@@ -0,0 +1,16 @@
+---
+'@objectstack/objectql': patch
+---
+
+A top-level object that no package body of a multi-package stack declares is now served by the data door, under the stack's `manifest.id`, the id the metadata door already lists it under
+
+Clause-②: no
+
+- **What was wrong.** A stack that carries `packages[]` registers each package body under that package's id. A top-level object that no body declares is the stack's residual. The metadata door registered it under the stack's `manifest.id` and the boot warned that every door would report that id as its owner. The engine's `manifest` service registered the bodies only. So `GET /api/v1/meta/object` listed the object while `GET /api/v1/data/<name>` answered `404`, on the artifact boot (`os serve` of a built artifact) and on the config boot (`os serve objectstack.config.ts`) alike.
+- **What changes.** After the bodies, the `manifest` service registers the residual's objects under the stack's `manifest.id`. It reads which objects are residual from `unclaimedTopLevel` (`@objectstack/metadata`), the same answer the metadata door and `os validate` read. No package record is created for that id: the residual is not a package. When the id names one of the bodies (a composed stack keeps one member's manifest), that body's record is unchanged. A residual object that arrives after boot, with a late artifact, is copied to the metadata service as a body's objects are.
+- **Listed and not served, by name.** Registering two classes of residual object would refuse a boot that the stack passes today, so they are not registered. They stay listed by the metadata door and unserved by the data door, and the boot prints one warning naming each object and why:
+  - an object whose name another package already owns: the data door keeps serving that package's object;
+  - an object with a field that names a picklist no package body declares: the stack's top-level picklists are metadata only, so the boot's picklist check would fail.
+
+  The remedy in the warning is the residual warning's own: declare the object inside the `packages[]` entry of the package that owns it, with every picklist its fields name. To add fields to an object another package owns, use `objectExtensions`.
+- **Unchanged.** A stack without `packages[]`, and a normally composed one whose top level repeats its bodies, has no residual and registers exactly as before.
@@ -40,11 +40,14 @@
  *   - CONTROL: a single-package config (no `packages[]`) is unchanged and has
  *     no residual on either door.
  *
- * ⚠️ What this file does NOT pin: the data door for a residual OBJECT. Both
- * doors list it on `/meta/object` and answer `404` on `/data/<name>` — the
- * residual rule registers metadata, and no engine registration follows. That
- * is the artifact door's answer this card makes the config boot match, not a
- * behaviour to freeze.
+ * The DATA door is read beside the metadata door (#22615): every `acme_*`
+ * object `/meta/object` lists is read back on `/data/<name>`. A residual object
+ * is listed under the stack's `manifest.id` AND served under it — the engine's
+ * `manifest` service registers the residual rule's own objects
+ * (`unclaimedTopLevel`), so both doors give one answer through both boots.
+ * Before that, both boots listed `acme_note` and answered `404` on
+ * `/data/acme_note`. The bodies' own objects are the control: `200` before and
+ * after, on every row.
  *
  * ⚠️ Pedigree, not counts: every doc page carries a marker written into exactly
  * one source, read back from the served doc.
@@ -325,6 +328,8 @@ interface Reading {
   /** `name@owner`, sorted. */
   objects: string[];
   views: string[];
+  /** `name:status` of `GET /data/<name>` for every object `objects` lists, sorted. */
+  data: string[];
   /** The count each residual line reports — one entry per line printed. */
   residual: number[];
 }
@@ -364,14 +369,23 @@ async function read(dir: string, args: string[]): Promise<Reading> {
         marker: /MARKER-22521-[\w-]+/.exec(JSON.stringify(one.body))?.[0],
       };
     }
-    const objects = owned(await list('object'));
+    const listedObjects = await list('object');
+    const objects = owned(listedObjects);
     const views = owned(await list('view'));
+    // The data door, for exactly the objects the metadata door listed: one
+    // answer per object across the two doors (#22615).
+    const data: string[] = [];
+    for (const item of listedObjects) {
+      const rows = await request(serve, `the data read of ${item.name}`, `${base}/data/${item.name}`, { headers });
+      data.push(`${item.name}:${rows.status}`);
+    }
+    data.sort();
     const residual = serve.output()
       .split('\n')
       .map((line) => RESIDUAL_LINE.exec(line)?.[1])
       .filter((count): count is string => count !== undefined)
       .map(Number);
-    return { docs, objects, views, residual };
+    return { docs, objects, views, data, residual };
   } finally {
     await stop(serve.child);
   }
@@ -455,6 +469,8 @@ describe('#22521 row 2: flat src/docs with a manifest.id naming no package', ()
       acme_faq: { packageId: RELEASE_ID, marker: 'MARKER-22521-flat-faq' },
     });
     expect(artifact.residual).toEqual([2]);
+    // The control for #22615's data-door reading: the bodies' own objects.
+    expect(artifact.data, JSON.stringify(artifact)).toEqual(['acme_account:200', 'acme_case:200']);
   });
 
