@@ -0,0 +1,18 @@
+---
+'@objectstack/runtime': minor
+---
+
+fix(runtime)!: an action that dispatches to a handler another declared action owns also answers with that owner's permission and activation gates
+
+Clause-②: no (narrowing) — the REST `POST /api/v1/actions/:object/:action` door and the MCP `run_action` tool refuse a `script` action whose dispatch reaches a handler that a different declared action's own dispatch reaches, when the caller lacks that action's `requiredPermissions` (403 `PERMISSION_DENIED`) or that action is switched off (409 `ACTION_DISABLED`), and while the metadata store cannot be read they refuse 503 `SERVICE_UNAVAILABLE` a call reaching a handler built from another stored declaration; both doors answered such a call with the handler's result before. Nothing is widened, and no schema or authorable key moves.
+Metadata-protocol: semantic
+Skills-docs: none — `skills/**` teaches `target` as a registered function name and `requiredPermissions` as an action's own gate, and neither statement changes; the rule is documented in `content/docs/ui/actions.mdx` in this change.
+
+<!-- adr-0087: not-required (no-migration-prescription) no authorable key, value or export is removed or renamed; an action declaration parses and saves exactly as before, and only which gates its dispatch answers to grows -->
+
+**BREAKING** narrowing at the two action-dispatch doors (`@objectstack/runtime`).
+
+- **The rule.** A handler entry belongs to every declared `script` action whose own dispatch reaches it — through its `target`, or through the handler its `body` registered under its name. When a call reaches an entry that a different declaration owns, that declaration's `requiredPermissions` and its packaged-action switch apply on top of the invoked action's own: the caller needs both sets, and the switch of either turns the call off. The handler does not run on a refusal, and nothing about the request is read first.
+- **An unreadable metadata store.** While the metadata store cannot be read, a call reaching a handler that was built from another stored action declaration is refused 503 `SERVICE_UNAVAILABLE`, because that declaration's gates cannot be checked; a handler a package or code registered, and an action's own stored handler, keep running.
+- **What counts as "different".** A declaration is its owning object and its name, so one declaration carried both inside its object and as a standalone item is one owner, not two. Two objects that each declare a same-named action are independent while each object has its own handler.
+- **Not changed.** An action with its own handler key answers exactly as before, and so do `flow`, `api` and declarative-update actions, which dispatch through no handler entry.
@@ -433,6 +433,16 @@ is a spec proposal for a properly named key, not a values map under this one.
   action inherits the flow's list; when both declare one, the caller needs
   both. Referenced
   capabilities must exist — `os lint` checks that.
+- **A `script` action that dispatches to a handler another declared action
+  owns is gated by that action too.** When the handler a call reaches is the
+  one a different declaration's own dispatch reaches — its `target` names that
+  declaration's handler key, or the handler that declaration's body registered —
+  the server applies that action's `requiredPermissions` (**403**
+  `PERMISSION_DENIED`) and its packaged-action switch (**409** `ACTION_DISABLED`)
+  as well as the invoked action's own, on the REST `/actions` endpoint and the
+  MCP `run_action` tool alike. The two sets add up, so the caller needs both,
+  and the handler does not run on a refusal. Give each action its own handler
+  key unless the two should share one gate.
 - **`visible`** is a CEL predicate evaluated **fail-closed**: an expression
   that throws hides the action silently. Two rules save real debugging time:
 
 
@@ -4343,6 +4343,16 @@ export async function invokeBusinessAction(deps: ActionExecutionDeps,
         if (refusal) {
             throw Object.assign(new Error(refusal.message), { code: refusal.code, status: refusal.status });
         }
+
+        // The handler the script dispatch below reaches may be one a DIFFERENT
+        // declared action owns: that owner's gates apply too, at the same
+        // point the REST `/actions` door asks the same function.
+        const ownerRefusal = await actionHandlerOwnerRefusal(deps, requestContext, {
+            ql: activationEngine, action, objectName, candidates: resolveActionHandlerKeys(action), ec, envId, obj,
+        });
+        if (ownerRefusal) {
+            throw Object.assign(new Error(ownerRefusal.message), { code: ownerRefusal.code, status: ownerRefusal.status });
+        }
     }
 
     // [ADR-0104 D2] Declared param contract — same enforcement as the REST
@@ -4909,6 +4919,274 @@ export function registeredActionHandlerProbe(_deps: ActionExecutionDeps,
 }
 
 
+/**
+ * The handler ENTRY a script dispatch for `(objectName, candidates)` reaches:
+ * the first `object:key` pair of {@link executeRegisteredAction}'s rotation
+ * that the engine's registry holds, read from `registered` (one snapshot of
+ * `listRegisteredActions()` as a `Set` of `object:key`). `undefined` = the
+ * dispatch reaches nothing.
