@@ -0,0 +1,18 @@
+---
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+---
+
+fix(rest,runtime)!: the import doors and the catalog refresh read the walled-catalog verdict the metadata save door reads
+
+Clause-②: no (narrowing) — under the `isolated` and `group` tenancy postures, importing a remote table as an object (`POST /api/v1/datasources/:name/external/tables/:remote/import`, and the MCP `import_object` tool) and refreshing a federated datasource's cached catalog (`POST /api/v1/datasources/:name/external/refresh-catalog`) are writes to the environment's metadata catalog, and they are the platform operator's, as every other write to that catalog is.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped and nothing at rest changes: which caller an import door or the catalog refresh admits under a walled tenancy posture is all that moves, and every object already imported and every catalog snapshot already stored stays as it is. -->
+
+**BREAKING** accept-set narrowing at both import doors and at the catalog refresh (`@objectstack/rest`, `@objectstack/runtime`) under a walled tenancy posture.
+
+- **The rule.** Under `isolated` and `group` every organization shares the environment's metadata catalog, and a write to it is admitted only for the platform operator and for the engine's own writes (ADR-0131 D3, D12 items 7–8, D11). An import saves an object into that catalog, and a catalog refresh saves the datasource's `external_catalog` snapshot there, so each of those doors asks the walled-catalog verdict the metadata save door asks (`walledCatalogWriteVerdict`, `@objectstack/metadata-core`) for the type it writes, after the federation capability rule and before the federation service is looked up.
+- **The answer.** A refused call answers `403 PERMISSION_DENIED` with the verdict's sentence for the type written, the one the metadata save door answers, naming the posture. Nothing is introspected and nothing is saved. A `tenancy` service that is registered and cannot answer refuses the call `503 SERVICE_UNAVAILABLE`.
+- **Unchanged.** The platform operator imports and refreshes under a wall as before. Under `single`, and on a deployment with no `tenancy` service, every caller holding both federation capabilities imports and refreshes as before. Listing remote tables, drafting an object and validating are unchanged, and the federation capability rule answers first, as before.
+- **Who moves.** On a walled deployment, an import or a catalog refresh by a caller below the platform operator is refused; the platform operator performs it.
@@ -145,7 +145,11 @@ What each piece does on this driver:
   datasource page lists its entity sets on the **Tables** tab. **Import** saves one,
   and **Import selected** saves several, referenced entity sets first. An MCP client
   whose token carries `metadata:write` reaches the same import through
-  `list_remote_tables` and `import_object`. The draft maps each EDM type to a field
+  `list_remote_tables` and `import_object`. An import saves an object into the
+  environment's metadata, so under the `group` and `isolated` tenancy postures only
+  the platform operator imports, as only the platform operator saves any other
+  metadata there ([tenancy modes](/docs/deployment/tenancy-modes)). A refresh of the
+  datasource's catalog saves its snapshot there too, so the same holds for it. The draft maps each EDM type to a field
   type, makes the key the `id`, and writes `columnMap` for every property whose name is
   not a snake_case field name (`CategoryID` becomes `category_id`). EDM types with no
   field type, such as `Edm.Duration` or a service's own enum, are listed for review. An
 
@@ -67,8 +67,12 @@ and the engine's own writes (seeders, installers, migrations) write it. Holding
 `manage_metadata` inside an organization does not admit a write: the `/meta`
 write doors (save, reset, publish, rollback), the install-wide stored rewrite
 (`POST /meta/_migrate-stored`), every `/packages` write,
-`install-local` install, upgrade and uninstall, and the `/automation`
-definition writes refuse such a caller `403`, naming the posture.
+`install-local` install, upgrade and uninstall, the `/automation`
+definition writes, the import of a remote table as an object
+(`POST /datasources/:name/external/tables/:remote/import` and the MCP
+`import_object` tool), and the refresh of a federated datasource's cached
+catalog (`POST /datasources/:name/external/refresh-catalog`) refuse such a
+caller `403`, naming the posture.
