@@ -0,0 +1,12 @@
+---
+'@objectstack/objectql': patch
+'@objectstack/cloud-connection': patch
+---
+
+Clause-②: no
+
+fix(objectql): withdrawing a package that extends another package's object puts the owner's definition back at `GET /api/v1/meta/object/NAME` at once, not at the next restart
+
+- **What was wrong.** When a package whose content is an `objectExtensions` field on another package's object is registered on a started kernel, the ObjectQL bridge rewrites the OWNER's copy of that object in the `metadata` service with the merged body, extension included. `DELETE /api/v1/marketplace/install-local/:manifestId` of the extender withdrew its contribution from the registry, so the object listing and the data plane dropped the field, but nothing rewrote the owner's copy. The by-name read asks that copy first, so `GET /api/v1/meta/object/NAME` kept serving the withdrawn field until the runtime restarted.
+- **What changes.** The ObjectQL bridge remembers which owners' copies each package's extensions rewrote, and the `manifest` service gains `restoreExtendedObjectCopies(packageId)`: once the registry no longer holds the package, it re-registers each such copy with the registry's current definition. The install-local DELETE calls it right after the registry withdrawal. The by-name read then serves the owner's body without the extension's fields, as the listing and the data plane already did.
+- **Not touched.** Only a copy stamped with the registry owner's id is rewritten, the same rule the bridge overwrites by, so an authored copy stays. The DELETE answer is unchanged. A copy that cannot be restored is logged once at `error`, naming the objects and the remedy: restart the runtime.
@@ -2001,6 +2001,14 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         const declared = captureUninstallDeclared(registry, manifestId);
         const withdrawal = this.withdrawFromRunningKernel(ctx, manifestId);
         const copies = withdrawal ? undefined : await this.withdrawObjectCopies(ctx, manifestId);
+        // [#24182] …and the copies of OTHER packages' objects that this one's
+        // extensions rewrote: the bridge that wrote them restores the owner's
+        // definition (`manifest.restoreExtendedObjectCopies`, never rejects).
+        if (!withdrawal) {
+            let manifestService: { restoreExtendedObjectCopies?(id: string): Promise<void> } | undefined;
+            try { manifestService = ctx.getService('manifest') as typeof manifestService; } catch { /* no engine — nothing bridged */ }
+            await manifestService?.restoreExtendedObjectCopies?.(manifestId);
+        }
         const cleanups = [
             ...(withdrawal ? [withdrawal] : []),
             ...(copies ? [copies] : []),
 
@@ -192,9 +192,9 @@ async function bootPlugin(opts: { refuseUnregister?: string; before?: (metadata:
     await plugin.start(ctx as never);
     await hooks.get('kernel:ready')?.();
 
