diff --git a/‎.changeset/22238-package-union-readers.md‎
Lines changed: 18 additions & 0 deletions b/‎.changeset/22238-package-union-readers.md‎
Lines changed: 18 additions & 0 deletions
diff --git a/‎packages/cli/src/commands/compile.ts‎
Lines changed: 14 additions & 6 deletions b/‎packages/cli/src/commands/compile.ts‎
Lines changed: 14 additions & 6 deletions
diff --git a/‎packages/cli/src/commands/i18n/check.ts‎
Lines changed: 6 additions & 1 deletion b/‎packages/cli/src/commands/i18n/check.ts‎
Lines changed: 6 additions & 1 deletion
diff --git a/‎packages/cli/src/commands/i18n/extract.ts‎
Lines changed: 7 additions & 1 deletion b/‎packages/cli/src/commands/i18n/extract.ts‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎packages/cli/src/commands/lint.ts‎
Lines changed: 8 additions & 1 deletion b/‎packages/cli/src/commands/lint.ts‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎packages/cli/src/commands/validate.ts‎
Lines changed: 14 additions & 6 deletions b/‎packages/cli/src/commands/validate.ts‎
Lines changed: 14 additions & 6 deletions
diff --git a/‎packages/cli/src/utils/capability-preflight.ts‎
Lines changed: 82 additions & 1 deletion b/‎packages/cli/src/utils/capability-preflight.ts‎
Lines changed: 82 additions & 1 deletion
@@ -0,0 +1,18 @@
+---
+"@objectstack/cli": patch
+---
+
+`os validate`, `os build`, `os lint` and `os i18n check` now judge a multi-package app by its package bodies. A multi-package app that passed with a required capability that has no installable provider in this edition, or with a missing translation, now fails, as the same app shipped as one package always did.
+
+Clause-②: no
+
+An app composed with `composeStacks([a, b], { manifest: 'preserve' })` carries its metadata, its `translations` and its `requires` only inside each package's body, and nothing a package owns at its top level. These readers looked at the top level alone, so on such an app they found nothing to judge and answered clean:
+
+- **The capability preflight** (`os validate`, `os build`) now reads each package body's `requires` when the top level declares none. A capability with no installable provider in this edition fails the run with exit 1, and each finding names its package: `package 'com.acme.service' — Capability "ai" resolves to …`. The advisory for an installable but absent provider (for example `hierarchy-security`) comes back the same way. A top-level `requires` is read exactly as before, so a single-package app prints the same text it always did.
+- **Translation coverage** (`os lint`, `os i18n check`) now expects the keys of every package, so a missing translation in any package is reported. Under `os lint --strict` it fails the run again.
+- **`os i18n extract`** now extracts every package's keys, where it extracted none.
+- **The undeclared-authoring-key warnings** that `os validate --json` and `os build --json` carry in `warnings` now cover items inside package bodies too.
+
+A `packages` value that is present but is not an array is now refused by `os validate`, `os i18n check` and `os i18n extract` with `INVALID_ARTIFACT_PACKAGES`, as the other readers already refuse it. `os i18n check` and `os i18n extract` used to accept such a config with exit 0 and zero keys; `os validate` refused it from the schema parse instead.
+
+Apart from that refusal, no accepted input, exported symbol or `--json` field changes. A single-package app's output is unchanged.
@@ -23,7 +23,7 @@ import { stackFilterJudge } from '../utils/authoring-filter-judge.js';
 import { buildAccessMatrix, diffAccessMatrix } from '@objectstack/lint';
 import { runAuthoringRules, splitBySeverity, authoringRulesFor } from '@objectstack/lint';
 import { resolveJsxGateManifest, printJsxGateNotices } from '../utils/sdui-manifest.js';
-import { preflightRequiredCapabilities, renderCapabilityMessage } from '../utils/capability-preflight.js';
+import { preflightDeclaredCapabilities, renderCapabilityMessage } from '../utils/capability-preflight.js';
 import { attachPackageDocs, collectAndLintDocs, type DocIssue } from '../utils/collect-docs.js';
 import { buildRuntimeBundle, cleanupOldRuntimeBundles } from '../utils/build-runtime.js';
 import {
@@ -750,11 +750,15 @@ export default class Compile extends Command {
       //     `os start` crash. Absent-but-installable is a `pnpm add` hint.
       //
       //     Not a registry rule: it reads `node_modules`, not the stack.
+      //
+      //     [#22189] Read wherever the stack declares `requires`: its top
+      //     level, or each `packages[]` body, naming the package. A
+      //     multi-package `preserve` artifact carries `requires` only in its
+      //     bodies, so a top-level read passed it with exit 0.
       if (!flags.json) printStep('Checking that every required capability has a provider installable in this edition...');
-      const capPreflight = preflightRequiredCapabilities({
-        requires: Array.isArray((config as { requires?: unknown[] }).requires)
-          ? ((config as { requires?: unknown[] }).requires as unknown[])
-          : [],
+      const capPreflight = preflightDeclaredCapabilities({
+        requires: (config as { requires?: unknown }).requires,
+        packages: packageEntries,
         projectDir: path.dirname(absolutePath),
       });
       // [#11727] MAPPED HERE, once, and consumed by BOTH faces — the text block
@@ -816,9 +820,13 @@ export default class Compile extends Command {
       //     its own `normalized` — so hoisting the formatting rather than
       //     restating it at the payload is what keeps the two faces from
       //     reporting different sets. One list cannot drift from itself.
+      //
+      //     [#22238] The item walk reads the package-union stack, as
+      //     `os validate`'s does; the stack-key lint stays on the envelope.
+      //     See `validate.ts` step 2 for why each.
       unknownKeyWarnings = [
         ...lintUnknownStackKeys(normalized as Record<string, unknown>, ObjectStackDefinitionSchema),
-        ...lintUnknownAuthoringKeys(normalized as Record<string, unknown>, ObjectStackDefinitionSchema),
+        ...lintUnknownAuthoringKeys(authoringRuleUnionStack(normalized as Record<string, unknown>), ObjectStackDefinitionSchema),
       ].map(formatUnknownAuthoringKey);
       if (unknownKeyWarnings.length > 0 && !flags.json) {
         printWarning(`Undeclared authoring keys (${unknownKeyWarnings.length}) — dropped at load; reported here, never refused`);
 