   it('the config boot gives the artifact boot\'s answer, without --dev', () => {
@@ -493,6 +509,12 @@ describe('#22521 row 4: a top-level object and view no package owns', () => {
     // Before the fix: neither acme_note nor its view listed, no residual line.
     expect(configDev).toEqual(artifact);
   });
+
+  it('the data door serves the residual object the metadata door lists, through both boots (#22615)', () => {
+    // Before #22615, on both boots: `acme_note:404` beside the listing above.
+    expect(artifact.data, JSON.stringify(artifact)).toEqual(['acme_account:200', 'acme_case:200', 'acme_note:200']);
+    expect(configDev.data, JSON.stringify(configDev)).toEqual(artifact.data);
+  });
 });
 
 describe('#22521 row 3: inline docs spread on a composed stack\'s top level', () => {
@@ -519,6 +541,7 @@ describe('#22521 row 3: inline docs spread on a composed stack\'s top level', ()
       acme_inline: { packageId: APP_ID, marker: 'MARKER-22521-inline' },
     });
     expect(configDev.residual).toEqual([1]);
+    expect(configDev.data, JSON.stringify(configDev)).toEqual(['acme_account:200', 'acme_case:200']);
   });
 });
 
@@ -540,6 +563,7 @@ describe('#22521 control: a single-package config has no residual on either door
     });
     expect(artifact.objects).toEqual([`acme_account@${APP_ID}`, `acme_note@${APP_ID}`]);
     expect(artifact.views).toEqual([`acme_note.default@${APP_ID}`]);
+    expect(artifact.data).toEqual(['acme_account:200', 'acme_note:200']);
     expect(artifact.residual).toEqual([]);
   });
 
 
@@ -247,15 +247,24 @@ import type { IHttpServer } from '@objectstack/spec/contracts';
 //     `objectstack.json` (`_parseAndRegisterArtifact` below);
 //   - the CONFIG door — `os serve objectstack.config.ts`, whose `AppPlugin`
 //     hands the stack to the `manifest` service, which registers the package
-//     bodies and never the top level (`resolveArtifactPackageOrder` answers
-//     `packages[]` alone when the key is present). Before this rule had a
+//     bodies (`resolveArtifactPackageOrder` answers `packages[]` alone when
+//     the key is present) and, of the top level, only the residual's objects
+//     (the engine half, below). Before this rule had a
 //     second caller, a config boot served such an item through no door and
 //     said nothing, while an artifact boot of the same project served it
 //     under `manifest.id` and warned.
 //
 // Both call {@link MetadataPlugin.registerUnclaimedTopLevel}, so which items
 // are residual, which id they take, how each is registered and what the boot
 // says are decided here and nowhere else. ⛔ Never a second copy at a door.
+//
+// The ENGINE half reads the same answer. Both doors hand the whole stack to
+// the `manifest` service (`@objectstack/objectql`), which registers the bodies
+// and then, from {@link unclaimedTopLevel}, the residual's OBJECTS under the
+// same id, so the data door serves the objects this rule lists. An object it
+// cannot register without refusing the boot (a name another package already
+// owns, a field naming a picklist no body declares) stays listed here and
+// unserved there, and the engine names it at boot.
 
 /**
  * Where one door's registrations land. The artifact door writes its in-memory
@@ -366,7 +375,8 @@ export interface UnclaimedTopLevel {
  * residual rule, with nothing registered and nothing thrown.
  *
  * {@link MetadataPlugin.registerUnclaimedTopLevel} registers exactly these, in
- * this order, through either boot door. `os validate` / `os build`
+ * this order, through either boot door, and the engine's `manifest` service
+ * registers the objects among them under the same id. `os validate` / `os build`
  * (`@objectstack/cli`'s view-container walk) read the same answer to judge what
  * that registration will judge, so an author-time door and a boot door cannot
  * disagree about which items are residual. ⛔ Never re-derived by a caller.
@@ -1410,8 +1420,9 @@ export class MetadataPlugin implements Plugin {
      *
      * Called by this plugin's artifact door on a compiled `objectstack.json`,
      * and by `AppPlugin` (`@objectstack/runtime`) on a config boot, whose
-     * `manifest` service registers the package bodies and never the top level
-     * of a stack that carries `packages[]`. The two doors differ only in where
+     * `manifest` service registers the package bodies and, of the top level of
+     * a stack that carries `packages[]`, only the residual's objects (from
+     * {@link unclaimedTopLevel}, this rule's own answer). The two doors differ only in where
      * their `sink` stores and in the words of the line; the decision — which
      * items, keyed how, owned by whom — is this method's.
      *