-    const install = () => routes.get(`POST ${ROUTE}`)!(makeC(`http://localhost:3000${ROUTE}`, { body: { manifest: MANIFEST } }));
-    const uninstall = () => routes.get(`DELETE ${ROUTE}/:manifestId`)!(
-        makeC(`http://localhost:3000${ROUTE}/${APP_ID}`, { manifestId: APP_ID }),
+    const install = (manifest: Bag = MANIFEST) => routes.get(`POST ${ROUTE}`)!(makeC(`http://localhost:3000${ROUTE}`, { body: { manifest } }));
+    const uninstall = (id: string = APP_ID) => routes.get(`DELETE ${ROUTE}/:manifestId`)!(
+        makeC(`http://localhost:3000${ROUTE}/${id}`, { manifestId: id }),
     );
     /** The uninstall's own warnings: each one opens with `uninstalled <id>`. */
     const warnings = () => logger.warn.mock.calls
@@ -329,3 +329,44 @@ describe('#24070: an install-local uninstall withdraws the package from every me
         expect(warned[0]).toContain(OBJECTS[0]);
     });
 });
+
+/** [#24182] A package whose only content is a field on another package's object. */
+const EXTENDER_ID = 'com.example.crmliteext';
+const EXTENDER: Bag = {
+    id: EXTENDER_ID,
+    version: '1.0.0',
+    type: 'app',
+    name: 'CRM Lite Score',
+    objectExtensions: [{ extend: OBJECTS[0], fields: { ext_score: { type: 'number', label: 'Score' } } }],
+};
+
+/** The field names `GET /meta/object/NAME` serves for `name`, read through the protocol the route calls. */
+async function servedFields(protocol: any, name: string): Promise<string[]> {
+    const res = await protocol.getMetaItem({ type: 'object', name });
+    return Object.keys(res?.item?.fields ?? {});
+}
+
+describe('#24182: an install-local uninstall of an extender restores the owner\'s object at the by-name read', () => {
+    it('owner + extender installed → DELETE the extender: the by-name read serves the owner\'s body without the field', async () => {
+        const h = await bootPlugin();
+        expect((await h.install()).status).toBe(200);
+        const extended = await h.install(EXTENDER);
+        expect(extended.status, JSON.stringify(extended.payload)).toBe(200);
+        // Identity: the extender's bridge rewrote the OWNER's copy, which the
+        // by-name read serves before the registry.
+        expect((await h.copyOf(OBJECTS[0]))?._packageId).toBe(APP_ID);
+        expect(await servedFields(h.protocol, OBJECTS[0])).toEqual(expect.arrayContaining(['name', 'ext_score']));
+
+        const res = await h.uninstall(EXTENDER_ID);
+
+        expect(res.status, JSON.stringify(res.payload)).toBe(200);
+        expect(res.payload.data.cleanups).toEqual([]);
+        const fields = await servedFields(h.protocol, OBJECTS[0]);
+        expect(fields).not.toContain('ext_score');
+        expect(fields).toEqual(Object.keys(h.ql.registry.getObject(OBJECTS[0])!.fields ?? {}));
+        // CONTROL: the owner's own field, its copy's stamp and its package stay.
+        expect(fields).toContain('name');
+        expect((await h.copyOf(OBJECTS[0]))?._packageId).toBe(APP_ID);
+        expect(await listed(h.protocol, 'object')).toEqual(expect.arrayContaining(OBJECTS));
+    });
+});
@@ -6,6 +6,8 @@ import { ObjectQLPlugin } from '../src/plugin';
 import { ObjectSchema } from '@objectstack/spec/data';
 import { readServiceSelfInfo } from '@objectstack/spec/api';
 import { SysMetadataAuditObject, SysMetadataCommitObject, SysMetadataHistoryObject, SysMetadataObject } from '@objectstack/metadata-core';
+import type { IMetadataService } from '@objectstack/spec/contracts';
+import type { ObjectQL } from './engine';
 
 describe('ObjectQLPlugin - Metadata Service Integration', () => {
   let kernel: ObjectKernel;
@@ -1900,6 +1902,64 @@ describe('ObjectQLPlugin - Metadata Service Integration', () => {
       expect(bridged.label).toBe('Contact');
     });
 
