@@ -176,6 +176,7 @@ import {
     type DroppedFieldsEvent, type QueryAST, type EngineQueryOptionsParsed,
     type ValidationAdvisoryEvent,
     discriminateDefaultValueShape,
+    externalBindingDatasourceRefusal,
 } from '@objectstack/spec/data';
 import { PLURAL_TO_SINGULAR, SINGULAR_TO_PLURAL, canonicalMetaUrlType, metaUrlSpellingRefusal, unrecognisedMetaTypeRefusal, METADATA_ITEM_NAME_PATTERN } from '@objectstack/spec/shared';
 // [#13331] The cluster fan-out transport type only — the protocol never
@@ -22444,6 +22445,117 @@ export class ObjectStackProtocolImplementation implements
         return err;
     }
 
+    /**
+     * [ADR-0015 §4.2 · #25211] The save doors' half of "`object.external` only
+     * on a datasource whose `schemaMode` is not 'managed'": the pair of the item
+     * being saved and the stored or registered item on the other side of it,
+     * which no parse can see.
+     *
+     * `ObjectSchema`'s refinement judges a binding on the primary datasource
+     * (`'default'`, written or omitted) inside the schema gate, and
+     * `defineStack` / `composeStacks` a binding on a datasource a stack
+     * declares (#25168). A binding on a datasource stored or registered here
+     * reached neither. Measured before this: an object saved `external` on a
+     * managed `wh`, and `wh` saved as managed (or with no `schemaMode`, the
+     * spec default) under objects bound to it with `external`, were both
+     * stored, in draft and in publish mode and under `force`, and the runtime
+     * then disagrees with itself about the object: its schema sync skips the
+     * DDL as federated while the boot validation and the write gate judge it
+     * as managed.
+     *
+     * Both directions, because either item can be the one saved last:
+     *  - an `object` with `external`: judged against the datasource it names,
+     *    as this door's own by-name read resolves it ({@link readMetaItem}: the
+     *    environment's stored row, else the definition the code layer
+     *    registers);
+     *  - a `datasource`: judged against every object that binds it with
+     *    `external` ({@link objectsBoundExternallyTo}). Only the `managed`
+     *    verdict counts here; a binding on the primary datasource is a fact
+     *    about the object alone, which its own save is refused for.
+     * The judgement is the spec's ({@link externalBindingDatasourceRefusal}),
+     * ⛔ never a copy, so a finding reads as the parse's and `defineStack`'s
+     * do. A datasource neither layer holds gets no verdict.
+     *
+     * Asked in draft and in publish mode by {@link saveMetaItem}, after the
+     * schema gate, and again by {@link promoteDraftForPublish} on the draft
+     * body, because the other half can change between a draft's save and its
+     * publish. An object's draft is not among the objects a datasource save
+     * meets: the draft is judged at its own publish. `force` does not reach
+     * it: `force` acknowledges a destructive diff, and this is no diff.
+     * Answered as the schema gate answers: `422 INVALID_METADATA`, the
+     * findings in `issues`, at `external` for an object and at `schemaMode`
+     * for a datasource.
+     */
+    private async externalBindingSaveRefusal(
+        singularType: string,
+        item: unknown,
+        name: string,
+        writeFace?: MetadataWriteFace,
+    ): Promise<(Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] }) | undefined> {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) return undefined;
+        const body = item as { external?: unknown; datasource?: unknown };
+        const issues: MetadataIssueEntry[] = [];
+        if (singularType === 'object') {
+            if (body.external === undefined || body.external === null) return undefined;
+            const datasource = typeof body.datasource === 'string' && body.datasource !== '' ? body.datasource : undefined;
+            const definition = datasource === undefined
+                ? undefined
+                : (await this.readMetaItem({ type: 'datasource', name: datasource }))?.item;
+            const refusal = externalBindingDatasourceRefusal(
+                name, body.external, datasource,
+                definition && typeof definition === 'object' ? definition as { schemaMode?: unknown } : undefined,
+            );
+            if (refusal) issues.push({ path: refusal.path, message: refusal.message, code: 'custom' });
+        } else if (singularType === 'datasource') {
+            for (const bound of await this.objectsBoundExternallyTo(name)) {
+                const refusal = externalBindingDatasourceRefusal(bound.name, bound.external, name, item as { schemaMode?: unknown });
+                if (refusal?.shape === 'managed') issues.push({ path: 'schemaMode', message: refusal.message, code: 'custom' });
+            }
+        }
+        if (issues.length === 0) return undefined;
+        const err = new Error(
+            `${singularType}/${name} failed spec validation: ${specValidationFindings(writeFace, issues)}`,
+        ) as Error & { code: 'INVALID_METADATA'; status: 422; issues: MetadataIssueEntry[] };
+        err.code = 'INVALID_METADATA';
+        err.status = 422;
+        err.issues = issues;
+        return err;
+    }
+
+    /**
+     * [#25211] Every object this environment holds that binds `datasource`
+     * with `external`, for {@link externalBindingSaveRefusal}'s datasource
+     * half: the environment's stored active rows ({@link readActiveOverlayRows},
+     * read as the list read parses them), and the registry's objects no stored
+     * row overlays (an object's stored row is its base layer, ADR-0029 D9).
+     * Drafts are not read: a draft does not bind anything until its publish,
+     * which is judged on its own.
+     */
+    private async objectsBoundExternallyTo(datasource: string): Promise<Array<{ name: string; external: unknown }>> {
+        const bound = new Map<string, unknown>();
+        let records: any[] = [];
+        try {
+            records = await this.readActiveOverlayRows({ type: 'object' });
+        } catch (error) {
+            this.rethrowUnlessMetadataStoreUnprovisioned(error, 'sys_metadata');
+        }
+        const stored = this.storedOverlayEntries({ type: 'object' }, records);
+        const storedNames = new Set(stored.map((entry) => entry.name));
+        const take = (name: string, obj: unknown) => {
+            const o = obj as { datasource?: unknown; external?: unknown } | null | undefined;
+            if (o?.datasource === datasource && o.external !== undefined && o.external !== null) bound.set(name, o.external);
+        };
+        for (const entry of stored) take(entry.name, entry.data);
+        const registry = this.engine.registry;
+        if (typeof registry?.getAllObjects === 'function') {
+            for (const obj of registry.getAllObjects() as Array<{ name?: unknown }>) {
+                if (typeof obj?.name !== 'string' || storedNames.has(obj.name)) continue;
+                take(obj.name, obj);
+            }
+        }
+        return [...bound].map(([name, external]) => ({ name, external }));
+    }
+
     /**
      * [ADR-0138 D2b] The flow half of the anonymous door × elevated flow
      * refusal: a flow published with `runAs: 'system'` while an
@@ -23943,6 +24055,17 @@ export class ObjectStackProtocolImplementation implements
             if (defaultPageRefusal) throw defaultPageRefusal;
         }
 
