@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': minor
+'@objectstack/core': minor
+'@objectstack/objectql': minor
+---
+
+feat(spec,core,objectql): one package entry of a release artifact may state its own `source`, and the registry records it
+
+Clause-②: yes
+Metadata-protocol: added
+
+`ArtifactPackageSchema` (one `packages[]` entry of an assembled release artifact) gains an optional `source: 'code' | 'marketplace'` beside `manifest`. The values are the new `ArtifactPackageSourceSchema`, the subset of `InstalledPackageSourceSchema` a load path can register; `authored` and any other value are refused at the entry gate as `INVALID_ARTIFACT_PACKAGE_ENTRY` (422).
+
+The `manifest` service registers each package with the `source` its entry states, so a merged artifact that carries marketplace installs beside the deployment's own code lists them as `marketplace` on `GET /api/v1/packages`. An entry that states nothing takes the registering door's statement as before (`register(artifact, { source })`, `code` when absent), so existing artifacts register unchanged. An entry's own statement wins over the door's.
+
+`@objectstack/core` adds `resolveArtifactPackageEntries(artifact)`, which returns each package to register as `{ manifest, source? }` in dependency order. `resolveArtifactPackageOrder` is unchanged and still returns the bodies alone.
@@ -136,7 +136,7 @@
  */
 
 import { resolvePluginOrder, type OrderablePlugin } from './plugin-order.js';
-import { ArtifactPackageSchema } from '@objectstack/spec';
+import { ArtifactPackageSchema, type ArtifactPackageSource } from '@objectstack/spec';
 
 /**
  * Refusals raised by {@link resolveArtifactPackageOrder}, as ADR-0112 envelopes
@@ -181,26 +181,61 @@ export function artifactPackageId(manifest: unknown): string | undefined {
   return typeof id === 'string' && id !== '' ? id : undefined;
 }
 
-/** The ordering-relevant projection of one artifact package. */
-interface ArtifactPackageNode extends OrderablePlugin {
+/**
+ * One package to register, as {@link resolveArtifactPackageEntries} answers it:
+ * the body, and the origin its artifact entry stated for it.
+ */
+export interface ArtifactPackageRegistration {
   /** The caller's ORIGINAL manifest body — never a parsed clone. */
   manifest: unknown;
+  /**
+   * The entry's own `source` (`ArtifactPackageSchema`), as written; absent
+   * when the entry states none, and always absent on the single-`manifest`
+   * branch, which has no entry to state one. ⛔ Never defaulted here: the
+   * registering door owns the default, so an absent value stays absent.
+   */
+  source?: ArtifactPackageSource;
 }
 
+/** The ordering-relevant projection of one artifact package. */
+interface ArtifactPackageNode extends OrderablePlugin, ArtifactPackageRegistration {}
+
 /**
  * Resolve an artifact into the manifests to register, in dependency-topological
  * order (ADR-0130 D4 + D5).
  *
+ * The bodies alone, for readers that register no package row (the metadata
+ * door). A door that records a row reads {@link resolveArtifactPackageEntries},
+ * which carries each entry's stated `source` beside its body.
+ *
  * @param artifact - A release artifact (`{ packages: [...] }`), or a bare
  *   manifest / single-`manifest` artifact — both shapes are read.
  * @returns The manifest bodies to register, in the order to register them.
+ * @throws As {@link resolveArtifactPackageEntries}.
+ */
+export function resolveArtifactPackageOrder(artifact: unknown): unknown[] {
+  return resolveArtifactPackageEntries(artifact).map((entry) => entry.manifest);
+}
+
+/**
+ * Resolve an artifact into the packages to register, in dependency-topological
+ * order (ADR-0130 D4 + D5), each with the `source` its entry states.
+ *
+ * One merged artifact may carry packages of different origins, so the origin is
+ * read per entry, off the entry the gate below has already parsed. The same
+ * gate and the same order as {@link resolveArtifactPackageOrder} — that
+ * function IS this one, projected to the bodies.
+ *
+ * @param artifact - A release artifact (`{ packages: [...] }`), or a bare
+ *   manifest / single-`manifest` artifact — both shapes are read.
+ * @returns The packages to register, in the order to register them.
  * @throws An ADR-0112 envelope (`code` + `status: 422`):
  *   `INVALID_ARTIFACT_PACKAGES` for a `packages` that is present but is not an
  *   array (`null` included), `INVALID_ARTIFACT_PACKAGE_ENTRY` for a malformed entry, and
  *   `DUPLICATE_ARTIFACT_PACKAGE` for a duplicate package id. Also
  *   `resolvePluginOrder`'s own error for a cycle.
  */
-export function resolveArtifactPackageOrder(artifact: unknown): unknown[] {
+export function resolveArtifactPackageEntries(artifact: unknown): ArtifactPackageRegistration[] {
   const declared = (artifact as { packages?: unknown } | null | undefined)?.packages;
 
