@@ -0,0 +1,21 @@
+---
+'@objectstack/metadata-core': patch
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+---
+
+fix(rest, runtime)!: the /meta action doors and MCP list_actions serve an action entry as the object door projects it (ADR-0106)
+
+Clause-②: no (narrowing) — the `/meta` `action` reads (the list, the item read, `/layers` with its `?layers=true` spelling, and `/published`, on both transports) and MCP `list_actions` now answer a caller only the action entries the `/meta` object door's projection serves that caller, which ADR-0106 D1 ("a field the caller cannot read does not exist for that caller, on any plane") already promises, so no stated contract is narrowed; what narrows is the answer to a caller with a `readable: false` field. Nothing is widened: no answer member, error code or status is added; the new exports are the shared projection the doors ask.
+Metadata-protocol: none
+Skills-docs: no move — `skills/**` teaches no `/meta` action read; `content/docs/ai/connect-mcp.mdx` and `content/docs/deployment/environment-variables.mdx` state the projection.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema and no stored shape changes: the action doors answer a field-restricted caller the action entries the metadata object door already serves them. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** for a field-restricted caller of the `/meta` `action` reads and of MCP `list_actions` over HTTP (`/api/v1/mcp`).
+
+- **Now.** Each standalone `action` entry the `/meta` doors serve is projected through the object door's ADR-0106 posture and projection for this caller, as its own object's only action (`projectMetaActionForCaller` in `@objectstack/rest`, the one rule every action door asks). Each param is judged on the object it names: its `objectOverride` when set, else the action's `objectName`. An entry that projection withholds is left out of `GET /api/v1/meta/action`, and `GET /api/v1/meta/action/:name`, its `/layers` (and `?layers=true`) and its `/published` answer it exactly as they answer a name with nothing behind it. A layered read with any layer withheld is answered that way too. The cached item arm judges a conditional request after that projection, so a withheld entry is never answered `304`.
+- **Object-less actions.** An action with no own object (a `global` action) whose `objectOverride` param binds a field the caller cannot read on the object it names is withheld the same way, on the `/meta` doors and in MCP `list_actions`.
+- **Param summaries.** MCP `list_actions` summarises a param bound through `objectOverride` with the field of the object it names (its label and type), not the action's own object's field of the same name; a target that names no object the bridge holds is summarised as before.
+- **Refusal.** Where the caller's field visibility on an action's own object cannot be evaluated, or the projection would leave that object with no field, the read is refused as the object door refuses it: `FIELD_VISIBILITY_UNRESOLVED` / 503.
+- **Unchanged.** A caller who may read every field, a D4-exempt caller (`manage_metadata`, the system context) and a deployment with no `security` service or with the mask switched off are answered byte for byte as before; so is every action whose params bind only readable fields, or none. The run doors (MCP `run_action`, `POST /actions`) and their param validation and refusal text are unchanged.
@@ -401,7 +401,8 @@ drive this MCP server. Same word, different layer.
   scope name only the fields the caller can read, the same field set
   `GET /api/v1/meta/object/:name` serves that caller. `list_actions` follows
   the same projection: an action that object door withholds from the caller
-  (one whose param binds a field the caller cannot read) is not listed, and a
+  (one whose param binds a field the caller cannot read, judged on the object
+  the param names, so an object-less action too) is not listed, and a
   listed action's params carry no label, help text or options of such a
   field. Sparse results or denied
   writes usually mean governance is *working*, not that the connection is
 