 
 - **Headquarters IT** authors the environment's metadata as the platform
   operator: declare its administrators in `OS_PLATFORM_OWNER_EMAIL`. A
 
@@ -204,7 +204,7 @@ One of the largest consumers of the flag;
 | 54 | Package REST route capability gate bypassed | rest | Get: a marketplace publish over REST (`POST /packages/publish`, the one route the REST registrar mounts since #14503) without `manage_metadata`; the package read cohort (`studio.access` / `setup.access`) is enforced by the dispatcher `/packages` domain's own read gate, where the reads are served | `refusePackageRequest` |
 | 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `requireManageMetadata`, `requireReadCapability` |
 | 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `refuseUngrantedActivationWrite`, `refuseUngrantedActivationAuthoring` |
-| 55b | Walled environment-metadata refusal does not fire | metadata-core, rest, runtime | Get: under `isolated` / `group`, a write of the environment's metadata, of any type, at the `/meta` write doors (save, reset, publish, rollback) and `POST /meta/_migrate-stored` on both transports, at every `/packages` write door (create, the manifest `PATCH`, enable, disable, publish, `publish-drafts`, `discard-drafts`, `revert`, `rollback`, `commits/:commitId/revert`, `duplicate`, `adopt-orphans`, delete), at the `/automation` definition writes (create, update, delete, clone), and at the permission-set clone door. Every other caller below the platform-operator rung is refused `403` there (ADR-0131 D3, D12 items 7–8, D11), because one organization's write would change what every organization resolves. The seeders, the package door and migrations write the environment's metadata this way. Under `single` the refusal is inert for every caller | `walledCatalogWriteVerdict`, `walledCatalogRefusal`, `refuseWalledCatalogPackageWrite`, `refuseWalledFlowDefinitionWrite` |
+| 55b | Walled environment-metadata refusal does not fire | metadata-core, rest, runtime | Get: under `isolated` / `group`, a write of the environment's metadata, of any type, at the `/meta` write doors (save, reset, publish, rollback) and `POST /meta/_migrate-stored` on both transports, at every `/packages` write door (create, the manifest `PATCH`, enable, disable, publish, `publish-drafts`, `discard-drafts`, `revert`, `rollback`, `commits/:commitId/revert`, `duplicate`, `adopt-orphans`, delete), at the `/automation` definition writes (create, update, delete, clone), at the permission-set clone door, at the import of a remote table as an object (the REST import route and the MCP `import_object` tool), and at the refresh of a federated datasource's cached catalog. Every other caller below the platform-operator rung is refused `403` there (ADR-0131 D3, D12 items 7–8, D11), because one organization's write would change what every organization resolves. The seeders, the package door and migrations write the environment's metadata this way. Under `single` the refusal is inert for every caller | `walledCatalogWriteVerdict`, `walledCatalogRefusal`, `refuseWalledCatalogPackageWrite`, `refuseWalledFlowDefinitionWrite`, `registerExternalDatasourceRoutes`, `federationService` |
 | 57 | Automation run-state read, flow-authoring write, the paused-run caller gate (screen read and resume), the two operator run-lifecycle writes, and the elevated self-triggered start and the start-record check at every door that starts a flow by name all pass | runtime | Get: run state, flow writes, a paused run's screen and its resume with no grant and without being the run's starter — and cancelling or restoring a suspension without the platform-operator rung. The screen read and the resume ask one predicate, so this is one bypass for both. The lifecycle bypass is the in-process owner's door: plugin-approvals' revise-window recall (ADR-0044) cancels on behalf of a decision it already authorized and recorded. And starting a flow declared `runAs: 'system'` whose type is self-triggered (`autolaunched`, `record_change`, `schedule`) through any door that starts a flow by name — the trigger route, an action of `type: 'flow'` (REST `/actions` and the MCP `run_action` bridge) and a declared endpoint of `type: 'flow'` — which every other caller, the guest principal included, is refused `403 PERMISSION_DENIED` (the maintainer's rulings, letters B and A) — and starting, through the same doors, a flow whose `requiredPermissions` the caller does not hold (ruling record 6377848497, letter A). And starting, through the same doors, a flow on a record key the caller's own scope does not deliver, which every other caller is refused with the action door's `404 RECORD_NOT_FOUND` before the run exists (and `400 VALIDATION_FAILED` for a key that is not one id, or for an elevated start that names no object). The three doors ask one check, so this is one bypass for all of them, and it is the in-process caller's, such as a job: inbound HTTP never carries the flag | `mayReadRunState`, `refuseUngrantedFlowWrite`, `isRunStarterOrRunStateReader`, `refuseUngrantedRunLifecycleWrite`, `flowStartRefusal`, `refuseUnreadableFlowStartRecords` |
 | 57b | Connector credential door's capability and posture gates pass | runtime | Get: listing, setting and clearing the environment's stored connector credentials (`/automation/connectors/credential-refs`) without `manage_metadata`, and under the `group` / `isolated` postures, where the door refuses every other caller `403 PERMISSION_DENIED` naming the posture, the platform operator included, because the store is environment-level. The bypass is the in-process caller's: inbound HTTP never carries the flag. Get nothing more about the value: no answer of this door carries it | `refuseUngrantedConnectorCredentialAccess`, `refuseWalledConnectorCredentialAccess` |
 | 57c | Connector connection door's capability gate passes | runtime | Get: reading, beginning, completing (the OAuth callback) and revoking an organization's connection of an `oauth2` `authorization_code` connector instance (`/automation/connectors/:name/connection`, `/automation/connectors/oauth/callback`, ADR-0143 D5) without `manage_metadata`. No posture refuses it: a connection belongs to its organization. The bypass is the in-process caller's: inbound HTTP never carries the flag. Get nothing more: no answer of this door carries a token, and the callback's `state` is still bound to the user and organization that began the connect | `refuseUngrantedConnectorConnectionAccess` |
@@ -618,7 +618,7 @@ and CI refuses one that differs from what the tree produces.