   // D4, second branch: no `packages` key → the artifact carries one package and
@@ -212,7 +247,7 @@ export function resolveArtifactPackageOrder(artifact: unknown): unknown[] {
   // `.optional()` refuses it, so reading it as absent here would answer for an
   // artifact the declaration calls malformed (#19926). It falls to the refusal
   // below with every other non-array value.
-  if (declared === undefined) return [artifact];
+  if (declared === undefined) return [{ manifest: artifact }];
 
   // Present but not an array: malformed, never absent. The rule is stated
   // once, beside `AssembledPackageBodySchema`.
@@ -300,8 +335,11 @@ export function resolveArtifactPackageOrder(artifact: unknown): unknown[] {
         (manifest as { dependencies?: Record<string, unknown> }).dependencies ?? {},
       ),
       manifest,
+      // Read off the PARSED entry: the gate above admitted only a declared
+      // origin, so this is never an unchecked value. Absent stays absent.
+      ...(verdict.data.source !== undefined ? { source: verdict.data.source } : {}),
     });
   });
 
-  return resolvePluginOrder(nodes).map((node) => node.manifest);
+  return resolvePluginOrder(nodes).map(({ manifest, source }) => (source !== undefined ? { manifest, source } : { manifest }));
 }
@@ -20,7 +20,7 @@
  */
 
 import { describe, it, expect, afterEach } from 'vitest';
-import { ObjectKernel, type Plugin, type PluginContext } from '@objectstack/core';
+import { ObjectKernel, resolveArtifactPackageEntries, type Plugin, type PluginContext } from '@objectstack/core';
 import { ObjectQLPlugin } from './plugin.js';
 import type { ObjectQL } from './engine.js';
 import { SchemaRegistry } from './registry.js';
@@ -94,6 +94,55 @@ describe('the manifest service stamps the registering caller\'s source (#23972)'
   });
 });
 
+describe('an artifact entry states its own package\'s source (ADR-0130 D4 entry, `ArtifactPackageSchema.source`)', () => {
+  // A merged artifact: the control plane folds an environment's marketplace
+  // installs into the one artifact the environment boots from, beside its code.
+  const merged = (entries: Array<{ manifest: unknown; source?: unknown }>) => ({ ...body(BUNDLE_A, 'srcbundle'), packages: entries });
+
+  it('a package whose entry states marketplace records marketplace; its sibling stating nothing records code', async () => {
+    const ql = await boot([[merged([
+      { manifest: body(BUNDLE_A, 'srcbundle') },
+      { manifest: body(BUNDLE_B, 'srcbundlex'), source: 'marketplace' },
+    ]), undefined]]);
+    expect([sourceOf(ql, BUNDLE_A), sourceOf(ql, BUNDLE_B)]).toEqual(['code', 'marketplace']);
+  });
+
+  it('an entry that states code is stamped code; one stating marketplace is stamped marketplace', async () => {
+    const ql = await boot([[merged([
+      { manifest: body(BUNDLE_A, 'srcbundle'), source: 'code' },
+      { manifest: body(BUNDLE_B, 'srcbundlex'), source: 'marketplace' },
+    ]), undefined]]);
+    expect([sourceOf(ql, BUNDLE_A), sourceOf(ql, BUNDLE_B)]).toEqual(['code', 'marketplace']);
+  });
+
+  it('the entry\'s statement is the more specific one: it is stamped over the door\'s, which still covers the entries that state none', async () => {
+    const ql = await boot([[merged([
+      { manifest: body(BUNDLE_A, 'srcbundle') },
+      { manifest: body(BUNDLE_B, 'srcbundlex'), source: 'code' },
+    ]), { source: 'marketplace' }]]);
+    expect([sourceOf(ql, BUNDLE_A), sourceOf(ql, BUNDLE_B)]).toEqual(['marketplace', 'code']);
+  });
+
+  it('CONTROL: an artifact none of whose entries states a source keeps today\'s behaviour — code', async () => {
+    const ql = await boot([[merged([
+      { manifest: body(BUNDLE_A, 'srcbundle') },
+      { manifest: body(BUNDLE_B, 'srcbundlex') },
+    ]), undefined]]);
+    expect([sourceOf(ql, BUNDLE_A), sourceOf(ql, BUNDLE_B)]).toEqual(['code', 'code']);
+  });
+
+  it.each(['authored', 'cloud'])('an entry stating `%s` is refused at the entry gate the load path reads', (source) => {
+    let refusal: (Error & { code?: string; status?: number }) | undefined;
+    try {
+      resolveArtifactPackageEntries(merged([{ manifest: body(BUNDLE_A, 'srcbundle'), source }]));
+    } catch (err) {
+      refusal = err as Error & { code?: string; status?: number };
+    }
+    expect(refusal).toMatchObject({ code: 'INVALID_ARTIFACT_PACKAGE_ENTRY', status: 422 });
+    expect(refusal?.message).toContain('source');
+  });
+});
+
 describe('SchemaRegistry.installPackage requires the origin and refuses an unknown one (#23972)', () => {
   it('records the source it is handed on the row', () => {
     const registry = new SchemaRegistry({ logLevel: 'silent' } as never);
 