+ */
+function reachedHandlerEntry(registered: ReadonlySet<string>, objectName: string, candidates: string[]): string | undefined {
+    for (const obj of actionHandlerObjectKeys(objectName)) {
+        for (const key of candidates) {
+            if (registered.has(`${obj}:${key}`)) return `${obj}:${key}`;
+        }
+    }
+    return undefined;
+}
+
+/** True when a declaration is dispatched through the engine's handler registry. */
+function dispatchesThroughHandlerRegistry(action: any): boolean {
+    return !isDeclarativeUpdateAction(action) && (action?.type ?? 'script') === 'script';
+}
+
+/** The refusal {@link actionHandlerOwnerRefusal} answers — the ADR-0112 envelope's three fields. */
+export interface ActionHandlerOwnerRefusal {
+    code: string;
+    status: number;
+    message: string;
+}
+
+/** The one protocol verb {@link collectHandlerOwnerCandidates} reads: the merged listing `GET /api/v1/meta/TYPE` serves. */
+type HandlerOwnerListingRead = Partial<Pick<MetadataProtocol, 'getMetaItems'>>;
+
+/**
+ * Every declaration that could own an entry under `entryObjectKey`, as
+ * `{ action, objectName }` rows: each source a declaration is resolved from
+ * on either door, read in full, so a declaration missing from one of them is
+ * still found in another. More rows can only add gates.
+ *
+ *  - object-embedded `actions[]` — of the routed object alone when the entry
+ *    lives under a real object key (only that object's declarations rotate
+ *    to it, {@link actionHandlerObjectKeys}), of every object when the entry
+ *    is object-less: the door's resolved definition, the engine's schema, and
+ *    for an object-less entry the protocol's merged listing (or the metadata
+ *    service's) and the engine registry's;
+ *  - standalone `action` items — the protocol's merged listing (or the
+ *    metadata service's `loadMany`), and the engine registry's, a disabled
+ *    package's items included.
+ *
+ * The engine's own copies are in memory and always read. The metadata plane's
+ * listings are read beside them, and a plane listing that throws is REPORTED
+ * (`planeError`), never read as "no rows": the caller decides whether the
+ * entry it judges can have an owner the engine's copies do not hold.
+ */
+async function collectHandlerOwnerCandidates(
+    deps: ActionExecutionDeps,
+    requestContext: HttpProtocolContext,
+    args: { ql: any; entryObjectKey: string; routedObjectName: string; routedObject?: any; envId?: string },
+): Promise<{ rows: Array<{ action: any; objectName: string }>; planeError?: unknown }> {
+    const { ql, entryObjectKey, routedObjectName, routedObject, envId } = args;
+    const protocol = await deps.resolveService(requestContext, 'protocol', envId) as HandlerOwnerListingRead | undefined;
+    const meta = await deps.resolveService(requestContext, 'metadata', envId);
+    let planeError: unknown;
+    const fromPlane = async (read: () => Promise<any[] | undefined>): Promise<any[]> => {
+        try {
+            return (await read()) ?? [];
+        } catch (err) {
+            planeError ??= err;
+            return [];
+        }
+    };
+    const mergedListing = async (type: 'object' | 'action'): Promise<any[] | undefined> => {
+        if (!protocol || typeof protocol.getMetaItems !== 'function') return undefined;
+        const answer: unknown = await protocol.getMetaItems({ type });
+        if (Array.isArray(answer)) return answer;
+        const items = (answer as { items?: unknown } | null | undefined)?.items;
+        return Array.isArray(items) ? items : [];
+    };
+    const registryListing = (type: 'object' | 'action'): any[] => {
+        const registry: any = ql?.registry;
+        if (type === 'object') return typeof registry?.getAllObjects === 'function' ? (registry.getAllObjects() ?? []) : [];
+        return typeof registry?.listItems === 'function'
+            ? (registry.listItems('action', undefined, { includeDisabledPackages: true }) ?? [])
+            : [];
+    };
+
+    const objects: any[] = [];
+    if (routedObject) objects.push(routedObject);
+    if (typeof ql?.getSchema === 'function') {
+        const schema = ql.getSchema(routedObjectName);
+        if (schema) objects.push(schema);
+    }
+    if (isObjectLessActionKey(entryObjectKey)) {
+        objects.push(...registryListing('object'));
+        objects.push(...await fromPlane(async () => (await mergedListing('object')) ?? (await meta?.listObjects?.())));