+    // [#24182] An extender's bridge rewrites the OWNER's copy with the merged
+    // body; withdrawing the extender must put the owner's definition back, or
+    // `GET /meta/object/NAME` (which reads the copy first) keeps serving the
+    // withdrawn field until a restart.
+    describe('withdrawing an extender restores the owner\'s copy', () => {
+      type WithdrawingManifestService = ManifestService & { restoreExtendedObjectCopies(id: string): Promise<void> };
+      const extenderManifest = () => ({
+        id: 'com.acme.crmext',
+        name: 'acme_crmext',
+        version: '1.0.0',
+        type: 'app',
+        objectExtensions: [
+          { extend: 'crm_contact', fields: { ext_score: { name: 'ext_score', label: 'Score', type: 'number' } } },
+        ],
+      });
+
+      async function installBoth() {
+        await kernel.use(new ObjectQLPlugin());
+        await kernel.bootstrap();
+        const manifest = kernel.getService('manifest') as WithdrawingManifestService;
+        await manifest.register(crmManifest());
+        await manifest.register(extenderManifest());
+        const metadata = kernel.getService<IMetadataService>('metadata');
+        const registry = kernel.getService<ObjectQL>('objectql').registry;
+        // Identity: the extender's bridge rewrote the owner's copy.
+        const extended = await metadata.getObject('crm_contact') as any;
+        expect(extended._packageId).toBe('com.acme.crm');
+        expect(Object.keys(extended.fields)).toEqual(expect.arrayContaining(['name', 'ext_score']));
+        return { manifest, metadata, registry };
+      }
+
+      it('serves the owner\'s body without the withdrawn field, its own fields kept', async () => {
+        const { manifest, metadata, registry } = await installBoth();
+
+        registry.uninstallPackage('com.acme.crmext');
+        // The registry already serves the owner's body; only the copy lags.
+        expect(Object.keys(registry.getObject('crm_contact')!.fields ?? {})).not.toContain('ext_score');
+        await manifest.restoreExtendedObjectCopies('com.acme.crmext');
+
+        const restored = await metadata.getObject('crm_contact') as any;
+        expect(restored._packageId).toBe('com.acme.crm');
+        expect(restored.label).toBe('Contact');
+        // The registry's own body, field for field (its injected system fields
+        // included): the owner's `name` kept, the extension's `ext_score` gone.
+        expect(Object.keys(restored.fields)).toEqual(Object.keys(registry.getObject('crm_contact')!.fields ?? {}));
+        expect(Object.keys(restored.fields)).toContain('name');
+        expect(Object.keys(restored.fields)).not.toContain('ext_score');
+      });
+
+      it('CONTROL: a package the registry still holds is not withdrawn — the copy keeps its field', async () => {
+        const { manifest, metadata } = await installBoth();
+
+        await manifest.restoreExtendedObjectCopies('com.acme.crmext');
+
+        expect(Object.keys(((await metadata.getObject('crm_contact')) as any).fields)).toContain('ext_score');
+      });
+    });
+
     it('boot-time registrations still flow through the one-shot startup bridge', async () => {
       await kernel.use(new ObjectQLPlugin());
       await kernel.use({
 
@@ -376,6 +376,16 @@ export class ObjectQLPlugin implements Plugin {
    */
   private bridgeLateManifests = false;
 
+  /**
+   * [#24182] For each package the late bridge bridged as an EXTENDER, the
+   * names of the objects whose copy it rewrote: copies stamped with another
+   * package's id (the owner's), re-registered with the merged body that
+   * carries this package's extension. Read and cleared by
+   * {@link restoreExtendedObjectCopies} when the package is withdrawn, the one
+   * moment the registry no longer says which objects it extended.
+   */
+  private readonly extendedObjectCopies = new Map<string, Set<string>>();
+
   /**
    * Set at `kernel:ready`, once the boot audit has found every picklist a
    * field names: from then on an artifact registered through the `manifest`
@@ -766,7 +776,14 @@ export class ObjectQLPlugin implements Plugin {
           ? [...ordered, { id: residual.ownerId }]
           : ordered;
         return this.bridgeArtifactObjectsToMetadataService(ctx, bridged);
-      }
+      },
+      // [#24182] The withdrawal counterpart of the bridge's extender rewrite:
+      // a door that withdrew a package from the registry calls this so the
+      // copies of OTHER packages' objects that the package's extensions
+      // rewrote serve the registry's definition again. Never rejects. See
+      // {@link restoreExtendedObjectCopies}.
+      restoreExtendedObjectCopies: (packageId: string): Promise<void> =>
+        this.restoreExtendedObjectCopies(ctx, packageId),
     });
 
     ctx.logger.info('ObjectQL engine registered', {
@@ -2792,6 +2809,14 @@ export class ObjectQLPlugin implements Plugin {
           if (!existing || ownPreviousCopy) {
             await metadataService.register('object', obj.name, obj, { notify: false });
             bridged++;
+            // [#24182] Another package owns this object: the copy just written
+            // carries this package's extension. Remembered, so its withdrawal
+            // can put the owner's definition back.
+            if ((obj as any)._packageId !== packageId) {
+              let names = this.extendedObjectCopies.get(packageId);
+              if (!names) this.extendedObjectCopies.set(packageId, names = new Set());
+              names.add(obj.name);
+            }
           }
         } catch (e: unknown) {
           ctx.logger.debug('Failed to bridge manifest object to metadata service', {
@@ -2816,6 +2841,71 @@ export class ObjectQLPlugin implements Plugin {
     }
   }
 
