diff --git a/web_field_provenance/README.rst b/web_field_provenance/README.rst
new file mode 100644
index 00000000000..674b4563124
--- /dev/null
+++ b/web_field_provenance/README.rst
@@ -0,0 +1,264 @@
+====================
+Web Field Provenance
+====================
+
+.. 
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! This file is generated by oca-gen-addon-readme !!
+   !! changes will be overwritten.                   !!
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+   !! source digest: sha256:c0e6a57f9f1fb3302bcfc4940b464ae29fdfd5116dc0cefc8e257efcb4370316
+   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+.. |badge1| image:: https://img.shields.io/badge/maturity-Beta-yellow.png
+    :target: https://odoo-community.org/page/development-status
+    :alt: Beta
+.. |badge2| image:: https://img.shields.io/badge/licence-AGPL--3-blue.png
+    :target: http://www.gnu.org/licenses/agpl-3.0-standalone.html
+    :alt: License: AGPL-3
+.. |badge3| image:: https://img.shields.io/badge/github-OCA%2Fweb-lightgray.png?logo=github
+    :target: https://github.com/OCA/web/tree/18.0/web_field_provenance
+    :alt: OCA/web
+.. |badge4| image:: https://img.shields.io/badge/weblate-Translate%20me-F47D42.png
+    :target: https://translation.odoo-community.org/projects/web-18-0/web-18-0-web_field_provenance
+    :alt: Translate me on Weblate
+.. |badge5| image:: https://img.shields.io/badge/runboat-Try%20me-875A7B.png
+    :target: https://runboat.odoo-community.org/builds?repo=OCA/web&target_branch=18.0
+    :alt: Try me on Runboat
+
+|badge1| |badge2| |badge3| |badge4| |badge5|
+
+Track and surface whether a field value was set by the user, assigned by
+a rule/cascade/integration, or is still at its default — Salesforce/
+SAP-style field provenance for Odoo.
+
+Solves the OCA-wide bug class where
+``compute=..., store=True, readonly=False`` ("computed-writable") fields
+silently overwrite manual user overrides when an upstream dependency
+changes and the compute re-fires through ``super()``. Provides:
+
+1. A persistent per-record provenance map (``_provenance``) that
+   records, for every opted-in field, **how** it got its current value.
+   Three states:
+
+   - **default** — no entry. The field is still at the value it had on
+     creation. We never stamp the default state, which keeps the JSON
+     column compact.
+   - **rule / cascade / EDI** —
+     ``{s:"r", b:<writer-id>, t:<unix>, r:<label>}``. Set by server-side
+     cascade code via ``_stamp_provenance(source="r", …)``.
+   - **user** — ``{s:"u", b:<login>, t:<unix>}``. Set by a regular user
+     write. Stamped automatically by the ORM hook.
+
+2. A reusable ``_user_set(fname)`` helper that compute methods consult
+   to gate ``super()`` on real user intent rather than chain-residual
+   values.
+3. A ``_stamp_provenance(keys, source, by, rule=None, when=None)``
+   public API for cascade methods, EDI connectors, and import loaders to
+   attribute their writes correctly.
+4. A ``_provenance_for(fname)`` helper returning the badge tooltip dict
+   (also useful as a golden-output target in tests).
+5. An OWL ``provenance_m2o`` widget that renders a small badge next to
+   opted-in fields with three icons:
+
+   - grey outline = default
+   - green cog = rule
+   - pencil = user Hovering shows the writer and timestamp. Clicking
+     promotes the value to user-anchored; the server sanitizes the
+     client payload so writer identity cannot be spoofed.
+
+This module is plumbing. To surface the badge on a specific field, set
+``track_provenance=True`` on its ``ir.model.fields`` record (see USAGE)
+and replace the view tag with ``widget="provenance_m2o"``.
+
+**Table of contents**
+
+.. contents::
+   :local:
+
+Usage
+=====
+
+1. Opt-in a field for provenance tracking
+-----------------------------------------
+
+In Settings → Technical → Database Structure → Fields, find the field
+and tick **Track Provenance**. (For fields declared in Python — most
+fields you'll want to track — the UI write is blocked by Odoo's
+base-field protection; the documented workaround is a small admin
+wizard, see ROADMAP.)
+
+Programmatically (e.g. in a ``post_init_hook`` of a downstream module):
+
+.. code:: python
+
+   self.env.cr.execute(
+       "UPDATE ir_model_fields SET track_provenance = TRUE "
+       "WHERE model = %s AND name = %s",
+       ("sale.order", "payment_term_id"),
+   )
+   self.env.registry.clear_cache()
+
+2. Preserve user values inside an override compute
+--------------------------------------------------
+
+In modules that layer overrides on Odoo core computes (e.g.
+``sale_order_type``), guard the recompute on the new helper:
+
+.. code:: python
+
+   @api.depends("type_id")
+   def _compute_payment_term_id(self):
+       # Records the user has explicitly touched are excluded from super().
+       preserved = self.filtered(lambda r: r._user_set("payment_term_id"))
+       super(SaleOrder, self - preserved)._compute_payment_term_id()
+       for order in (self - preserved).filtered("type_id.payment_term_id"):
+           order.payment_term_id = order.type_id.payment_term_id
+
+3. Attribute cascade / rule / EDI writes correctly
+--------------------------------------------------
+
+When a non-user writer (a compute cascade, an EDI inbound, an import
+loader) sets a value, call ``_stamp_provenance`` so the badge attributes
+the value to the correct source instead of the env user:
+
+.. code:: python
+
+   order._stamp_provenance(
+       ["payment_term_id"],
+       source="r",
+       by="sot.cascade",                 # stable writer identifier
+       rule="Sale Order Type cascade",   # optional human-readable label
+   )
+
+The badge will then render the green-cog (rule) icon and the hover
+tooltip will read "Set by *Sale Order Type cascade*".
+
+4. Render the badge in views
+----------------------------
+
+Replace the field's view tag:
+
+.. code:: xml
+
+   <field name="payment_term_id" widget="provenance_m2o"/>
+
+A small icon appears next to the field with three states:
+
+- **Grey outline** — *default*: field is still at its initial value. No
+  entry exists in the provenance map; the badge falls back to
+  ``record.create_date`` for the tooltip.
+- **Green cog** — *rule / cascade / EDI*: the value was set by
+  server-side logic (``_stamp_provenance`` called with ``source="r"``).
+  Tooltip names the writer.
+- **Pencil** — *user*: the user has anchored this value. Recompute
+  cascades that consult ``_user_set`` will respect it.
+
+Clicking the icon promotes the current value to user-anchored. The
+server sanitizes the click (forces ``b = env.user.login``, drops any
+client-supplied rule provenance) — there is no path for a malicious
+client to spoof the writer identity.
+
+5. Inspect provenance programmatically
+--------------------------------------
+
+.. code:: python
+
+   order._user_set("payment_term_id")        # True/False
+   order._provenance_for("payment_term_id")  # {state, label, by?, rule?, when}
+
+The dict form is what the OWL widget renders; it's also useful for
+golden-output tests of cascade flows.
+
+Known issues / Roadmap
+======================
+
+- ☐ **Opt-in wizard for base fields.** Odoo blocks
+  ``ir.model.fields.write()`` on ``state='base'`` fields, so
+  ``track_provenance`` can't be toggled from the generic technical view
+  today. Ship a small wizard (Settings → Technical → Field Provenance
+  Setup) that picks (model, field) tuples and applies the flag via a SQL
+  UPDATE + ``registry.clear_cache()``. Tests already use this bypass.
+- ☐ **provenance_selection** and **provenance_char** widget variants
+  (current MVP only ships ``provenance_m2o``).
+- ☐ Pre-commit cascade banner: intercept the onchange RPC result in the
+  OWL form controller and surface "Field X is about to change from A → B
+  because Y changed" before commit. ProseMirror ``filterTransaction`` is
+  the conceptual reference.
+- ☐ Draft-time cascade log panel (chatter-adjacent) listing every field
+  cascade with timestamp, prior value, new value, cause field.
+- ☐ Undo toast (Linear-style) — let the cascade happen, then offer a
+  6-second window to revert just the overwritten field.
+- ☐ Demo addon ``web_field_provenance_sale`` that wires ``sale.order`` +
+  ``account.move`` fields touched by ``sale_order_type`` to the widget
+  and applies the ``_user_set`` guard in the seven mirror computes.
+- ☐ Upstream RFC to Odoo S.A.: expose ``_user_set`` on the ORM base
+  class so this module becomes plumbing-only.
+- ☐ **API / EDI integration** (sub-track — separate from the MVP):
+
+  - Documented
+    ``_stamp_provenance(..., source='r', by='edi:<connector>')`` hook
+    for inbound EDI / XML-RPC writers. Connector modules call this when
+    applying values on behalf of an upstream system so the badge
+    attributes correctly.
+  - Conflict policy on re-import: when an inbound EDI rewrites a ``s=u``
+    field, decide between "preserve user (block)", "override and log
+    prior in chatter", or "override and re-stamp as ``r=edi:...``".
+    Per-integration setting.
+  - Provenance serializer ``_provenance_to_audit_dict`` for outbound
+    audit exports (UBL/Peppol BTG-65-equivalent "Originator Document
+    Reference" semantics).
+  - Bulk-import (``load()``, base_import) stamping with ``b='import'``
+    and optional batch identifier so audit can trace a row to a specific
+    import job.
+  - Benchmark JSON-column overhead at 100+ tracked fields per record;
+    consider migrating to a ``mail.tracking.value``-style external table
+    if the inline column starts dominating query costs.
+
+Bug Tracker
+===========
+
+Bugs are tracked on `GitHub Issues <https://github.com/OCA/web/issues>`_.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+`feedback <https://github.com/OCA/web/issues/new?body=module:%20web_field_provenance%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**>`_.
+
+Do not contact contributors directly about support or help with technical issues.
+
+Credits
+=======
+
+Authors
+-------
+
+* Ledoweb
+
+Contributors
+------------
+
+- Dan Kendall dkendall@ledoweb.com
+
+Maintainers
+-----------
+
+This module is maintained by the OCA.
+
+.. image:: https://odoo-community.org/logo.png
+   :alt: Odoo Community Association
+   :target: https://odoo-community.org
+
+OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.
+
+.. |maintainer-dkendall| image:: https://github.com/dkendall.png?size=40px
+    :target: https://github.com/dkendall
+    :alt: dkendall
+
+Current `maintainer <https://odoo-community.org/page/maintainer-role>`__:
+
+|maintainer-dkendall| 
+
+This module is part of the `OCA/web <https://github.com/OCA/web/tree/18.0/web_field_provenance>`_ project on GitHub.
