diff --git a/‎.changeset/21777-sync-schemas-federated-object.md‎
Lines changed: 12 additions & 0 deletions b/‎.changeset/21777-sync-schemas-federated-object.md‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎packages/objectql/src/engine.ts‎
Lines changed: 42 additions & 5 deletions b/‎packages/objectql/src/engine.ts‎
Lines changed: 42 additions & 5 deletions
diff --git a/‎packages/objectql/src/federated-object.ts‎
Lines changed: 33 additions & 0 deletions b/‎packages/objectql/src/federated-object.ts‎
Lines changed: 33 additions & 0 deletions
diff --git a/‎packages/objectql/src/plugin.ts‎
Lines changed: 9 additions & 5 deletions b/‎packages/objectql/src/plugin.ts‎
Lines changed: 9 additions & 5 deletions
@@ -0,0 +1,12 @@
+---
+"@objectstack/objectql": patch
+---
+
+A runtime schema sync (`ObjectQL.syncSchemas()`) no longer sends DDL to an object with `external` set. That sync runs on an install-local install, a rehydrate and template seeding. It also no longer logs the durability ERROR "Schema sync FAILED … not durable" for such an object. The ERROR still fires for any other object whose sync fails.
+
+Clause-②: no
+
+- **What was wrong.** A federated object (ADR-0015) lives on a datasource whose schema the remote database owns. The boot sync never sends it DDL. It binds the object to its remote table with the driver's DDL-free `registerExternalObject`. The runtime sync had no such branch, so it called `syncSchema` on every federated object in the registry. On an external-schema datasource the driver refuses that DDL, as designed. The refusal was then logged as a durability failure, although nothing durable was lost. A showcase-based host printed two false ERROR lines on every install-local install, one each for `showcase_ext_customer` and `showcase_ext_order`. A false alarm on every run teaches operators to skip the one line that, for any other object, means its data is not on disk.
+- **What it does now.** `syncSchemas()` treats a federated object exactly as the boot sync does. It binds the object without DDL and logs a `debug` line. If the driver has no `registerExternalObject`, it skips the object at `debug`. A binding that throws is logged at `warn`. It never calls `syncSchema` for the object. The binding matters for an object registered at runtime: without it, every read resolves to a table named after the object instead of the remote table, and fails with "no such table".
+- **One predicate.** The boot sync, `syncSchemas()` and `syncObjectSchema()` now ask one shared predicate, `external != null`, so the runtime and boot syncs cannot drift apart again. The predicate reads the object's own `external` block, not its datasource's `schemaMode`. An object without `external` that lands on an external-schema datasource still gets the ERROR when its DDL is refused, because it expected a table it did not get.
+- No accepted input, key, export, status or error code changes.
@@ -298,6 +298,8 @@ import {
   rowsWithDeclaredColumnsOnly,
   withDeclaredColumnsOnly,
 } from './declared-read-columns.js';
+// [#21777] "Is this schema the remote's?" One predicate, shared with the boot sync.
+import { isFederatedObject } from './federated-object.js';
 import { applyInMemoryAggregation } from './in-memory-aggregation.js';
 import {
   resolveEngineDeleteDispatch,
@@ -5483,10 +5485,10 @@ export class ObjectQL implements IObjectQLEngine {
     // of their own and were riding the same wrong connection.
     const hasTx = tx !== undefined && this.transactionCoversDriverFor(object, tx);
     const objectSchema = this._registry.getObject(object) as any;
-    // `external != null` is the same predicate `syncObjectSchema` routes a
+    // `isFederatedObject` is the same predicate every schema-sync seam routes a
     // federated object by — one spelling of "this schema is the remote's",
     // not a second reading of it.
-    const isFederated = objectSchema?.external != null;
+    const isFederated = isFederatedObject(objectSchema);
     const hasTenant =
       execCtx?.tenantId !== undefined &&
       !isTenancyDisabled(objectSchema) &&
@@ -5730,7 +5732,7 @@ export class ObjectQL implements IObjectQLEngine {
     // A federated object's schema is the REMOTE's (ADR-0015); the platform's
     // injected column says nothing about it, which is the same reason
     // `buildDriverOptions` withholds `tenantId` there.
