composeProviderForDeclarations(new Ctor() as object);
   };
-  for (const token of [...new Set([...requires, ...PLATFORM_ALWAYS_ON_CAPABILITIES])]) {
+  for (const token of resolveServedCapabilities(requires).tokens) {
     const spec = CAPABILITY_PROVIDERS[token];
     // A tier token (`auth`, `ui`, `i18n`, `ai`) or one no open package
     // provides mounts nothing in `serve`'s resolver either.
 
@@ -12,6 +12,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 import { composeStacks, defineStack } from '@objectstack/spec';
 import { PLATFORM_ALWAYS_ON_CAPABILITIES } from '@objectstack/spec/kernel';
 import { resolveCapabilityArgument, resolveServedCapabilities } from './capability-composition.js';
+import { stackDeclaredCapabilities } from './stack-collections.js';
 
 const SLATE = [...PLATFORM_ALWAYS_ON_CAPABILITIES];
 
@@ -38,50 +39,50 @@ const twoPackages = (svcExtra: Record<string, unknown>): Record<string, unknown>
 
 describe('resolveServedCapabilities — which tokens a served boot mounts', () => {
   it('an app that declares nothing gets the always-on slate, in the slate\'s order', () => {
-    const served = resolveServedCapabilities({});
+    const served = resolveServedCapabilities([]);
     // Anti-vacuity: the slate is the spec's, and it is not empty.
     expect(SLATE.length).toBeGreaterThan(0);
     expect(served.tokens).toEqual(SLATE);
     expect([...served.declared]).toEqual([]);
   });
 
   it('the declared tokens come first, deduplicated, and a slate member declared is not repeated', () => {
-    const served = resolveServedCapabilities({ requires: ['automation', 'cache', 'automation'] });
+    const served = resolveServedCapabilities(['automation', 'cache', 'automation']);
     expect(served.tokens.slice(0, 2)).toEqual(['automation', 'cache']);
     expect(served.tokens.filter((token) => token === 'cache')).toEqual(['cache']);
     expect(served.tokens.slice(2)).toEqual(SLATE.filter((token) => token !== 'cache'));
     expect([...served.declared]).toEqual(['automation', 'cache']);
   });
 
   it('`--preset minimal` mounts no slate — only what the stack declares', () => {
-    expect(resolveServedCapabilities({ requires: ['automation'] }, { preset: 'minimal' }).tokens).toEqual(['automation']);
+    expect(resolveServedCapabilities(['automation'], { preset: 'minimal' }).tokens).toEqual(['automation']);
     // Control: any other preset name keeps the slate.
-    expect(resolveServedCapabilities({ requires: ['automation'] }, { preset: 'default' }).tokens).toEqual([
+    expect(resolveServedCapabilities(['automation'], { preset: 'default' }).tokens).toEqual([
       'automation',
       ...SLATE,
     ]);
   });
 
   it('a declared `auth` brings `email`, and `job` / `queue` move ahead of what schedules background work', () => {
-    const served = resolveServedCapabilities({ requires: ['auth'] }, { preset: 'minimal' });
+    const served = resolveServedCapabilities(['auth'], { preset: 'minimal' });
     expect(served.tokens).toEqual(['job', 'queue', 'auth', 'email']);
     // `email` was appended by the platform, not declared by the stack.
     expect([...served.declared]).toEqual(['auth']);
     // Control: nothing that schedules background work, nothing moved.
-    expect(resolveServedCapabilities({ requires: ['automation'] }, { preset: 'minimal' }).tokens).toEqual(['automation']);
+    expect(resolveServedCapabilities(['automation'], { preset: 'minimal' }).tokens).toEqual(['automation']);
   });
 
   it('the host defaults land after the declared tokens and before the slate', () => {
-    const served = resolveServedCapabilities({ requires: ['automation'] }, { hostDefaults: ['mcp', 'pinyin-search'] });
+    const served = resolveServedCapabilities(['automation'], { hostDefaults: ['mcp', 'pinyin-search'] });
     expect(served.tokens).toEqual(['automation', 'mcp', 'pinyin-search', ...SLATE]);
     expect(served.declared.has('mcp')).toBe(false);
   });
 
-  it('a package body\'s `requires` is read when the top level carries none', () => {
+  it('a package body\'s `requires`, as `stackDeclaredCapabilities` reads it for the boots, is what the rule mounts', () => {
     const stack = twoPackages({ requires: ['approvals'] });
     // Anti-vacuity: the producer really left `requires` out of the top level.
     expect(stack.requires).toBeUndefined();
-    const served = resolveServedCapabilities(stack, { preset: 'minimal' });
+    const served = resolveServedCapabilities(stackDeclaredCapabilities(stack), { preset: 'minimal' });
     expect(served.tokens).toEqual(['job', 'queue', 'approvals']);
     expect([...served.declared]).toEqual(['approvals']);
   });
 
