@@ -0,0 +1,24 @@
+---
+"@objectstack/cli": patch
+---
+
+The CLI reads a multi-package app's package-owned keys (`requires`, `tiers`, `analyticsCubes`, `flows`, `objects` and the rest) out of its package bodies, as it reads a one-package app's top level.
+
+Clause-②: no
+
+A `composeStacks([…], { manifest: 'preserve' })` config carries each of these keys only inside the body of the package that declared it. Its top level carries none of them. These readers looked at the top level only, so they read nothing on such an app, and did so silently:
+
+- **`os serve` capability providers.** A config boot with no compiled artifact did not mount the provider a package declares in `requires` (`automation`, say). The boot logged `Optional service not present` and the features that need the provider were absent. `os dev`, `os start`, and `os serve` beside a built `dist/objectstack.json` already mounted it, because they boot the artifact.
+- **`os serve` tiers.** A package's own `tiers` were ignored on `os serve`, `os dev` and `os start`. The preset's tiers were used instead.
+- **`os serve` analytics cubes.** The always-on analytics provider started with none of the cubes a package declares in `analyticsCubes`, on every boot of such an app.
+- **`os serve` flow line.** The ready banner's line `N flow(s) declared but the automation engine is not enabled` never counted a package's flows, so it did not appear.
+- **`os migrate plan` / `apply`.** A host plugin that hard-depends on a provider a package's `requires` supplies could not be ordered. Both commands exited 1 with `Dependency '…' not found for plugin '…'`.
+- **`os generate`.** After writing a flow, it warned that the config does not require `automation` and `triggers` even when a package declares both. `os generate types`, `client` and `migration` emitted none of a package's objects.
+- **`os doctor`, `os diff`, `os migrate meta`.** `os doctor` skipped every metadata check and reported a healthy environment. `os diff` reported no change for an object added to a package. `os migrate meta` did not list the data migration a package's file fields need.
+
+Each now reads by one rule: the top-level value when the stack carries one, otherwise every package body's. This is the rule `os validate` and `os build` already use for `requires`. A stack with no `packages[]` reads exactly as before.
+
+**Two behaviours narrow.** In each, a two-package app is now refused where the same declarations in one `defineStack` were always refused:
+
+- A capability a package declares in `requires` with no installed provider (`requires: ['ai']` in the open edition, say) now stops an `os serve` boot of the config, with the same `Capability "…"` error. `os dev` and `os start` already stopped there.
+- A package's `tiers` now apply. A package that declares `tiers` without `auth` gets a stack with no auth, which `os serve` refuses to boot with its data API, as it always has for one package. To keep the preset's tiers, remove `tiers` from the package, or list every tier it needs.
@@ -3,6 +3,7 @@
 import { Args, Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
 import { loadConfig } from '../utils/config.js';
+import { authoringRuleUnionStack } from '../utils/stack-collections.js';
 import {
   printHeader,
   printSuccess,
@@ -214,8 +215,13 @@ export default class Diff extends Command {
     }
 
     try {
-      const { config: beforeConfig } = await loadConfig(beforePath);
-      const { config: afterConfig } = await loadConfig(afterPath);
+      // [#22288] Each side folded before any category is read: a
+      // multi-package `preserve` config carries its objects, views, flows
+      // and the rest in its package bodies, none at its top level, so a diff
+      // of two such configs compared two empty stacks and reported nothing.
+      // A stack with no `packages[]` comes back by identity.
+      const beforeConfig: any = authoringRuleUnionStack((await loadConfig(beforePath)).config);
+      const afterConfig: any = authoringRuleUnionStack((await loadConfig(afterPath)).config);
 
       if (!flags.json) {
         printInfo(`Before: ${chalk.white(beforePath)}`);
 