 | `packages/plugins/plugin-webhooks/src/declared-webhooks.ts#bindDeclaredWebhookNameGuard` | 1 | 59 |
 | `packages/plugins/plugin-webhooks/src/webhook-provenance.ts#bindWebhookProvenanceStamp` | 1 | 59 |
 | `packages/rest/src/data-action-routes.ts#importUndoWriteContext` | 1 | 30c |
-| `packages/rest/src/external-datasource-routes.ts#registerExternalDatasourceRoutes` | 1 | 52 |
+| `packages/rest/src/external-datasource-routes.ts#registerExternalDatasourceRoutes` | 2 | 52, 55b |
 | `packages/rest/src/import-prepare.ts#importControlOptOutRefusal` | 1 | 30b |
 | `packages/rest/src/meta-collection-routes.ts#registerMetaCollectionRoutes` | 1 | 50 |
 | `packages/rest/src/meta-item-history-routes.ts#registerMetaItemHistoryRoutes` | 2 | 50 |
@@ -648,6 +648,7 @@ and CI refuses one that differs from what the tree produces.
 | `packages/runtime/src/domains/automation.ts#refuseWalledConnectorCredentialAccess` | 1 | 57b |
 | `packages/runtime/src/domains/automation.ts#refuseWalledFlowDefinitionWrite` | 1 | 55b |
 | `packages/runtime/src/domains/i18n.ts#handleI18nRequest` | 1 | 52 |
+| `packages/runtime/src/domains/mcp.ts#federationService` | 1 | 55b |
 | `packages/runtime/src/domains/mcp.ts#handleMcpRequest` | 1 | 53 |
 | `packages/runtime/src/domains/meta.ts#handleMetadataRequest` | 5 | 50, 52 |
 | `packages/runtime/src/domains/packages.ts#handlePackagesRequest` | 1 | 52 |
 
@@ -45,7 +45,9 @@
  * Under a wall, the doors that write the environment's metadata ask a second
  * predicate after their capability gate, {@link walledCatalogWriteVerdict}:
  * the `/meta` item write doors, `POST /meta/_migrate-stored`, the `/packages`
- * write doors, the `/automation` definition writes and `install-local`.
+ * write doors, the `/automation` definition writes, `install-local`, the
+ * external-table import (the REST route and the MCP `import_object` tool) and
+ * the federated catalog refresh.
  *
  * ── Refusal messages (#7450) ──────────────────────────────────────────────
  *
@@ -181,8 +183,11 @@ export const PLATFORM_OPERATOR_POSTURE = 'PLATFORM_ADMIN';
  * `/meta` item write doors on both transports (save, reset, publish,
  * rollback), `POST /meta/_migrate-stored` on both transports, the `/packages`
  * write doors, the `/automation` definition writes,
- * `install-local` (install, upgrade, uninstall) and the permission-set clone
- * door. (The security plugin's data door on the catalog objects asked it too,
+ * `install-local` (install, upgrade, uninstall), the permission-set clone
+ * door, the external-table import on both of its doors (the REST route and
+ * the MCP `import_object` tool, which save an `object` into the catalog), and
+ * the federated catalog refresh (which saves an `external_catalog`). (The
+ * security plugin's data door on the catalog objects asked it too,
  * until those objects retired — ADR-0131 D3, C3 stage 8: no `sys_position`,
  * `sys_permission_set` or `sys_capability` write reaches the engine, so a
  * position, set or capability is written through the `/meta` doors above.)