@@ -11,6 +11,9 @@ Clause-②: yes (widening)
 
 - **What was left in clear.** `sys_audit_log` declares `lifecycle.archive: { after: '90d', to: 'archive', keep: '7y' }`. Past the hot window, the lifecycle Archiver copies its rows to the datasource named `archive` as they are, then deletes them hot. A `sys_email` / `sys_identity_email` copy archived before the audit writer masked the mail body still holds `body_text` / `body_html` in clear there, password-reset, verification, magic-link and invitation links included, for as long as the archive keeps it. The engine never routes `sys_audit_log` to the archive, so the hot run could not reach those rows.
 - **What changed.** After the hot run, the command reads the archive target each copy table declares (`sys_audit_log` only; `sys_activity` declares none) and runs the same mask, in the same dry-run or `--apply` mode, through that datasource's driver. Each archived row keeps every other column, `updated_at` included. The run is idempotent and its report is counts only. A hot copy masked first is archived masked, so one run covers both the copies already archived and the ones still to be.
-- **Which archives it reaches.** The command now connects the datasources the stack config declares, as `os serve` does. An archive datasource is declared with `autoConnect: true`, since nothing routes objects to it. If the archive is instead a runtime datasource created in Setup → Datasources, which `os serve` connects and this command does not, the run reports it `not-connected` and exits `1` rather than reporting a clean archive. Declare it in the config's `datasources` and re-run.
-- **New in the `--json` document:** an `archive` array, one entry per declared target: `{ datasource, objects, status, report? }`, with `status` one of `examined`, `none`, `not-connected` or `unknown`. The `report` key and its shape are unchanged.
+- **Which archives it reaches.** The command now connects the managed datasources the stack config declares, through the same connect service `os serve` uses. An archive datasource is declared with `autoConnect: true`, since nothing routes objects to it. It is NOT examined, and the run reports `not-connected` and exits `1` rather than reporting a clean archive, in two cases. In the first, the archive is declared but this boot did not connect it; the entry carries the connect status and reason. In the second, the archive is a runtime datasource created in Setup → Datasources, which `os serve` connects and this command does not; declare it in the config's `datasources` and re-run.
+- **What `none` means.** No datasource of that name is declared and connected on this boot, none was attempted, and no active runtime datasource row names one. That is all it checks. An archive a host registers in code outside the stack config is not reached and reads `none`. To mask it, declare it in the stack config's `datasources` with `autoConnect: true`.
+- **The command's boot can now fail on a declared datasource.** A bound, mapped or boot-critical declared datasource that cannot connect now fails the command's boot with exit `1`, as it fails `os serve`'s. `OS_ALLOW_DRIVER_CONNECT_FAILURE` is the same escape.
+- **Run it with the server stopped**, or re-run it once and read 0 to mask in both halves. A live server's Archiver can move a row between the hot run and the archive run.
+- **New in the `--json` document:** an `archive` array, one entry per declared target: `{ datasource, objects, status, report?, connection? }`, with `status` one of `examined`, `none`, `not-connected` or `unknown`. The `report` key and its shape are unchanged.
 - **New exports from `@objectstack/plugin-audit`:** `migrateArchivedMailLogBodyCopies(driver, logger, options)`, the runner over a datasource's driver, and an `objects` option on both runners, which limits a run to the named copy tables. Types `MailLogBodyArchiveDriver`, `MailLogBodyCopyObject` and `MailLogBodyMigrationOptions`.
@@ -1501,9 +1501,15 @@ value.
 
 **Idempotent**: a masked body is the mask, so a second run masks nothing, and
 re-running is how an interrupted run is finished. A failed read or write exits
-`1`. The copies age out with each table's retention (14 days for activity, 90
-for the audit log, unless the deployment lengthens it); run it once after
-upgrading rather than wait for that.
+`1`. Activity copies age out with its 14-day retention. Audit-log copies do not
+age out: with no archive datasource they are retained hot, and with one they
+are moved there after 90 days and kept for seven years. Run it once after
+upgrading.
