@@ -0,0 +1,13 @@
+---
+'@objectstack/objectql': patch
+---
+
+An app, object or other item registered through `ObjectQL.registerApp` is now served with its package's `_packageVersion`, as the artifact loader already serves it
+
+Clause-②: no
+
+`_packageVersion` ("Owning package version") is declared on the protection envelope, and the metadata plugin's artifact loader stamps it. The registry load path stamped only `_packageId`: `ObjectQL.registerApp(manifest)` called `SchemaRegistry.registerItem` and `registerObject` with the package id alone. So `GET /api/v1/meta/app` served such an app with no version, and a console waiting for an upgrade could not tell the new app from the old one that a stale kernel still serves.
+
+`registerApp` now stamps `manifest.version` on every item it registers: owned objects, object extensions, apps, every metadata collection, seed datasets, and the objects, app and collections of a nested plugin, which carry their owning package's version. A multi-package stack's residual top-level objects, which the engine registers under the stack's own id, now carry the stack's version too, as the metadata door stamps them. Each item is stamped before it reaches the registry, with the artifact loader's own call, `applyProtection(item, { packageId, packageVersion })`. The registry's stamp knows the id only, and it keeps a version that is already set. No signature changes: `SchemaRegistry.registerItem`, `registerObject` and `registerApp` keep theirs.
+
+A caller that passes only a package id still stamps the id alone. No version is looked up or invented. Those callers are the metadata-service re-sync and the facade, which pass along the stamp the artifact loader already put on the item; the stored-row hydration, whose rows are tenant-authored; and the security catalog's built-ins.
@@ -129,14 +129,17 @@ describe('ObjectQL Engine', () => {
             const manifest = {
                 id: 'com.example.app',
                 namespace: 'example',
+                version: '1.2.0',
                 objects: [
                     { name: 'task', fields: {} }
                 ]
             };
 
             engine.registerApp(manifest);
+            // The engine stamps the manifest's version before the registry sees
+            // the object; the registry's own signature is unchanged.
             expect(SchemaRegistry.registerObject).toHaveBeenCalledWith(
-                expect.objectContaining({ name: 'task' }), 
+                expect.objectContaining({ name: 'task', _packageId: 'com.example.app', _packageVersion: '1.2.0' }), 
                 'com.example.app',
                 'example',
                 'own'
 
@@ -250,7 +250,7 @@ import {
 } from './secret-fields.js';
 import { assertGroupByNamesNoJsonStoredField } from './group-by-structured-json-door.js';
 import { assertAggregationFieldTypesAccepted } from './aggregate-field-type-door.js';
-import { pluralToSingular, ExternalWriteForbiddenError } from '@objectstack/spec/shared';
+import { applyProtection, pluralToSingular, ExternalWriteForbiddenError } from '@objectstack/spec/shared';
 import { SchemaRegistry, computeFQN, type ArtifactInstallScope } from './registry.js';
 import { expandSearchToFilter } from './search-filter.js';
 import { isSearchCompanionRequested, stripSearchCompanion } from './search-companion.js';
@@ -4069,6 +4069,32 @@ function cascadeSetAdd(index: Map<string, Set<string>>, object: string, id: unkn
   return true;
 }
 
+/**
+ * [ADR-0010 §3.7] Stamp a manifest item with its owning package's
+ * `(packageId, packageVersion)` before the registry stores it: the call the
+ * artifact loader makes (`metadata/plugin.ts`), so both load paths serve one
+ * envelope. The registry's own `applyProtection` knows the id only, and
+ * `applyProtection` stamps a key only while it is unset, so the version
+ * stamped here is the one the item keeps. With no version this does nothing:
+ * the registry stamps the id, exactly as before.
+ */
+function stampPackage<T>(item: T, packageId: string, packageVersion: string | undefined): T {
+  if (packageVersion !== undefined) applyProtection(item as any, { packageId, packageVersion });
+  return item;
+}
+
+/**
+ * {@link stampPackage} for an authored OBJECT definition, on a shallow copy.
+ * The registry stamps an object schema on its own copy (`applySystemFields`
+ * and friends run first), so `registerApp` leaves the caller's definition
+ * unstamped, and a manifest registered twice, or recorded by a second install,
+ * shows the same objects both times. `applyProtection` writes top-level keys
+ * only, so a shallow copy holds every key it touches.
+ */
+function stampObjectPackage(def: ServiceObject, packageId: string, packageVersion: string | undefined): ServiceObject {
+  return packageVersion === undefined ? def : stampPackage({ ...def }, packageId, packageVersion);
+}
+
 export class ObjectQL implements IObjectQLEngine {
   /**
    * Ambient transaction store (ADR-0034). While a `transaction()` callback
@@ -7295,6 +7321,9 @@ export class ObjectQL implements IObjectQLEngine {
   registerApp(manifest: any, scope?: ArtifactInstallScope) {
       const id = manifest.id || manifest.name;
       const namespace = manifest.namespace as string | undefined;
+      // Stamped beside `id` on every item below ({@link stampPackage}), so an
+      // item served from this path tells an upgrade's new item from its old one.
+      const version = manifest.version as string | undefined;
       this.invalidateSummaryIndex(); // new objects may add/change summary fields
       this.logger.debug('Registering package manifest', { id, namespace });
 