@@ -58,7 +58,7 @@
 import { PLATFORM_ALWAYS_ON_CAPABILITIES } from '@objectstack/spec/kernel';
 import { readEnvWithDeprecation } from '@objectstack/types';
 import { CAPABILITY_PROVIDERS } from './capability-providers.js';
-import { resolveStackCollection, stackDeclaredCapabilities } from './stack-collections.js';
+import { resolveStackCollection } from './stack-collections.js';
 
 type Bag = Record<string, unknown>;
 
@@ -70,7 +70,7 @@ export interface ServedCapabilities {
   /** Every token, deduplicated, in the order a served boot mounts its provider. */
   readonly tokens: readonly string[];
   /**
-   * The tokens the stack itself declares in `requires` — the "required" intent
+   * The tokens the stack itself declares — the "required" intent
    * (#1597): under `serve` a declared token whose provider cannot be provided
    * is a hard boot error, where a token the platform appended is best-effort.
    */
@@ -84,12 +84,17 @@ export interface ServedCapabilities {
 const NEEDS_JOB_AND_QUEUE: readonly string[] = ['email', 'approvals', 'auth'];
 
 /**
- * The capability tokens a served boot of `stack` mounts providers for, in
- * mount order — the rule `os serve` reads, in its order:
+ * The capability tokens a served boot mounts providers for, in mount order,
+ * given the tokens the stack DECLARES — the rule `os serve` reads, in its
+ * order:
  *
- *  1. the tokens the stack declares in `requires`
- *     ({@link stackDeclaredCapabilities}: the top-level list, otherwise each
- *     package body's), deduplicated in first-seen order;
+ *  1. the declared tokens, deduplicated in first-seen order. A reader hands
+ *     them in as it reads them: `serve` and the handle by
+ *     `stackDeclaredCapabilities` (the top-level `requires`, otherwise each
+ *     package body's); `os migrate plan`'s declaration boot by the same reader,
+ *     or off a compiled artifact for a host config. Reading `requires` stays
+ *     each boot's own step, so it is ONE call shared with the other readers of
+ *     `requires`, never a second copy inside this rule;
  *  2. `email` when `auth` is declared — auth callbacks (password reset, email
  *     verification, magic link, invitation) depend on the email service, which
  *     falls back to its log transport when no provider is configured;
@@ -106,15 +111,15 @@ const NEEDS_JOB_AND_QUEUE: readonly string[] = ['email', 'approvals', 'auth'];
  * which tokens mount nothing is each reader's lookup in `CAPABILITY_PROVIDERS`.
  */
 export function resolveServedCapabilities(
-  stack: unknown,
+  declaredTokens: readonly string[],
   opts: {
     /** `serve`'s `--preset`; `minimal` mounts no slate. */
     readonly preset?: string;
     /** The host's process-level default tokens, appended before the slate. */
     readonly hostDefaults?: readonly string[];
   } = {},
 ): ServedCapabilities {
-  const tokens = [...new Set(stackDeclaredCapabilities(stack))];
+  const tokens = [...new Set(declaredTokens)];
   const declared: ReadonlySet<string> = new Set(tokens);
   if (tokens.includes('auth') && !tokens.includes('email')) tokens.push('email');
   for (const token of opts.hostDefaults ?? []) {
 
@@ -15,9 +15,10 @@
 //
 // ## What is `serve`'s, read from where `serve` reads it (`@objectstack/core`)
 //
-//   · WHICH tokens: `resolveServedCapabilities` — the tokens the app declares
-//     (the top-level `requires` when the stack carries one, otherwise each
-//     package body's), `email` for a declared `auth`, the always-on slate
+//   · WHICH tokens: `resolveServedCapabilities` over the tokens the app
+//     declares as `stackDeclaredCapabilities` reads them (the top-level
+//     `requires` when the stack carries one, otherwise each package body's) —
+//     `email` for a declared `auth`, the always-on slate
 //     (`PLATFORM_ALWAYS_ON_CAPABILITIES`), and `job` / `queue` ahead of the
 //     tokens that schedule background work. No preset: `bootStack` takes none,
 //     so the slate is always mounted, as on a `serve` with no `--preset`.
@@ -62,6 +63,7 @@ import {
   providesCapability,
   resolveCapabilityArgument,
   resolveServedCapabilities,
+  stackDeclaredCapabilities,
 } from '@objectstack/core';
 
 /** Why this boot constructs a provider, as a refusal names it. */
@@ -133,7 +135,7 @@ export async function constructServedProviders(opts: {
   held: readonly unknown[];
   packageRoot: string;
 }): Promise<unknown[]> {
-  const { tokens, declared } = resolveServedCapabilities(opts.config);
+  const { tokens, declared } = resolveServedCapabilities(stackDeclaredCapabilities(opts.config));
   const constructed: unknown[] = [];
   const all = (): unknown[] => [...opts.held, ...constructed];