+
+**Run it with the server stopped**, or re-run it once and read 0 to mask in
+both halves. A live server's Archiver sweeps on its own schedule, and a row it
+moves between the hot run and the archive run can land in the archive
+unmasked.
 
 **The archive datasource too.** `sys_audit_log` declares
 `lifecycle.archive: { after: '90d', to: 'archive', keep: '7y' }`: past the hot
@@ -1516,9 +1522,9 @@ every other column, `updated_at` included. A hot copy masked first is archived
 masked, so one run covers both the copies already archived and the ones still
 to be. `sys_activity` declares no archive: its copies are only ever hot.
 
-The command connects the datasources the stack config declares, as `os serve`
-does, so it reaches an archive declared there. A managed datasource nothing
-routes to is connected only with `autoConnect: true`, which is how an archive
+The command connects the managed datasources the stack config declares through
+the same connect service `os serve` uses. A managed datasource nothing routes
+to is connected only with `autoConnect: true`, which is how an archive
 datasource is declared:
 
 ```ts
@@ -1533,12 +1539,17 @@ The `--json` document carries one `archive` entry per declared target, with a
 | `status` | Meaning | Exit |
 | :--- | :--- | :--- |
 | `examined` | Connected and masked (or counted); `report` holds the counts | `0`, or `1` on a failed read or write |
-| `none` | No such datasource, and no runtime datasource row of that name: the Archiver retains every row hot, so nothing was archived | `0` |
-| `not-connected` | The database holds an active runtime datasource of that name (one created in Setup → Datasources). `os serve` connects it; this command does not, so the archive was **not** examined | `1` |
+| `none` | No datasource of that name is declared and connected on this boot, none was attempted, and no active runtime datasource row names one. That is all it checked | `0` |
+| `not-connected` | The archive was **not** examined. Either the stack config declares it and this boot did not connect it (`connection` carries the connect status and reason), or the database holds an active runtime datasource of that name (one created in Setup → Datasources), which `os serve` connects and this command does not | `1` |
 | `unknown` | Not connected, and the datasource rows could not be read | `1` |
 
-On `not-connected`, declare the archive datasource in the stack config's
-`datasources` (with `autoConnect: true`), then re-run.
+On `not-connected` for a runtime datasource, declare the archive datasource in
+the stack config's `datasources` (with `autoConnect: true`), then re-run. For a
+declared one, make it reachable from where the command runs, then re-run.
+
+An archive that a host registers in code outside the stack config (a plugin
+that publishes the driver itself) is not reached and reads `none`. To mask it,
+declare it in the stack config's `datasources` with `autoConnect: true`.
 
 #### `os migrate organization-ownership`
 
 
@@ -1,5 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
-// test-budget: 70 — spawns the real producer once per single-cause fixture: two served-shape boots that run the real Archiver, and five spawns of the source CLI (dry run, --apply, re-run over the archive fixture; --apply on a project with no archive; a dry run with a runtime archive row); 54.7 s, the slower of two local runs on a shared container, x 1.25, no CI reading yet
+// test-budget: 70 — spawns the real producer once per single-cause fixture: two served-shape boots that run the real Archiver, and six spawns of the source CLI (dry run, --apply, re-run over the archive fixture; --apply on a project with no archive; a dry run with a runtime archive row; --apply with a declared archive that cannot connect); 54.7 s, the slower of two local runs on a shared container, x 1.25, no CI reading yet
 
 /**
  * [#24899] `os migrate audit-mail-bodies` masks the mail-log bodies the
@@ -40,6 +40,10 @@
  *      connects and this command's boot does not) is NOT reported clean: the
  *      archive reads `not-connected` and the command exits 1. With neither a
  *      connected datasource nor such a row it reads `none` and exits 0.