+        // [ADR-0015 §4.2 · #25211] An `object` bound `external` to a datasource
+        // this environment holds as managed, or a `datasource` saved as managed
+        // while objects bind it with `external`, is refused, in draft and in
+        // publish mode, after the schema (the body is the type it says, and the
+        // parse has judged a binding on the primary datasource) and before the
+        // authoring gate and every write. See {@link externalBindingSaveRefusal}.
+        {
+            const bindingRefusal = await this.externalBindingSaveRefusal(singularType, request.item, request.name, request.writeFace);
+            if (bindingRefusal) throw bindingRefusal;
+        }
+
         // [ADR-0138 D2b] A flow published with `runAs: 'system'` while an
         // anonymous endpoint of `type: 'flow'` names it is refused, in publish
         // mode only (a draft does not execute; its publish is judged at the
@@ -25684,6 +25807,17 @@ export class ObjectStackProtocolImplementation implements
             const defaultPageRefusal = await this.defaultRecordPageSaveRefusal(singularType, draftForGate.body, request.name, 'published');
             if (defaultPageRefusal) throw defaultPageRefusal;
         }
+        // [ADR-0015 §4.2 · #25211] …and an object draft bound `external` to a
+        // datasource that is managed by the time it is published, or a
+        // datasource draft that would go `active` as managed under objects that
+        // bind it with `external`: the draft save judged the other half as it
+        // stood then. Judged again here, on the draft body and with the save
+        // door's predicate and envelope, before `repo.promoteDraft` writes, so a
+        // batch publish aborts on it too. See {@link externalBindingSaveRefusal}.
+        if (draftForGate) {
+            const bindingRefusal = await this.externalBindingSaveRefusal(singularType, draftForGate.body, request.name);
+            if (bindingRefusal) throw bindingRefusal;
+        }
         // [ADR-0138 D2b] …and a flow draft that would go `active` with
         // `runAs: 'system'` while an anonymous endpoint of `type: 'flow'` names
         // it: the draft save let it through (a draft does not execute), so its
 
