@@ -0,0 +1,19 @@
+---
+'@objectstack/objectql': minor
+'@objectstack/runtime': minor
+'@objectstack/cli': minor
+---
+
+fix(objectql)!: a disabled package's `objectExtensions` fields are withheld from the object they extend, and come back with their values on enable
+
+Clause-②: yes (narrowing) — while a package is disabled, the served object it extends (`GET /api/v1/meta/object/:name`, the record page, the `/data` field map) no longer carries the fields, validation rules and indexes the package's `objectExtensions` add, so a `/data` write, filter, sort or `fields` projection naming one of those fields is refused as a field the object does not have (`400 INVALID_FIELD` / `INVALID_SORT`), and `GET /api/v1/packages/:id/customizations` no longer lists them among the base's `contributions`.
+Metadata-protocol: semantic
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and nothing stored changes: the extension, its columns and its values stay as they are, and enabling the package serves them again. -->
+
+**BREAKING** served-object narrowing under package disable (`@objectstack/objectql`, `@objectstack/runtime`, `@objectstack/cli`).
+
+- **Before.** Disabling a package withheld its objects (`404 OBJECT_PACKAGE_DISABLED`), flows, navigation items, permissions and actions, but the fields its `objectExtensions` add to another package's object stayed on that object: in `/meta/object`, in every `/data` read and on the record page.
+- **Now.** The served fold of an object leaves out every `extend` contribution of a disabled package: its fields, its validation rules, its indexes and its field patches. A base layer that already carries them (a tenant overlay saved from a served read, a metadata-service copy of a resolved object) has those fields and rules taken off too. A field the owner itself declares, or another enabled extension also adds, stays. A write naming a withheld field answers exactly what a write naming an unknown field answers; a write through the object's other fields lands and leaves the withheld values alone.
+- **Kept.** Schema sync, the federated binding and the lifecycle sweep read the object with every extension folded in (`SchemaRegistry.getStorageObject` / `getAllStorageObjects`), so a disable never drops or skips a column, and a boot that starts with the package disabled still creates them. Enabling the package serves the fields again with the stored values. With `OS_SKIP_SCHEMA_SYNC=1`, `os migrate`'s drift plan no longer reports a disabled module's columns as orphan columns to drop.
+- **Who moves.** A client that reads a disabled module's extension fields gets the object without them. A formula on the object that reads a withheld field answers `null`. A validation rule of another, enabled package that reads a withheld field cannot be evaluated, so writes to the object are refused (`400 VALIDATION_FAILED`, naming the rule) until the field's package is enabled again or the rule's package declares and keeps that package.
@@ -5,6 +5,8 @@ import { describe, it, expect, afterEach, beforeEach } from 'vitest';
 import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { SchemaRegistry } from '@objectstack/objectql';
 import {
   findHostConfig,
   composeForDeclarations,
@@ -803,6 +805,66 @@ describe('measureComposedCoverage (#13028)', () => {
   });
 });
 