+ *   7. A DECLARED `autoConnect: true` archive this boot cannot connect is NOT
+ *      reported clean either: gate (c) is not fail-fast, so the boot degrades
+ *      and leaves no driver, and the archive reads `not-connected`, carrying
+ *      the connect service's verdict, and the command exits 1.
  *
  * ⛔ The bodies are sentinels, never a link or a token, and every comparison is
  * reported as a count or a boolean.
@@ -51,6 +55,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
 import Database from 'better-sqlite3';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -167,6 +172,11 @@ let hotAfterApply: Record<string, unknown>[];
 let archivedAfterAging: Record<string, unknown>[];
 let runtimeRowRun: Run;
 let noArchiveRun: Run;
+let unreachableDir: string;
+let unreachableRun: Run;
+let archivedAfterDry: Record<string, unknown>[];
+let hotBeforeDry: Record<string, unknown>[];
+let hotAfterDry: Record<string, unknown>[];
 
 function sweep(mode: 'seed' | 'age'): { source: string; archived: number | null } {
   const r = spawnSync(process.execPath, ['--input-type=module', '-e', SWEEP_CHILD], {
@@ -243,7 +253,10 @@ beforeAll(async () => {
   seedDetail = sweep('seed');
   archivedBefore = auditRows(archiveDb);
 
+  hotBeforeDry = auditRows(mainDb);
   runs.dry = await runCommand(dir, mainDb, ['--json']);
+  archivedAfterDry = auditRows(archiveDb);
+  hotAfterDry = auditRows(mainDb);
   runs.apply = await runCommand(dir, mainDb, ['--apply', '--yes', '--json']);
   archivedAfterApply = auditRows(archiveDb);
   hotAfterApply = auditRows(mainDb);
@@ -267,14 +280,27 @@ beforeAll(async () => {
     db.close();
   }
   runtimeRowRun = await runCommand(runtimeRowDir, runtimeRowDb, ['--json']);
+
+  // A declared archive whose SQLite file cannot be opened: its directory is a
+  // regular file, so the connect fails on every attempt.
+  unreachableDir = mkdtempSync(join(tmpdir(), 'os-24899-unreachable-'));
+  writeFileSync(join(unreachableDir, 'blocker'), 'not a directory');
+  writeArtifact(unreachableDir, [
+    { name: 'archive', driver: 'sqlite', config: { filename: join(unreachableDir, 'blocker', 'archive.db') }, autoConnect: true },
+  ]);
+  unreachableRun = await runCommand(unreachableDir, join(unreachableDir, 'main.db'), ['--apply', '--yes', '--json']);
 }, HOOK_TIMEOUT_MS);
 
 afterAll(() => {
   if (dir) rmSync(dir, { recursive: true, force: true });
   if (runtimeRowDir) rmSync(runtimeRowDir, { recursive: true, force: true });
+  if (unreachableDir) rmSync(unreachableDir, { recursive: true, force: true });
 });
 
 const doc = (run: Run): any => JSON.parse(run.stdout);
+/** Two row sets hold the same rows, column for column — a boolean, so a failure prints no row. */
+const sameRows = (a: Record<string, unknown>[], b: Record<string, unknown>[]): boolean =>
+  a.length === b.length && a.every((row, i) => isDeepStrictEqual(row, b[i]));
 const archiveOf = (run: Run): any => doc(run).archive.find((a: { datasource: string }) => a.datasource === 'archive');
 
 describe('[#24899] os migrate audit-mail-bodies over an archive datasource', () => {
@@ -293,8 +319,10 @@ describe('[#24899] os migrate audit-mail-bodies over an archive datasource', ()
       objects: ['sys_audit_log'],
       report: { apply: false, failures: 0, byObject: { sys_audit_log: { scanned: 2, rewritten: 2 } } },
     });
-    // Written only by --apply below: the dry run left the archive as the Archiver did.
-    expect(clear(archivedBefore)).toBe(2);
+    // Both stores, read after the dry run: neither moved.