@@ -7329,7 +7358,7 @@ export class ObjectQL implements IObjectQLEngine {
           if (Array.isArray(manifest.objects)) {
              this.logger.debug('Registering objects from manifest (Array)', { id, objectCount: manifest.objects.length });
              for (const objDef of manifest.objects) {
-                const fqn = this._registry.registerObject(objDef, id, namespace, 'own');
+                const fqn = this._registry.registerObject(stampObjectPackage(objDef, id, version), id, namespace, 'own');
                 this.logger.debug('Registered Object', { fqn, from: id });
              }
           } else {
@@ -7342,7 +7371,7 @@ export class ObjectQL implements IObjectQLEngine {
              for (const [name, objDef] of Object.entries(manifest.objects) as [string, ServiceObject][]) {
                 // Ensure name in definition matches key
                 objDef.name = name;
-                const fqn = this._registry.registerObject(objDef, id, namespace, 'own');
+                const fqn = this._registry.registerObject(stampObjectPackage(objDef, id, version), id, namespace, 'own');
                 this.logger.debug('Registered Object', { fqn, from: id });
              }
           }
@@ -7365,7 +7394,7 @@ export class ObjectQL implements IObjectQLEngine {
                   indexes: ext.indexes,
               };
               // Register as extension (namespace is undefined since we're targeting by FQN)
-              this._registry.registerObject(extDef, id, undefined, 'extend', priority);
+              this._registry.registerObject(stampPackage(extDef, id, version), id, undefined, 'extend', priority);
               this.logger.debug('Registered Object Extension', { target: targetFqn, priority, from: id });
           }
       }
@@ -7379,7 +7408,7 @@ export class ObjectQL implements IObjectQLEngine {
               const appName = app.name || app.id;
               if (appName) {
                   const resolved = namespace ? this.resolveNavObjectNames(app, namespace) : app;
-                  this._registry.registerApp(resolved, id);
+                  this._registry.registerApp(stampPackage(resolved, id, version), id);
                   this.logger.debug('Registered App', { app: appName, from: id });
               }
           }
@@ -7389,7 +7418,7 @@ export class ObjectQL implements IObjectQLEngine {
       //    This handles the case where the manifest IS the app definition (legacy/simple packages)
       if (manifest.name && manifest.navigation && !manifest.apps?.length) {
           const resolved = namespace ? this.resolveNavObjectNames(manifest, namespace) : manifest;
-          this._registry.registerApp(resolved, id);
+          this._registry.registerApp(stampPackage(resolved, id, version), id);
           this.logger.debug('Registered manifest-as-app', { app: manifest.name, from: id });
       }
 
@@ -7410,15 +7439,15 @@ export class ObjectQL implements IObjectQLEngine {
       // 5. Register all other metadata types generically — the SAME seam the
       //    nested-plugin path uses (`registerMetadataCollections`), so the two
       //    entry points cannot answer differently for one collection (#7163).
-      this.registerMetadataCollections(manifest, id, 'manifest');
+      this.registerMetadataCollections(manifest, id, 'manifest', version);
 