@@ -5,7 +5,7 @@ import { assembleMetadataProtocol } from '@objectstack/metadata-protocol';
 import { isTenantAuthored, readLegacyOrganizationRows } from '@objectstack/metadata-core';
 import type { MetadataAuthoringChannel } from '@objectstack/metadata-protocol';
 import { Plugin, PluginContext } from '@objectstack/core';
-import { resolveArtifactPackageOrder, artifactPackageId, readDeploymentOrgScopingEntitlement } from '@objectstack/core';
+import { resolveArtifactPackageEntries, artifactPackageId, readDeploymentOrgScopingEntitlement } from '@objectstack/core';
 // [ADR-0130 D4] The residual rule's decision half — which top-level items of a
 // multi-package stack no body declares, and the id they take. See
 // `unclaimedTopLevelObjects` below.
@@ -705,7 +705,7 @@ export class ObjectQLPlugin implements Plugin {
       // [ADR-0130 D4/D5] The load path reads BOTH artifact shapes and registers
       // the packages inside one artifact in dependency-TOPOLOGICAL order.
       //
-      // `resolveArtifactPackageOrder` is the whole of that decision: it reads
+      // `resolveArtifactPackageEntries` is the whole of that decision: it reads
       // `packages` when present and falls back to the caller's own object as a
       // single-element list when absent (D4), and it orders through
       // `resolvePluginOrder` — the platform's ONE topological sorter (ADR-0116).
@@ -723,6 +723,12 @@ export class ObjectQLPlugin implements Plugin {
       // from, stamped on each registry row (`InstalledPackageSchema.source`).
       // Absent means `'code'`, the deployment's own code (`registerApp`'s
       // default); the marketplace install-local plugin states `'marketplace'`.
+      //
+      // One merged artifact may carry packages of different origins, so an
+      // entry may state its own (`ArtifactPackageSchema.source`): the producer
+      // that merged it is the one that knows. A package's own statement is the
+      // more specific one and is stamped as written; a package that states none
+      // takes the door's, as above.
       register: (registeredArtifact: any, options?: { source?: 'code' | 'marketplace' }) => {
         // ADR-0087 D2 at the registration door, for an artifact that carries
         // `packages[]`: its bodies are strictly parsed by the ordering below
@@ -736,7 +742,8 @@ export class ObjectQLPlugin implements Plugin {
         const artifact = Array.isArray(registeredArtifact?.packages)
           ? ql.convertPackageBodyForward(registeredArtifact)
           : registeredArtifact;
-        const ordered = resolveArtifactPackageOrder(artifact) as any[];
+        const entries = resolveArtifactPackageEntries(artifact);
+        const ordered = entries.map((entry) => entry.manifest) as any[];
         // [ADR-0130 D4] The objects of the stack's RESIDUAL — top-level objects
         // no package body declares — as the residual rule answers it. See
         // {@link unclaimedTopLevelObjects}.
@@ -802,8 +809,8 @@ export class ObjectQLPlugin implements Plugin {
           if (refusal) throw refusal;
         }
 
-        for (const manifest of ordered) {
-          ql.registerApp(manifest, scope, options?.source);
+        for (const { manifest, source } of entries as Array<{ manifest: any; source?: 'code' | 'marketplace' }>) {
+          ql.registerApp(manifest, scope, source ?? options?.source);
           ctx.logger.debug('Manifest registered via manifest service', {
             id: manifest.id || manifest.name
           });
 
