@@ -3,18 +3,20 @@
 '@objectstack/driver-sql': patch
 ---
 
-fix(cli): `os migrate plan` / `apply` examine what `os serve` mounts around the stack, so the retired `sys_account.issuer` is finally a drop (#22506)
+fix(cli): `os migrate plan` / `apply` / `unmapped-columns` examine what `os serve` mounts around the stack, so the retired `sys_account.issuer` is finally a drop (#22506)
 
 `os migrate plan` and `os migrate apply` only examine the objects their own boot registers, and that boot stopped at the stack: its config, its metadata and the platform floor. Nothing `os serve` mounts around a stack was there. On an app declaring `requires: ['auth']`, the plan examined 9 of the 68 tables the serving boot had created. `sys_account` read as an undeclared platform table, so its retired `issuer` column (and that column's unique index) was never a destructive drop. `os migrate apply --allow-destructive` dropped nothing, while the boot's drift line and `os migrate account-issuer` kept prescribing exactly that command.
 
-The two commands now also compose, each through the rule `os serve` itself reads:
+The two commands now also compose, each through the rule `os serve` itself reads, and so does `os migrate unmapped-columns`, which reads the plan's own `unmapped_column` findings and therefore needs the plan's object set:
 
 - the auth family behind `serve`'s auth gate: plugin-auth's identity objects, the security plugin and the audit plugin, when the stack mounts no `AuthPlugin` of its own, the `auth` tier is on, and an auth secret resolves;
 - the provider of every capability `serve` mounts: the stack's `requires` and the always-on slate, as `os serve` composes it with no `--preset`;
 - the REST API plugin;
 - every `plugins` entry by `serve`'s rule for one: a package name is loaded from the app, and a plain bundle is wrapped as an app;
 - the pinyin-search decision from the config's locales, so the `__search` companion columns a boot provisions are no longer listed as destructive drops on a config-only project.
 
+`os migrate unmapped-columns --object sys_account` (or any platform object the plan now declares) resolves the object and reads its unmapped columns, where it used to answer `OBJECT_NOT_FOUND`.
+
 Each piece is composed for its declarations only. Its `init()` runs, and its `start()` and lifecycle hooks do not, so no dispatcher, scheduler or seed runs inside a dry run.
 
 **What an operator sees.** On the shape that looped, `os migrate plan` lists `sys_account.issuer` and `uniq_sys_account_issuer_account_id` as destructive drops. `os migrate apply --allow-destructive` drops both, `os migrate account-issuer` reads zero, and the next boot prints no drift line for them. When no auth secret is set and the boot is not a development one, the plan says it did not compose the auth family, and how to compose it: run with the deployment's `OS_AUTH_SECRET` exported. `os migrate` reads no `.env` file.
 
@@ -30,7 +30,12 @@
  *     type): refused in both faces, exit 1, naming the column and the record
  *     id, no record emitted;
  *  7. the door writes nothing: the schema and every row are byte-identical
- *     after it ran.
+ *     after it ran;
+ *  8. [#22506] a PLATFORM object the plan declares — `sys_account`, behind
+ *     `os serve`'s auth gate, carrying the retired `issuer` column — is
+ *     resolved and read, the same column set the plan reports for its table,
+ *     not refused as `OBJECT_NOT_FOUND`. The plan composes what `os serve`
+ *     mounts around the stack, so this door has to boot that object set too.
  *
  * The runtime half, that the engine's data door never serves these columns, is
  * the read narrowing's own pin
@@ -130,6 +135,13 @@ await raw.knex.raw('ALTER TABLE um_contact ADD COLUMN ${HASH_SHADOW} text');
 await raw.knex('um_contact').update({ ${HASH_SHADOW}: 'shadow' });
 await raw.knex.raw('ALTER TABLE um_blob ADD COLUMN legacy_bytes blob');
 await raw.knex('um_blob').update({ legacy_bytes: Buffer.from([1, 2, 255]) });
+// [#22506] A platform table the auth family declares, in the shape a
+// pre-retirement deployment left it: today's definition plus the retired
+// \`issuer\` column, one account row carrying a value in it.
+const { SysAccount } = await import('@objectstack/platform-objects/identity');
+await raw.initObjects([SysAccount]);
+await raw.knex.raw('ALTER TABLE sys_account ADD COLUMN issuer text');
+await raw.knex('sys_account').insert({ id: 'acc_os22506', provider_id: 'credential', account_id: 'u1', user_id: 'u1', issuer: 'local:credential' });
 await raw.disconnect();
 process.stderr.write('[fixture] seeded\\n');
 process.exit(0);
@@ -185,6 +197,9 @@ function runCli(argv: string[]): Promise<Run> {
         NO_COLOR: '1',
         OS_ARTIFACT_PATH: join(dir, 'dist', 'objectstack.json'),
         OS_SECRET_KEY: '0e2e'.repeat(16),
+        // [#22506] Auth-enabled, as a serving deployment is: `os serve`'s auth
+        // gate composes the auth family when a secret resolves.
+        OS_AUTH_SECRET: 'os22506-unmapped-secret-at-least-32-chars',
       }),
       stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -217,6 +232,7 @@ let unknownJson: Run;
 let cappedJson: Run;
 let bytesJson: Run;
 let bytesHuman: Run;
+let platformJson: Run;
 