       // 6. Register seed data as metadata (keyed by target object name)
       const seedData = (manifest as any).data;
       if (Array.isArray(seedData) && seedData.length > 0) {
           this.logger.debug('Registering seed data datasets', { id, count: seedData.length });
           for (const dataset of seedData) {
               if (dataset.object) {
-                  this._registry.registerItem('data', dataset, 'object' as any, id);
+                  this._registry.registerItem('data', stampPackage(dataset, id, version), 'object' as any, id);
               }
           }
       }
@@ -7449,7 +7478,7 @@ export class ObjectQL implements IObjectQLEngine {
               if (plugin && typeof plugin === 'object') {
                   const pluginName = plugin.name || plugin.id || 'unnamed-plugin';
                   this.logger.debug('Registering nested plugin', { pluginName, parentId: id });
-                  this.registerPlugin(plugin, id, namespace);
+                  this.registerPlugin(plugin, id, namespace, version);
               }
           }
       }
@@ -7489,7 +7518,8 @@ export class ObjectQL implements IObjectQLEngine {
    * @param parentId - The parent package ID (for ownership tracking)
    * @param parentNamespace - The parent package's namespace (for FQN resolution)
    */
-  private registerPlugin(plugin: any, parentId: string, parentNamespace?: string) {
+  private registerPlugin(plugin: any, parentId: string, parentNamespace?: string, parentVersion?: string) {
+      // `parentVersion` is the owning package's version, stamped like `parentId`.
       const pluginName = plugin.name || plugin.id || 'unnamed';
       const pluginNamespace = plugin.namespace || parentNamespace;
 
@@ -7504,7 +7534,7 @@ export class ObjectQL implements IObjectQLEngine {
               if (Array.isArray(plugin.objects)) {
                   this.logger.debug('Registering plugin objects (Array)', { pluginName, count: plugin.objects.length });
                   for (const objDef of plugin.objects) {
-                      const fqn = this._registry.registerObject(objDef, ownerId, pluginNamespace, 'own');
+                      const fqn = this._registry.registerObject(stampObjectPackage(objDef, ownerId, parentVersion), ownerId, pluginNamespace, 'own');
                       this.logger.debug('Registered Object', { fqn, from: pluginName });
                   }
               } else {
@@ -7514,7 +7544,7 @@ export class ObjectQL implements IObjectQLEngine {
                   this.logger.debug('Registering plugin objects (Map)', { pluginName, count: entries.length });
                   for (const [name, objDef] of entries) {
                       objDef.name = name;
-                      const fqn = this._registry.registerObject(objDef, ownerId, pluginNamespace, 'own');
+                      const fqn = this._registry.registerObject(stampObjectPackage(objDef, ownerId, parentVersion), ownerId, pluginNamespace, 'own');
                       this.logger.debug('Registered Object', { fqn, from: pluginName });
                   }
               }
@@ -7527,7 +7557,7 @@ export class ObjectQL implements IObjectQLEngine {
       if (plugin.name && plugin.navigation) {
           try {
               const resolved = pluginNamespace ? this.resolveNavObjectNames(plugin, pluginNamespace) : plugin;
-              this._registry.registerApp(resolved, ownerId);
+              this._registry.registerApp(stampPackage(resolved, ownerId, parentVersion), ownerId);
               this.logger.debug('Registered plugin-as-app', { app: plugin.name, from: pluginName });
           } catch (err: any) {
               this.logger.warn('Failed to register plugin as app', { pluginName, error: err.message });
@@ -7543,7 +7573,7 @@ export class ObjectQL implements IObjectQLEngine {
       // list is no longer copied here to be patched one name at a time; the
       // aggregated-view expansion, #7163, for why the loop BODY is no longer
       // copied here either).
-      this.registerMetadataCollections(plugin, ownerId, 'nested plugin');
+      this.registerMetadataCollections(plugin, ownerId, 'nested plugin', parentVersion);
   }
 
   /**
@@ -7588,7 +7618,8 @@ export class ObjectQL implements IObjectQLEngine {
    * @param ownerId  The owning package id — stamped as ADR-0010 provenance.
    * @param sourceLabel Human-readable source name for the `debug` line.
    */
-  private registerMetadataCollections(source: any, ownerId: string, sourceLabel: string) {
+  private registerMetadataCollections(source: any, ownerId: string, sourceLabel: string, ownerVersion?: string) {
+      // `ownerVersion` is the owning package's version, stamped like `ownerId`.
       for (const key of METADATA_ARRAY_KEYS) {
           const items = (source as any)?.[key];
           if (!Array.isArray(items) || items.length === 0) continue;
@@ -7685,7 +7716,7 @@ export class ObjectQL implements IObjectQLEngine {
                   err.httpStatus = 422;
                   throw err;
               }
-              this._registry.registerItem(pluralToSingular(key), toRegister, 'name' as any, ownerId);
+              this._registry.registerItem(pluralToSingular(key), stampPackage(toRegister, ownerId, ownerVersion), 'name' as any, ownerId);
               // "Object has-many View" (ADR-0017): a `defineView` document
               // aggregates an object's views. Register the container under the
               // bare <object> key (above, back-compat) AND expand it into
@@ -7697,7 +7728,7 @@ export class ObjectQL implements IObjectQLEngine {
                       for (const w of vi._diagnostics?.warnings ?? []) {
                           this.logger.warn(`View expansion warning for '${vi.name}': ${w.message}`, { from: ownerId });
                       }
-                      this._registry.registerItem('view', vi, 'name' as any, ownerId);
+                      this._registry.registerItem('view', stampPackage(vi, ownerId, ownerVersion), 'name' as any, ownerId);
                   }
               }
           }
@@ -7740,7 +7771,7 @@ export class ObjectQL implements IObjectQLEngine {
                   continue;
               }
               const toRegister = body.name === itemName ? body : { ...body, name: itemName };
-              this._registry.registerItem('view', toRegister, 'name' as any, ownerId);
+              this._registry.registerItem('view', stampPackage(toRegister, ownerId, ownerVersion), 'name' as any, ownerId);
           }
       }
   }
 