@@ -10,6 +10,7 @@ import { normalizeStackInput } from '@objectstack/spec';
 import { referenceCarrierOf } from '@objectstack/spec/data';
 import { printHeader, printSuccess, printWarning, printError, printStep, printInfo } from '../utils/format.js';
 import { loadConfig, configExists } from '../utils/config.js';
+import { authoringRuleUnionStack } from '../utils/stack-collections.js';
 import { cwdConfigJoinsBoot, resolveArtifactBootSource } from '../utils/artifact-precedence.js';
 import { checkProtocolVersionGap } from '../utils/protocol-version-gap.js';
 // #5644 — "the optional package is not installed" and "it is installed and
@@ -2312,7 +2313,13 @@ export default class Doctor extends Command {
         // `withDotenvOverlay` would revert the overlay while `loadConfig()`'s
         // promise was still pending — applied, then removed, never read.
         const { config: rawConfig } = await withDotenvOverlayAsync(dotenvReading, () => loadConfig());
-        const config: any = normalizeStackInput(rawConfig as Record<string, unknown>);
+        // [#22288] Folded once, here, before any analysis below reads a
+        // collection: a multi-package `preserve` config carries every object,
+        // view, flow, app and dashboard in its package bodies and none at its
+        // top level, so every check below skipped such an app and doctor
+        // printed a clean bill of health. Envelope keys (`manifest`) are
+        // untouched, and a stack with no `packages[]` comes back by identity.
+        const config: any = authoringRuleUnionStack(normalizeStackInput(rawConfig as Record<string, unknown>));
 
         // Protocol drift: installed platform outside the range the app declares.
         printStep('Checking platform protocol version...');
 
@@ -1334,7 +1334,12 @@ export function generateTypesFromConfig(config: Record<string, unknown>): string
 
   // Extract objects from config (supports both top-level and nested)
   const objects: Record<string, unknown>[] = [];
-  const rawObjects = (config as any).objects ?? (config as any).data?.objects ?? {};
+  // [#22288] Read off the folded stack: a multi-package `preserve` config
+  // carries its objects in its package bodies and none at its top level, so
+  // this emitted nothing for such an app. A stack with no `packages[]` comes
+  // back by identity.
+  const stack = authoringRuleUnionStack(config) as any;
+  const rawObjects = stack.objects ?? stack.data?.objects ?? {};
 
   if (Array.isArray(rawObjects)) {
     objects.push(...rawObjects);
@@ -2245,7 +2250,9 @@ function generateClientFromConfig(config: Record<string, unknown>): string {
   ];
 
   const objects: Record<string, unknown>[] = [];
-  const rawObjects = (config as any).objects ?? (config as any).data?.objects ?? {};
+  // [#22288] The folded stack, as in `generateTypesFromConfig`.
+  const stack = authoringRuleUnionStack(config) as any;
+  const rawObjects = stack.objects ?? stack.data?.objects ?? {};
 
   if (Array.isArray(rawObjects)) {
     objects.push(...rawObjects);
@@ -3482,7 +3489,9 @@ export function generateMigrationSql(config: Record<string, unknown>): string {
   ];
 
   const objects: Record<string, unknown>[] = [];
-  const rawObjects = (config as any).objects ?? (config as any).data?.objects ?? {};
+  // [#22288] The folded stack, as in `generateTypesFromConfig`.
+  const stack = authoringRuleUnionStack(config) as any;
+  const rawObjects = stack.objects ?? stack.data?.objects ?? {};
 
   if (Array.isArray(rawObjects)) {
     objects.push(...rawObjects);
@@ -3653,7 +3662,9 @@ export function generateMigrationTs(config: Record<string, unknown>): string {
   ];
 
   const objects: Record<string, unknown>[] = [];
-  const rawObjects = (config as any).objects ?? (config as any).data?.objects ?? {};
+  // [#22288] The folded stack, as in `generateTypesFromConfig`.
+  const stack = authoringRuleUnionStack(config) as any;
+  const rawObjects = stack.objects ?? stack.data?.objects ?? {};
 
   if (Array.isArray(rawObjects)) {
     objects.push(...rawObjects);
 
