@@ -0,0 +1,13 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+fix(metadata-protocol): removing a field that stores nothing is not a destructive change
+
+Clause-②: yes (widening) (the save door newly accepts, without `force`, a removal it refused; owes the seat's `TIER_DEFAULT` review of record before the queue)
+
+- **What changed.** The object save's safety diff (`PUT /api/v1/meta/object/:name`, and every other door that reaches `saveMetaItem`'s destructive gate) now judges each finding by whether the field is stored, using the spec's storage predicate `isVirtualSearchField` (`SEARCH_VIRTUAL_TYPES`) on the field's own declaration — the predicate the sortability projection already reads. A `formula` field is computed on read and has no column (ADR-0079 addendum, item 9), so:
+  - removing a `formula` field saves `200` without `?force=true` (it answered `409 DESTRUCTIVE_CHANGE` with "existing data in this column will become inaccessible");
+  - retyping a `formula` field into a stored kind saves without `force`: the new column starts empty, and no stored value is lost.
+- **Not changed.** Removing a stored field, including an engine-computed but stored one (`autonumber`, `summary`), still answers `409 DESTRUCTIVE_CHANGE` with the same `field_removed` finding and message. Retyping a stored field into a `formula` still answers `409` with `field_type_change`. The `force` mechanism, the messages and the error codes are unchanged.
+- **Who notices.** An author or an agent that removes a formula field no longer needs `force=true` for it, so `force=true` stays reserved for a real loss of stored data.
@@ -504,3 +504,114 @@ describe('[#11014 §3] the double fault the trimmed limb used to catch', () => {
         expect(FieldSchema.safeParse(stored).success).toBe(false);
     });
 });
+
+// ═══════════════════════════════════════════════════════════════════════════
+// 4. [#24411] A field that STORES NOTHING loses nothing — judged by the spec's
+//    storage predicate, never by a type list kept beside the detector
+// ═══════════════════════════════════════════════════════════════════════════
+
+describe('[#24411 §4] the destructive diff reads the field\'s own storage declaration', () => {
+    /**
+     * The gate's findings each say what stored data a save makes unreachable.
+     * A `formula` is computed on read and materialises no column (ADR-0079
+     * addendum, item 9), so removing one, or retyping one into a stored kind,
+     * loses nothing — and a 409 there trains authors to send `force=true` by
+     * reflex, which silences the true finding on a stored field too.
+     *
+     * "Stored" is `isVirtualSearchField` (`SEARCH_VIRTUAL_TYPES`), the
+     * predicate the sortability projection reads. `autonumber` is the
+     * contrast that keeps the axis honest: engine-computed, but stored in a
+     * column, so its removal is still a data-loss event.
+     */
+    const OBJ = 'crm_invoice';
+    const STORED = {
+        name: { name: 'name', type: 'text' },
+        notes: { name: 'notes', type: 'text' },
+        amount: { name: 'amount', type: 'number' },
+        reference: { name: 'reference', type: 'autonumber' },
+    };
+    const DOUBLED = { name: 'doubled', type: 'formula', expression: 'record.amount * 2' };
+    const seed = () => row({
+        type: 'object',
+        name: OBJ,
+        metadata: JSON.stringify({ name: OBJ, label: OBJ, fields: { ...STORED, doubled: DOUBLED } }),
+    });
+    const saveFields = (protocol: any, fields: Record<string, unknown>) =>
+        save(protocol, { type: 'object', name: OBJ, item: { name: OBJ, label: OBJ, sharingModel: 'private', fields } });
+    const withoutField = (drop: keyof typeof STORED) =>
+        Object.fromEntries(Object.entries({ ...STORED, doubled: DOUBLED }).filter(([k]) => k !== drop));
+
+    it('CONTROL: a stored `text` removal is still refused, with the same finding and message', async () => {
+        const { protocol, writes } = makeKernel([seed()]);
+
+        const r = await saveFields(protocol, withoutField('notes'));
+
+        expect(r.outcome).toBe('threw');
+        const err = (r as { error: any }).error;
+        expect(err.code).toBe('DESTRUCTIVE_CHANGE');
+        expect(err.status).toBe(409);
+        expect(err.issues).toEqual([{
+            code: 'field_removed',
+            field: 'notes',
+            message: "Field 'notes' removed — existing data in this column will become inaccessible.",
+        }]);
+        expect(metadataWrites(writes)).toEqual([]);
+    });
+
+    it('a `formula` removal saves without `force`', async () => {
+        const { protocol, writes } = makeKernel([seed()]);
+
+        const r = await saveFields(protocol, { ...STORED });
+
+        expect(r.outcome, JSON.stringify((r as any).error?.issues)).toBe('resolved');
+        expect(metadataWrites(writes).length).toBeGreaterThan(0);
+    });
+
+    it('an `autonumber` removal is still refused: engine-computed, but stored', async () => {
+        const { protocol } = makeKernel([seed()]);
+
+        const r = await saveFields(protocol, withoutField('reference'));
+
+        expect(r.outcome).toBe('threw');
+        const err = (r as { error: any }).error;