@@ -57,6 +57,7 @@ import {
   isReportedError,
 } from '../../utils/format.js';
 import { computeI18nCoverage, COVERAGE_SURFACE_PHRASE } from '../../utils/i18n-coverage.js';
+import { authoringRuleUnionStack } from '../../utils/stack-collections.js';
 
 export default class I18nCheck extends Command {
   // ⛔ The surface list is DERIVED (`COVERAGE_SURFACE_PHRASE`), never a
@@ -153,7 +154,11 @@ export default class I18nCheck extends Command {
       if (!flags.json) printInfo(`Config: ${chalk.white(absolutePath)}`);
 
       const normalized = normalizeStackInput(config as Record<string, unknown>);
-      const report = computeI18nCoverage(normalized, {
+      // [#22238] Over the package-union stack, as `os lint` reads it: a
+      // multi-package `preserve` artifact carries its collections and
+      // `translations` only in `packages[]`, so the top level alone expected
+      // zero keys and reported 100%.
+      const report = computeI18nCoverage(authoringRuleUnionStack(normalized as Record<string, unknown>), {
         defaultLocale: flags['default-locale'],
         locales: flags.locales ? flags.locales.split(',').map((s) => s.trim()).filter(Boolean) : undefined,
         strict: flags.strict,
 
@@ -30,6 +30,7 @@ import {
   type FillStrategy,
   type TranslationModuleKind,
 } from '../../utils/i18n-extract.js';
+import { authoringRuleUnionStack } from '../../utils/stack-collections.js';
 
 const FILL_STRATEGIES: FillStrategy[] = ['empty', 'default', 'todo'];
 
@@ -285,7 +286,12 @@ export default class I18nExtract extends Command {
         }
       }
 
-      const result = extractTranslations(normalized, {
+      // [#22238] Over the package-union stack, as `os i18n check` reads it: a
+      // multi-package `preserve` artifact carries its collections and
+      // `translations` only in `packages[]`, so the top level alone yielded no
+      // key to extract. The `i18n` read above stays on the top level, where
+      // that artifact keeps it.
+      const result = extractTranslations(authoringRuleUnionStack(normalized as Record<string, unknown>), {
         defaultLocale,
         locales,
         previousSourceHashes,
 