+  /**
+   * [#24182] The withdrawal counterpart of {@link bridgeManifestObjectsToMetadataService}
+   * for a package that EXTENDS objects other packages own: put the registry's
+   * current definition back into each owner's copy the package's bridge rewrote.
+   *
+   * When an extender is bridged, the objects it contributes to resolve to the
+   * merged body stamped with the OWNER's id, and the bridge re-registers the
+   * owner's copy with it (its own-previous-copy rule is keyed on that stamp).
+   * Withdrawing the extender (`SchemaRegistry.uninstallPackage`) drops its
+   * contribution from the registry, so the object listing and the data door
+   * stop serving the extension's fields; but the copy keeps them, and
+   * `GET /meta/object/NAME` reads the copy before the registry, so it kept
+   * serving them until a restart. A withdrawal of the package's OWN copies
+   * never touches these: they are stamped with another package's id.
+   *
+   * The names come from {@link extendedObjectCopies}, recorded when the bridge
+   * wrote each copy. Only a copy the bridge itself would overwrite is written
+   * (its stamp is the registry owner's), through the bridge's own verb, so an
+   * authored copy stays as it is; a name the registry no longer serves is left
+   * to the owner's own withdrawal. A package the registry still holds is not
+   * withdrawn, and nothing is done.
+   *
+   * Never rejects: the withdrawal has already happened. A copy that could not
+   * be written disagrees with what the registry serves while everything looks
+   * normal, so that is said once at `error`, with the remedy.
+   */
+  private async restoreExtendedObjectCopies(ctx: PluginContext, packageId: string): Promise<void> {
+    const names = this.extendedObjectCopies.get(packageId);
+    const registry = this.ql?.registry;
+    if (!names || !registry || registry.getPackage(packageId) !== undefined) return;
+    this.extendedObjectCopies.delete(packageId);
+    let metadataService: IMetadataService | undefined;
+    try {
+      metadataService = ctx.getService<IMetadataService>('metadata');
+    } catch {
+      return; // no metadata service on this kernel — there is no copy to restore
+    }
+    if (!metadataService || typeof metadataService.register !== 'function') return;
+
+    const failed: string[] = [];
+    for (const name of names) {
+      try {
+        const served = this.currentObjectCopyBody(name);
+        const owner = (served as any)?._packageId;
+        if (!served || owner === undefined) continue;
+        const existing = await metadataService.getObject(name);
+        if (existing == null || (existing as any)._packageId !== owner) continue;
+        await metadataService.register('object', name, served, { notify: false });
+      } catch {
+        failed.push(name);
+      }
+    }
+    if (failed.length > 0) {
+      ctx.logger.error(
+        `[ObjectQLPlugin] package '${packageId}' was withdrawn, but the metadata service's copy of the object(s) it extended `
+        + `${failed.map((n) => `'${n}'`).join(', ')} could not be restored: the object listing and the data door already `
+        + 'serve them without its fields, while GET /api/v1/meta/object/NAME keeps serving those fields until a restart. '
+        + 'Fix: restart this process (the boot bridge re-copies every object); if it recurs, check that the metadata '
+        + 'service accepts registration.',
+        undefined,
+        { package: packageId, objects: failed },
+      );
+    }
+  }
+
   /**
    * True when a hook of this name is shipped by an installed CODE package —
    * i.e. the SchemaRegistry holds a composite (`<packageId>:<name>`) artifact