@@ -0,0 +1,18 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/objectql': minor
+'@objectstack/cli': minor
+'@objectstack/cloud-connection': minor
+---
+
+feat(metadata-protocol,objectql): a package's action can be customized by a declared override in its paired `.custom` package (ADR-0146 D9 `action`), and an override that widens who may run the action is refused
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+- **A declared action override is admitted.** An `action` saved, published or installed in a base's paired `<base>.custom` package with `overrides: { package: '<base>', basedOn: '<version>' }` was refused `403 NOT_OVERRIDABLE` ("action customization is not yet available"). It is now admitted by the save, publish and install doors, `os validate` and `os build`, like a flow override. It replaces the base's action whole, and every read of the base's action serves it under the base's name: the by-name and execution reads, the layered read's `effective` (with `code` still the base's), both lists, the object read's `actions` (what the list toolbar, row menu and record header are drawn from) and the engine's schema, which the REST `/actions` door and the MCP `run_action` bridge read the action from. Deleting the override serves the base's action again everywhere. The action activation switch keyed by the action's name turns the override off while it is armed, and the switch stays where it was when the base is restored. Only the pair declares: a dependent's declaration and the pair's undeclared same-named save stay refused, and a dependent's row is never served.
+- **A script action's body is rebound.** The override's `body` runs in place of the base's handler after one resync (`kernel:ready`, `metadata:reloaded`, or the publish itself). Removing the override binds the base's handler again on the next resync, without re-registering the base. `@objectstack/objectql` adds `ObjectQL#registerActionOverride(objectName, actionName, handler, packageName)`, which binds a handler over the one registered under the key and keeps it beneath. `removeActionsByPackage(packageName)` now removes the package's entries from each key's stack, so the handler beneath is bound again. `registerAction` of another package's handler under a key an override holds takes the place beneath the override instead of replacing it: a marketplace-installed base binds its handlers in the install plugin's `kernel:ready` rehydrate, after the boot's resync bound the override, and after a restart the override still runs (and a restore runs the base's body).
+- **An override may add a gate and never remove one (ADR-0066 D4).** The write gate refuses, with the new rule `declared_action_widens_access` (`403 NOT_OVERRIDABLE`), an action override that drops a capability the base's `requiredPermissions` names, sets `ai.exposed: true` on an action the base keeps off the agent surface, or drops the base's `ai.requiresConfirmation: true`. The refusal names each widened gate. Adding a capability or turning a gate on is admitted. Everything else (`label`, `type`, `target`, `body`, `params`, `visible` and the rest) is replaced whole, so an override can still change what runs, including a body that runs system-elevated, but only for people who could already run the action. `@objectstack/metadata-protocol` exports `actionOverrideWidening(baseItem, overrideItem)`, which returns the widened gates as clauses, and `OverrideWriteClosure.baseItemOf`, through which a door hands the judge the base's own item. `@objectstack/cli` (`os validate`) and `@objectstack/cloud-connection` (the managed install) pass it.
+- The action switch route in the packaged-base refusal sentences is now spelled `POST /api/v1/actions/_activation/:object_or_global/:action`, which keeps the declared-save sentence within the REST door's 500-character message bound for long action names.
+
+Skills-docs: follow-up #30505
@@ -98,19 +98,38 @@ describe('#28410 — findOverrideDeclarationRefusals walks the artifact under th
       manifest: manifest(PAIR, [BASE]),
       dashboards: [{ name: 'crm_board', overrides: { package: BASE, basedOn: '1.0.0' } }],
       objects: [{ name: 'crm_account', overrides: { package: BASE, basedOn: '1.0.0' } }],
-      // [#28412, ADR-0146 D9] A declared flow override is admitted now (its D9
-      // conditions are delivered); an `action` declaration still waits.
+      // [#28412, #30065, ADR-0146 D9] Declared flow and action overrides are
+      // admitted (their D9 conditions are delivered).
       flows: [{ name: 'crm_flow', overrides: { package: BASE, basedOn: '1.0.0' } }],
       actions: [{ name: 'crm_call', objectName: 'crm_account', label: 'Call', overrides: { package: BASE, basedOn: '1.0.0' } }],
       pages: [{ name: 'crm_home', overrides: { package: 'com.unlisted', basedOn: '1.0.0' } }],
     });
     expect(rows.map((r) => [r.path, r.rule])).toEqual([
       ['objects[0]', 'declared_object'],
-      ['actions[0]', 'declared_type_not_yet_available'],
       ['pages[0]', 'declared_outside_pair'],
     ]);
   });
 