@@ -160,6 +160,8 @@ describe('ADR-0130 D4 — the manifest service registers the residual\'s objects
       acme_note: RELEASE_ID,
     });
     expect((ql.registry.resolveObject('acme_note') as { _packageId?: string } | undefined)?._packageId).toBe(RELEASE_ID);
+    // …with the stack's version beside it, as the metadata door stamps the residual (#22689).
+    expect((ql.registry.resolveObject('acme_note') as { _packageVersion?: string } | undefined)?._packageVersion).toBe('1.0.0');
     expect(unservedLines(recorder)).toEqual([]);
   });
 
 
@@ -11,6 +11,7 @@ import { resolveArtifactPackageOrder, artifactPackageId, readDeploymentOrgScopin
 import { unclaimedTopLevel } from '@objectstack/metadata';
 import { applyConversionsToStoredItem } from '@objectstack/spec';
 import { StorageNameMapping } from '@objectstack/spec/system';
+import { applyProtection } from '@objectstack/spec/shared';
 // [#21777] The ONE "is this schema the remote's?" predicate, shared with `ObjectQL.syncSchemas`.
 import { isFederatedObject } from './federated-object.js';
 // [#22070] The builtin audit stamps are wrapped like a bound hook but registered in code.
@@ -104,13 +105,15 @@ function hasLoadMetaFromDb(service: unknown): service is ProtocolWithDbRestore {
  */
 function unclaimedTopLevelObjects(
   stack: unknown,
-): { ownerId: string | undefined; objects: ServiceObject[] } | undefined {
+): { ownerId: string | undefined; ownerVersion: string | undefined; objects: ServiceObject[] } | undefined {
   const residual = unclaimedTopLevel(stack);
   if (!residual) return undefined;
   const objects = residual.items
     .filter((entry) => entry.type === 'object')
     .map((entry) => entry.item as ServiceObject);
-  return objects.length > 0 ? { ownerId: residual.ownerId, objects } : undefined;
+  return objects.length > 0
+    ? { ownerId: residual.ownerId, ownerVersion: residual.ownerVersion, objects }
+    : undefined;
 }
 
 /**
@@ -2307,7 +2310,7 @@ export class ObjectQLPlugin implements Plugin {
    */
   private registerUnclaimedTopLevelObjects(
     ctx: PluginContext,
-    residual: { ownerId: string | undefined; objects: ServiceObject[] },
+    residual: { ownerId: string | undefined; ownerVersion: string | undefined; objects: ServiceObject[] },
     bodies: unknown[],
   ): void {
     const ql = this.ql;
@@ -2325,7 +2328,14 @@ export class ObjectQLPlugin implements Plugin {
         continue;
       }
       try {
-        ql.registry.registerObject(object, residual.ownerId, undefined, 'own');
+        // The metadata door stamps the residual with `(ownerId, ownerVersion)`. The
+        // registry's own stamp knows the id only and keeps a key already set, so
+        // the version is stamped here first — on a shallow copy, leaving the
+        // artifact's own object as the registry leaves it.
+        const stamped = residual.ownerVersion === undefined
+          ? object
+          : applyProtection({ ...object } as any, { packageId: residual.ownerId, packageVersion: residual.ownerVersion }) as ServiceObject;
+        ql.registry.registerObject(stamped, residual.ownerId, undefined, 'own');
       } catch (e) {
         if (!(e instanceof ObjectOwnershipConflictError)) throw e;
         unserved.push(`'${object.name}' (package '${e.existingPackageId}' already owns that name)`);