@@ -0,0 +1,85 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * A kernel booted from a MERGED artifact lists each package with the origin
+ * its artifact entry states (`ArtifactPackageSchema.source`).
+ *
+ * The producer this serves is a control plane that folds an environment's
+ * marketplace installs into the one artifact the environment boots from,
+ * beside the environment's own code. It boots that artifact through
+ * `AppPlugin` → the `manifest` service → `ObjectQL.registerApp`, the door the
+ * deployment's own code uses, whose default is `code` — so without a per-entry
+ * statement every such package was served as `code`, and Setup's marketplace
+ * filter (`source === 'marketplace'` on the `GET /packages` row) showed none.
+ *
+ * Driven end to end on the real chain: a real kernel, the real `AppPlugin` and
+ * `ObjectQLPlugin`, and the real dispatcher's `GET /packages` over the engine
+ * that boot produced.
+ */
+
+import { describe, it, expect, afterEach } from 'vitest';
+import { LiteKernel } from '@objectstack/core';
+import { ObjectQLPlugin, type ObjectQL } from '@objectstack/objectql';
+import { ListInstalledPackagesResponseSchema } from '@objectstack/spec/api-assembled';
+import { AppPlugin } from '../app-plugin.js';
+import { HttpDispatcher } from '../http-dispatcher.js';
+
+const HOST = 'com.example.merged.host';
+const INSTALLED = 'com.example.merged.installed';
+
+const body = (id: string, namespace: string) => ({ id, name: namespace, namespace, version: '1.0.0', type: 'app' });
+
+const kernels: LiteKernel[] = [];
+
+afterEach(async () => {
+    while (kernels.length) await kernels.pop()!.shutdown();
+});
+
+/** Boot `artifact` through `AppPlugin`, and answer `GET /packages` over the engine it produced. */
+async function listBootedFrom(artifact: Record<string, unknown>): Promise<Record<string, unknown>> {
+    const kernel = new LiteKernel({ logger: { level: 'error' } });
+    kernels.push(kernel);
+    kernel.use(new ObjectQLPlugin({}));
+    kernel.use(new AppPlugin(artifact));
+    await kernel.bootstrap();
+
+    // The route reads `.registry` and `.manifests` off the engine slot — the
+    // same handle `packages-writable-verdict.test.ts` hands it.
+    const objectql = kernel.getService<ObjectQL>('objectql');
+    const dispatcher = new HttpDispatcher({ context: { getService: (name: string) => (name === 'objectql' ? objectql : null) } } as any);
+    const r = await dispatcher.handlePackages('/', 'GET', undefined, {}, {
+        request: {},
+        environmentId: 'pkg-artifact-entry-source-test',
+        executionContext: { userId: 'u_admin', isSystem: false, systemPermissions: ['manage_metadata', 'studio.access'] },
+    } as any);
+    expect(r.response?.status ?? 200).toBe(200);
+    // The served body is the declared contract, `source` included.
+    const rows = ListInstalledPackagesResponseSchema.parse(r.response?.body).data.packages;
+    return Object.fromEntries(rows
+        .filter((row) => row.manifest.id === HOST || row.manifest.id === INSTALLED)
+        .map((row) => [row.manifest.id, row.source]));
+}
+
+describe('GET /packages on a kernel booted from a merged artifact', () => {
+    it('lists a package whose entry states marketplace as marketplace, beside the code package that states nothing', async () => {
+        const sources = await listBootedFrom({
+            ...body(HOST, 'mergedhost'),
+            packages: [
+                { manifest: body(HOST, 'mergedhost') },
+                { manifest: body(INSTALLED, 'mergedinst'), source: 'marketplace' },
+            ],
+        });
+        expect(sources).toEqual({ [HOST]: 'code', [INSTALLED]: 'marketplace' });
+    });
+
+    it('CONTROL: packages whose entries state no source keep today\'s behaviour — code', async () => {
+        const sources = await listBootedFrom({
+            ...body(HOST, 'mergedhost'),
+            packages: [
+                { manifest: body(HOST, 'mergedhost') },
+                { manifest: body(INSTALLED, 'mergedinst') },
+            ],
+        });
+        expect(sources).toEqual({ [HOST]: 'code', [INSTALLED]: 'code' });
+    });
+});
@@ -15,6 +15,8 @@
     "ArtifactPackageEntrySchema (const)",
     "ArtifactPackageParsed (type)",
     "ArtifactPackageSchema (const)",
+    "ArtifactPackageSource (type)",
+    "ArtifactPackageSourceSchema (const)",
     "ArtifactStagePackageBody (type)",
     "ArtifactStagePackageBodyParsed (type)",
     "ArtifactStagePackageBodySchema (const)",
 
@@ -15,6 +15,8 @@
     "ArtifactPackageEntrySchema": "src/stack.zod.ts#ArtifactPackageEntrySchema (const)",
     "ArtifactPackageParsed": "src/stack.zod.ts#ArtifactPackageParsed (type)",
     "ArtifactPackageSchema": "src/stack.zod.ts#ArtifactPackageSchema (const)",
+    "ArtifactPackageSource": "src/stack.zod.ts#ArtifactPackageSource (type)",
+    "ArtifactPackageSourceSchema": "src/stack.zod.ts#ArtifactPackageSourceSchema (const)",
     "ArtifactStagePackageBody": "src/stack.zod.ts#ArtifactStagePackageBody (type)",
     "ArtifactStagePackageBodyParsed": "src/stack.zod.ts#ArtifactStagePackageBodyParsed (type)",
     "ArtifactStagePackageBodySchema": "src/stack.zod.ts#ArtifactStagePackageBodySchema (const)",