@@ -18,7 +18,6 @@ import {
 import {
   bootSchemaStack,
   collectDriftApplyLimits,
-  describeWithApplyLimits,
   describeDatabaseSource,
   describeTelemetryDatabase,
   renderPlan,
@@ -37,12 +36,16 @@ import {
 } from '../../utils/schema-migration-plugins.js';
 import { OCCUPANCY_HINT, probeMigrationTarget } from '../../utils/migrate-occupancy-gate.js';
 import { describeOccupancy } from '../../utils/sqlite-occupancy.js';
+import { ceremonyOrganizationColumnDrops } from '../../utils/organization-ownership-drop-gate.js';
 import {
-  COMMENT_OBJECT,
-  REACTIONS_COLUMN,
-  readCommentReactionsConversion,
-} from '../../utils/comment-reactions-conversion.js';
-import { ceremonyOrganizationColumnDrops, readOrganizationOwnershipMarker } from '../../utils/organization-ownership-drop-gate.js';
+  DropGateReads,
+  describeDriftEntries,
+  describeHeldDrops,
+  isAccountIssuerDrop,
+  isCommentReactionsDrop,
+  readHeldDrops,
+  type HeldDrops,
+} from '../../utils/apply-drop-gates.js';
 
 async function confirm(question: string): Promise<boolean> {
   if (!process.stdin.isTTY) return false; // non-interactive → require --yes
@@ -101,6 +104,13 @@ function describeNotApplied(entry: ManagedDriftEntry): string {
  *    The drift entries are applied as on any database, and **every entry the
  *    driver did not apply is named** by table, column and kind; a destructive
  *    one the operator confirmed makes the run PARTIAL and exit 1.
+ *
+ * [#24958] And it never offers `--allow-destructive` for a drop its own gates
+ * refuse here (`sys_account.issuer`, `sys_comment.reactions`, an
+ * `organization_id` drop ahead of the ceremony). The listing before the prompt
+ * names what each such drop waits for, the skip lines offer no re-run while
+ * one is held, and the gates' predicates and reads are the ones
+ * `utils/apply-drop-gates.ts` holds for `os migrate plan` too.
  */
 export default class MigrateApply extends Command {
   static override description =
@@ -337,23 +347,44 @@ export default class MigrateApply extends Command {
       // the --json document, `notApplied`, PARTIAL and the exit code never read
       // it. Empty for a driver that declares nothing, which reads as it always has.
       const limits = flags.json ? new Map<ManagedDriftEntry, string>() : collectDriftApplyLimits(stack, drift);
+      // [#24958] Each drop gate below reads at most once per run: the listing
+      // and the gate share that read, so they cannot answer differently.
+      const gateReads = new DropGateReads();
+      // [#24958] The drops those gates refuse on this database, each with the
+      // gate that refuses it — read for the human face only, like `limits`:
+      // the --json document, the gates' rule and the exit code never read it.
+      // Empty when nothing is held, and then everything below reads as it
+      // always has.
+      const kernel = stack.kernel as { getService?: (n: string) => unknown };
+      const gateHeld: HeldDrops = flags.json
+        ? new Map()
+        : await readHeldDrops(gateReads, () => kernel.getService?.call(kernel, 'objectql'), drift);
+      // A held-back entry no re-run with --allow-destructive could apply here:
+      // a driver's declared limit keeps it from any run. A gate-held entry is
+      // not one of these — it waits for the gate's own command.
+      const neverReRunnable = (d: ManagedDriftEntry) => limits.has(d) && !gateHeld.has(d);
 
       if (!flags.json) {
         // [#23925] An entry with a limit shows its finding and that limit, never
-        // --allow-destructive.
+        // --allow-destructive. [#24958] Nor does an entry a gate holds: it
+        // names what it waits for.
         await renderPendingSchemaWork(pending);
-        if (limits.size === 0) renderPlan(drift);
-        else renderPlan(drift, await describeWithApplyLimits(limits));
+        renderPlan(drift, await describeDriftEntries(limits, gateHeld));
         if (pending.length > 0) printInfo(await summarizePendingSchemaWork(pending));
         printInfo(summarize(drift));
         // [#23925] A re-run with --allow-destructive is offered only for the
         // held-back entries it could apply here; the rest are named as drift
-        // that re-run would leave as it is.
-        const reRunnable = deferred.filter((d) => !limits.has(d));
+        // that re-run would leave as it is. [#24958] While a gate holds a
+        // drop, that re-run is refused whole, so it is offered for nothing:
+        // each gate's line names the command that moves the database on.