+
+You are welcome to contribute. To learn how please visit https://odoo-community.org/page/Contribute.
diff --git a/web_field_provenance/__init__.py b/web_field_provenance/__init__.py
new file mode 100644
index 00000000000..0650744f6bc
--- /dev/null
+++ b/web_field_provenance/__init__.py
@@ -0,0 +1 @@
+from . import models
diff --git a/web_field_provenance/__manifest__.py b/web_field_provenance/__manifest__.py
new file mode 100644
index 00000000000..3a008f58ba7
--- /dev/null
+++ b/web_field_provenance/__manifest__.py
@@ -0,0 +1,27 @@
+# Copyright 2026 Ledoweb (Dan Kendall)
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html)
+{
+    "name": "Web Field Provenance",
+    "summary": "Track and surface whether a field value came from the user "
+    "or from a computed/derived default, SAP-style.",
+    "category": "Tools",
+    "version": "18.0.1.0.0",
+    "author": "Ledoweb, Odoo Community Association (OCA)",
+    "license": "AGPL-3",
+    "website": "https://github.com/OCA/web",
+    "depends": ["web"],
+    "data": [
+        "views/ir_model_fields_views.xml",
+    ],
+    "demo": [
+        "demo/web_field_provenance_demo.xml",
+    ],
+    "assets": {
+        "web.assets_backend": [
+            "web_field_provenance/static/src/**/*",
+        ],
+    },
+    "maintainers": ["dkendall"],
+    "auto_install": False,
+    "installable": True,
+}
diff --git a/web_field_provenance/demo/web_field_provenance_demo.xml b/web_field_provenance/demo/web_field_provenance_demo.xml
new file mode 100644
index 00000000000..7733a130b40
--- /dev/null
+++ b/web_field_provenance/demo/web_field_provenance_demo.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <!--
+    Demo view: opt-in `res.partner.title` to the provenance badge so the
+    widget can be visually verified against the three states (default /
+    rule / user). `parent_id` is rendered with a specialized partner-m2o
+    widget in core that can't be replaced via inheritance, so `title`
+    serves as the demo target. This is loaded only with demo data and
+    is safe to install on a production DB — the underlying field's
+    `track_provenance` flag is the real opt-in switch and is OFF until
+    set explicitly by an admin.
+    -->
+    <record id="view_partner_form_provenance_demo" model="ir.ui.view">
+        <field name="name">res.partner.form.web_field_provenance.demo</field>
+        <field name="model">res.partner</field>
+        <field name="inherit_id" ref="base.view_partner_form" />
+        <field name="arch" type="xml">
+            <field name="title" position="replace">
+                <field name="title" widget="provenance_m2o" />
+            </field>
+        </field>
+    </record>
+</odoo>
diff --git a/web_field_provenance/models/__init__.py b/web_field_provenance/models/__init__.py
new file mode 100644
index 00000000000..89ee9153d32
--- /dev/null
+++ b/web_field_provenance/models/__init__.py
@@ -0,0 +1,2 @@
+from . import base_model
+from . import ir_model_fields
diff --git a/web_field_provenance/models/base_model.py b/web_field_provenance/models/base_model.py
new file mode 100644
index 00000000000..6acf9d27967
--- /dev/null
+++ b/web_field_provenance/models/base_model.py
@@ -0,0 +1,354 @@
+# Copyright 2026 Ledoweb (Dan Kendall)
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html)
+"""Provenance machinery for computed-writable fields.
+
+Two cooperating ideas:
+
+1.  Per-field "did the user set this?" probe — `_user_set(fname)` — combining
+    the persisted provenance map with an `_origin` transactional fallback.
+    Available on every model.
+
+2.  Per-field provenance map — a JSON column `_provenance` recording, for
+    every opted-in field, *how* it got its current value:
+
+      - **No entry**       → field still at its default. Implicit. We never
+                             stamp the default state to keep the JSON small;
+                             the badge falls back to `record.create_date`.
+      - `{"s": "u", ...}`  → set by a user (login captured in `b`).
+      - `{"s": "r", ...}`  → set by a rule / cascade / integration
+                             (writer identifier in `b`, human-readable label
+                             in `r`).
+
+    Each entry also carries a unix timestamp `t`, surfaced to the OWL badge
+    so the hover tooltip can say "Set by *dkendall* 12 minutes ago" or
+    "Set by *Sale Order Type cascade* at 14:02".
+
+Only fields opted-in via `ir.model.fields.track_provenance=True` are
+stamped — keeps cost at zero for the typical record.
+
+The OWL widget consumes `_provenance` from `web_read` and renders a small
+icon next to the field; the `_provenance_for(fname)` method returns the
+tooltip dict.
+"""
+
+import json
+import time
+from datetime import datetime, timezone
+
+from odoo import api, fields, models, tools
+
+# Source short-codes, kept terse so the JSON column stays compact when
+# many fields opt in. Matches the convention in mail.tracking.value and
+# sale.order.line.extra_tax_data.
+_USER = "u"
+_RULE = "r"
+_VALID_SOURCES = (_USER, _RULE)
+
+
+class Base(models.AbstractModel):
+    _inherit = "base"
+
+    _provenance = fields.Json(
+        string="Field Provenance",
+        help="Per-field provenance map.\n"
+        "Absence of an entry means the field is still at its default. "
+        "Entries are of the form {s, b, t, r?}: "
+        "s=source ('u'=user, 'r'=rule/cascade), "
+        "b=writer identifier (login or rule id), "
+        "t=unix timestamp, "
+        "r=optional human-readable rule label.",
+        copy=False,
+    )
+
+    # ------------------------------------------------------------------
+    # Public helper API
+    # ------------------------------------------------------------------
+    def _user_set(self, fname):
+        """Return True if `fname` was set by the user, not by a default
+        or a cascade.
+
+        Resolution order:
+          1. Persisted provenance map: entry with `s == 'u'` ⇒ True.
+          2. `_origin` fallback: a NewId record whose current value
+             differs from the persisted one and is non-falsy is treated
+             as user-touched (in-form dirty bit before save).
+        """
+        self.ensure_one()
+        entry = self._provenance_entry(fname)
+        if entry.get("s") == _USER:
+            return True
+        origin = self._origin
+        if (
+            origin
+            and origin is not self
+            and self[fname]
+            and origin[fname] != self[fname]
+        ):
+            return True
+        return False
+
+    def _stamp_provenance(self, keys, *, source, by, rule=None, when=None):
+        """Public API for cascade methods and integrations.
+
+        Use this when a rule, cascade, EDI inbound, import wizard, or any
+        other non-user writer applies a value, so that the badge surface
+        can attribute the value correctly.
+
+        :param keys:  iterable of tracked field names to stamp.
+        :param source: 'u' (user) or 'r' (rule/cascade). Do not stamp the
+                       default state — its absence is informative.
+        :param by: stable string identifier of the writer. Required and
+                   non-empty. Examples:
+                     - 'sot.cascade' for sale_order_type propagation
+                     - 'edi:l10n_gr_edi' for Greek e-invoicing inbound
+                     - 'import' for bulk loaders
+                     - a user login for explicit attribution.
+        :param rule: optional human-readable label rendered in the badge
+                     tooltip ("Sale Order Type cascade").
+        :param when: optional unix timestamp; defaults to `time.time()`.
+        """
+        if source not in _VALID_SOURCES:
+            raise ValueError(
+                "_stamp_provenance: source must be 'u' or 'r' "
+                f"(absence of an entry already means default); got {source!r}"
+            )
+        if not by:
+            raise ValueError(
+                "_stamp_provenance: 'by' must be a non-empty string identifier"
+            )
+        tracked = self._field_track_set()
+        keys = [k for k in keys if k in tracked]
+        if not keys:
+            return
+        self._stamp_provenance_keys(
+            keys,
+            source=source,
+            by=by,
+            rule=rule,
+            when=when,
+        )
+
+    def _provenance_for(self, fname):
+        """Return the badge-tooltip dict for `fname`.
+
+        Shape:
+            {
+                "state":  "default" | "user" | "rule",
+                "label":  human-readable summary,
+                "by":     writer identifier (omitted for default),
+                "rule":   rule label (only for state=="rule" with `r`),
+                "when":   ISO-8601 timestamp (None if unknown),
+            }
+
+        Consumed by the OWL widget; also useful in tests for golden
+        assertions.
+        """
+        self.ensure_one()
+        entry = self._provenance_entry(fname)
+        if not entry or "s" not in entry:
+            return {
+                "state": "default",
+                "label": "Default value",
+                "when": (
+                    self.create_date.replace(tzinfo=timezone.utc).isoformat()
+                    if self.create_date
+                    else None
+                ),
+            }
+        source = entry.get("s")
+        by = entry.get("b") or "system"
+        when = entry.get("t")
+        when_iso = (
+            datetime.fromtimestamp(when, tz=timezone.utc).isoformat()
+            if isinstance(when, int | float)
+            else None
+        )
+        if source == _USER:
+            return {
+                "state": "user",
+                "by": by,
+                "label": f"Set by user {by}",
+                "when": when_iso,
+            }
+        if source == _RULE:
+            label_name = entry.get("r") or by
+            return {
+                "state": "rule",
+                "by": by,
+                "rule": entry.get("r"),
+                "label": f"Set by {label_name}",
+                "when": when_iso,
+            }
+        # Unknown source — degrade to default semantics rather than crash.
+        return {
+            "state": "default",
+            "label": "Default value",
+            "when": None,
+        }
+
+    # ------------------------------------------------------------------
+    # ORM hooks — stamp provenance on user writes
+    # ------------------------------------------------------------------
+    @api.model_create_multi
+    def create(self, vals_list):
+        records = super().create(vals_list)
+        if records._field_track_set():
+            records._stamp_provenance_from_vals(vals_list, source=_USER)
+        return records
+
+    def write(self, vals):
+        if self.env.context.get("_prov_skip"):
+            return super().write(vals)
+        # If the client supplied a `_provenance` payload (e.g. the OWL
+        # badge's optimistic click-to-anchor update), sanitize it before
+        # it hits the column. Untrusted callers must not be able to
+        # forge `b` (writer identity) or `t` (timestamp), and must not
+        # be able to claim rule provenance — only server-side cascade
+        # code can do that via `_stamp_provenance`.
+        if "_provenance" in vals and vals["_provenance"] is not None:
+            vals = dict(vals)
+            vals["_provenance"] = self._sanitize_client_provenance(vals["_provenance"])
+        tracked = self._field_track_set()
+        user_keys = [k for k in vals if k in tracked]
+        res = super().write(vals)
+        if user_keys:
+            self._stamp_provenance_keys(user_keys, source=_USER)
+        return res
+
+    def _sanitize_client_provenance(self, payload):
+        """Rewrite a client-supplied `_provenance` map so every entry is
+        attributed to the currently-authenticated user with the current
+        timestamp. Drops any `s='r'` (rule) entry — only server-side
+        cascade callers may stamp rule provenance via `_stamp_provenance`.
+
+        We keep the payload's *keys* (the field names the client wants
+        anchored) but always replace the *values* with trusted ones.
+        """
+        if not isinstance(payload, dict):
+            # Reject non-dict payloads outright rather than persist
+            # something the badge can't interpret.
+            return {}
+        login = self.env.user.login
+        now = int(time.time())
+        sanitized = {}
+        for fname, raw in payload.items():
+            # Reject obvious junk: non-string keys, unknown sources, etc.