@@ -339,7 +339,7 @@ that bypassed write hooks, `rebuildSearchCompanion` (from
 |:---|:---|:---|:---|
 | `OS_MARKETPLACE_CACHE` | enum | `on` | `off` disables the in-memory marketplace listing cache. |
 | `OS_MARKETPLACE_PUBLIC_BASE_URL` | url | — | Public base URL of the marketplace registry (proxied from this runtime when set). |
-| `OS_ALLOW_UNMASKED_OBJECT_METADATA` | boolean | `false` | Escape hatch for the metadata-plane field-level security mask ([ADR-0106](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0106-metadata-plane-fls-object-schema-masking.md) D8). By default every object schema served by `/meta` and `/metadata` is projected onto the fields the **calling user** may read, so a field they cannot read does not appear at all — not its name, label, type, picklist options, formula, `visibleWhen` predicate, `defaultValue`, or the `requiredPermissions` capability guarding it. Set to `1` to serve the full schema to every authenticated caller, as releases before this one did. This changes **disclosure only**: the data plane still masks values and refuses forbidden writes either way, and the console reads field affordances from `/auth/me/permissions`, so toggling it never changes UI correctness. The REST layer also honours a per-server `metadata.maskObjectFields: false`; this variable is the deployment-wide knob and covers the runtime `/metadata` dispatcher, which has no REST config to read. |
+| `OS_ALLOW_UNMASKED_OBJECT_METADATA` | boolean | `false` | Escape hatch for the metadata-plane field-level security mask ([ADR-0106](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0106-metadata-plane-fls-object-schema-masking.md) D8). By default every object schema served by `/meta` and `/metadata` is projected onto the fields the **calling user** may read, so a field they cannot read does not appear at all — not its name, label, type, picklist options, formula, `visibleWhen` predicate, `defaultValue`, or the `requiredPermissions` capability guarding it; an `action` entry whose param binds such a field is answered as a name that does not exist. Set to `1` to serve the full schema to every authenticated caller, as releases before this one did. This changes **disclosure only**: the data plane still masks values and refuses forbidden writes either way, and the console reads field affordances from `/auth/me/permissions`, so toggling it never changes UI correctness. The REST layer also honours a per-server `metadata.maskObjectFields: false`; this variable is the deployment-wide knob and covers the runtime `/metadata` dispatcher, which has no REST config to read. |
 | `OS_METADATA_WRITABLE` | csv | — (none) | Comma-separated metadata type names (e.g. `hook,job`) granted a runtime escape hatch that treats them as `allowEnvironmentOverlay: true` for items **no managed package ships**: it opens runtime creation of a type whose registry entry allows none. It never opens an organization-scoped write: since [ADR-0131](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0131-total-organization-ownership-no-null-organization-id.md) D6 the metadata protocol refuses every organization-scoped write with `403 NOT_OVERRIDABLE`. It **never opens an item a managed package ships**: managed content is sealed ([ADR-0131](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0131-total-organization-ownership-no-null-organization-id.md) D6), so an overlay or a removal of a shipped flow, object, field, permission set, position or any other type without an environment overlay is refused with `403 NOT_OVERRIDABLE` whether the hatch is set or not. Customize managed content through its type's own route instead: an environment overlay for `view`, `dashboard`, `report`, `translation` and `email_template`; disable, or clone under a new name, for a flow; clone for a permission set. An overlay row this hatch wrote before over a managed item is kept at rest but **not served**: every read takes the package's definition, and boot names each such row, per type (`[metadata_sealed_overlay_unserved]`), with the two remedies — re-express the change as a new item under a new name, or delete the row. A stored fork of a packaged permission set is the one exception: the deployment does not boot while it holds one (ADR-0048); `os migrate security-catalog-overlays` lists such rows and, with `--apply`, deletes them, which restores the package's definition. A stored row over a managed item of the other types that merge overlays at read (`position`, `page`, `app`, `dataset`, `book`, `tool`, `skill`) can still be removed, but removing it changes nothing that is served: no read serves it, so the package's definition is already served. See [ADR-0005](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0005-metadata-customization-overlay.md). |
 
 ---
 
@@ -8,6 +8,8 @@
 import { describe, it, expect } from 'vitest';
 import {
     ObjectSchemaMaskEvaluationError,
+    actionObjectOverrideTargets,
+    actionServedWithoutOwnObject,
     applyObjectSchemaMask,
     foldVisibilityFingerprintIntoEtag,
     isObjectSchemaMaskExempt,
@@ -428,3 +430,30 @@ describe('[#22250] the D4 exemption covers the definition, not the runtime view'
         expect(noService).toEqual({ kind: 'passthrough', reason: 'exempt' });
     });
 });
+
+describe('[ADR-0106 D1] an action with no own-object definition — its objectOverride params judged on the object each names', () => {
+    const RATE = { field: 'rate', objectOverride: 'vendor' };
+    const ACTION = { name: 'quote', params: [RATE, { field: 'name', objectOverride: 'vendor' }, { field: 'code', objectOverride: 'region' }, { name: 'note' }] };
+
+    it('names every other object a param reads, once each, in declaration order', () => {
+        expect(actionObjectOverrideTargets(ACTION)).toEqual(['vendor', 'region']);
+        expect(actionObjectOverrideTargets(ACTION, 'vendor')).toEqual(['region']);
+        expect(actionObjectOverrideTargets({ name: 'plain', params: [{ name: 'note' }] })).toEqual([]);
+    });
+
+    it('serves the action only when every bound field is readable on the object it names', () => {
+        const readable = new Map([['vendor', new Set(['rate', 'name'])], ['region', new Set(['code'])]]);
+        expect(actionServedWithoutOwnObject(ACTION, undefined, readable)).toBe(true);
+        const rateDenied = new Map([['vendor', new Set(['name'])], ['region', new Set(['code'])]]);
+        expect(actionServedWithoutOwnObject(ACTION, undefined, rateDenied)).toBe(false);
+    });
+
+    it('withholds the action when a named object\'s readable set is undetermined (fail closed)', () => {
+        expect(actionServedWithoutOwnObject(ACTION, undefined, new Map([['vendor', new Set(['rate', 'name'])]]))).toBe(false);
+        expect(actionServedWithoutOwnObject(ACTION, undefined, new Map([['vendor', new Set(['rate', 'name'])], ['region', undefined]]))).toBe(false);
+    });
+
+    it('an action binding no other object is served as declared', () => {
+        expect(actionServedWithoutOwnObject({ name: 'plain', params: [{ name: 'note' }] }, undefined, new Map())).toBe(true);
+    });
+});
@@ -696,6 +696,39 @@ export function applyObjectSchemaMask<T>(document: T, posture: ObjectSchemaMaskP
     };
 }
 