-    if (objectSchema?.external != null) return undefined;
+    if (isFederatedObject(objectSchema)) return undefined;
     const tenantField = resolveTenantFieldName(objectSchema);
     if (!tenantField) return undefined;
     // A row that names its own organization has carried one explicitly. Only a
@@ -8410,7 +8412,7 @@ export class ObjectQL implements IObjectQLEngine {
         // caller that is not SYSTEM its rows are the ones its OWN read returns,
         // through every enforcement layer; any other id is 'unreadable', stored or not.
         let ownRead: Set<string> | undefined;
-        if (bound && (targetSchema?.external != null || resolveTenantFieldName(targetSchema) === null)) {
+        if (bound && (isFederatedObject(targetSchema) || resolveTenantFieldName(targetSchema) === null)) {
           const own = await this.find(target, {
             where: { id: { $in: [...ids] } }, fields: ['id'], context: caller as EngineQueryOptions['context'],
           }) as Array<Record<string, unknown>>;
@@ -18304,12 +18306,47 @@ export class ObjectQL implements IObjectQLEngine {
    * Call this after dynamically registering new objects at runtime
    * (e.g. after template seeding) to ensure tables/collections exist
    * before inserting seed data.
+   *
+   * A federated object (ADR-0015 `external`) is not a DDL target. It is bound
+   * to its remote table without DDL, the way the boot sync
+   * (`ObjectQLPlugin.syncRegisteredSchemas`) binds it.
    */
   async syncSchemas(): Promise<void> {
     const allObjects = this._registry.getAllObjects();
     for (const obj of allObjects) {
       const driver = this.getDriverForObject(obj.name);
       if (!driver) continue;
+      // [#21777] Same predicate and same treatment as the boot sync. The remote
+      // owns this object's schema, so `syncSchema` would be refused
+      // (`ExternalSchemaModeViolationError` on an external-schema datasource).
+      // Logging that refusal at the #4632 ERROR below was a false durability
+      // alarm, because nothing was meant to be created. The DDL-free binding
+      // still runs, because an object registered at runtime has no other way
+      // to its remote table: without it every read resolves to a table named
+      // after the object.
+      if (isFederatedObject(obj)) {
+        if (typeof (driver as any).registerExternalObject !== 'function') {
+          this.logger.debug('Driver does not support registerExternalObject, skipping external object', {
+            object: obj.name,
+            driver: (driver as any).name,
+          });
+          continue;
+        }
+        try {
+          await (driver as any).registerExternalObject(obj);
+          this.logger.debug('Federated object is not a DDL target — bound to its remote table without DDL', {
+            object: obj.name,
+            driver: (driver as any).name,
+          });
+        } catch (e: unknown) {
+          this.logger.warn('Failed to register external object metadata', {
+            object: obj.name,
+            driver: (driver as any).name,
+            error: e instanceof Error ? e.message : String(e),
+          });
+        }
+        continue;
+      }
       const tableName = StorageNameMapping.resolveTableName(obj);
       if (typeof (driver as any).syncSchemasBatch === 'function' && (driver as any).supports?.batchSchemaSync) {
         // Already handled per-driver below; skip individual call
@@ -18358,7 +18395,7 @@ export class ObjectQL implements IObjectQLEngine {
     // (its remote schema is owned externally). This is what an app's onEnable
     // calls after registering a late external driver so coercion maps + the
     // physical-table mapping exist for queries. See SqlDriver.registerExternalObject.
-    if (obj.external != null) {
+    if (isFederatedObject(obj)) {
       if (typeof (driver as any).registerExternalObject === 'function') {
         await (driver as any).registerExternalObject(obj);
       }
 
@@ -0,0 +1,33 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Is `schema` a federated object (ADR-0015 `external`), one whose schema is
+ * owned by the REMOTE database?