+            if not isinstance(fname, str):
+                continue
+            if isinstance(raw, dict) and raw.get("s") == _RULE:
+                # Client cannot claim rule provenance. Skip.
+                continue
+            sanitized[fname] = {"s": _USER, "b": login, "t": now}
+        return sanitized
+
+    # ------------------------------------------------------------------
+    # Web client integration — surface _provenance alongside tracked
+    # fields. Form views in 18.0+ call web_read; the legacy read()
+    # override is kept thin for backwards compat.
+    # ------------------------------------------------------------------
+    def web_read(self, specification):
+        result = super().web_read(specification)
+        if not result or not self._field_track_set():
+            return result
+        if not any(name in self._field_track_set() for name in specification):
+            return result
+        prov_by_id = {r.id: (r._provenance or {}) for r in self}
+        for row in result:
+            row["_provenance"] = prov_by_id.get(row.get("id"), {})
+        return result
+
+    # ------------------------------------------------------------------
+    # Internals
+    # ------------------------------------------------------------------
+    @api.model
+    @tools.ormcache("self._name")
+    def _field_track_set(self):
+        """Cached set of opted-in field names on this model. Invalidated
+        when `ir.model.fields.track_provenance` toggles (see
+        ir_model_fields.py).
+        """
+        return frozenset(
+            self.env["ir.model.fields"]
+            .sudo()
+            .search(
+                [
+                    ("model", "=", self._name),
+                    ("track_provenance", "=", True),
+                ]
+            )
+            .mapped("name")
+        )
+
+    def _provenance_entry(self, fname):
+        """Return a dict-shaped entry for `fname`, normalizing the legacy
+        bare-string form (`"u"` / `"s"`) into the dict shape. Callers
+        outside this module should prefer `_provenance_for`.
+        """
+        self.ensure_one()
+        raw = (self._provenance or {}).get(fname)
+        if isinstance(raw, str):
+            # Legacy v0.1 schema — keep readable while DBs migrate.
+            return {"s": raw} if raw in _VALID_SOURCES else {}
+        return dict(raw) if raw else {}
+
+    def _stamp_provenance_from_vals(self, vals_list, source):
+        tracked = self._field_track_set()
+        for rec, vals in zip(self, vals_list, strict=False):
+            keys = [k for k in (vals or {}) if k in tracked]
+            if keys:
+                rec._stamp_provenance_keys(keys, source=source)
+
+    def _stamp_provenance_keys(self, keys, source, by=None, when=None, rule=None):
+        """Persist the stamping. One UPDATE per persistent record.
+
+        Skips records whose `id` is a `NewId` — i.e. unsaved records
+        living inside an Odoo Form / onchange cycle. Stamping those
+        would force `_provenance` into the onchange-diff result and
+        break form views that don't declare the field (which is most
+        of them — `_provenance` is consumed via `web_read` by the OWL
+        badge, not via the view spec). On the eventual save the
+        `create()` hook will stamp from `vals`, which includes the
+        cascade-resolved value — so attribution is preserved with
+        the caveat that NewId-time cascade stamps degrade to `s='u'`
+        rather than `s='r'`. Acceptable for v1; a deferred-flush
+        mechanism is the right long-term fix.
+
+        We also bypass `write()` and use raw SQL: routing through the
+        ORM would re-trigger compute chains and tracking machinery for
+        what is conceptually a metadata side-effect.
+
+        `by` defaults to `env.user.login` for user writes. For rule writes
+        the public `_stamp_provenance` already enforced a non-empty `by`,
+        so this private path shouldn't see `None`.
+        """
+        if not by:
+            by = self.env.user.login if source == _USER else "system"
+        if when is None:
+            when = int(time.time())
+        table = self._table
+        # Only stamp persistent records. NewId records show up in two
+        # paths: Form/onchange (stamping there leaks `_provenance` into
+        # the diff and trips `KeyError: '_provenance'` in views that
+        # don't declare the field — most of them) and `create()`
+        # precomputes (no row to UPDATE yet). For new-record cascade
+        # attribution, the badge degrades to the "default" state until
+        # the next persistent-record write touches the field — at which
+        # point this stamping path catches it correctly.
+        persistent = self.filtered(lambda r: isinstance(r.id, int))
+        for rec in persistent:
+            current = dict(rec._provenance or {})
+            for k in keys:
+                entry = {"s": source, "b": by, "t": when}
+                if rule:
+                    entry["r"] = rule
+                current[k] = entry
+            self.env.cr.execute(
+                f'UPDATE "{table}" SET "_provenance" = %s WHERE id = %s',
+                [json.dumps(current), rec.id],
+            )
+            # Invalidate (don't set) so the new value isn't tracked as
+            # an in-flight write — that's what makes `_provenance` show
+            # up in onchange results and breaks Form tests with
+            # `KeyError: '_provenance'`. Subsequent reads round-trip
+            # to the DB, which is fine because the field is read-rare.
+            rec.invalidate_recordset(["_provenance"])
diff --git a/web_field_provenance/models/ir_model_fields.py b/web_field_provenance/models/ir_model_fields.py
new file mode 100644
index 00000000000..c4c67c410dd
--- /dev/null
+++ b/web_field_provenance/models/ir_model_fields.py
@@ -0,0 +1,42 @@
+# Copyright 2026 Ledoweb (Dan Kendall)
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html)
+from odoo import api, fields, models
+
+
+class IrModelFields(models.Model):
+    _inherit = "ir.model.fields"
+
+    track_provenance = fields.Boolean(
+        help="Surface a badge on the web client showing whether the value "
+        "was set by the user or assigned by a computed default. "
+        "Only meaningful on computed-writable fields "
+        "(compute=..., store=True, readonly=False).",
+    )
+
+    @api.model_create_multi
+    def create(self, vals_list):
+        records = super().create(vals_list)
+        if any(v.get("track_provenance") for v in vals_list):
+            self._invalidate_track_cache(records.mapped("model"))
+        return records
+
+    def write(self, vals):
+        res = super().write(vals)
+        if "track_provenance" in vals:
+            self._invalidate_track_cache(self.mapped("model"))
+        return res
+
+    def unlink(self):
+        models_affected = self.filtered("track_provenance").mapped("model")
+        res = super().unlink()
+        if models_affected:
+            self._invalidate_track_cache(models_affected)
+        return res
+
+    def _invalidate_track_cache(self, model_names):
+        """Drop the cached `_field_track_set`. Toggling `track_provenance` is
+        a rare admin action so a full ormcache flush is acceptable; finer-
+        grained invalidation isn't worth the API-stability risk against
+        Odoo's private cache internals."""
+        if model_names:
+            self.env.registry.clear_cache()
diff --git a/web_field_provenance/pyproject.toml b/web_field_provenance/pyproject.toml
new file mode 100644
index 00000000000..4231d0cccb3
--- /dev/null
+++ b/web_field_provenance/pyproject.toml
@@ -0,0 +1,3 @@
+[build-system]
+requires = ["whool"]
+build-backend = "whool.buildapi"
diff --git a/web_field_provenance/readme/CONTRIBUTORS.md b/web_field_provenance/readme/CONTRIBUTORS.md
new file mode 100644
index 00000000000..11a61dd91cd
--- /dev/null
+++ b/web_field_provenance/readme/CONTRIBUTORS.md
@@ -0,0 +1 @@
+- Dan Kendall <dkendall@ledoweb.com>
diff --git a/web_field_provenance/readme/DESCRIPTION.md b/web_field_provenance/readme/DESCRIPTION.md
new file mode 100644
index 00000000000..8ec2de70366
--- /dev/null
+++ b/web_field_provenance/readme/DESCRIPTION.md
@@ -0,0 +1,38 @@
+Track and surface whether a field value was set by the user, assigned
+by a rule/cascade/integration, or is still at its default — Salesforce/
+SAP-style field provenance for Odoo.
+
+Solves the OCA-wide bug class where `compute=..., store=True, readonly=False`
+("computed-writable") fields silently overwrite manual user overrides
+when an upstream dependency changes and the compute re-fires through
+`super()`. Provides:
+
+1. A persistent per-record provenance map (`_provenance`) that records,
+   for every opted-in field, **how** it got its current value. Three
+   states:
+   - **default** — no entry. The field is still at the value it had on
+     creation. We never stamp the default state, which keeps the JSON
+     column compact.
+   - **rule / cascade / EDI** — `{s:"r", b:<writer-id>, t:<unix>, r:<label>}`.
+     Set by server-side cascade code via `_stamp_provenance(source="r", …)`.
+   - **user** — `{s:"u", b:<login>, t:<unix>}`. Set by a regular user
+     write. Stamped automatically by the ORM hook.
+2. A reusable `_user_set(fname)` helper that compute methods consult to
+   gate `super()` on real user intent rather than chain-residual values.
+3. A `_stamp_provenance(keys, source, by, rule=None, when=None)` public
+   API for cascade methods, EDI connectors, and import loaders to
+   attribute their writes correctly.
+4. A `_provenance_for(fname)` helper returning the badge tooltip dict
+   (also useful as a golden-output target in tests).
+5. An OWL `provenance_m2o` widget that renders a small badge next to
+   opted-in fields with three icons:
+   - grey outline = default
+   - green cog = rule
+   - pencil = user
+   Hovering shows the writer and timestamp. Clicking promotes the value
+   to user-anchored; the server sanitizes the client payload so writer
+   identity cannot be spoofed.
+
+This module is plumbing. To surface the badge on a specific field, set
+`track_provenance=True` on its `ir.model.fields` record (see USAGE) and
+replace the view tag with `widget="provenance_m2o"`.
diff --git a/web_field_provenance/readme/ROADMAP.md b/web_field_provenance/readme/ROADMAP.md
new file mode 100644
index 00000000000..4705b2a9402
--- /dev/null
+++ b/web_field_provenance/readme/ROADMAP.md
@@ -0,0 +1,39 @@
+- [ ] **Opt-in wizard for base fields.** Odoo blocks `ir.model.fields.write()`
+  on `state='base'` fields, so `track_provenance` can't be toggled from the
+  generic technical view today. Ship a small wizard
+  (Settings → Technical → Field Provenance Setup) that picks
+  (model, field) tuples and applies the flag via a SQL UPDATE +
+  `registry.clear_cache()`. Tests already use this bypass.
+- [ ] **provenance_selection** and **provenance_char** widget variants
+  (current MVP only ships `provenance_m2o`).
+- [ ] Pre-commit cascade banner: intercept the onchange RPC result in
+  the OWL form controller and surface "Field X is about to change from
+  A → B because Y changed" before commit. ProseMirror `filterTransaction`
+  is the conceptual reference.
+- [ ] Draft-time cascade log panel (chatter-adjacent) listing every
+  field cascade with timestamp, prior value, new value, cause field.
+- [ ] Undo toast (Linear-style) — let the cascade happen, then offer
+  a 6-second window to revert just the overwritten field.