+        const reRunnable = deferred.filter((d) => !neverReRunnable(d));
         const notReRunnable = deferred.length - reRunnable.length;
         if (reRunnable.length > 0) {
-          printWarning(`${reRunnable.length} destructive change(s) will be SKIPPED (re-run with --allow-destructive to include them).`);
+          printWarning(gateHeld.size === 0
+            ? `${reRunnable.length} destructive change(s) will be SKIPPED (re-run with --allow-destructive to include them).`
+            : `${reRunnable.length} destructive change(s) will be SKIPPED, and a re-run with --allow-destructive cannot include them yet:`);
         }
+        for (const line of describeHeldDrops(gateHeld, drift, limits)) printWarning(line);
         if (notReRunnable > 0) {
           printWarning(
             `${notReRunnable} destructive change(s) remain drift that a re-run with --allow-destructive cannot apply `
@@ -440,12 +471,11 @@ export default class MigrateApply extends Command {
       // rows indistinguishable and let a sign-in resolve onto the wrong user's
       // account — silently. Hence a row-level pre-flight, run against the live
       // database at the moment it matters.
-      const dropsAccountIssuer = intended.some(
-        (d) => d.op?.type === 'drop_column' && d.table === 'sys_account' && d.op.column === 'issuer',
-      );
+      // [#24958] Its predicate and read live in `utils/apply-drop-gates.ts`,
+      // where `os migrate plan` and the listing above ask them too.
+      const dropsAccountIssuer = intended.some(isAccountIssuerDrop);
       if (dropsAccountIssuer) {
-        const { probeAccountIdentityCollisions, formatAccountIdentityPreflightReport } =
-          await import('@objectstack/plugin-auth');
+        const { formatAccountIdentityPreflightReport } = await import('@objectstack/plugin-auth');
         const engine = (stack.kernel as { getService?: (n: string) => unknown }).getService?.call(
           stack.kernel,
           'objectql',
@@ -456,7 +486,7 @@ export default class MigrateApply extends Command {
         // caller gating on the status. Each emitted with 0 until this card.
         let preflight;
         try {
-          preflight = await probeAccountIdentityCollisions(engine as never);
+          preflight = await gateReads.accountIssuerPreflight(engine);
         } catch (e: any) {
           // A pre-flight that could not read is not a pre-flight that passed.
           const detail = e?.message ?? String(e);
@@ -513,16 +543,16 @@ export default class MigrateApply extends Command {
       // converted, a member may delete their own reaction, and a live probe
       // would read that as unconverted (`utils/comment-reactions-conversion.ts`
       // says why). The boot drift report and the retirement's upgrade note name
-      // this very command as the remedy, so both arrive here.
-      const dropsCommentReactions = intended.some(
-        (d) => d.op?.type === 'drop_column' && d.table === COMMENT_OBJECT && d.op.column === REACTIONS_COLUMN,
-      );
+      // this very command as the remedy, so both arrive here. [#24958] Its
+      // predicate and read live in `utils/apply-drop-gates.ts`, where
+      // `os migrate plan` and the listing above ask them too.
+      const dropsCommentReactions = intended.some(isCommentReactionsDrop);
       if (dropsCommentReactions) {
         const engine = (stack.kernel as { getService?: (n: string) => unknown }).getService?.call(
           stack.kernel,
           'objectql',
         );
-        const conversion = await readCommentReactionsConversion(engine as never);
+        const conversion = await gateReads.commentReactionsConversion(engine);
         if (!conversion.verified) {
           const detail = conversion.flag
             ? `The last run of "os migrate comment-reactions --apply" (${conversion.flag.last_run_at}) left `
@@ -569,7 +599,7 @@ export default class MigrateApply extends Command {
           stack.kernel,
           'objectql',
         );
-        const marker = await readOrganizationOwnershipMarker(engine as never);
+        const marker = await gateReads.organizationOwnershipMarker(engine);
         if (!marker.verified) {
           // The ceremony is the way on (18.x step 6): the refusal names its
           // steps, as the boot refusal does (`organizationOwnershipRefusalMessage`,
@@ -688,12 +718,16 @@ export default class MigrateApply extends Command {
       printSuccess(`Applied ${applied.length} change(s).`);
       // [#23925] Split as the count before the prompt splits `deferred`: a re-run
       // is offered only for the held-back entries it could apply here, and the
-      // rest are named as drift it could not apply either.