+/**
+ * [ADR-0106 D1] The objects an action entry's params name through
+ * `objectOverride` — every object other than `ownerName` — once each, in
+ * declaration order. These are the objects {@link actionServedWithoutOwnObject}
+ * judges against.
+ */
+export function actionObjectOverrideTargets(action: unknown, ownerName?: string): string[] {
+    const document = ownerName === undefined ? { actions: [action] } : { name: ownerName, actions: [action] };
+    return [...new Set(objectOverrideReads(document).map((read) => read.object))];
+}
+
+/**
+ * [ADR-0106 D1] Does the `/meta` object door's projection keep this action,
+ * for an action with no own-object definition to project: an object-less
+ * (`global`) action, or one whose `objectName` names no object?
+ *
+ * Such an action carries no field of its own object, so nothing of it is
+ * denied there; each param bound through `objectOverride` is judged on the
+ * object it names, against `related` (the caller's readable fields on that
+ * object; a missing or `undefined` entry withholds the action, fail closed).
+ * It is the object door's own rule — {@link maskDeniedFieldReferences} on the
+ * action as a document's only `actions` entry — not a second one.
+ */
+export function actionServedWithoutOwnObject(
+    action: unknown,
+    ownerName: string | undefined,
+    related: ReadonlyMap<string, ReadonlySet<string> | undefined>,
+): boolean {
+    const document = ownerName === undefined ? { actions: [action] } : { name: ownerName, actions: [action] };
+    const served = maskDeniedFieldReferences(document, new Set(), related);
+    return Array.isArray(served.actions) && served.actions.length === 1;
+}
+
 /**
  * A stable hash of the caller's **denied** field set for one object (ADR-0106
  * D3) — the ETag dimension that keeps `304` semantics correct per permission
 
@@ -179,6 +179,8 @@ export {
     metaRequestLocale,
     metaTypeReadRefusal,
     metaTypeWriteRefusal,
+    projectMetaActionForCaller,
+    projectMetaActionItem,
     projectMetaObjectSchema,
     refuseUnknownMetaListType,
     STORED_VERSION_DOOR_POLICY,
@@ -187,6 +189,8 @@ export {
     wantsMetaItemLayers,
 } from './meta-item-read-gate.js';
 export type {
+    MetaActionProjection,
+    MetaActionProjectionSources,
     MetaBookTreeAnswer,
     MetaBookTreeSources,
     MetaItemAnswer,
 
@@ -170,7 +170,7 @@ import type { AuditMetaItemRequest, HistoryMetaItemRequest, PublishMetaItemReque
 import { canonicalMetaUrlType } from '@objectstack/spec/shared';
 import { handleRouteError, sendFieldVisibilityFault, thrownAnswerIsBareNotFound } from './error-response.js';
 import type { MetaRouteScope, TransportScopedMetaRequest } from './meta-collection-routes.js';
-import { META_ITEM_MEMBER_PARAM, META_ITEM_PUBLISHED_PARAMS, metaMemberSelector } from './meta-item-read-gate.js';
+import { META_ITEM_MEMBER_PARAM, META_ITEM_PUBLISHED_PARAMS, metaMemberSelector, projectMetaActionItem } from './meta-item-read-gate.js';
 import { refuseUnknownQueryParams } from './query-allowlist.js';
 import { refuseRepeatedQueryParams } from './query-multiplicity.js';
 import {
@@ -1094,6 +1094,8 @@ export interface MetaItemPublishedRouteHost {
     readonly objectQLProvider: RestServer['objectQLProvider'];
     resolveRequestEnvironmentId: RestServer['resolveRequestEnvironmentId'];
     resolveMetadataService: RestServer['resolveMetadataService'];
+    /** [ADR-0106 D1] The `object` list read the `action` projection reads its objects from. */
+    metaListSource: RestServer['metaListSource'];
 }
 
 /**
@@ -1246,6 +1248,25 @@ export function registerMetaItemPublishedRoute(this: MetaItemPublishedRouteHost,
                         } else if (publishedMaskPosture.kind === 'undetermined') {
                             res.header('Cache-Control', 'private, no-store');
                         }
+                        // [ADR-0106 D1] An `action` is served as the object
+                        // door's projection serves it to this caller, as the
+                        // plain read serves it; a withheld one is this door's
+                        // answer for a name with nothing published behind it.
+                        if (publishedMetaType === 'action') {
+                            const projected = await projectMetaActionItem({
+                                ...this.metaListSource(gateProtocol, environmentId),
+                                resolveObjectMasker: () => this.resolveObjectMasker(environmentId, req, 'object'),
+                            }, served);
+                            if (projected.kind === 'withhold') {
+                                res.status(404).json({ error: { code: 'NOT_FOUND', message: 'Not found' } });
+                                return;
+                            }
+                            if (projected.kind === 'fault') {
+                                sendFieldVisibilityFault(res, projected.object);
+                                return;
+                            }
+                            if (projected.cacheControl) res.header('Cache-Control', projected.cacheControl);
+                        }
                         res.json(served);
                     };
                     // [#20156] The overlay found is SERVED outside the