+/**
+ * A disabled package's `objectExtensions` are withheld from the SERVED object
+ * and kept at the storage layer. The DDL-free binding (`OS_SKIP_SCHEMA_SYNC`)
+ * installs each object it reads as the driver's managed field set, which is
+ * what the drift report diffs the live table against, so it must read the
+ * storage fold: on the served one, a column a disable only hides is reported
+ * as an orphan to drop. The one case in this file that reaches a real driver,
+ * because the answer at stake is that driver's own drift report.
+ */
+describe('measureComposedCoverage, DDL-free, with a disabled package\'s extension', () => {
+  const APP = 'com.qa.migrate.app';
+  const MODULE = 'com.qa.migrate.orders';
+  const OBJECT = 'qm_account';
+  let dir: string | undefined;
+  const drivers: SqlDriver[] = [];
+  afterEach(async () => {
+    while (drivers.length) await drivers.pop()!.disconnect().catch(() => {});
+    if (dir) rmSync(dir, { recursive: true, force: true });
+    dir = undefined;
+  });
+
+  const sqlDriver = (file: string): SqlDriver => {
+    const driver = new SqlDriver({ client: 'better-sqlite3', connection: { filename: file }, useNullAsDefault: true });
+    (driver as any).logger = { debug() {}, info() {}, warn() {}, error() {} };
+    drivers.push(driver);
+    return driver;
+  };
+
+  it('binds the column the disable hides, so the drift report proposes no drop of it and the value stays', async () => {
+    const registry = new SchemaRegistry({ multiTenant: false });
+    (registry as any).logLevel = 'silent';
+    registry.installPackage({ id: APP, name: APP, version: '1.0.0', type: 'app', namespace: 'qm' } as any, 'code');
+    registry.installPackage({ id: MODULE, name: MODULE, version: '1.0.0', type: 'module', namespace: 'qm', dependencies: { [APP]: '^1.0.0' } } as any, 'code');
+    registry.registerObject({ name: OBJECT, fields: { name: { name: 'name', type: 'text' } } } as any, APP, undefined, 'own');
+    registry.registerObject({ name: OBJECT, fields: { qm_credit: { name: 'qm_credit', type: 'number' } } } as any, MODULE, undefined, 'extend');
+
+    // The table as a boot with the module enabled created it, holding a value.
+    dir = mkdtempSync(join(tmpdir(), 'os-migrate-disabled-ext-'));
+    const file = join(dir, 'data.db');
+    const first = sqlDriver(file);
+    await first.initObjects([registry.getStorageObject(OBJECT) as any]);
+    await (first as any).knex(OBJECT).insert({ id: 'a1', name: 'acme', qm_credit: 500, organization_id: 'org_a' });
+    await first.disconnect();
+    drivers.pop();
+
+    registry.disablePackage(MODULE);
+    expect(Object.keys(registry.getObject(OBJECT)?.fields ?? {}), 'precondition: the served object withholds it').not.toContain('qm_credit');
+
+    const driver = sqlDriver(file);
+    const engine = { registry, getDriverForObject: () => driver, syncObjectSchema: async () => { throw new Error('DDL on a DDL-free plan'); } };
+    const kernel = { getService: (slot: string) => (slot === 'objectql' ? engine : undefined) };
+    const out = await measureComposedCoverage(kernel, [driver], false, { ddlFree: true });
+    expect(out.coverage).toMatchObject({ registeredObjects: 1, examinedObjects: 1 });
+
+    const drift = (await driver.detectManagedDrift()).map((d: any) => `${d.op?.type}:${d.op?.column ?? d.op?.indexName ?? ''}`);
+    expect(drift.filter((op) => op.includes('qm_credit'))).toEqual([]);
+    expect(await (driver as any).knex(OBJECT).where({ id: 'a1' }).first()).toMatchObject({ qm_credit: 500 });
+  });
+});
+
 /**
  * [#22506] What `os migrate plan` / `apply` compose AROUND the stack
  * (`servedPlatform`): the auth family behind `serve`'s auth gate, the provider
 
@@ -2399,7 +2399,13 @@ export async function measureComposedCoverage(
   // the injected-columns plan's input, so it is installed before one object
   // is bound. See this function's docblock.
   notes.push(...installDeploymentPlatformGlobalObjects(kernel, engine?.registry));
-  const objects: unknown = engine?.registry?.getAllObjects?.();
+  // The STORAGE layer's objects: a disabled package's `objectExtensions`
+  // folded in. The DDL-free binding below installs each one as the driver's
+  // managed field set, so a served fold here would make the drift report
+  // propose dropping every column a disable only hides.
+  const objects: unknown = typeof engine?.registry?.getAllStorageObjects === 'function'
+    ? engine.registry.getAllStorageObjects()
+    : engine?.registry?.getAllObjects?.();
   if (
     !Array.isArray(objects)
     || typeof engine?.getDriverForObject !== 'function'
 
@@ -117,7 +117,9 @@ export async function introspectDatasource(
 export async function syncSchemas(
   this: Pick<CompatibilityApiHost, '_registry' | 'getDriverForObject' | 'logger'>,
 ): Promise<void> {
-  const allObjects = this._registry.getAllObjects();
+  // The storage layer's objects: a disabled package's extensions folded in,
+  // so the DDL keeps their columns (`SchemaRegistry.getStorageObject`).
+  const allObjects = this._registry.getAllStorageObjects();
   for (const obj of allObjects) {
     const driver = this.getDriverForObject(obj.name);
     if (!driver) continue;
@@ -187,7 +189,8 @@ export async function syncObjectSchema(
   this: Pick<CompatibilityApiHost, '_registry' | 'getDriverForObject'>,
   objectName: string,
 ): Promise<void> {
-  const obj = this._registry.getObject(objectName) as any;
+  // The storage layer's object, as {@link syncSchemas} reads it.
+  const obj = this._registry.getStorageObject(objectName) as any;
   if (!obj) return;
   const driver = this.getDriverForObject(objectName);
   if (!driver) return;
 