+      // rest are named as drift it could not apply either. [#24958] While a
+      // gate holds a drop, no re-run is offered: the lines before the prompt
+      // name each gate's command.
       const heldBackEntries = skipped.filter((d) => held.has(d));
-      const heldBack = heldBackEntries.filter((d) => !limits.has(d)).length;
+      const heldBack = heldBackEntries.filter((d) => !neverReRunnable(d)).length;
       const heldBackNotReRunnable = heldBackEntries.length - heldBack;
       if (heldBack > 0) {
-        printWarning(`Skipped ${heldBack} destructive change(s) (re-run with --allow-destructive to include them).`);
+        printWarning(gateHeld.size === 0
+          ? `Skipped ${heldBack} destructive change(s) (re-run with --allow-destructive to include them).`
+          : `Skipped ${heldBack} destructive change(s); a re-run with --allow-destructive cannot include them yet (see above).`);
       }
       if (heldBackNotReRunnable > 0) {
         printWarning(
 
@@ -2,7 +2,6 @@
 
 import { Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
-import type { ManagedDriftEntry } from '@objectstack/driver-sql';
 import {
   printHeader,
   printSuccess,
@@ -17,7 +16,6 @@ import {
 import {
   bootSchemaStack,
   collectDriftApplyLimits,
-  describeWithApplyLimits,
   describeDatabaseSource,
   describeTelemetryDatabase,
   distinctDatabaseDrivers,
@@ -40,7 +38,12 @@ import {
 } from '../../utils/unmanaged-tables.js';
 import { describeOccupancy, JOURNAL_MODE_SWITCH_NOTE } from '../../utils/sqlite-occupancy.js';
 import { describeDriverSqliteFile } from '../../utils/connection-display.js';
-import { ceremonyOrganizationColumnDrops, readOrganizationOwnershipMarker } from '../../utils/organization-ownership-drop-gate.js';
+import {
+  DropGateReads,
+  describeDriftEntries,
+  describeHeldDrops,
+  readHeldDrops,
+} from '../../utils/apply-drop-gates.js';
 import {
   resolveTenancyPosture,
   collectGlobalUniques,
@@ -97,6 +100,13 @@ import {
  * ceremony verified, are read through the two functions `apply` asks, never a
  * second list. A verified database, or one with no such drop, gets the plan it
  * always got, byte for byte; the `--json` document is unchanged.
+ *
+ * [#24958] The same holds for every drop `apply` refuses, not only the
+ * ceremony's: `sys_account.issuer` while its retirement pre-flight does not
+ * pass, and `sys_comment.reactions` while no verified run of
+ * `os migrate comment-reactions --apply` is recorded. Each gate's predicate
+ * and read live in `utils/apply-drop-gates.ts`, which `apply` asks too; a held
+ * drop names what it waits for, and the footer names each gate's command.
  */
 export default class MigratePlan extends Command {
   static override description =
@@ -419,21 +429,20 @@ export default class MigratePlan extends Command {
       // but a drop (it runs no SQLite table rebuild). Empty for a driver that
       // declares nothing, and then everything below reads as it always has.
       const limits = collectDriftApplyLimits(stack, drift);
-      // [#24925] The `organization_id` drops `os migrate apply` refuses here
-      // until the organization-ownership ceremony has verified. Empty on a
-      // verified database and on one with no such drop, and then everything
+      // [#24925, #24958] The drops `os migrate apply` refuses here, each with
+      // the gate that refuses it: an `organization_id` drop until the
+      // organization-ownership ceremony has verified, and the
+      // `sys_account.issuer` / `sys_comment.reactions` drops until their own
+      // preconditions hold. Read through the gates' own predicates and reads,
+      // never a second list. Empty when nothing is held, and then everything
       // below reads as it always has.
-      const held = await ceremonyHeldDrops(stack, drift);
+      const kernel = stack.kernel as { getService?: (n: string) => unknown };
+      const held = await readHeldDrops(new DropGateReads(), () => kernel.getService?.call(kernel, 'objectql'), drift);
 
       await renderPendingSchemaWork(pending);
-      if (limits.size === 0 && held.size === 0) {
-        renderPlan(drift);
-      } else {
-        // Still listed, still counted: it IS drift. Only the remedy changes,
-        // from a command that cannot perform it here to the reason it cannot.
-        const byLimit = limits.size === 0 ? (d: ManagedDriftEntry) => d.message : await describeWithApplyLimits(limits);
-        renderPlan(drift, held.size === 0 ? byLimit : await describeWithCeremonyHolds(held, byLimit));
-      }
+      // Still listed, still counted: it IS drift. Only the remedy changes,
+      // from a command that cannot perform it here to the reason it cannot.