+    }
+
+    const standalone: any[] = [
+        ...registryListing('action'),
+        ...await fromPlane(async () => (await mergedListing('action')) ?? (await meta?.loadMany?.('action'))),
+    ];
+
+    const rows: Array<{ action: any; objectName: string }> = [];
+    for (const obj of objects) {
+        const objectName: unknown = obj?.name;
+        if (typeof objectName !== 'string' || objectName === '') continue;
+        for (const action of Array.isArray(obj?.actions) ? obj.actions : []) {
+            if (action && typeof action.name === 'string') rows.push({ action, objectName });
+        }
+    }
+    for (const action of standalone) {
+        if (action && typeof action.name === 'string') rows.push({ action, objectName: standaloneActionOwnerKey(action) });
+    }
+    return planeError === undefined ? { rows } : { rows, planeError };
+}
+
+/**
+ * The package label the engine plugin's authored-action resync registers a
+ * metadata-plane action's handler under (`ObjectQLPlugin`'s
+ * `resyncAuthoredActionsNow`, `registerAction(…, 'metadata-service')`). An
+ * entry carrying it was built from a plane row, so the declarations that own
+ * it are plane rows, which the engine's in-memory copies need not hold.
+ */
+const PLANE_AUTHORED_HANDLER_PACKAGE = 'metadata-service';
+
+/**
+ * [ADR-0066 D4 · ADR-0126 §8 item 2 · ADR-0110 D2] An action whose dispatch
+ * reaches a handler that a DIFFERENT declared action owns also answers with
+ * that owner's gates: its `requiredPermissions` (403 `PERMISSION_DENIED`) and
+ * its activation-ledger switch (409 `ACTION_DISABLED`), on top of the invoked
+ * declaration's own, which the door has already applied. The sets are unioned,
+ * so this only ever narrows who may run a handler — the reading
+ * `content/docs/ui/actions.mdx` already gives a `flow` action, which inherits
+ * its target flow's `requiredPermissions`.
+ *
+ * ## Owner = the entry the declaration's own dispatch reaches
+ *
+ * ADR-0110 D2 makes a handler KEY an addressing fact, not an identity — so
+ * ownership is read at the handler ENTRY the dispatch actually reaches
+ * (`object:key`, one snapshot of `listRegisteredActions()`, walked in
+ * {@link executeRegisteredAction}'s own rotation), never at every key a
+ * declaration names. A declared `script` action owns the entry ITS OWN
+ * dispatch would reach. Consequences, each pinned by
+ * `domains/action-handler-owner-gates.test.ts`:
+ *
+ *  - a declaration is one identity — its owning object key and its name — so
+ *    the same declaration reaching the population twice (object-embedded and
+ *    as a standalone copy) is the invoked one, not a second owner;
+ *  - two objects that each declare a same-named action are not coupled while
+ *    each has its own entry: each declaration's dispatch stops at its own
+ *    object's key before the object-less one;
+ *  - only `script` declarations dispatch through the registry, so a `flow`,
+ *    `api` or declarative-update declaration owns no entry, and an invocation
+ *    of one is not judged here.
+ *
+ * ## Where it sits
+ *
+ * Both doors call it right after their own D4 gate and activation consult,
+ * ahead of the param contract, the subject-record load and dispatch: a
+ * refused call reads no row and runs nothing. Owner permissions are judged
+ * before owner switches, the doors' own order, so the switch is no oracle to
+ * a caller the owner would refuse. The REST `/actions` door maps the refusal
+ * onto its envelope; the MCP `run_action` bridge throws it with `code` and
+ * `status`.
+ *
+ * ## An unreadable metadata plane
+ *
+ * The owners are read from the engine's in-memory copies and from the plane's
+ * listings ({@link collectHandlerOwnerCandidates}). The plane being down
+ * adds no dependency to a call whose handler a package or code registered:
+ * its owners are declarations the engine holds. Only an entry the
+ * authored-action resync built for ANOTHER plane declaration is refused
+ * 503 while the plane cannot be read — the one case where the owner's gates
+ * live nowhere else.
+ *
+ * `candidates` are the handler keys the door hands {@link executeRegisteredAction},
+ * so the entry judged here is the one the dispatch reaches. An engine that
+ * cannot enumerate its handlers (no `listRegisteredActions`) names no entry,
+ * and this answers `undefined`.