@@ -19,6 +19,7 @@ import { PROTOCOL_MAJOR, PROTOCOL_VERSION } from '@objectstack/spec/kernel';
 import { FILE_REFERENCE_TYPES, REFERENCE_VALUE_TYPES, STRUCTURED_JSON_TYPES } from '@objectstack/spec/data';
 import { FILE_REFERENCES_MIGRATION_ID, VALUE_SHAPES_MIGRATION_ID } from '@objectstack/spec/system';
 import { loadConfig } from '../../utils/config.js';
+import { authoringRuleUnionStack } from '../../utils/stack-collections.js';
 import {
   printHeader,
   printSuccess,
@@ -1065,7 +1066,13 @@ export default class MigrateMeta extends Command {
       // diff" the consumer agent reviews (ADR-0087 D3/D5).
       const parsed = ObjectStackDefinitionSchema.safeParse(result.stack);
       const specChanges = composeSpecChanges(fromMajor, toMajor);
-      const dataMigrations = pendingDataMigrations(result.stack, result.fromMajor, result.toMajor);
+      // [#22288] Asked of the folded stack: the advice is about field classes
+      // the author's objects declare, and a multi-package `preserve` stack
+      // carries its objects in its package bodies, none at its top level, so
+      // the advice was never listed for such an app. A stack with no
+      // `packages[]` comes back by identity.
+      const dataMigrations = pendingDataMigrations(
+        authoringRuleUnionStack(result.stack as Record<string, unknown>), result.fromMajor, result.toMajor);
 
       // The declared protocol range the load would still refuse after this
       // run (#22219): `--write` rewrites it, a dry run names the edit.
 
@@ -105,6 +105,8 @@ import {
   shouldAutoRegisterStorageDriver,
   stackDeclaresMetadata,
   bundleDeclaresTranslations,
+  resolveStackCollection,
+  stackDeclaredCapabilities,
 } from '../utils/stack-collections.js';
 import { redactConnectionUrl, describeDriverConnection, describeDriverSqliteFile } from '../utils/connection-display.js';
 import { captureServedDatabaseFile, watchServedDatabaseFile } from '../utils/served-database-file.js';
@@ -2844,9 +2846,15 @@ export default class Serve extends Command {
       // `aiStudio`/`aiSeat` alias canonicalization was removed in framework#3308
       // — legacy spellings are now unknown tokens (warned below, rejected at
       // authoring by defineStack).
-      const rawRequires: string[] = Array.isArray((config as any).requires)
-        ? (config as any).requires.filter((c: unknown) => typeof c === 'string')
-        : [];
+      //
+      // [#22288] Read by `resolveStackCollection`'s rule: the top-level list
+      // when the config carries one, otherwise each package body's. A
+      // multi-package `preserve` config carries `requires` only in the body of
+      // the package that declared it, so a top-level read mounted none of its
+      // providers on a config boot with no compiled artifact. (An artifact boot
+      // already answered here: `createStandaloneStack` resolves the artifact's
+      // packages and `mergeBootConfig` lays its `requires` over the top level.)
+      const rawRequires: string[] = stackDeclaredCapabilities(config);
       const requires: string[] = [...new Set(rawRequires)];
       // Snapshot the app's EXPLICIT capability declarations BEFORE the platform
       // appends its own convenience defaults (auth→email, mcp, pinyin-search,
@@ -2915,10 +2923,12 @@ export default class Serve extends Command {
       const requiredTiers = requires
         .map((c) => CAPABILITY_TO_TIER[c])
         .filter((t): t is string => typeof t === 'string');
-      const baseTiers =
-        Array.isArray((config as any).tiers) && (config as any).tiers.length > 0
-          ? (config as any).tiers
-          : presetTiers;
+      // [#22288] `tiers` is package-owned like `requires`, and no boot path
+      // lays it over the top level (`createStandaloneStack` does not carry it),
+      // so a package's own `tiers` were ignored on `os serve`, `os dev` and
+      // `os start` alike. Same rule as `requires` above.
+      const declaredTiers = resolveStackCollection(config, 'tiers') as string[];
+      const baseTiers = declaredTiers.length > 0 ? declaredTiers : presetTiers;
       const tiers: Set<string> = new Set([...baseTiers, ...requiredTiers]);
       const tierEnabled = (t: string) => tiers.has(t);
       const requiresCapability = (c: string) => requires.includes(c);
@@ -4790,7 +4800,13 @@ export default class Serve extends Command {
             // this root by the automation service's package file loader.
             arg = { packageRoot: path.dirname(absolutePath) };
           } else if (spec.configKey === 'analyticsCubes') {
-            const cubes = (config as any).analyticsCubes ?? (config as any).cubes ?? [];
+            // [#22288] The top level first, as before (its own array, then the
+            // legacy `cubes` spelling), and only then the package bodies: a
+            // multi-package config carries a package's `analyticsCubes` in that
+            // body alone, and `analytics` is always on, so its cubes were
+            // dropped on every boot of such an app (`os dev` included).
+            const cubes = (config as any).analyticsCubes ?? (config as any).cubes
+              ?? resolveStackCollection(config, 'analyticsCubes');
             arg = { cubes };
           } else if (cap === 'email') {
             // Throws on a mail configuration that cannot deliver (#5087,
@@ -5303,9 +5319,12 @@ export default class Serve extends Command {
       // read off the live engine. Collect it here (after restore) and surface it
       // in the banner: declared-but-engine-missing, unbound triggered flows, and
       // bound-but-dead (unknown object) flows.
+      // [#22288] Counted by `resolveStackCollection`'s rule, so a flow a
+      // package declares is counted: the "declared but the automation engine is
+      // not enabled" line used to stay silent for every multi-package app.
       const automationSummary = collectAutomationSummary(
         kernel,
-        Array.isArray((config as any)?.flows) ? (config as any).flows.length : 0,
+        resolveStackCollection(config, 'flows').length,
       );
 
