feat: resolve roster-bound packages through verified cache

docs/architecture/package-activation.md

@@ -7,9 +7,18 @@ Rollback restores the exact pointers, deletes the pilot version and startup scri
 ## Last-known-good resolution
 
 Each activated version retains its validated package manifest alongside its payload.
-`LocalPackageStore.ResolveAsync` revalidates the manifest, package identity/product
-compatibility, entry payload and every payload SHA-256 before returning a local
-version. It returns current first. Only when current is invalid and the caller
-explicitly permits offline fallback can it return previous. It never reads or
-executes a package from DFS, and a failed or corrupted update never becomes
-last-known-good.
+`PackageResolutionUseCase` receives an explicit roster requirement: package ID,
+product/year/architecture, channel, exact version, roster identity and offline
+policy. On an online acquisition it stages locally, binds that requirement to the
+activated version, then revalidates through `LocalPackageStore.ResolveAsync`.
+
+The resolver checks manifest, binding, identity/product compatibility, entry and
+all payload lengths/SHA-256 before returning a local version. It returns current
+first. Only when current is invalid and the requirement explicitly permits offline
+fallback can it return previous. A cache entry with another roster, channel or
+version is rejected. It never reads or executes a package from DFS, and a failed
+or corrupted update never becomes last-known-good.
+
+Resolution emits stable evidence codes: `ONLINE_PACKAGE_SELECTED`,
+`VALID_CURRENT_CACHE_SELECTED`, `PREVIOUS_LKG_SELECTED`,
+`OFFLINE_FALLBACK_DISABLED`, and `NO_SAFE_PACKAGE_AVAILABLE`.