+  it('[#30065] a declared action override is judged against the base\'s own action: a widening is refused, a narrowing admitted', () => {
+    const gates = { requiredPermissions: ['crm_admin'], ai: { requiresConfirmation: true } };
+    const gatedBase = pkg(BASE, [], { actions: [{ name: 'log_call', objectName: 'crm_account', label: 'Log', ...gates }] });
+    const overrides = { package: BASE, basedOn: '1.0.0' };
+    const wider = { name: 'log_call', objectName: 'crm_account', label: 'Ours', overrides, requiredPermissions: [], ai: { requiresConfirmation: true } };
+    const narrower = { name: 'log_call', objectName: 'crm_account', label: 'Ours', overrides, ...gates, requiredPermissions: ['crm_admin', 'crm_auditor'] };
+    const rows = findOverrideDeclarationRefusals({
+      manifest: manifest('com.acme.bundle'),
+      packages: [gatedBase, pkg(PAIR, [BASE], { actions: [wider] })],
+    });
+    expect(rows.map((r) => [r.path, r.code, r.rule])).toEqual([
+      ['packages[1].manifest.actions[0]', 'NOT_OVERRIDABLE', 'declared_action_widens_access'],
+    ]);
+    expect(rows[0].message).toContain("drops 'crm_admin' from `requiredPermissions`");
+    expect(findOverrideDeclarationRefusals({
+      manifest: manifest('com.acme.bundle'),
+      packages: [gatedBase, pkg(PAIR, [BASE], { actions: [narrower] })],
+    })).toEqual([]);
+  });
+
   it('a dependent carrying `overrides` is refused, and a declaration of an item the base does not ship is refused', () => {
     const rows = findOverrideDeclarationRefusals({
       manifest: manifest('com.acme.bundle'),
 
@@ -122,9 +122,13 @@ export function findOverrideDeclarationRefusals(parsed: Record<string, unknown>)
       if (base !== undefined && dependencies.includes(base) && !byId.has(base) && !shippers.includes(base)) {
         shippers.push(base);
       }
+      // [#30065] The base's own item of this identity, when this artifact
+      // carries the base: what a declared action override is judged against.
+      const baseItemOf = (baseId: string): unknown =>
+        byId.get(baseId)?.items.find((i) => `${i.type}\u0000${i.identity}` === key)?.item;
       const verdict = judgeOverrideWrite(
         { type: walked.type, name: walked.name, packageId: pkg.id, item: walked.item },
-        { dependencies, shippers },
+        { dependencies, shippers, baseItemOf },
       );
       if (verdict.verdict !== 'refuse') continue;
       rows.push({ path: walked.path, code: 'NOT_OVERRIDABLE', rule: verdict.rule, packageId: pkg.id, message: verdict.message });
 
@@ -195,8 +195,8 @@ describe('install-local 2d — the override write gate at the managed install (A
         expect(res.payload.data).not.toHaveProperty('overrideCollisions');
     });
 
-    it('[#28412] the paired .custom installs its declared FLOW override; a declared action override still waits', async () => {
-        // ADR-0146 D9: flow's conditions are delivered, so the gate admits it.
+    it('[#28412, #30065] the paired .custom installs its declared FLOW and ACTION overrides', async () => {
+        // ADR-0146 D9: flow's and action's conditions are delivered, so the gate admits them.
         const flow = await install({
             id: PAIR, version: '1.0.0', namespace: 'crm_custom', dependencies: deps(BASE),
             flows: [{ name: 'crm_followup', label: 'Ours', overrides: { package: BASE, basedOn: '1.0.0' } }],
@@ -209,8 +209,26 @@ describe('install-local 2d — the override write gate at the managed install (A
             id: PAIR, version: '1.0.0', namespace: 'crm_custom', dependencies: deps(BASE),
             actions: [{ name: 'crm_call', label: 'Ours', overrides: { package: BASE, basedOn: '1.0.0' } }],
         });
-        expect(action.res.status).toBe(403);
-        expect(refusedOf(action.res)).toEqual([['action', 'crm_call', 'declared_type_not_yet_available']]);
+        expect(action.res.status, JSON.stringify(action.res.payload)).toBe(200);
+        expect(action.registered).toEqual([]);
+        expect(action.saved).toEqual([['action', 'crm_call']]);
+    });
+
+    it('[#30065] a declared action override that widens who may run the base\'s action is refused 403, and nothing is written', async () => {
+        const holdings: Holdings = {
+            [BASE]: { action: [{ name: 'crm_call', label: 'Call', requiredPermissions: ['crm_admin'], ai: { exposed: false } }] },
+        };
+        const wider = { name: 'crm_call', label: 'Ours', overrides: { package: BASE, basedOn: '1.0.0' }, requiredPermissions: ['crm_admin'], ai: { exposed: true } };
+        const { res, registered, saved, ledger } = await install(
+            { id: PAIR, version: '1.0.0', namespace: 'crm_custom', dependencies: deps(BASE), actions: [wider] },
+            [{ id: BASE }],
+            holdings,
+        );
+        expect(res.status, JSON.stringify(res.payload)).toBe(403);
+        expect(res.payload?.error?.code).toBe('NOT_OVERRIDABLE');
+        expect(refusedOf(res)).toEqual([['action', 'crm_call', 'declared_action_widens_access']]);
+        expect(res.payload.error.details.refusals[0].message).toContain('`ai.exposed: true`');
+        expect([registered, saved, ledger]).toEqual([[], [], []]);
     });
 
     it('CONTROL: a dependent shipping its own names installs, and its answer carries no collision key', async () => {
 