+      renderPlan(drift, await describeDriftEntries(limits, held));
       if (pending.length > 0) printInfo(await summarizePendingSchemaWork(pending));
       printInfo(summarize(drift));
       if (limits.size === 0 && held.size === 0) {
@@ -444,7 +453,7 @@ export default class MigratePlan extends Command {
         // apply; no apply line at all when it can apply nothing listed here.
         const appliable = drift.filter((d) => !limits.has(d) && !held.has(d));
         const appliableDestructive = appliable.filter((d) => d.category === 'destructive').length;
-        // [#24925] While the ceremony holds a drop, `apply` refuses every
+        // [#24925, #24958] While a gate holds a drop, `apply` refuses every
         // --allow-destructive run, so it is offered for nothing: what `apply`
         // performs now is the rest, and the destructive changes wait.
         const appliableNow = held.size === 0 ? appliable : appliable.filter((d) => d.category !== 'destructive');
@@ -453,7 +462,7 @@ export default class MigratePlan extends Command {
             ? chalk.dim(` (add --allow-destructive for the ${appliableDestructive} destructive change(s) it can apply on this database)`)
             : ''));
         }
-        if (held.size > 0) printWarning(describeCeremonyHold(held.size, appliableDestructive));
+        for (const line of describeHeldDrops(held, drift, limits)) printWarning(line);
         const limited = [...limits.keys()].filter((d) => !held.has(d)).length;
         if (limited > 0) {
           printWarning(
@@ -473,57 +482,3 @@ export default class MigratePlan extends Command {
     }
   }
 }
-
-/**
- * [#24925] The entries `os migrate apply` refuses on this database: each
- * `organization_id` drop, while the organization-ownership ceremony has not
- * verified. Answered by the two functions `apply`'s drop gate asks, through
- * the same `objectql` service, so the plan and the refusal cannot disagree:
- * `ceremonyOrganizationColumnDrops`, asked of one entry at a time, says which
- * entries; `readOrganizationOwnershipMarker` says whether the ceremony
- * verified, and answers "not verified" for a database with no `sys_migration`
- * table or row. The marker is read only when such a drop is listed, so every
- * other plan reads nothing it did not read before.
- */
-async function ceremonyHeldDrops(
-  stack: { kernel: unknown },
-  drift: readonly ManagedDriftEntry[],
-): Promise<ReadonlySet<ManagedDriftEntry>> {
-  const drops = drift.filter((d) => ceremonyOrganizationColumnDrops([d]).length > 0);
-  if (drops.length === 0) return new Set();
-  const kernel = stack.kernel as { getService?: (n: string) => unknown };
-  const engine = kernel.getService?.call(kernel, 'objectql');
-  const marker = await readOrganizationOwnershipMarker(engine as never);
-  return marker.verified ? new Set() : new Set(drops);
-}
-
-/**
- * [#24925] The {@link renderPlan} line for a held drop: the finding without
- * its `--allow-destructive` sentence, then the ceremony as its remedy. Every
- * other entry is described by `otherwise`. The driver package is imported at
- * the point of use, never statically (`schema-migrate.lazy-driver-import.test.ts`).
- */
-async function describeWithCeremonyHolds(
-  held: ReadonlySet<ManagedDriftEntry>,
-  otherwise: (d: ManagedDriftEntry) => string,
-): Promise<(d: ManagedDriftEntry) => string> {
-  const { driftFindingWithoutRemedy } = await import('@objectstack/driver-sql');
-  return (d) => (held.has(d)
-    ? `${driftFindingWithoutRemedy(d)} — a drop the organization-ownership ceremony owns, and it has not verified `
-      + 'on this database: the ceremony drops it itself (see below).'
-    : otherwise(d));
-}
-
-/**
- * [#24925] The footer line for the held drops: why `--allow-destructive` is
- * offered for nothing, and the ceremony's two commands, as `os migrate apply`'s
- * refusal names them. `waiting` counts the other destructive entries that run
- * could perform once the ceremony has verified.
- */
-function describeCeremonyHold(drops: number, waiting: number): string {
-  return `${drops} organization_id drop(s) above are the organization-ownership ceremony's, and it has not verified `
-    + 'on this database, so "os migrate apply --allow-destructive" refuses every run until it has'
-    + (waiting > 0 ? ` (the other ${waiting} destructive change(s) above wait for it too)` : '')
-    + '. Run "os migrate organization-ownership --out PLAN" to write and review its plan, take a backup, then '
-    + '"os migrate organization-ownership --apply --plan-file PLAN --backup-taken"; it drops these columns itself.';
-}