+- [ ] Demo addon `web_field_provenance_sale` that wires `sale.order` +
+  `account.move` fields touched by `sale_order_type` to the widget and
+  applies the `_user_set` guard in the seven mirror computes.
+- [ ] Upstream RFC to Odoo S.A.: expose `_user_set` on the ORM base
+  class so this module becomes plumbing-only.
+- [ ] **API / EDI integration** (sub-track — separate from the MVP):
+  - Documented `_stamp_provenance(..., source='r', by='edi:<connector>')`
+    hook for inbound EDI / XML-RPC writers. Connector modules call this
+    when applying values on behalf of an upstream system so the badge
+    attributes correctly.
+  - Conflict policy on re-import: when an inbound EDI rewrites a
+    `s=u` field, decide between "preserve user (block)", "override and
+    log prior in chatter", or "override and re-stamp as `r=edi:...`".
+    Per-integration setting.
+  - Provenance serializer `_provenance_to_audit_dict` for outbound
+    audit exports (UBL/Peppol BTG-65-equivalent "Originator Document
+    Reference" semantics).
+  - Bulk-import (`load()`, base_import) stamping with `b='import'` and
+    optional batch identifier so audit can trace a row to a specific
+    import job.
+  - Benchmark JSON-column overhead at 100+ tracked fields per record;
+    consider migrating to a `mail.tracking.value`-style external table
+    if the inline column starts dominating query costs.
diff --git a/web_field_provenance/readme/USAGE.md b/web_field_provenance/readme/USAGE.md
new file mode 100644
index 00000000000..06fe1126724
--- /dev/null
+++ b/web_field_provenance/readme/USAGE.md
@@ -0,0 +1,85 @@
+## 1. Opt-in a field for provenance tracking
+
+In Settings → Technical → Database Structure → Fields, find the field
+and tick **Track Provenance**. (For fields declared in Python — most
+fields you'll want to track — the UI write is blocked by Odoo's
+base-field protection; the documented workaround is a small admin
+wizard, see ROADMAP.)
+
+Programmatically (e.g. in a `post_init_hook` of a downstream module):
+
+```python
+self.env.cr.execute(
+    "UPDATE ir_model_fields SET track_provenance = TRUE "
+    "WHERE model = %s AND name = %s",
+    ("sale.order", "payment_term_id"),
+)
+self.env.registry.clear_cache()
+```
+
+## 2. Preserve user values inside an override compute
+
+In modules that layer overrides on Odoo core computes
+(e.g. `sale_order_type`), guard the recompute on the new helper:
+
+```python
+@api.depends("type_id")
+def _compute_payment_term_id(self):
+    # Records the user has explicitly touched are excluded from super().
+    preserved = self.filtered(lambda r: r._user_set("payment_term_id"))
+    super(SaleOrder, self - preserved)._compute_payment_term_id()
+    for order in (self - preserved).filtered("type_id.payment_term_id"):
+        order.payment_term_id = order.type_id.payment_term_id
+```
+
+## 3. Attribute cascade / rule / EDI writes correctly
+
+When a non-user writer (a compute cascade, an EDI inbound, an import
+loader) sets a value, call `_stamp_provenance` so the badge attributes
+the value to the correct source instead of the env user:
+
+```python
+order._stamp_provenance(
+    ["payment_term_id"],
+    source="r",
+    by="sot.cascade",                 # stable writer identifier
+    rule="Sale Order Type cascade",   # optional human-readable label
+)
+```
+
+The badge will then render the green-cog (rule) icon and the hover
+tooltip will read "Set by *Sale Order Type cascade*".
+
+## 4. Render the badge in views
+
+Replace the field's view tag:
+
+```xml
+<field name="payment_term_id" widget="provenance_m2o"/>
+```
+
+A small icon appears next to the field with three states:
+
+* **Grey outline** — *default*: field is still at its initial value.
+  No entry exists in the provenance map; the badge falls back to
+  `record.create_date` for the tooltip.
+* **Green cog** — *rule / cascade / EDI*: the value was set by
+  server-side logic (`_stamp_provenance` called with `source="r"`).
+  Tooltip names the writer.
+* **Pencil** — *user*: the user has anchored this value. Recompute
+  cascades that consult `_user_set` will respect it.
+
+Clicking the icon promotes the current value to user-anchored. The
+server sanitizes the click (forces `b = env.user.login`, drops any
+client-supplied rule provenance) — there is no path for a malicious
+client to spoof the writer identity.
+
+## 5. Inspect provenance programmatically
+
+```python
+order._user_set("payment_term_id")        # True/False
+order._provenance_for("payment_term_id")  # {state, label, by?, rule?, when}
+```
+
+The dict form is what the OWL widget renders; it's also useful for
+golden-output tests of cascade flows.
diff --git a/web_field_provenance/static/description/index.html b/web_field_provenance/static/description/index.html
new file mode 100644
index 00000000000..39d85fb681e
--- /dev/null
+++ b/web_field_provenance/static/description/index.html
@@ -0,0 +1,603 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<meta name="generator" content="Docutils: https://docutils.sourceforge.io/" />
+<title>Web Field Provenance</title>
+<style type="text/css">
+
+/*
+:Author: David Goodger (goodger@python.org)
+:Id: $Id: html4css1.css 9511 2024-01-13 09:50:07Z milde $
+:Copyright: This stylesheet has been placed in the public domain.
+
+Default cascading style sheet for the HTML output of Docutils.
+Despite the name, some widely supported CSS2 features are used.
+
+See https://docutils.sourceforge.io/docs/howto/html-stylesheets.html for how to
+customize this style sheet.
+*/
+
+/* used to remove borders from tables and images */
+.borderless, table.borderless td, table.borderless th {
+  border: 0 }
+
+table.borderless td, table.borderless th {
+  /* Override padding for "table.docutils td" with "! important".
+     The right padding separates the table cells. */
+  padding: 0 0.5em 0 0 ! important }
+
+.first {
+  /* Override more specific margin styles with "! important". */
+  margin-top: 0 ! important }
+
+.last, .with-subtitle {
+  margin-bottom: 0 ! important }
+
+.hidden {
+  display: none }
+
+.subscript {
+  vertical-align: sub;
+  font-size: smaller }
+
+.superscript {
+  vertical-align: super;
+  font-size: smaller }
+
+a.toc-backref {
+  text-decoration: none ;
+  color: black }
+
+blockquote.epigraph {
+  margin: 2em 5em ; }
+
+dl.docutils dd {
+  margin-bottom: 0.5em }
+
+object[type="image/svg+xml"], object[type="application/x-shockwave-flash"] {
+  overflow: hidden;
+}
+
+/* Uncomment (and remove this text!) to get bold-faced definition list terms
+dl.docutils dt {
+  font-weight: bold }
+*/
+
+div.abstract {
+  margin: 2em 5em }
+
+div.abstract p.topic-title {
+  font-weight: bold ;
+  text-align: center }
+
+div.admonition, div.attention, div.caution, div.danger, div.error,
+div.hint, div.important, div.note, div.tip, div.warning {
+  margin: 2em ;
+  border: medium outset ;
+  padding: 1em }
+
+div.admonition p.admonition-title, div.hint p.admonition-title,
+div.important p.admonition-title, div.note p.admonition-title,
+div.tip p.admonition-title {
+  font-weight: bold ;
+  font-family: sans-serif }
+
+div.attention p.admonition-title, div.caution p.admonition-title,
+div.danger p.admonition-title, div.error p.admonition-title,
+div.warning p.admonition-title, .code .error {
+  color: red ;
+  font-weight: bold ;
+  font-family: sans-serif }
+
+/* Uncomment (and remove this text!) to get reduced vertical space in
+   compound paragraphs.
+div.compound .compound-first, div.compound .compound-middle {
+  margin-bottom: 0.5em }
+
+div.compound .compound-last, div.compound .compound-middle {
+  margin-top: 0.5em }
+*/
+
+div.dedication {
+  margin: 2em 5em ;
+  text-align: center ;
+  font-style: italic }
+
+div.dedication p.topic-title {
+  font-weight: bold ;
+  font-style: normal }
+
+div.figure {
+  margin-left: 2em ;
+  margin-right: 2em }
+
+div.footer, div.header {
+  clear: both;
+  font-size: smaller }
+
+div.line-block {
+  display: block ;
+  margin-top: 1em ;
+  margin-bottom: 1em }
+
+div.line-block div.line-block {
+  margin-top: 0 ;
+  margin-bottom: 0 ;
+  margin-left: 1.5em }
+
+div.sidebar {
+  margin: 0 0 0.5em 1em ;
+  border: medium outset ;
+  padding: 1em ;
+  background-color: #ffffee ;
+  width: 40% ;
+  float: right ;
+  clear: right }
+
+div.sidebar p.rubric {
+  font-family: sans-serif ;
+  font-size: medium }
+
+div.system-messages {
+  margin: 5em }
+
+div.system-messages h1 {
+  color: red }
+
+div.system-message {
+  border: medium outset ;
+  padding: 1em }
+
+div.system-message p.system-message-title {
+  color: red ;
+  font-weight: bold }
+
+div.topic {
+  margin: 2em }
+
+h1.section-subtitle, h2.section-subtitle, h3.section-subtitle,
+h4.section-subtitle, h5.section-subtitle, h6.section-subtitle {
+  margin-top: 0.4em }
+
+h1.title {
+  text-align: center }
+
+h2.subtitle {
+  text-align: center }
+
+hr.docutils {
+  width: 75% }
+
+img.align-left, .figure.align-left, object.align-left, table.align-left {
+  clear: left ;
+  float: left ;
+  margin-right: 1em }
+
+img.align-right, .figure.align-right, object.align-right, table.align-right {
+  clear: right ;
+  float: right ;
+  margin-left: 1em }
+
+img.align-center, .figure.align-center, object.align-center {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+table.align-center {
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.align-left {
+  text-align: left }
+
+.align-center {
+  clear: both ;
+  text-align: center }
+
+.align-right {
+  text-align: right }
+
+/* reset inner alignment in figures */
+div.align-right {
+  text-align: inherit }
+
+/* div.align-center * { */
+/*   text-align: left } */
+
+.align-top    {
+  vertical-align: top }
+
+.align-middle {
+  vertical-align: middle }
+
+.align-bottom {
+  vertical-align: bottom }
+
+ol.simple, ul.simple {
+  margin-bottom: 1em }
+
+ol.arabic {
+  list-style: decimal }
+
+ol.loweralpha {
+  list-style: lower-alpha }
+
+ol.upperalpha {
+  list-style: upper-alpha }
+
+ol.lowerroman {
+  list-style: lower-roman }
+
+ol.upperroman {
+  list-style: upper-roman }
+
+p.attribution {
+  text-align: right ;
+  margin-left: 50% }
+
+p.caption {
+  font-style: italic }
+
+p.credits {
+  font-style: italic ;
+  font-size: smaller }
+
+p.label {
+  white-space: nowrap }
+
+p.rubric {
+  font-weight: bold ;
+  font-size: larger ;
+  color: maroon ;
+  text-align: center }
+
+p.sidebar-title {
+  font-family: sans-serif ;
+  font-weight: bold ;
+  font-size: larger }
+
+p.sidebar-subtitle {
+  font-family: sans-serif ;
+  font-weight: bold }
+
+p.topic-title {
+  font-weight: bold }
+
+pre.address {
+  margin-bottom: 0 ;
+  margin-top: 0 ;
+  font: inherit }
+
+pre.literal-block, pre.doctest-block, pre.math, pre.code {
+  margin-left: 2em ;
+  margin-right: 2em }
+
+pre.code .ln { color: gray; } /* line numbers */
+pre.code, code { background-color: #eeeeee }
+pre.code .comment, code .comment { color: #5C6576 }
+pre.code .keyword, code .keyword { color: #3B0D06; font-weight: bold }
+pre.code .literal.string, code .literal.string { color: #0C5404 }
+pre.code .name.builtin, code .name.builtin { color: #352B84 }
+pre.code .deleted, code .deleted { background-color: #DEB0A1}
+pre.code .inserted, code .inserted { background-color: #A3D289}
+
+span.classifier {
+  font-family: sans-serif ;
+  font-style: oblique }
+
+span.classifier-delimiter {
+  font-family: sans-serif ;
+  font-weight: bold }
+
+span.interpreted {
+  font-family: sans-serif }
+
+span.option {
+  white-space: nowrap }
+
+span.pre {
+  white-space: pre }
+
+span.problematic, pre.problematic {
+  color: red }
+
+span.section-subtitle {
+  /* font-size relative to parent (h1..h6 element) */
+  font-size: 80% }
+
+table.citation {
+  border-left: solid 1px gray;
+  margin-left: 1px }
+
+table.docinfo {
+  margin: 2em 4em }
+
+table.docutils {
+  margin-top: 0.5em ;
+  margin-bottom: 0.5em }
+
+table.footnote {
+  border-left: solid 1px black;
+  margin-left: 1px }
+
+table.docutils td, table.docutils th,
+table.docinfo td, table.docinfo th {
+  padding-left: 0.5em ;
+  padding-right: 0.5em ;
+  vertical-align: top }
+
+table.docutils th.field-name, table.docinfo th.docinfo-name {
+  font-weight: bold ;
+  text-align: left ;
+  white-space: nowrap ;
+  padding-left: 0 }
+
+/* "booktabs" style (no vertical lines) */
+table.docutils.booktabs {
+  border: 0px;
+  border-top: 2px solid;
+  border-bottom: 2px solid;
+  border-collapse: collapse;
+}
+table.docutils.booktabs * {
+  border: 0px;
+}
+table.docutils.booktabs th {
+  border-bottom: thin solid;
+  text-align: left;
+}
+
+h1 tt.docutils, h2 tt.docutils, h3 tt.docutils,
+h4 tt.docutils, h5 tt.docutils, h6 tt.docutils {
+  font-size: 100% }
+
+ul.auto-toc {
+  list-style-type: none }
+
+</style>
+</head>
+<body>
+<div class="document" id="web-field-provenance">
+<h1 class="title">Web Field Provenance</h1>
+
+<!-- !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!! This file is generated by oca-gen-addon-readme !!