@@ -1019,9 +1019,16 @@ export default class Lint extends Command {
       // already cover. A project that ships neither is checked against its
       // default locale alone, which its inline labels already satisfy — so this
       // stays silent for projects that do not translate.
+      //
+      // [#22238] Judged over the package-union stack. A multi-package
+      // `preserve` artifact carries its collections and `translations` only in
+      // `packages[]` and keeps `i18n` at the top level, so the top level alone
+      // had no key to expect and every `i18n/missing-*` went silent. The union
+      // keeps `i18n` and folds the rest back in; a stack that already carries
+      // its collections comes back by identity.
       let hiddenPlatform = 0;
       if (!flags['skip-i18n']) {
-        const coverage = computeI18nCoverage(normalized, {
+        const coverage = computeI18nCoverage(authoringRuleUnionStack(normalized as Record<string, unknown>), {
           defaultLocale: flags['default-locale'],
           strict: flags['i18n-strict'],
         });
 
@@ -23,7 +23,7 @@ import { artifactPackages, runPerPackageAuthoringRules } from '../utils/artifact
 import { stackFilterJudge } from '../utils/authoring-filter-judge.js';
 import { runAuthoringRules, splitBySeverity, authoringRulesFor } from '@objectstack/lint';
 import { resolveJsxGateManifest, printJsxGateNotices } from '../utils/sdui-manifest.js';
-import { preflightRequiredCapabilities, renderCapabilityMessage } from '../utils/capability-preflight.js';
+import { preflightDeclaredCapabilities, renderCapabilityMessage } from '../utils/capability-preflight.js';
 import { collectAndLintDocs, type DocIssue } from '../utils/collect-docs.js';
 import {
   printHeader,
@@ -279,9 +279,15 @@ export default class Validate extends Command {
       // carries the key the author actually wrote. Computed here rather than
       // down in the warnings section so the `--json` path reports it too — the
       // "computed, then discarded" shape this file already had to fix once.
+      //
+      // The item walk reads the package-union stack (#22238): a multi-package
+      // `preserve` artifact carries its collections only in `packages[]`, so
+      // the top level alone held no item to walk. The stack-key lint stays on
+      // the top level on purpose: it judges the envelope's own keys, and a
+      // package body is a closed shape the parse refuses an unknown key on.
       unknownKeyWarnings = [
         ...lintUnknownStackKeys(normalized as Record<string, unknown>, ObjectStackDefinitionSchema),
-        ...lintUnknownAuthoringKeys(normalized as Record<string, unknown>, ObjectStackDefinitionSchema),
+        ...lintUnknownAuthoringKeys(authoringRuleUnionStack(normalized as Record<string, unknown>), ObjectStackDefinitionSchema),
       ].map(formatUnknownAuthoringKey);
       // 2b. [#16544] Lower inline `function` handlers (Hook.handler, action
       //     `target`, top-level `functions`) to a metadata `body` + string ref
@@ -687,10 +693,12 @@ export default class Validate extends Command {
       }
 
       if (!flags.json) printStep('Checking that every required capability has a provider installable in this edition...');
-      const capProviderPreflight = preflightRequiredCapabilities({
-        requires: Array.isArray((config as { requires?: unknown[] }).requires)
-          ? ((config as { requires?: unknown[] }).requires as unknown[])
-          : [],
+      // [#22189] Every place the stack declares `requires`: its top level, or
+      //     each `packages[]` body, naming the package. A multi-package
+      //     `preserve` artifact carries `requires` only in its bodies.
+      const capProviderPreflight = preflightDeclaredCapabilities({
+        requires: (config as { requires?: unknown }).requires,
+        packages: packageEntries,
         projectDir: dirname(absolutePath),
       });
       const capProviderErrors = capProviderPreflight.errors;
 