@@ -3688,10 +3688,16 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             const bases = closure.filter(isBase);
             for (const item of pkg.items) {
                 const shippers: string[] = [];
-                for (const base of bases) if ((await heldBy(item.type, base)).has(item.identity)) shippers.push(base);
+                // [#30065] …and each shipper's own item, what a declared
+                // action override is judged against.
+                const shipped = new Map<string, unknown>();
+                for (const base of bases) {
+                    const held = (await heldBy(item.type, base)).get(item.identity);
+                    if (held !== undefined) { shippers.push(base); shipped.set(base, held); }
+                }
                 const verdict = judgeOverrideWrite(
                     { type: item.type, name: item.name, packageId, item: item.item },
-                    { dependencies: closure, shippers },
+                    { dependencies: closure, shippers, baseItemOf: (base) => shipped.get(base) },
                 );
                 if (verdict.verdict === 'refuse') {
                     refusals.push({
 
@@ -190,8 +190,11 @@ export const PACKAGED_BASE_REGIME: Readonly<Record<string, PackagedBaseRegimeRow
     action: {
         regime: 'C',
         routes: {
-            switchOff: 'POST /api/v1/actions/_activation/:object/:action, body {enabled: false}, '
-                + ':object = global for an object-less action; '
+            // [#30065] `:object_or_global` names the object-less spelling in
+            // the segment itself: the declared-override save sentence adds the
+            // declaration's clause, and the route must keep it under the REST
+            // door's 500-character bound for an 88-character name.
+            switchOff: 'POST /api/v1/actions/_activation/:object_or_global/:action, body {enabled: false}; '
                 + 'operator-only where one install serves several organizations',
         },
     },
@@ -319,7 +322,8 @@ export function isOriginGatedType(type: string): boolean {
  * Kept under the REST door's 500-character client-message bound
  * (`truncateClientMessage`, `packages/rest/src/error-response.ts`), past which
  * the tail is truncated. Characters outside the item's name, save / removal:
- * `flow` 395 / 388, `action` 349 / 342, `permission` 301 / 294,
+ * `flow` 395 / 388, `action` 315 / 308 ([#30065] its declared-override save 398
+ * with a 22-character pair id), `permission` 301 / 294,
  * `datasource` 192 / 193, `sharing_rule` 390 / 383 — so a name of up to 88
  * characters arrives whole for every row (pinned). [#21944] A row's `hostOwned` name is a fixed, short name
  * with its own remedy (`default`: under 300 characters whole).
 
@@ -19,6 +19,11 @@
  * stored row it judges, and does not decline a shipped flow name's row that
  * the one served-override predicate (`isServedOverrideRowOf`) admits for the
  * shipping package — its declared `.custom` override, the packaged flow.
+ * [#30065] The same admission holds for an `action` name's declared
+ * override (ADR-0146 D9's `action` paragraph). Unlike the sealed row-served
+ * types, an action's override row keeps its bare registry entry, as a flow's
+ * does: the object read's `actions`, the run doors' first rung and the
+ * authored-action handler resync read the registry, not the row.
  *
  * ## How the moved bodies reach the class
  *
@@ -155,7 +160,11 @@ export function declinesStoredRow(
     // above, on the row's own `package_id` and body, against the package
     // that ships the name. The reads then serve it from its row, as they
     // serve a dashboard's. Every other sealed row of the name stays declined.
-    return !(servesSealedOverrideRow(type)
+    // [#30065, ADR-0146 D9 `action`] …and for an `action`, judged the same
+    // way: its declared override is served over the base's name from its
+    // row, so the layered read's `effective` and a by-name read answered by
+    // the metadata service see it as the registry's readers do.
+    return !((servesSealedOverrideRow(type) || canonicalMetaType(type) === 'action')
         && isServedOverrideRowOf(row, this.packagedArtifactOwner({ type, name })));
 }
 
 
@@ -349,9 +349,10 @@ const BORROWED_ENVELOPE_DECLINED_TYPES: ReadonlySet<string> = new Set([
  * `import-mapping.ts`, included) answered the base's body, so a published
  * override did nothing.
  *
- * ⛔ A closed list, judged on the canonical type. `action` and `flow` wait for
- * ADR-0146 D9's conditions (`flow` has its own admission,
- * `declinesStoredRow`'s first branch). Every type here is also in
+ * ⛔ A closed list, judged on the canonical type. `flow` and [#30065] `action`
+ * are not here: ADR-0146 D9 admits their declared override in
+ * `declinesStoredRow` on its own, and their override row keeps its bare
+ * registry entry, which the engine's readers arm from. Every type here is also in
  * {@link BORROWED_ENVELOPE_DECLINED_TYPES}: the bare entry served no reader
  * the row does not serve now.
  */