+        expect(err.code).toBe('DESTRUCTIVE_CHANGE');
+        expect(err.status).toBe(409);
+        expect(err.issues).toEqual([expect.objectContaining({ code: 'field_removed', field: 'reference' })]);
+    });
+
+    it('removing a formula and a stored field together reports the stored one alone', async () => {
+        const { protocol } = makeKernel([seed()]);
+
+        const { notes: _notes, ...rest } = STORED;
+        const r = await saveFields(protocol, rest);
+
+        expect(r.outcome).toBe('threw');
+        const err = (r as { error: any }).error;
+        expect(err.code).toBe('DESTRUCTIVE_CHANGE');
+        expect(err.issues.map((i: any) => i.field)).toEqual(['notes']);
+    });
+
+    it('retyping a formula into a stored kind loses nothing: the stored side starts empty', async () => {
+        const { protocol } = makeKernel([seed()]);
+
+        const r = await saveFields(protocol, { ...STORED, doubled: { name: 'doubled', type: 'number' } });
+
+        expect(r.outcome, JSON.stringify((r as any).error?.issues)).toBe('resolved');
+    });
+
+    it('retyping a stored field into a formula is still refused: the stored side loses its column', async () => {
+        const { protocol } = makeKernel([seed()]);
+
+        const r = await saveFields(protocol, {
+            ...STORED,
+            notes: { name: 'notes', type: 'formula', expression: 'record.name' },
+            doubled: DOUBLED,
+        });
+
+        expect(r.outcome).toBe('threw');
+        const err = (r as { error: any }).error;
+        expect(err.code).toBe('DESTRUCTIVE_CHANGE');
+        expect(err.status).toBe(409);
+        expect(err.issues).toEqual([expect.objectContaining({ code: 'field_type_change', field: 'notes' })]);
+    });
+});
@@ -5689,12 +5689,22 @@ function detectDestructiveObjectChanges(prev: any, next: any): Array<{
 
     const issues: Array<{ code: string; field?: string; message: string }> = [];
 
+    // [#24411] Every finding below names STORED data a save makes unreachable,
+    // so a field with no stored column (a `formula`, computed on read —
+    // ADR-0079 addendum, item 9) loses nothing when it is removed or retyped.
+    // "Stored" is the spec's storage predicate — the one the sortability
+    // projection reads — judged from the field's own declaration, ⛔ never a
+    // type list kept here. A false finding trains callers to send `force=true`
+    // by reflex, which silences the true one on a stored field.
+    const isStored = (field: SearchFieldMeta | undefined): boolean => !isVirtualSearchField(field);
+
     // Removed fields — silently dropping a column is a data-loss event.
     for (const fname of Object.keys(prevFields)) {
         // Skip system fields — those are managed by applySystemFields and
         // re-injected on every registerObject call; they will look "removed"
         // in any user-supplied overlay.
         if (prevFields[fname]?.system) continue;
+        if (!isStored(prevFields[fname])) continue;
         if (!(fname in nextFields)) {
             issues.push({
                 code: 'field_removed',
@@ -5718,7 +5728,9 @@ function detectDestructiveObjectChanges(prev: any, next: any): Array<{
         if (!prevField) continue; // brand-new field — non-destructive
         const prevType = prevField.type;
         const nextType = nextField.type;
-        if (prevType && nextType && prevType !== nextType) {
+        // Judged by what the STORED side loses: an unstored previous field held
+        // no values, so retyping it into anything starts from an empty column.
+        if (prevType && nextType && prevType !== nextType && isStored(prevField)) {
             const compatible = TYPE_COMPATIBILITY[prevType]?.has(nextType);
             if (!compatible) {
                 issues.push({
 
@@ -0,0 +1,124 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// GOLDEN REGRESSION — removing a field that stores nothing is not a destructive
+// change, booted for real and driven through `PUT /api/v1/meta/object/:name`.
+//
+// The object save's safety diff refuses, with `409 DESTRUCTIVE_CHANGE`, a save
+// that drops a field: the column's data becomes unreachable, and only
+// `?force=true` lifts the refusal. That is true of a stored field and false of
+// a `formula`, which is computed on read and has no column (ADR-0079 addendum,
+// item 9). Refusing the formula removal taught authors and agents to send
+// `force=true` by reflex — which silences the true warning on a stored field.
+//
+// "Stored" is the spec's storage predicate (`isVirtualSearchField` /
+// `SEARCH_VIRTUAL_TYPES`), the one the sortability projection reads — so the
+// cases below are judged by what each field declares:
+//
+//   1. a `formula` removal saves 200 without `force`, and the stored values of
+//      the other fields read back unchanged;
+//   2. a stored `text` removal still answers 409 DESTRUCTIVE_CHANGE, with the
+//      same finding and message — the live control that this harness reaches
+//      the gate at all;
+//   3. an `autonumber` removal still answers 409: it is computed by the ENGINE
+//      but stored in a column, so "computed" is not the axis — storage is.