@@ -27,10 +27,15 @@
  * - the object names another datasource, and that datasource's definition is
  *   visible to the door and declares `schemaMode: 'managed'` (or no
  *   `schemaMode`, which is managed by the spec default). `defineStack`'s
- *   cross-reference pass judges it for a datasource the same stack declares
- *   (`stack.zod.ts`). A datasource the door cannot see — one a host or
- *   another package registers, or one stored at runtime — gets no verdict
- *   here: absence of a definition is not evidence about its `schemaMode`.
+ *   cross-reference pass judges it for a datasource the same stack declares,
+ *   and `composeStacks`' artifact pass for one another input of the
+ *   composition declares (`stack.zod.ts`). [#25211] At runtime the metadata
+ *   save doors (`@objectstack/metadata-protocol`) judge the pair from both
+ *   sides: an object saved with `external`, against the datasource it names
+ *   (a stored row or a registered definition), and a datasource saved as
+ *   managed, against the objects that bind it with `external`; the draft
+ *   promotion judges both again. A datasource no door can see gets no
+ *   verdict: absence of a definition is not evidence about its `schemaMode`.
  *
  * Why the object's OWN `datasource`, and not the datasource a package
  * `defaultDatasource` or a `datasourceMapping` rule routes it to: ADR-0015's
@@ -40,7 +45,9 @@
  * binding is a declaration about the object, so it is the object that names
  * where its remote table lives.
  *
- * Internal to `packages/spec`: not re-exported from `data/index.ts`.
+ * [#25211] Exported from `@objectstack/spec/data` for the runtime save doors,
+ * so the rule and its message keep one copy: a door resolves what it can see
+ * and asks this function, ⛔ never a reimplementation of the judgement.
  */
 
 /** The host's primary datasource — `HOST_RESERVED_DATASOURCE_NAME` in `stack.zod.ts`, managed by construction. */
 
@@ -291,6 +291,12 @@ export * from './driver/index';
 // metadata read path's per-type redaction hook share a single security list).
 export * from './datasource-credential-redaction';
 
+// ADR-0015 §4.2's one predicate — `object.external` only on a datasource whose
+// `schemaMode` is not 'managed' (#25168). Exported for the metadata save doors
+// (#25211), which resolve the datasource a saved object names and the objects
+// a saved datasource is named by, and judge the pair here rather than copy it.
+export * from './external-binding-datasource';
+
 // External Datasource Federation — SQL↔field type compatibility (ADR-0015)
 export * from './type-compat';
 export * from './external-catalog.zod';
 
@@ -16,16 +16,23 @@ export const entry: SemanticMigration = {
   surface:
     'object.external together with object.datasource — an external (federated) binding on the platform\'s '
     + 'primary datasource (datasource \'default\', also the value when none is written) or on a datasource '
-    + 'the same stack declares with schemaMode \'managed\' (or no schemaMode, which is managed by default)',
+    + 'declared with schemaMode \'managed\' (or no schemaMode, which is managed by default) by the same stack, '
+    + 'by another input of the same composition, or as a stored or registered datasource the metadata API sees',
   replacement:
     'Name, in the object\'s own `datasource`, the datasource that holds the remote table, and declare that '
     + 'datasource with `schemaMode: \'external\'` (or `\'validate-only\'`) and its `external` settings. An object '
     + 'whose rows ObjectStack should own instead drops `external` and stays managed. `ObjectSchema` refuses an '
     + '`external` binding whose object `datasource` is `\'default\'` at parse, so `ObjectSchema.create()`, '
     + '`defineStack`, `os validate` and the object save door (`422 INVALID_METADATA`) refuse it; `defineStack` '
-    + 'refuses one on a managed datasource the same stack declares with `STACK_CROSS_REFERENCE_INVALID`. A '
-    + 'package `defaultDatasource` or a `datasourceMapping` rule does not make an object federated: they route '
-    + 'its queries, while the boot validation and the write gate read the object\'s own `datasource`.',
+    + 'refuses one on a managed datasource the same stack declares with `STACK_CROSS_REFERENCE_INVALID`, and '
+    + '`composeStacks` one on a managed datasource another input declares. At runtime the metadata save door '
+    + '(`PUT /api/v1/meta/object/NAME`) refuses an object bound `external` to a stored or registered managed '
+    + 'datasource, and `PUT /api/v1/meta/datasource/NAME` refuses saving a datasource as managed while objects '
+    + 'bind it with `external` (both `422 INVALID_METADATA`, in draft and publish mode, and again when a draft '
+    + 'is published): change the datasource to `schemaMode: \'external\'` first, or drop `external` from the '
+    + 'objects first. A package `defaultDatasource` or a `datasourceMapping` rule does not make an object '
+    + 'federated: they route its queries, while the boot validation and the write gate read the object\'s own '
+    + '`datasource`.',
   reason:
     'ADR-0015 §1 makes an object federated by the datasource it points to, and §4.2 allows `object.external` '
     + 'only when that datasource\'s `schemaMode` is not \'managed\', declared "enforced at metadata-load time". '
@@ -34,9 +41,10 @@ export const entry: SemanticMigration = {
     + 'object. Its schema sync treats any object carrying `external` as federated and never creates its table, '
     + 'while the boot validation skips it as "not federated" and the write gate exempts it because its datasource '
     + 'is managed. So the object booted with no table and nothing judged it. The rule is enforced where each half '
-    + 'is visible: the object alone shows a binding on `default`, the platform\'s managed primary; a stack that '
-    + 'declares the named datasource shows its `schemaMode`. A datasource the door cannot see (one a host or '
-    + 'another package registers, or one stored at runtime) gets no verdict at these doors. No mechanical move '
+    + 'is visible: the object alone shows a binding on `default`, the platform\'s managed primary; a stack, or a '
+    + 'composition, that declares the named datasource shows its `schemaMode`; the metadata save doors see the '
+    + 'stored and registered datasources and objects, so they judge the pair whichever of the two is saved last. '
+    + 'A datasource no door can see gets no verdict. No mechanical move '
     + 'is lossless: dropping `external` turns a remote table into a table ObjectStack creates, and pointing the '
     + 'object at another datasource or re-declaring the datasource external are statements about where the rows '
     + 'live that only the owner can make. Measured at the change: the one in-tree producer, the showcase\'s '
 