+!! changes will be overwritten.                   !!
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!! source digest: sha256:c0e6a57f9f1fb3302bcfc4940b464ae29fdfd5116dc0cefc8e257efcb4370316
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -->
+<p><a class="reference external image-reference" href="https://odoo-community.org/page/development-status"><img alt="Beta" src="https://img.shields.io/badge/maturity-Beta-yellow.png" /></a> <a class="reference external image-reference" href="http://www.gnu.org/licenses/agpl-3.0-standalone.html"><img alt="License: AGPL-3" src="https://img.shields.io/badge/licence-AGPL--3-blue.png" /></a> <a class="reference external image-reference" href="https://github.com/OCA/web/tree/18.0/web_field_provenance"><img alt="OCA/web" src="https://img.shields.io/badge/github-OCA%2Fweb-lightgray.png?logo=github" /></a> <a class="reference external image-reference" href="https://translation.odoo-community.org/projects/web-18-0/web-18-0-web_field_provenance"><img alt="Translate me on Weblate" src="https://img.shields.io/badge/weblate-Translate%20me-F47D42.png" /></a> <a class="reference external image-reference" href="https://runboat.odoo-community.org/builds?repo=OCA/web&amp;target_branch=18.0"><img alt="Try me on Runboat" src="https://img.shields.io/badge/runboat-Try%20me-875A7B.png" /></a></p>
+<p>Track and surface whether a field value was set by the user, assigned by
+a rule/cascade/integration, or is still at its default — Salesforce/
+SAP-style field provenance for Odoo.</p>
+<p>Solves the OCA-wide bug class where
+<tt class="docutils literal"><span class="pre">compute=...,</span> store=True, readonly=False</tt> (“computed-writable”) fields
+silently overwrite manual user overrides when an upstream dependency
+changes and the compute re-fires through <tt class="docutils literal">super()</tt>. Provides:</p>
+<ol class="arabic simple">
+<li>A persistent per-record provenance map (<tt class="docutils literal">_provenance</tt>) that
+records, for every opted-in field, <strong>how</strong> it got its current value.
+Three states:<ul>
+<li><strong>default</strong> — no entry. The field is still at the value it had on
+creation. We never stamp the default state, which keeps the JSON
+column compact.</li>
+<li><strong>rule / cascade / EDI</strong> —
+<tt class="docutils literal"><span class="pre">{s:&quot;r&quot;,</span> <span class="pre">b:&lt;writer-id&gt;,</span> <span class="pre">t:&lt;unix&gt;,</span> <span class="pre">r:&lt;label&gt;}</span></tt>. Set by server-side
+cascade code via <tt class="docutils literal"><span class="pre">_stamp_provenance(source=&quot;r&quot;,</span> …)</tt>.</li>
+<li><strong>user</strong> — <tt class="docutils literal"><span class="pre">{s:&quot;u&quot;,</span> <span class="pre">b:&lt;login&gt;,</span> <span class="pre">t:&lt;unix&gt;}</span></tt>. Set by a regular user
+write. Stamped automatically by the ORM hook.</li>
+</ul>
+</li>
+<li>A reusable <tt class="docutils literal">_user_set(fname)</tt> helper that compute methods consult
+to gate <tt class="docutils literal">super()</tt> on real user intent rather than chain-residual
+values.</li>
+<li>A <tt class="docutils literal">_stamp_provenance(keys, source, by, rule=None, when=None)</tt>
+public API for cascade methods, EDI connectors, and import loaders to
+attribute their writes correctly.</li>
+<li>A <tt class="docutils literal">_provenance_for(fname)</tt> helper returning the badge tooltip dict
+(also useful as a golden-output target in tests).</li>
+<li>An OWL <tt class="docutils literal">provenance_m2o</tt> widget that renders a small badge next to
+opted-in fields with three icons:<ul>
+<li>grey outline = default</li>
+<li>green cog = rule</li>
+<li>pencil = user Hovering shows the writer and timestamp. Clicking
+promotes the value to user-anchored; the server sanitizes the
+client payload so writer identity cannot be spoofed.</li>
+</ul>
+</li>
+</ol>
+<p>This module is plumbing. To surface the badge on a specific field, set
+<tt class="docutils literal">track_provenance=True</tt> on its <tt class="docutils literal">ir.model.fields</tt> record (see USAGE)
+and replace the view tag with <tt class="docutils literal"><span class="pre">widget=&quot;provenance_m2o&quot;</span></tt>.</p>
+<p><strong>Table of contents</strong></p>
+<div class="contents local topic" id="contents">
+<ul class="simple">
+<li><a class="reference internal" href="#usage" id="toc-entry-1">Usage</a><ul>
+<li><a class="reference internal" href="#opt-in-a-field-for-provenance-tracking" id="toc-entry-2">1. Opt-in a field for provenance tracking</a></li>
+<li><a class="reference internal" href="#preserve-user-values-inside-an-override-compute" id="toc-entry-3">2. Preserve user values inside an override compute</a></li>
+<li><a class="reference internal" href="#attribute-cascade-rule-edi-writes-correctly" id="toc-entry-4">3. Attribute cascade / rule / EDI writes correctly</a></li>
+<li><a class="reference internal" href="#render-the-badge-in-views" id="toc-entry-5">4. Render the badge in views</a></li>
+<li><a class="reference internal" href="#inspect-provenance-programmatically" id="toc-entry-6">5. Inspect provenance programmatically</a></li>
+</ul>
+</li>
+<li><a class="reference internal" href="#known-issues-roadmap" id="toc-entry-7">Known issues / Roadmap</a></li>
+<li><a class="reference internal" href="#bug-tracker" id="toc-entry-8">Bug Tracker</a></li>
+<li><a class="reference internal" href="#credits" id="toc-entry-9">Credits</a><ul>
+<li><a class="reference internal" href="#authors" id="toc-entry-10">Authors</a></li>
+<li><a class="reference internal" href="#contributors" id="toc-entry-11">Contributors</a></li>
+<li><a class="reference internal" href="#maintainers" id="toc-entry-12">Maintainers</a></li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="section" id="usage">
+<h1><a class="toc-backref" href="#toc-entry-1">Usage</a></h1>
+<div class="section" id="opt-in-a-field-for-provenance-tracking">
+<h2><a class="toc-backref" href="#toc-entry-2">1. Opt-in a field for provenance tracking</a></h2>
+<p>In Settings → Technical → Database Structure → Fields, find the field
+and tick <strong>Track Provenance</strong>. (For fields declared in Python — most
+fields you’ll want to track — the UI write is blocked by Odoo’s
+base-field protection; the documented workaround is a small admin
+wizard, see ROADMAP.)</p>
+<p>Programmatically (e.g. in a <tt class="docutils literal">post_init_hook</tt> of a downstream module):</p>
+<pre class="code python literal-block">
+<span class="bp">self</span><span class="o">.</span><span class="n">env</span><span class="o">.</span><span class="n">cr</span><span class="o">.</span><span class="n">execute</span><span class="p">(</span><span class="w">
+</span>    <span class="s2">&quot;UPDATE ir_model_fields SET track_provenance = TRUE &quot;</span><span class="w">
+</span>    <span class="s2">&quot;WHERE model = </span><span class="si">%s</span><span class="s2"> AND name = </span><span class="si">%s</span><span class="s2">&quot;</span><span class="p">,</span><span class="w">
+</span>    <span class="p">(</span><span class="s2">&quot;sale.order&quot;</span><span class="p">,</span> <span class="s2">&quot;payment_term_id&quot;</span><span class="p">),</span><span class="w">
+</span><span class="p">)</span><span class="w">
+</span><span class="bp">self</span><span class="o">.</span><span class="n">env</span><span class="o">.</span><span class="n">registry</span><span class="o">.</span><span class="n">clear_cache</span><span class="p">()</span>
+</pre>
+</div>
+<div class="section" id="preserve-user-values-inside-an-override-compute">
+<h2><a class="toc-backref" href="#toc-entry-3">2. Preserve user values inside an override compute</a></h2>
+<p>In modules that layer overrides on Odoo core computes (e.g.