@@ -65,8 +65,19 @@ export function makeProviderResolver(projectDir: string): (pkg: string) => boole
  * build/validate preflight and the serve boot error so both read identically.
  * Only `installable` / `unavailable` / `unknown` produce a message; `ok` is
  * satisfied and never surfaced.
+ *
+ * A finding a PACKAGE declared (see {@link preflightDeclaredCapabilities}) is
+ * prefixed with that package, in the `package '<id>' — ` spelling the
+ * per-package author-time rule pass puts on its findings. Without a package the
+ * text is exactly what it was.
  */
-export function renderCapabilityMessage(c: CapabilityClassification): string {
+export function renderCapabilityMessage(c: DeclaredCapabilityClassification): string {
+  const text = renderTokenMessage(c);
+  return c.package === undefined ? text : `package '${c.package}' — ${text}`;
+}
+
+/** {@link renderCapabilityMessage} without the package prefix. */
+function renderTokenMessage(c: CapabilityClassification): string {
   const p = c.provider;
   switch (c.status) {
     case 'installable': {
@@ -149,6 +160,76 @@ export function preflightRequiredCapabilities(opts: {
   return { errors, warnings };
 }
 
+/**
+ * A classified capability, and the package whose `requires` declared it.
+ * `package` is absent when the stack's own top level declared it.
+ */
+export interface DeclaredCapabilityClassification extends CapabilityClassification {
+  readonly package?: string;
+}
+
+/** {@link CapabilityPreflightResult}, each finding attributed to where it was declared. */
+export interface DeclaredCapabilityPreflightResult {
+  readonly errors: DeclaredCapabilityClassification[];
+  readonly warnings: DeclaredCapabilityClassification[];
+}
+
+/**
+ * The `os validate` / `os build` preflight over every place a stack DECLARES
+ * capabilities: its own top level, or each `packages[]` body.
+ *
+ * A multi-package `composeStacks(…, { manifest: 'preserve' })` artifact carries
+ * `requires` once, inside the body of the package that declared it (ADR-0130
+ * D4, 2026-09-22 addendum), and nothing at its top level. A preflight that read
+ * only the top level read `[]` there, so a capability with no installable
+ * provider passed both doors with exit 0, while the same token in one
+ * `defineStack` exits 1.
+ *
+ * The resolution rule is `resolveStackCollection`'s (`stack-collections.ts`):
+ * a top-level `requires` WINS whenever it is present. In the additive shape
+ * that array already is the union of the bodies, and a single-package stack has
+ * nothing else, so every stack that declares `requires` at its top level is
+ * judged exactly as before, unattributed. The bodies are read only when the top
+ * level does not carry the key, and each finding there names its package,
+ * because a token is removed from the package that declared it. The same token
+ * in two packages is reported once per package for that reason.
+ *
+ * @param opts.requires - The stack's top-level `requires`, as declared.
+ * @param opts.packages - The stack's `packages[]` entries, as `artifactPackages`
+ *   (`artifact-packages.ts`) names them. Passed in, never derived here: that
+ *   module carries the one package-id rule, and importing it would load
+ *   `@objectstack/lint` into `os serve`, which imports this module.
+ */
+export function preflightDeclaredCapabilities(opts: {
+  requires: unknown;
+  packages: ReadonlyArray<{ readonly id: string; readonly body: Record<string, unknown> }>;
+  projectDir: string;
+  /** Injectable for tests; defaults to on-disk `require.resolve` resolution. */
+  isInstalled?: (pkg: string) => boolean;
+}): DeclaredCapabilityPreflightResult {
+  const isInstalled = opts.isInstalled ?? makeProviderResolver(opts.projectDir);
+  if (Array.isArray(opts.requires) || opts.packages.length === 0) {
+    return preflightRequiredCapabilities({
+      requires: Array.isArray(opts.requires) ? opts.requires : [],
+      projectDir: opts.projectDir,
+      isInstalled,
+    });
+  }
+  const errors: DeclaredCapabilityClassification[] = [];
+  const warnings: DeclaredCapabilityClassification[] = [];
+  for (const pkg of opts.packages) {
+    const declared = pkg.body.requires;
+    const result = preflightRequiredCapabilities({
+      requires: Array.isArray(declared) ? declared : [],
+      projectDir: opts.projectDir,
+      isInstalled,
+    });
+    errors.push(...result.errors.map((c) => ({ ...c, package: pkg.id })));
+    warnings.push(...result.warnings.map((c) => ({ ...c, package: pkg.id })));
+  }
+  return { errors, warnings };
+}
+
 /**
  * The fatal one-line message `os serve` throws when a DECLARED capability's
  * provider import fails as module-not-found. The package is already confirmed