@@ -100,6 +100,14 @@ export interface LifecycleEngineLike {
      * exactly as it did before this member existed. Every real engine has it.
      */
     getObject?(name: string): unknown;
+    /**
+     * The objects as the storage layer sees them: a disabled package's
+     * `objectExtensions` folded in (`SchemaRegistry.getAllStorageObjects`).
+     * The sweep reads these, so the archive datasource's schema keeps every
+     * column the hot rows it copies carry. Optional, as `getObject` is: a
+     * double modelling only `getAllObjects` is read through that.
+     */
+    getAllStorageObjects?(): LifecycleObjectLike[];
   };
   delete(
     object: string,
@@ -733,8 +741,9 @@ export class LifecycleService {
 
     this.sweeping = true;
     try {
-      const declared = engine.registry
-        .getAllObjects()
+      const declared = (typeof engine.registry.getAllStorageObjects === 'function'
+        ? engine.registry.getAllStorageObjects()
+        : engine.registry.getAllObjects())
         .filter((o) => o?.lifecycle && o.lifecycle.class !== 'record');
 
       // Governance snapshot (P4): settings-driven overrides / quotas.
 
@@ -2099,8 +2099,9 @@ export class ObjectQLPlugin implements Plugin {
    * exactly the incomplete test double #9154 measured.
    *
    * @param seam - the calling method, named in the thrown message.
+   * @param layer - `storage` for a DDL / binding reader, `served` otherwise.
    */
-  private readRegisteredObjects(seam: string): ServiceObject[] {
+  private readRegisteredObjects(seam: string, layer: 'served' | 'storage' = 'served'): ServiceObject[] {
     const registry: any = (this.ql as any)?.registry;
     const read: unknown = registry?.getAllObjects;
     if (registry == null || typeof read !== 'function') {
@@ -2114,6 +2115,13 @@ export class ObjectQLPlugin implements Plugin {
           '`getAllObjects()` — a duck-typed engine or an incomplete test double is the only way to reach this line.',
       );
     }
+    // A STORAGE reader (DDL, the federated binding) reads the objects with
+    // every extension folded in, a disabled package's included: a disable must
+    // not take a column away from the data it keeps
+    // (`SchemaRegistry.getAllStorageObjects`). A registry without that read
+    // answers its served fold, as before.
+    const storage: unknown = registry.getAllStorageObjects;
+    if (layer === 'storage' && typeof storage === 'function') return (storage as () => ServiceObject[]).call(registry);
     return (read as () => ServiceObject[]).call(registry);
   }
 
@@ -2186,7 +2194,7 @@ export class ObjectQLPlugin implements Plugin {
     // looks healthy while declared data is simply not reachable.
     let allObjects: ServiceObject[];
     try {
-      allObjects = this.readRegisteredObjects('reconcileFederatedBindings');
+      allObjects = this.readRegisteredObjects('reconcileFederatedBindings', 'storage');
     } catch (e: unknown) {
       ctx.logger.error(
         'Federated (external) object reconciliation did NOT run — the object registry could not be read, so this boot ' +
@@ -2338,7 +2346,7 @@ export class ObjectQLPlugin implements Plugin {
     // [#9285] Same propagation contract as the sync pass: "the registry holds
     // nothing" and "the registry could not be read" have opposite consequences
     // and only the first is a truthful reason to register nothing.
-    const allObjects = this.readRegisteredObjects('registerSchemasWithoutDdl');
+    const allObjects = this.readRegisteredObjects('registerSchemasWithoutDdl', 'storage');
     if (allObjects.length === 0) return;
 
     const groups = new Map<any, ServiceObject[]>();
@@ -2423,7 +2431,7 @@ export class ObjectQLPlugin implements Plugin {
     // against a store whose DDL was never run. On the `metadata:reloaded` path
     // the caller already catches this and reports it at `error` (#4632), so
     // propagation there is a loud durability report, not a dead kernel.
-    const allObjects = this.readRegisteredObjects('syncRegisteredSchemas');
+    const allObjects = this.readRegisteredObjects('syncRegisteredSchemas', 'storage');
     if (allObjects.length === 0) return;
 
     let synced = 0;