+    expect(sameRows(archivedAfterDry, archivedBefore)).toBe(true);
+    expect(sameRows(hotAfterDry, hotBeforeDry)).toBe(true);
+    expect(clear(archivedAfterDry)).toBe(2);
   });
 
   it('2. --apply leaves 0 clear copies in either store, and every other archived row is untouched', () => {
@@ -304,14 +332,15 @@ describe('[#24899] os migrate audit-mail-bodies over an archive datasource', ()
     expect(clear(archivedAfterApply)).toBe(0);
     expect(clear(hotAfterApply)).toBe(0);
     const before = new Map(archivedBefore.map((r) => [r.id, r]));
-    for (const row of archivedAfterApply) {
-      const original = before.get(row.id)!;
-      for (const key of Object.keys(original)) {
-        if (key === 'new_value' || key === 'old_value') continue;
-        expect(row[key], `${String(row.id)}.${key}`).toEqual(original[key]);
-      }
-    }
-    expect(archivedAfterApply.find((r) => r.id === 'aud_old_3')).toEqual(before.get('aud_old_3'));
+    const movedColumns = archivedAfterApply.flatMap((row) =>
+      Object.keys(before.get(row.id)!)
+        .filter((key) => key !== 'new_value' && key !== 'old_value')
+        .filter((key) => !isDeepStrictEqual(row[key], before.get(row.id)![key]))
+        .map((key) => `${String(row.id)}.${key}`),
+    );
+    // Names only: an id and a column, never a value.
+    expect(movedColumns).toEqual([]);
+    expect(isDeepStrictEqual(archivedAfterApply.find((r) => r.id === 'aud_old_3'), before.get('aud_old_3'))).toBe(true);
     const masked = JSON.parse(String(archivedAfterApply.find((r) => r.id === 'aud_old_1')!.new_value));
     expect([masked.body_text === MASK, masked.body_html === MASK, masked.subject === 'Subject kept']).toEqual([true, true, true]);
   });
@@ -321,7 +350,7 @@ describe('[#24899] os migrate audit-mail-bodies over an archive datasource', ()
     expect(run.code, run.stderr.slice(-2000)).toBe(0);
     expect(doc(run).report.rewritten).toBe(0);
     expect(archiveOf(run).report).toMatchObject({ scanned: 2, rewritten: 0, failures: 0 });
-    expect(archivedAfterAgain).toEqual(archivedAfterApply);
+    expect(sameRows(archivedAfterAgain, archivedAfterApply)).toBe(true);
   });
 
   it('4. the copy that was hot when the command ran is archived masked', () => {
@@ -332,7 +361,7 @@ describe('[#24899] os migrate audit-mail-bodies over an archive datasource', ()
   });
 
   it('5. no run prints a body', () => {
-    for (const run of [runs.dry, runs.apply, runs.again, runtimeRowRun, noArchiveRun]) {
+    for (const run of [runs.dry, runs.apply, runs.again, runtimeRowRun, noArchiveRun, unreachableRun]) {
       expect(`${run.stdout}\n${run.stderr}`.includes(SENTINEL)).toBe(false);
     }
   });
@@ -343,4 +372,13 @@ describe('[#24899] os migrate audit-mail-bodies over an archive datasource', ()
     expect(runtimeRowRun.code).toBe(1);
     expect(archiveOf(runtimeRowRun)).toEqual({ datasource: 'archive', objects: ['sys_audit_log'], status: 'not-connected' });
   });
+
+  it('7. a declared archive this boot cannot connect is NOT reported clean', () => {
+    expect(unreachableRun.code).toBe(1);
+    const entry = archiveOf(unreachableRun);
+    expect(entry).toMatchObject({ datasource: 'archive', objects: ['sys_audit_log'], status: 'not-connected' });
+    expect(typeof entry.connection?.status).toBe('string');
+    expect(entry.connection.status === 'connected' || entry.connection.status === 'already-registered').toBe(false);
+    expect(entry.report).toBeUndefined();
+  });
 });