+ *
+ * This is the ONE spelling of that question for this package's schema-sync
+ * seams. A federated object is never a DDL target: its storage belongs to the
+ * remote, so a sync binds it with the driver's DDL-free
+ * `registerExternalObject` (the object -> remote-table mapping and the
+ * coercion maps a read needs) and never calls `syncSchema`. Three seams make
+ * that decision, and all three ask this predicate, so they cannot drift apart:
+ *
+ * - the boot sync, `ObjectQLPlugin.syncRegisteredSchemas` (and its DDL-free
+ *   sibling and the `kernel:ready` reconciliation);
+ * - the runtime sync, `ObjectQL.syncSchemas`, which install-local installs,
+ *   rehydrates and template seeding run after registering objects;
+ * - the single-object sync, `ObjectQL.syncObjectSchema`.
+ *
+ * They did drift (#21777). The runtime sync had no federated branch, so it sent
+ * DDL to every federated object in the registry. The driver refused it, as
+ * designed for an external-schema datasource, and the refusal was logged as
+ * the #4632 durability ERROR, although nothing durable was lost. Every
+ * install-local install on a showcase host printed that false alarm.
+ *
+ * It is a PRESENCE test, `external != null`, and deliberately not a reading of
+ * the datasource's `schemaMode`. An object with no `external` block is not
+ * federated, whatever datasource it lands on. If its DDL is refused, that is a
+ * real lost sync, and it keeps the ERROR.
+ */
+export function isFederatedObject(schema: unknown): boolean {
+  return (schema as { external?: unknown } | null | undefined)?.external != null;
+}
@@ -7,6 +7,8 @@ import { Plugin, PluginContext } from '@objectstack/core';
 import { resolveArtifactPackageOrder, artifactPackageId } from '@objectstack/core';
 import { applyConversionsToStoredItem } from '@objectstack/spec';
 import { StorageNameMapping } from '@objectstack/spec/system';
+// [#21777] The ONE "is this schema the remote's?" predicate, shared with `ObjectQL.syncSchemas`.
+import { isFederatedObject } from './federated-object.js';
 import { LifecycleService } from './lifecycle/lifecycle-service.js';
 import { lifecycleSettingsManifest } from './lifecycle/lifecycle-settings.js';
 import type { DanglingReferenceAuditOptions } from './integrity/dangling-reference-audit.js';
@@ -1492,7 +1494,7 @@ export class ObjectQLPlugin implements Plugin {
       );
       return;
     }
-    const federated = allObjects.filter((o: any) => o?.external != null);
+    const federated = allObjects.filter((o: any) => isFederatedObject(o));
     if (federated.length === 0) return;
 
     let bound = 0;
@@ -1614,7 +1616,7 @@ export class ObjectQLPlugin implements Plugin {
     let unbound = 0;
 
     for (const obj of allObjects) {
-      if ((obj as any).external != null) {
+      if (isFederatedObject(obj)) {
         federated++;
         continue;
       }
@@ -1757,7 +1759,7 @@ export class ObjectQLPlugin implements Plugin {
         // That is the point at which "still no driver" is final and is a real
         // defect, and it is reported as one — this skip is no longer the last
         // word on a declared external object.
-        if (obj.external != null) {
+        if (isFederatedObject(obj)) {
           ctx.logger.debug(
             'No driver yet for federated object — deferring its remote-table binding to the kernel:ready reconciliation',
             { object: obj.name, datasource: this.ql.resolveEffectiveDatasource?.(obj.name) },
@@ -1776,8 +1778,10 @@ export class ObjectQLPlugin implements Plugin {
       // remote database, so DDL (syncSchema/initObjects) is forbidden and would
       // throw. Register read metadata (physical remote table + coercion maps)
       // without DDL so the query path resolves to the remote table, then skip
-      // the DDL grouping below.
-      if (obj.external != null) {
+      // the DDL grouping below. `ObjectQL.syncSchemas` (the runtime sync) routes
+      // by this SAME predicate and gives the same treatment, so the two passes
+      // cannot disagree about which objects are DDL targets (#21777).
+      if (isFederatedObject(obj)) {
         if (typeof driver.registerExternalObject === 'function') {
           try {
             await driver.registerExternalObject(obj);