+<tt class="docutils literal">sale_order_type</tt>), guard the recompute on the new helper:</p>
+<pre class="code python literal-block">
+<span class="nd">&#64;api</span><span class="o">.</span><span class="n">depends</span><span class="p">(</span><span class="s2">&quot;type_id&quot;</span><span class="p">)</span><span class="w">
+</span><span class="k">def</span><span class="w"> </span><span class="nf">_compute_payment_term_id</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span><span class="w">
+</span>    <span class="c1"># Records the user has explicitly touched are excluded from super().</span><span class="w">
+</span>    <span class="n">preserved</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">filtered</span><span class="p">(</span><span class="k">lambda</span> <span class="n">r</span><span class="p">:</span> <span class="n">r</span><span class="o">.</span><span class="n">_user_set</span><span class="p">(</span><span class="s2">&quot;payment_term_id&quot;</span><span class="p">))</span><span class="w">
+</span>    <span class="nb">super</span><span class="p">(</span><span class="n">SaleOrder</span><span class="p">,</span> <span class="bp">self</span> <span class="o">-</span> <span class="n">preserved</span><span class="p">)</span><span class="o">.</span><span class="n">_compute_payment_term_id</span><span class="p">()</span><span class="w">
+</span>    <span class="k">for</span> <span class="n">order</span> <span class="ow">in</span> <span class="p">(</span><span class="bp">self</span> <span class="o">-</span> <span class="n">preserved</span><span class="p">)</span><span class="o">.</span><span class="n">filtered</span><span class="p">(</span><span class="s2">&quot;type_id.payment_term_id&quot;</span><span class="p">):</span><span class="w">
+</span>        <span class="n">order</span><span class="o">.</span><span class="n">payment_term_id</span> <span class="o">=</span> <span class="n">order</span><span class="o">.</span><span class="n">type_id</span><span class="o">.</span><span class="n">payment_term_id</span>
+</pre>
+</div>
+<div class="section" id="attribute-cascade-rule-edi-writes-correctly">
+<h2><a class="toc-backref" href="#toc-entry-4">3. Attribute cascade / rule / EDI writes correctly</a></h2>
+<p>When a non-user writer (a compute cascade, an EDI inbound, an import
+loader) sets a value, call <tt class="docutils literal">_stamp_provenance</tt> so the badge attributes
+the value to the correct source instead of the env user:</p>
+<pre class="code python literal-block">
+<span class="n">order</span><span class="o">.</span><span class="n">_stamp_provenance</span><span class="p">(</span><span class="w">
+</span>    <span class="p">[</span><span class="s2">&quot;payment_term_id&quot;</span><span class="p">],</span><span class="w">
+</span>    <span class="n">source</span><span class="o">=</span><span class="s2">&quot;r&quot;</span><span class="p">,</span><span class="w">
+</span>    <span class="n">by</span><span class="o">=</span><span class="s2">&quot;sot.cascade&quot;</span><span class="p">,</span>                 <span class="c1"># stable writer identifier</span><span class="w">
+</span>    <span class="n">rule</span><span class="o">=</span><span class="s2">&quot;Sale Order Type cascade&quot;</span><span class="p">,</span>   <span class="c1"># optional human-readable label</span><span class="w">
+</span><span class="p">)</span>
+</pre>
+<p>The badge will then render the green-cog (rule) icon and the hover
+tooltip will read “Set by <em>Sale Order Type cascade</em>”.</p>
+</div>
+<div class="section" id="render-the-badge-in-views">
+<h2><a class="toc-backref" href="#toc-entry-5">4. Render the badge in views</a></h2>
+<p>Replace the field’s view tag:</p>
+<pre class="code xml literal-block">
+<span class="nt">&lt;field</span><span class="w"> </span><span class="na">name=</span><span class="s">&quot;payment_term_id&quot;</span><span class="w"> </span><span class="na">widget=</span><span class="s">&quot;provenance_m2o&quot;</span><span class="nt">/&gt;</span>
+</pre>
+<p>A small icon appears next to the field with three states:</p>
+<ul class="simple">
+<li><strong>Grey outline</strong> — <em>default</em>: field is still at its initial value. No
+entry exists in the provenance map; the badge falls back to
+<tt class="docutils literal">record.create_date</tt> for the tooltip.</li>
+<li><strong>Green cog</strong> — <em>rule / cascade / EDI</em>: the value was set by
+server-side logic (<tt class="docutils literal">_stamp_provenance</tt> called with <tt class="docutils literal"><span class="pre">source=&quot;r&quot;</span></tt>).
+Tooltip names the writer.</li>
+<li><strong>Pencil</strong> — <em>user</em>: the user has anchored this value. Recompute
+cascades that consult <tt class="docutils literal">_user_set</tt> will respect it.</li>
+</ul>
+<p>Clicking the icon promotes the current value to user-anchored. The
+server sanitizes the click (forces <tt class="docutils literal">b = env.user.login</tt>, drops any
+client-supplied rule provenance) — there is no path for a malicious
+client to spoof the writer identity.</p>
+</div>
+<div class="section" id="inspect-provenance-programmatically">
+<h2><a class="toc-backref" href="#toc-entry-6">5. Inspect provenance programmatically</a></h2>
+<pre class="code python literal-block">
+<span class="n">order</span><span class="o">.</span><span class="n">_user_set</span><span class="p">(</span><span class="s2">&quot;payment_term_id&quot;</span><span class="p">)</span>        <span class="c1"># True/False</span><span class="w">
+</span><span class="n">order</span><span class="o">.</span><span class="n">_provenance_for</span><span class="p">(</span><span class="s2">&quot;payment_term_id&quot;</span><span class="p">)</span>  <span class="c1"># {state, label, by?, rule?, when}</span>
+</pre>
+<p>The dict form is what the OWL widget renders; it’s also useful for
+golden-output tests of cascade flows.</p>
+</div>
+</div>
+<div class="section" id="known-issues-roadmap">
+<h1><a class="toc-backref" href="#toc-entry-7">Known issues / Roadmap</a></h1>
+<ul class="simple">
+<li>☐ <strong>Opt-in wizard for base fields.</strong> Odoo blocks
+<tt class="docutils literal">ir.model.fields.write()</tt> on <tt class="docutils literal"><span class="pre">state='base'</span></tt> fields, so
+<tt class="docutils literal">track_provenance</tt> can’t be toggled from the generic technical view
+today. Ship a small wizard (Settings → Technical → Field Provenance
+Setup) that picks (model, field) tuples and applies the flag via a SQL
+UPDATE + <tt class="docutils literal">registry.clear_cache()</tt>. Tests already use this bypass.</li>
+<li>☐ <strong>provenance_selection</strong> and <strong>provenance_char</strong> widget variants
+(current MVP only ships <tt class="docutils literal">provenance_m2o</tt>).</li>
+<li>☐ Pre-commit cascade banner: intercept the onchange RPC result in the
+OWL form controller and surface “Field X is about to change from A → B
+because Y changed” before commit. ProseMirror <tt class="docutils literal">filterTransaction</tt> is
+the conceptual reference.</li>
+<li>☐ Draft-time cascade log panel (chatter-adjacent) listing every field
+cascade with timestamp, prior value, new value, cause field.</li>
+<li>☐ Undo toast (Linear-style) — let the cascade happen, then offer a
+6-second window to revert just the overwritten field.</li>
+<li>☐ Demo addon <tt class="docutils literal">web_field_provenance_sale</tt> that wires <tt class="docutils literal">sale.order</tt> +
+<tt class="docutils literal">account.move</tt> fields touched by <tt class="docutils literal">sale_order_type</tt> to the widget
+and applies the <tt class="docutils literal">_user_set</tt> guard in the seven mirror computes.</li>
+<li>☐ Upstream RFC to Odoo S.A.: expose <tt class="docutils literal">_user_set</tt> on the ORM base
+class so this module becomes plumbing-only.</li>
+<li>☐ <strong>API / EDI integration</strong> (sub-track — separate from the MVP):<ul>
+<li>Documented
+<tt class="docutils literal"><span class="pre">_stamp_provenance(...,</span> <span class="pre">source='r',</span> <span class="pre">by='edi:&lt;connector&gt;')</span></tt> hook
+for inbound EDI / XML-RPC writers. Connector modules call this when
+applying values on behalf of an upstream system so the badge
+attributes correctly.</li>
+<li>Conflict policy on re-import: when an inbound EDI rewrites a <tt class="docutils literal">s=u</tt>
+field, decide between “preserve user (block)”, “override and log
+prior in chatter”, or “override and re-stamp as <tt class="docutils literal"><span class="pre">r=edi:...</span></tt>”.
+Per-integration setting.</li>
+<li>Provenance serializer <tt class="docutils literal">_provenance_to_audit_dict</tt> for outbound
+audit exports (UBL/Peppol BTG-65-equivalent “Originator Document
+Reference” semantics).</li>
+<li>Bulk-import (<tt class="docutils literal">load()</tt>, base_import) stamping with <tt class="docutils literal"><span class="pre">b='import'</span></tt>
+and optional batch identifier so audit can trace a row to a specific
+import job.</li>
+<li>Benchmark JSON-column overhead at 100+ tracked fields per record;
+consider migrating to a <tt class="docutils literal">mail.tracking.value</tt>-style external table
+if the inline column starts dominating query costs.</li>
+</ul>
+</li>
+</ul>
+</div>
+<div class="section" id="bug-tracker">
+<h1><a class="toc-backref" href="#toc-entry-8">Bug Tracker</a></h1>
+<p>Bugs are tracked on <a class="reference external" href="https://github.com/OCA/web/issues">GitHub Issues</a>.
+In case of trouble, please check there if your issue has already been reported.