+ */
+export async function actionHandlerOwnerRefusal(deps: ActionExecutionDeps,
+    requestContext: HttpProtocolContext,
+    args: {
+        ql: any;
+        action: any;
+        objectName: string;
+        candidates: string[];
+        ec: any;
+        envId?: string;
+        /** The routed object's definition, as the door resolved it. */
+        obj?: any;
+    },
+): Promise<ActionHandlerOwnerRefusal | undefined> {
+    const { ql, action, objectName, candidates, ec, envId, obj } = args;
+    if (!dispatchesThroughHandlerRegistry(action)) return undefined;
+    if (!ql || typeof ql.listRegisteredActions !== 'function') return undefined;
+
+    const registered = new Set<string>();
+    const packageOf = new Map<string, string | undefined>();
+    for (const row of ql.listRegisteredActions() as Array<{ objectName: string; actionName: string; package?: string }>) {
+        registered.add(`${row.objectName}:${row.actionName}`);
+        packageOf.set(`${row.objectName}:${row.actionName}`, row.package);
+    }
+    const entry = reachedHandlerEntry(registered, objectName, candidates);
+    if (!entry) return undefined;
+
+    // The invoked declaration's identity: the routed object key when the routed
+    // object embeds that name (both doors resolve object-embedded first, so
+    // the invoked declaration IS that entry), else its own standalone owner
+    // key — an object-less item is routable at any object.
+    const embeddedInRouted = Array.isArray(obj?.actions)
+        && obj.actions.some((a: any) => a === action || (a && a.name === action?.name));
+    const invokedIdentity = `${embeddedInRouted ? objectName : standaloneActionOwnerKey(action)}:${action?.name}`;
+
+    const { rows: population, planeError } = await collectHandlerOwnerCandidates(deps, requestContext, {
+        ql, entryObjectKey: entry.slice(0, entry.indexOf(':')), routedObjectName: objectName, routedObject: obj, envId,
+    });
+    // A plane listing that could not be read leaves the engine's own copies,
+    // which hold every declaration a package or code registered a handler for.
+    // An entry built from a plane row is owned by the plane row it was built
+    // for (registered under that row's owner key and name): when that row is
+    // not the invoked declaration, its gates cannot be verified with the plane
+    // unread, and the call is refused rather than run ungated — ADR-0110 D3's
+    // posture for an unreadable plane.
+    if (planeError !== undefined && entry !== invokedIdentity
+        && packageOf.get(entry) === PLANE_AUTHORED_HANDLER_PACKAGE) {
+        const reason = planeError instanceof Error ? planeError.message : String(planeError);
+        return {
+            code: standardErrorCodeForHttpStatus(503),
+            status: 503,
+            message:
+                `Cannot verify which declared action owns the handler that action '${action?.name ?? 'unknown'}' ` +
+                `dispatches to — the metadata plane is unavailable (${reason}). ` +
+                'Refusing rather than running it ungated.',
+        };
+    }
+
+    const owners = new Map<string, { action: any; objectName: string }[]>();
+    for (const row of population) {
+        const identity = `${row.objectName}:${row.action.name}`;
+        if (identity === invokedIdentity) continue;
+        if (!dispatchesThroughHandlerRegistry(row.action)) continue;
+        if (reachedHandlerEntry(registered, row.objectName, resolveActionHandlerKeys(row.action)) !== entry) continue;
+        const copies = owners.get(identity) ?? [];
+        copies.push(row);
+        owners.set(identity, copies);
+    }
+    if (owners.size === 0) return undefined;
+
+    const via = `Action '${action?.name ?? 'unknown'}' on '${objectName}' dispatches to a handler`;
+    for (const copies of owners.values()) {
+        for (const owner of copies) {
+            const denied = actionPermissionError(deps, owner.action, ec, owner.objectName);
+            if (denied) {
+                return {
+                    code: standardErrorCodeForHttpStatus(403),
+                    status: 403,
+                    message: `${via} that action '${owner.action.name}' owns, so it is gated by that action too: ${denied}`,
+                };
+            }
+        }
+    }
+    for (const copies of owners.values()) {
+        const switchedOff = disabledActionRefusal(deps, ql, copies[0].action);
+        if (switchedOff) return switchedOff;
+    }
+    return undefined;
+}
+
+
 /**
  * Resolve the DECLARATION behind a `<object>/<action>` route pair — the
  * single source the REST `/actions` route reads for the ADR-0066 D4