@@ -3824,6 +3824,33 @@ function collectExternalBindingDatasourceErrors(config: ObjectStackDefinition):
   return errors;
 }
 
+/**
+ * [ADR-0015 §4.2 · #25211] {@link collectExternalBindingDatasourceErrors} over
+ * a COMPOSITION: an `external` object of one input bound to a datasource
+ * another input declares managed (or with no `schemaMode`).
+ *
+ * `defineStack` resolves a binding against its own stack's `datasources`, so a
+ * pair split across two inputs reached the artifact with no verdict: each input
+ * is legal alone, and the composed artifact registers both, the object as
+ * federated and its datasource as managed. Judged here over the objects the
+ * artifact carries (step 2's merge, after the conflict strategy) and the
+ * `datasources` of every input, by the same collector, so the finding reads
+ * exactly as the per-stack one does.
+ *
+ * What this can newly refuse: a cross-input pair, and, as with the artifact
+ * pass's other rules, a same-stack pair in an input built with
+ * `strict: false`, which never reached the per-stack pass. A strict input holds
+ * no same-stack pair. A datasource name two inputs declare is judged against
+ * the later declaration (the collector keeps the last one it meets).
+ */
+function collectComposedExternalBindingDatasourceErrors(
+  stacks: readonly ObjectStackDefinition[],
+  composedObjects: ObjectStackDefinition['objects'],
+): string[] {
+  const datasources = stacks.flatMap((stack) => (Array.isArray(stack.datasources) ? stack.datasources : []));
+  return collectExternalBindingDatasourceErrors({ objects: composedObjects, datasources } as ObjectStackDefinition);
+}
+
 /**
  * Perform strict cross-reference validation on a parsed stack definition.
  * Returns an array of error messages (empty if valid).
@@ -6597,7 +6624,7 @@ function composeBuiltStacks(
   // 0. [#20367 ruling B] Every input must be a stack a producer built. The
   //    per-stack refusals run only inside `defineStack`, so an input that never
   //    passed through it is unjudged, and nothing below re-judges it (the
-  //    artifact pass in step 3b re-runs two artifact-scoped rules, not the
+  //    artifact pass in step 3b re-runs the artifact-scoped rules, not the
   //    family). FIRST, and before the single-input early return, so a lone
   //    plain object is refused as well rather than handed straight back.
   const unbuilt = stacks.flatMap((stack, i) => {
@@ -6712,12 +6739,16 @@ function composeBuiltStacks(
   //     inputs, each legal on its own: one deployment holds them both. It needs
   //     no object to resolve against, so it is not behind that pass's
   //     object-count early return.
+  //     [ADR-0015 §4.2 · #25211] …and an `external` object of one input bound
+  //     to a datasource another input declares managed: see
+  //     {@link collectComposedExternalBindingDatasourceErrors}.
   const artifactCrossRefErrors = [
     ...collectArtifactCrossReferenceErrors(
       stacks,
       objects as readonly { name: string }[] | undefined,
     ),
     ...collectComposedDefaultRecordPageErrors(stacks, opts.manifest === 'preserve'),
+    ...collectComposedExternalBindingDatasourceErrors(stacks, objects),
   ];
   if (artifactCrossRefErrors.length > 0) {
     const count = artifactCrossRefErrors.length;