+If you spotted it first, help us to smash it by providing a detailed and welcomed
+<a class="reference external" href="https://github.com/OCA/web/issues/new?body=module:%20web_field_provenance%0Aversion:%2018.0%0A%0A**Steps%20to%20reproduce**%0A-%20...%0A%0A**Current%20behavior**%0A%0A**Expected%20behavior**">feedback</a>.</p>
+<p>Do not contact contributors directly about support or help with technical issues.</p>
+</div>
+<div class="section" id="credits">
+<h1><a class="toc-backref" href="#toc-entry-9">Credits</a></h1>
+<div class="section" id="authors">
+<h2><a class="toc-backref" href="#toc-entry-10">Authors</a></h2>
+<ul class="simple">
+<li>Ledoweb</li>
+</ul>
+</div>
+<div class="section" id="contributors">
+<h2><a class="toc-backref" href="#toc-entry-11">Contributors</a></h2>
+<ul class="simple">
+<li>Dan Kendall <a class="reference external" href="mailto:dkendall&#64;ledoweb.com">dkendall&#64;ledoweb.com</a></li>
+</ul>
+</div>
+<div class="section" id="maintainers">
+<h2><a class="toc-backref" href="#toc-entry-12">Maintainers</a></h2>
+<p>This module is maintained by the OCA.</p>
+<a class="reference external image-reference" href="https://odoo-community.org">
+<img alt="Odoo Community Association" src="https://odoo-community.org/logo.png" />
+</a>
+<p>OCA, or the Odoo Community Association, is a nonprofit organization whose
+mission is to support the collaborative development of Odoo features and
+promote its widespread use.</p>
+<p>Current <a class="reference external" href="https://odoo-community.org/page/maintainer-role">maintainer</a>:</p>
+<p><a class="reference external image-reference" href="https://github.com/dkendall"><img alt="dkendall" src="https://github.com/dkendall.png?size=40px" /></a></p>
+<p>This module is part of the <a class="reference external" href="https://github.com/OCA/web/tree/18.0/web_field_provenance">OCA/web</a> project on GitHub.</p>
+<p>You are welcome to contribute. To learn how please visit <a class="reference external" href="https://odoo-community.org/page/Contribute">https://odoo-community.org/page/Contribute</a>.</p>
+</div>
+</div>
+</div>
+</body>
+</html>
diff --git a/web_field_provenance/static/src/provenance_badge.esm.js b/web_field_provenance/static/src/provenance_badge.esm.js
new file mode 100644
index 00000000000..d38f95e5d9f
--- /dev/null
+++ b/web_field_provenance/static/src/provenance_badge.esm.js
@@ -0,0 +1,120 @@
+/** @odoo-module **/
+
+/*
+ * Provenance Badge — Salesforce/SAP-style "where did this value come
+ * from?" indicator for Odoo.
+ *
+ * Reads `_provenance` (a JSON map of {field: {s, b, t, r?}}) from the
+ * active record and renders a small icon next to fields that opted in
+ * via `ir.model.fields.track_provenance`. Three visual states:
+ *
+ *   - default:  grey outline circle — field is still at its default
+ *               (no entry in the map).
+ *   - rule:     green cog — set by a rule / cascade / EDI integration.
+ *   - user:     pencil — set by a user write.
+ *
+ * Hover reveals the writer and timestamp ("Set by user dkendall at
+ * 2026-05-16T20:15Z", "Set by Sale Order Type cascade", etc.).
+ * Clicking the badge promotes the value to user-anchored.
+ *
+ * Usage: <field name="payment_term_id" widget="provenance_m2o"/>
+ *
+ * MVP scope: many2one only. Selection / char follow the same shape.
+ */
+import {registry} from "@web/core/registry";
+import {_t} from "@web/core/l10n/translation";
+import {Many2OneField, many2OneField} from "@web/views/fields/many2one/many2one_field";
+
+const SOURCE_USER = "u";
+const SOURCE_RULE = "r";
+
+export class ProvenanceMany2OneField extends Many2OneField {
+    static template = "web_field_provenance.ProvenanceMany2One";
+    static components = {...Many2OneField.components};
+
+    get entry() {
+        const map = this.props.record.data._provenance || {};
+        const raw = map[this.props.name];
+        if (!raw) {
+            return null;
+        }
+        // Legacy bare-string schema: normalize to dict shape.
+        if (typeof raw === "string") {
+            return {s: raw};
+        }
+        return raw;
+    }
+
+    get badgeState() {
+        // NOTE: renamed from `state` to avoid colliding with the
+        // `state` property the base `Many2OneField` sets in its
+        // setup() — JS raises `Cannot set property state of ... which
+        // has only a getter` when a subclass defines a getter without
+        // a setter and the parent class tries to write to it.
+        const e = this.entry;
+        if (!e || !e.s) {
+            return "default";
+        }
+        if (e.s === SOURCE_USER) {
+            return "user";
+        }
+        if (e.s === SOURCE_RULE) {
+            return "rule";
+        }
+        return "default";
+    }
+
+    get badgeIconClass() {
+        if (this.badgeState === "user") {
+            return "fa fa-pencil";
+        }
+        if (this.badgeState === "rule") {
+            return "fa fa-cog text-success";
+        }
+        return "fa fa-circle-o text-muted";
+    }
+
+    get badgeTitle() {
+        const e = this.entry;
+        const when = e?.t ? new Date(e.t * 1000).toLocaleString() : null;
+        if (this.badgeState === "user") {
+            return _t("Set by user %s%s", e.b || "?", when ? " at " + when : "");
+        }
+        if (this.badgeState === "rule") {
+            const label = e.r || e.b || _t("a rule");
+            return _t("Set by %s%s", label, when ? " at " + when : "");
+        }
+        return _t("Default value — set when the record was created");
+    }
+
+    onBadgeClick(ev) {
+        ev.stopPropagation();
+        ev.preventDefault();
+        const current = {...(this.props.record.data._provenance || {})};
+        // Promote to user-anchored. The `t` and `b` get filled in by the
+        // server on save (ORM write() handles user stamping); we set a
+        // sentinel here so the badge updates optimistically.
+        current[this.props.name] = {
+            s: SOURCE_USER,
+            b: this.env.services.user?.login || "user",
+            t: Math.floor(Date.now() / 1000),
+        };
+        this.props.record.update({_provenance: current});
+    }
+}
+
+export const provenanceMany2OneField = {
+    ...many2OneField,
+    component: ProvenanceMany2OneField,
+    displayName: ({string}) => string,
+    supportedOptions: many2OneField.supportedOptions,
+    // Pull `_provenance` into the record alongside the field this
+    // widget renders. Without this, `record.data._provenance` is
+    // undefined because the view spec doesn't declare the field.
+    fieldDependencies: [
+        ...(many2OneField.fieldDependencies || []),
+        {name: "_provenance", type: "json"},
+    ],
+};
+
+registry.category("fields").add("provenance_m2o", provenanceMany2OneField);
diff --git a/web_field_provenance/static/src/provenance_badge.scss b/web_field_provenance/static/src/provenance_badge.scss
new file mode 100644
index 00000000000..084085159fc
--- /dev/null
+++ b/web_field_provenance/static/src/provenance_badge.scss
@@ -0,0 +1,30 @@
+.o_provenance_field_wrapper {
+    .o_provenance_badge {
+        background: transparent;
+        border: 0;
+        line-height: 1;
+        cursor: pointer;
+        opacity: 0.55;
+        transition: opacity 0.15s ease;
+
+        &:hover {
+            opacity: 1;
+        }
+
+        i {
+            font-size: 0.85rem;
+        }
+
+        // 3-state colors keyed off the `o_provenance_<state>` class
+        // emitted by the OWL template.
+        &.o_provenance_default i {
+            color: var(--bs-secondary, #6c757d);
+        }
+        &.o_provenance_rule i {
+            color: var(--bs-success, #28a745);
+        }
+        &.o_provenance_user i {
+            color: var(--bs-primary, #714b67);
+        }
+    }
+}
diff --git a/web_field_provenance/static/src/provenance_badge.xml b/web_field_provenance/static/src/provenance_badge.xml
new file mode 100644
index 00000000000..081620a2767
--- /dev/null
+++ b/web_field_provenance/static/src/provenance_badge.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<templates xml:space="preserve">
+
+  <t t-name="web_field_provenance.ProvenanceMany2One" owl="1">
+        <div class="o_provenance_field_wrapper d-flex align-items-center">
+            <t t-call="web.Many2OneField" />
+            <button
+                class="o_provenance_badge btn btn-sm p-0 ms-1"
+                t-att-class="'o_provenance_' + badgeState"
+                t-att-title="badgeTitle"
+                t-on-click="onBadgeClick"
+                type="button"
+            >
+                <i t-att-class="badgeIconClass" />
+            </button>
+        </div>
+    </t>
+
+</templates>
diff --git a/web_field_provenance/tests/__init__.py b/web_field_provenance/tests/__init__.py
new file mode 100644
index 00000000000..d9fe20d7ed6
--- /dev/null
+++ b/web_field_provenance/tests/__init__.py
@@ -0,0 +1 @@
+from . import test_provenance
diff --git a/web_field_provenance/tests/test_provenance.py b/web_field_provenance/tests/test_provenance.py
new file mode 100644
index 00000000000..246e5981c90
--- /dev/null
+++ b/web_field_provenance/tests/test_provenance.py
@@ -0,0 +1,305 @@
+# Copyright 2026 Ledoweb (Dan Kendall)
+# License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl.html)
+import time
+
+from odoo.addons.base.tests.common import BaseCommon
+
+
+class TestProvenance(BaseCommon):
+    """Provenance stamping + `_user_set` + `_provenance_for` coverage.
+
+    Uses `res.partner.comment` as the probe field because it's
+    universally available and not driven by any compute, so we control
+    its provenance exclusively from these tests.
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        super().setUpClass()
+        cls.field_comment = cls.env["ir.model.fields"]._get("res.partner", "comment")
+        # Base fields (state='base') are protected from `.write()`; flip the
+        # opt-in flag via SQL. Production UX exposes the same operation
+        # via a custom wizard (Technical → Field Provenance Setup) — that
+        # wizard will use the same SQL path. The `clear_cache` ensures the
+        # ormcache on `_field_track_set` picks it up.
+        cls._set_track_provenance(cls.field_comment, True)
+
+    @classmethod
+    def _set_track_provenance(cls, field, enabled):
+        cls.env.cr.execute(
+            "UPDATE ir_model_fields SET track_provenance = %s WHERE id = %s",
+            [enabled, field.id],
+        )
+        cls.env.cache.invalidate()
+        cls.env.registry.clear_cache()
+
+    # ------------------------------------------------------------------
+    # Stamping on user paths
+    # ------------------------------------------------------------------
+    def test_create_with_value_stamps_user(self):
+        partner = self.env["res.partner"].create(
+            {"name": "Created With Comment", "comment": "manual note"}
+        )
+        entry = (partner._provenance or {}).get("comment")
+        self.assertIsInstance(entry, dict, "Provenance entries are dicts now")
+        self.assertEqual(entry["s"], "u")
+        self.assertEqual(entry["b"], self.env.user.login)
+        self.assertIsInstance(entry["t"], int)
+        self.assertTrue(partner._user_set("comment"))
+
+    def test_create_without_value_does_not_stamp(self):
+        """Implicit default — absence of an entry means the field is
+        still at its default. We never stamp the default state; it
+        keeps the JSON column compact."""
+        partner = self.env["res.partner"].create({"name": "No Comment"})
+        self.assertNotIn(
+            "comment",
+            (partner._provenance or {}),
+            "Default state must be implicit (no entry).",
+        )
+        self.assertFalse(partner._user_set("comment"))
+
+    def test_write_stamps_user(self):
+        partner = self.env["res.partner"].create({"name": "Late Writer"})
+        partner.write({"comment": "user-typed"})
+        entry = (partner._provenance or {}).get("comment")
+        self.assertEqual(entry["s"], "u")
+        self.assertEqual(entry["b"], self.env.user.login)
+
+    # ------------------------------------------------------------------
+    # Rule / cascade stamping (public API)
+    # ------------------------------------------------------------------
+    def test_stamp_provenance_rule(self):
+        partner = self.env["res.partner"].create({"name": "Cascade Target"})
+        partner._stamp_provenance(
+            ["comment"],
+            source="r",
+            by="sot.cascade",
+            rule="Sale Order Type cascade",
+        )
+        entry = (partner._provenance or {}).get("comment")
+        self.assertEqual(entry["s"], "r")
+        self.assertEqual(entry["b"], "sot.cascade")
+        self.assertEqual(entry["r"], "Sale Order Type cascade")
+        # `_user_set` returns False for rule-stamped entries — that's the
+        # whole point: cascade values stay re-computable on next change.