+//
+// Boots a fixture stack of its own, so it stays out of `SHARED_SHOWCASE`.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { cel, defineStack } from '@objectstack/spec';
+
+const NAME = 'dfu_invoice';
+
+const stackDef = defineStack({
+  manifest: {
+    id: 'com.dogfood.unstored-removal',
+    namespace: 'dfu',
+    version: '0.0.0',
+    type: 'app',
+    name: 'Unstored Field Removal',
+    description: 'An empty app; the object under test is saved at runtime through the metadata door.',
+  },
+});
+
+/** Every field the object starts with — each case removes exactly one. */
+const FIELDS: Record<string, Record<string, unknown>> = {
+  name: { type: 'text', label: 'Name' },
+  notes: { type: 'text', label: 'Notes' },
+  amount: { type: 'number', label: 'Amount' },
+  // JSON round-trip: the wire form of the `cel` envelope.
+  doubled: { type: 'formula', label: 'Doubled', expression: JSON.parse(JSON.stringify(cel`record.amount * 2`)) },
+  reference: { type: 'autonumber', label: 'Reference' },
+};
+
+const definition = (fields: Record<string, Record<string, unknown>>) => ({
+  name: NAME,
+  label: 'Invoice',
+  sharingModel: 'public_read_write',
+  fields,
+});
+
+const without = (drop: string) => Object.fromEntries(Object.entries(FIELDS).filter(([k]) => k !== drop));
+
+describe('dogfood: removing an unstored field through PUT /meta/object/:name', () => {
+  let stack: VerifyStack;
+  let token: string;
+  let recordId: string;
+
+  const call = async (method: string, path: string, body?: unknown) => {
+    const res = await stack.apiAs(token, method, path, body);
+    const json: any = await res.json().catch(() => ({}));
+    return { status: res.status, json };
+  };
+
+
+  beforeAll(async () => {
+    stack = await bootStack(stackDef);
+    token = await stack.signIn();
+
+    const saved = await call('PUT', `/meta/object/${NAME}`, definition(FIELDS));
+    expect(saved.status, JSON.stringify(saved.json)).toBe(200);
+
+    const created = await call('POST', `/data/${NAME}`, { name: 'INV-1', notes: 'keep me', amount: 21 });
+    expect(created.status, JSON.stringify(created.json)).toBeLessThan(300);
+    recordId = String(created.json?.data?.id ?? created.json?.id);
+    expect(recordId, JSON.stringify(created.json)).toMatch(/\S/);
+  }, 300_000);
+
+  afterAll(async () => {
+    await stack?.stop?.();
+  });
+
+  it('a stored `text` removal still answers 409 DESTRUCTIVE_CHANGE with today\'s finding (live control)', async () => {
+    const refused = await call('PUT', `/meta/object/${NAME}`, definition(without('notes')));
+    expect(refused.status, JSON.stringify(refused.json)).toBe(409);
+    expect(refused.json?.code, JSON.stringify(refused.json)).toBe('DESTRUCTIVE_CHANGE');
+    expect(refused.json?.issues).toEqual([{
+      code: 'field_removed',
+      field: 'notes',
+      message: "Field 'notes' removed — existing data in this column will become inaccessible.",
+    }]);
+  });
+
+  it('an `autonumber` removal still answers 409: engine-computed, but stored in a column', async () => {
+    const refused = await call('PUT', `/meta/object/${NAME}`, definition(without('reference')));
+    expect(refused.status, JSON.stringify(refused.json)).toBe(409);
+    expect(refused.json?.code, JSON.stringify(refused.json)).toBe('DESTRUCTIVE_CHANGE');
+    expect(refused.json?.issues).toEqual([expect.objectContaining({ code: 'field_removed', field: 'reference' })]);
+  });
+
+  it('a `formula` removal saves 200 without `force`, and the stored fields read back unchanged', async () => {
+    const saved = await call('PUT', `/meta/object/${NAME}`, definition(without('doubled')));
+    expect(saved.status, JSON.stringify(saved.json)).toBe(200);
+
+    const meta = await call('GET', `/meta/object/${NAME}`);
+    expect(meta.status, JSON.stringify(meta.json)).toBe(200);
+    expect(Object.keys(meta.json?.item?.fields ?? {})).not.toContain('doubled');
+
+    const read = await call('GET', `/data/${NAME}/${recordId}`);
+    expect(read.status, JSON.stringify(read.json)).toBe(200);
+    expect(read.json?.record, JSON.stringify(read.json)).toMatchObject({
+      name: 'INV-1', notes: 'keep me', amount: 21, reference: expect.stringMatching(/\S/),
+    });
+  });
+});