 beforeAll(async () => {
   dir = mkdtempSync(join(tmpdir(), 'os-21573-'));
@@ -241,6 +257,7 @@ beforeAll(async () => {
   cappedJson = await runCli(door('um_contact', '--max-records', '2', '--json'));
   bytesJson = await runCli(door('um_blob', '--json'));
   bytesHuman = await runCli(door('um_blob'));
+  platformJson = await runCli(door('sys_account', '--json'));
   after = readState();
   planJson = await runCli(['migrate', 'plan', '--json']);
 }, HOOK_TIMEOUT_MS);
@@ -329,3 +346,19 @@ describe('os migrate unmapped-columns: the other answers', () => {
     for (const out of [bytesJson.stdout, bytesHuman.stdout]) expect(out).not.toContain('"type":"Buffer"');
   });
 });
+
+describe('os migrate unmapped-columns: a platform object the plan declares (#22506)', () => {
+  it('resolves sys_account on an auth-enabled stack and reads the column the plan reports, not OBJECT_NOT_FOUND', () => {
+    expect(platformJson.code, `${platformJson.stdout}\n${platformJson.stderr}`).toBe(0);
+    const doc = JSON.parse(platformJson.stdout);
+    expect(doc).toMatchObject({ object: 'sys_account', table: 'sys_account', count: 1 });
+    expect(doc.records).toEqual([{ id: 'acc_os22506', values: { issuer: 'local:credential' } }]);
+    // ONE column set with the plan, on this platform table too.
+    const plan = JSON.parse(planJson.stdout);
+    const planned = (plan.changes as Array<{ kind: string; table: string; column: string; actual: string }>)
+      .filter((c) => c.kind === 'unmapped_column' && c.table === 'sys_account')
+      .map((c) => ({ column: c.column, actual: c.actual }));
+    expect(planned.map((c) => c.column)).toEqual(['issuer']);
+    expect(doc.columns).toEqual(planned);
+  });
+});
@@ -285,14 +285,18 @@ export default class MigrateUnmappedColumns extends Command {
     try {
       // The `os migrate plan` boot, so the differ runs over the plan's object
       // set: schema DDL deferred and no seed (`deferSchemaDdl`), no database
-      // file brought into existence (`readOnlyProbe`), and the deployment's
-      // own composition (`composeHostStack`).
+      // file brought into existence (`readOnlyProbe`), the deployment's own
+      // composition (`composeHostStack`), and what `os serve` mounts around it
+      // (`composeServedPlatform`, #22506) — or a platform object the plan
+      // reports an `unmapped_column` on, such as `sys_account`, is one this
+      // command cannot resolve.
       stack = await bootSchemaStack({
         jsonOutput: flags.json,
         ...(flags['database-url'] ? { databaseUrl: flags['database-url'] } : {}),
         deferSchemaDdl: true,
         readOnlyProbe: true,
         composeHostStack: true,
+        composeServedPlatform: true,
       });
     } catch (error: any) {
       if (flags.json) {
 
@@ -472,8 +472,10 @@ export async function bootSchemaStack(
      * mounts AROUND the stack, each piece for its declarations only: the auth
      * family behind its auth gate, the provider of every capability its
      * resolver mounts (the stack's `requires` and the always-on slate), and
-     * the REST API plugin. Set by `os migrate plan` and `os migrate apply`, and
-     * by nothing else — their subject is the deployment's whole object set.
+     * the REST API plugin. Set by `os migrate plan` and `os migrate apply`,
+     * whose subject is the deployment's whole object set, and by `os migrate
+     * unmapped-columns`, which reads the plan's own findings over that set —
+     * and by nothing else.
      * See `buildSchemaMigrationPlugins`'s `servedPlatform`.
      */
     composeServedPlatform?: boolean;
 
@@ -68,8 +68,8 @@ import {
  *    companion columns its boot provisions are in the schema view too.
  *  - **`PlatformObjectsPlugin`**, when absent — `serve` step 5c, composed on
  *    every served boot.
- *  - **What `os serve` mounts AROUND the stack — `os migrate plan` and `apply`
- *    only** (`servedPlatform`, #22506, {@link composeServedPlatform}): the auth
+ *  - **What `os serve` mounts AROUND the stack — `os migrate plan`, `apply` and
+ *    `unmapped-columns` only** (`servedPlatform`, #22506, {@link composeServedPlatform}): the auth
  *    family behind `serve`'s auth gate, the provider of every capability its
  *    resolver mounts (the stack's `requires` and the always-on slate), and the
  *    REST API plugin — each through the rule `serve` reads, each for its
@@ -1531,7 +1531,8 @@ export async function buildSchemaMigrationPlugins(opts: {
    * stack surfaced it.
    *
    * Set by `os migrate plan` and `os migrate apply`, whose subject is the
-   * deployment's whole object set. Unset (`os migrate
+   * deployment's whole object set, and by `os migrate unmapped-columns`, which
+   * reads the plan's own `unmapped_column` findings over that set. Unset (`os migrate
    * security-catalog-overlays`, which also boots NON-deferred under `--apply`):
    * a provider is composed only when a composed plugin hard-depends on it
    * (#21732), as before.