+        self.assertFalse(partner._user_set("comment"))
+
+    def test_stamp_provenance_user_via_public_api(self):
+        partner = self.env["res.partner"].create({"name": "Anchored"})
+        partner._stamp_provenance(["comment"], source="u", by="dkendall")
+        self.assertTrue(partner._user_set("comment"))
+
+    def test_stamp_provenance_rejects_unknown_source(self):
+        partner = self.env["res.partner"].create({"name": "Reject Source"})
+        with self.assertRaises(ValueError):
+            partner._stamp_provenance(["comment"], source="d", by="anything")
+        with self.assertRaises(ValueError):
+            partner._stamp_provenance(["comment"], source="s", by="anything")
+
+    def test_stamp_provenance_requires_by(self):
+        partner = self.env["res.partner"].create({"name": "Reject By"})
+        with self.assertRaises(ValueError):
+            partner._stamp_provenance(["comment"], source="r", by="")
+        with self.assertRaises(ValueError):
+            partner._stamp_provenance(["comment"], source="r", by=None)
+
+    def test_stamp_provenance_skips_untracked_keys(self):
+        partner = self.env["res.partner"].create({"name": "Mixed"})
+        partner._stamp_provenance(["comment", "name"], source="r", by="sot.cascade")
+        prov = partner._provenance or {}
+        self.assertIn("comment", prov)
+        self.assertNotIn("name", prov, "Untracked keys must not be stamped")
+
+    def test_user_write_flips_rule_to_user(self):
+        partner = self.env["res.partner"].create({"name": "Override Path"})
+        partner._stamp_provenance(["comment"], source="r", by="sot.cascade")
+        self.assertFalse(partner._user_set("comment"))
+        partner.write({"comment": "I override the rule"})
+        self.assertTrue(partner._user_set("comment"))
+        self.assertEqual((partner._provenance or {})["comment"]["s"], "u")
+
+    # ------------------------------------------------------------------
+    # `_provenance_for` — badge tooltip
+    # ------------------------------------------------------------------
+    def test_provenance_for_default(self):
+        partner = self.env["res.partner"].create({"name": "Default Only"})
+        info = partner._provenance_for("comment")
+        self.assertEqual(info["state"], "default")
+        self.assertIn("Default", info["label"])
+        # The "when" for a default state is the record's create_date,
+        # serving as the proxy for "this default has been in effect
+        # since X" without storing any extra data.
+        self.assertIsNotNone(info["when"])
+
+    def test_provenance_for_user(self):
+        partner = self.env["res.partner"].create({"name": "User State", "comment": "x"})
+        info = partner._provenance_for("comment")
+        self.assertEqual(info["state"], "user")
+        self.assertEqual(info["by"], self.env.user.login)
+        self.assertIn(self.env.user.login, info["label"])
+
+    def test_provenance_for_rule(self):
+        partner = self.env["res.partner"].create({"name": "Rule State"})
+        partner._stamp_provenance(
+            ["comment"],
+            source="r",
+            by="sot.cascade",
+            rule="Sale Order Type cascade",
+        )
+        info = partner._provenance_for("comment")
+        self.assertEqual(info["state"], "rule")
+        self.assertEqual(info["by"], "sot.cascade")
+        self.assertEqual(info["rule"], "Sale Order Type cascade")
+        self.assertIn("Sale Order Type cascade", info["label"])
+
+    def test_provenance_for_legacy_string_entry(self):
+        """Backward-compat: read a v0.1 bare-string entry."""
+        partner = self.env["res.partner"].create({"name": "Legacy"})
+        # Bypass the public API to inject the legacy shape directly.
+        partner.with_context(_prov_skip=True).write({"_provenance": {"comment": "u"}})
+        self.assertTrue(partner._user_set("comment"))
+        info = partner._provenance_for("comment")
+        self.assertEqual(info["state"], "user")
+        # No `by` was stored in the legacy form; tooltip degrades to
+        # "Set by user system".
+        self.assertEqual(info["by"], "system")
+
+    # ------------------------------------------------------------------
+    # Track-set caching and untracked-field hygiene
+    # ------------------------------------------------------------------
+    def test_untracked_field_not_stamped(self):
+        partner = self.env["res.partner"].create({"name": "Tracked Only"})
+        self.assertNotIn("name", partner._provenance or {})
+
+    def test_cache_invalidated_on_flag_toggle(self):
+        self._set_track_provenance(self.field_comment, False)
+        partner = self.env["res.partner"].create(
+            {"name": "Post-Toggle", "comment": "no longer tracked"}
+        )
+        self.assertNotIn("comment", partner._provenance or {})
+        self._set_track_provenance(self.field_comment, True)
+
+    # ------------------------------------------------------------------
+    # Web client integration
+    # ------------------------------------------------------------------
+    def test_web_read_emits_provenance(self):
+        partner = self.env["res.partner"].create(
+            {"name": "WebRead Probe", "comment": "anchored"}
+        )
+        rows = partner.web_read({"comment": {}, "name": {}})
+        self.assertEqual(len(rows), 1)
+        self.assertIn("_provenance", rows[0])
+        self.assertEqual(rows[0]["_provenance"]["comment"]["s"], "u")
+
+    # ------------------------------------------------------------------
+    # Timestamp determinism
+    # ------------------------------------------------------------------
+    def test_explicit_when_is_persisted(self):
+        partner = self.env["res.partner"].create({"name": "Frozen Time"})
+        frozen = int(time.time()) - 3600  # one hour ago
+        partner._stamp_provenance(
+            ["comment"], source="r", by="cron.recompute", when=frozen
+        )
+        self.assertEqual((partner._provenance or {})["comment"]["t"], frozen)
+        info = partner._provenance_for("comment")
+        # The ISO timestamp serializes the frozen-in-the-past time.
+        self.assertIn("T", info["when"])
+
+    # ------------------------------------------------------------------
+    # Client-side payload sanitization (security)
+    # ------------------------------------------------------------------
+    def test_client_provenance_write_forces_env_user(self):
+        """A client-supplied entry that claims a fake `b` must be
+        overwritten with `env.user.login` on save."""
+        partner = self.env["res.partner"].create({"name": "Anti-Spoof"})
+        partner.write(
+            {
+                "_provenance": {
+                    "comment": {"s": "u", "b": "attacker", "t": 0},
+                }
+            }
+        )
+        entry = (partner._provenance or {})["comment"]
+        self.assertEqual(
+            entry["b"],
+            self.env.user.login,
+            "Server must overwrite client-supplied `b` with env.user.login",
+        )
+        self.assertGreater(
+            entry["t"], 0, "Server must overwrite client-supplied timestamp"
+        )
+
+    def test_client_cannot_claim_rule_provenance(self):
+        """Client-side writes must never assert rule provenance — only
+        server-side cascade callers (via `_stamp_provenance`) may."""
+        partner = self.env["res.partner"].create({"name": "No Rule Claim"})
+        partner.write(
+            {
+                "_provenance": {
+                    "comment": {
+                        "s": "r",
+                        "b": "fake.cascade",
+                        "t": 0,
+                        "r": "Fake Rule",
+                    },
+                }
+            }
+        )
+        self.assertNotIn(
+            "comment",
+            partner._provenance or {},
+            "Client-asserted rule entries must be dropped by sanitization",
+        )
+
+    def test_client_provenance_non_dict_payload_rejected(self):
+        partner = self.env["res.partner"].create({"name": "Junk Payload"})
+        partner.write({"_provenance": "not a dict"})
+        self.assertFalse(
+            partner._provenance,
+            "Non-dict client payloads must be sanitized to empty",
+        )
+
+    # ------------------------------------------------------------------
+    # Backward-compat: legacy bare-string entries
+    # ------------------------------------------------------------------
+    def test_legacy_system_string_falls_back_to_default(self):
+        """v0.1 used 's' for system-assigned. With the 3-state schema,
+        that maps to "default" semantics — the value isn't user-anchored
+        and the badge shows the default state."""
+        partner = self.env["res.partner"].create({"name": "Legacy System"})
+        partner.with_context(_prov_skip=True).write({"_provenance": {"comment": "s"}})
+        self.assertFalse(partner._user_set("comment"))
+        info = partner._provenance_for("comment")
+        self.assertEqual(info["state"], "default")
+
+    # ------------------------------------------------------------------
+    # Multi-record stamping
+    # ------------------------------------------------------------------
+    def test_multirecord_stamp_writes_each(self):
+        p1 = self.env["res.partner"].create({"name": "Multi 1"})
+        p2 = self.env["res.partner"].create({"name": "Multi 2"})
+        (p1 + p2)._stamp_provenance(["comment"], source="r", by="batch.recompute")
+        for p in (p1, p2):
+            entry = (p._provenance or {}).get("comment")
+            self.assertEqual(entry["s"], "r")
+            self.assertEqual(entry["b"], "batch.recompute")
+
+    # ------------------------------------------------------------------
+    # Cache invalidation on field unlink
+    # ------------------------------------------------------------------
+    def test_unlink_invalidates_track_cache(self):
+        """Removing the track_provenance flag via unlink (or by deleting
+        the ir.model.fields row, which we simulate via direct SQL) must
+        invalidate the cached `_field_track_set` so subsequent creates
+        don't stamp."""
+        # Toggle off via SQL — same path tests use elsewhere.
+        self._set_track_provenance(self.field_comment, False)
+        p = self.env["res.partner"].create({"name": "Post Untrack", "comment": "x"})
+        self.assertNotIn(
+            "comment",
+            p._provenance or {},
+            "After cache invalidation, the field should not be stamped",
+        )
+        # Restore for the rest of the class.
+        self._set_track_provenance(self.field_comment, True)
diff --git a/web_field_provenance/views/ir_model_fields_views.xml b/web_field_provenance/views/ir_model_fields_views.xml
new file mode 100644
index 00000000000..cf378bf3246
--- /dev/null
+++ b/web_field_provenance/views/ir_model_fields_views.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <record id="view_model_fields_form_inherit_provenance" model="ir.ui.view">
+        <field name="name">ir.model.fields.form.inherit.web_field_provenance</field>
+        <field name="model">ir.model.fields</field>
+        <field name="inherit_id" ref="base.view_model_fields_form" />
+        <field name="arch" type="xml">
+            <field name="readonly" position="after">
+                <field name="track_provenance" />
+            </field>
+        </field>
+    </record>
+</odoo>