       // ── Seed outcome summary (#3415/#3430) ─────────────────────────
 
@@ -6,7 +6,7 @@ import { isAggregatedViewContainer } from '@objectstack/spec';
 // The LEAF subpath: the registry-key derivation alone, not the metadata plugin.
 import { deriveViewContainerObject } from '@objectstack/metadata/view-container';
 import { findConfigPath, loadConfig } from './config.js';
-import { authoringRuleUnionStack } from './stack-collections.js';
+import { authoringRuleUnionStack, stackDeclaredCapabilities } from './stack-collections.js';
 
 /**
  * Whether what `os generate` just wrote REACHES the stack the project's config
@@ -48,8 +48,9 @@ export type StackReach =
   /**
    * The config loaded. `reached` says whether its stack carries the item;
    * `missingRequires` lists the capability tokens the item needs to RUN that
-   * the stack's top-level `requires` does not declare, and `declaredRequires`
-   * is that list as declared (`null`: the stack declares no `requires`).
+   * the stack does not declare ({@link declaredCapabilities}: its top-level
+   * `requires`, else every package body's), and `declaredRequires` is that
+   * list as declared (`null`: the stack declares no `requires`).
    */
   | {
     kind: 'loaded';
@@ -104,19 +105,35 @@ export function stackCarries(config: unknown, stackKey: string, itemName: string
 }
 
 /**
- * The tokens in `requires` that the config's top-level `requires` does not
- * declare. Top-level on purpose: it is the list `defineStack`'s trigger
- * capability rule reads and the list `os serve` mounts capabilities from.
+ * The tokens in `requires` that the config's stack does not declare, read as
+ * `os serve` reads them to decide which providers it mounts
+ * ({@link declaredCapabilities}).
  */
 export function missingCapabilities(config: unknown, requires: readonly string[]): string[] {
   const tokens = declaredCapabilities(config) ?? [];
   return requires.filter((token) => !tokens.includes(token));
 }
 
-/** The config's top-level `requires` tokens, or `null` when it declares none. */
+/**
+ * The config's declared `requires` tokens, or `null` when it declares none —
+ * by `stackDeclaredCapabilities`'s rule, the one `os serve` mounts providers
+ * from: the top-level `requires` when the stack carries one, otherwise every
+ * package body's (#22288).
+ *
+ * - A one-package stack: its top-level `requires`. That is also the list
+ *   `defineStack`'s trigger capability rule reads for that stack.
+ * - A multi-package `preserve` stack: its top level carries no `requires`, so
+ *   this is the union of the package bodies, which is the set a server mounts.
+ *   `defineStack`'s rule judged each package against that package's OWN
+ *   `requires` when the config loaded: a package carrying a record-change flow
+ *   without `automation` and `triggers` refuses there, and this module answers
+ *   `load-failed` before it reads this list. Reading only the top level here
+ *   told the author that a token a package already declares was missing.
+ */
 export function declaredCapabilities(config: unknown): string[] | null {
-  const declared = (config as { requires?: unknown } | null)?.requires;
-  return Array.isArray(declared) ? declared.filter((t): t is string => typeof t === 'string') : null;
+  const declared = stackDeclaredCapabilities(config);
+  const topLevel = (config as { requires?: unknown } | null)?.requires;
+  return Array.isArray(topLevel) || declared.length > 0 ? declared : null;
 }
 
 /** Load the project's config and ask it about `target`. Never throws. */