@@ -0,0 +1,21 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql): on a kernel with an `environmentId` (`os dev`, `os serve`, `os start`, the cloud single-environment runtime), a runtime-authored object now has a metadata-service copy, so both MCP doors refuse an object whose API exposure is off
+
+Clause-②: no
+
+On a kernel built with an `environmentId`, the `metadata` service is sourced from the artifact and the boot bridge does not run. Until now, the copy follow that keeps a runtime-authored object's copy current also returned early on that shape. So the service held **no** copy of **any** object saved through Studio, the REST metadata door or an AI author, and the MCP exposure gates read that absence as "no declaration". Measured on the real `os dev` (`env_local`), where the REST data door refused the same objects with `OBJECT_API_DISABLED`:
+
+- **Saved with `apiEnabled: false`, or turned off after a save.** The HTTP MCP door served `query_records` and `create_record`, and the create wrote a row. The MCP stdio door did the same.
+- **Saved with `apiEnabled: false`, then a restart.** Still served: the hydrated object had no copy, and no save fired after boot.
+- **Exposed objects.** `list_objects` did not name them, and `describe_object` answered "not found".
+
+The fix is at the copy's producer, and it bounds what is written the same way the no-`environmentId` shape already does:
+
+- **The copy follow runs on every kernel shape.** A save refreshes the copy before it returns, through `registerInMemory` (in memory, no persistence, no announce). A delete removes it once the stored row is gone and the registry no longer serves the name.
+- **A kernel that hydrates its own `sys_metadata` (`hydrateMetadataFromDb`) copies its hydrated runtime-authored objects once at boot.** That option is set only on a kernel whose registry is its own. Only objects whose registry owner row is tenant-authored are copied, so a code package's objects still reach the service from the artifact alone. The full boot bridge stays off on this shape.
+- **A boot copy that cannot land is logged at `error`.** The line names the objects, the consequence (the MCP exposure gates serve them even when their exposure is off) and the way out.
+
+Both exposure gates read this service: the MCP stdio door's `enforceApiExposure`, and `refuseUnexposedDataAction`, which the HTTP MCP data verbs run through. Both now answer `OBJECT_API_DISABLED` / 404 for such an object, which is what `apiEnabled: false` declares. Neither gate's fall-open rule for an absent definition changes. The kernel shape without an `environmentId` is unchanged.
@@ -46,7 +46,7 @@
  */
 
 import { randomUUID } from 'node:crypto';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, describe, expect, it, vi } from 'vitest';
@@ -320,3 +320,132 @@ describe('the metadata service\'s copy of a runtime-authored object follows the
         expect((await copyOf(k, OTHER)).copy).toMatchObject({ enable: { apiEnabled: true } });
     });
 });
+
+/**
+ * The same copy on a kernel with an `environmentId` that hydrates its own
+ * `sys_metadata`: `createStandaloneStack`'s composition (`os dev` as
+ * `env_local`, `os serve`, `os start`) and the cloud single-environment
+ * runtime. Its `metadata` service is sourced from the artifact and the boot
+ * bridge does not run, so before the fix a runtime-authored object had NO copy
+ * there, exposed or not, and both MCP exposure gates served one saved with
+ * `apiEnabled: false` (measured through the real `os dev`).
+ */
+describe('on a kernel with an environmentId, a runtime-authored object has a copy that follows the registry', () => {
+    const ENV = 'env_local';
+    const live: ObjectKernel[] = [];
+    const roots: string[] = [];
+    afterEach(async () => {
+        while (live.length) {
+            const kernel = live.pop()!;
+            if (kernel.getState() === 'running') await kernel.shutdown();
+        }
+        while (roots.length) rmSync(roots.pop()!, { recursive: true, force: true });
+    });
+
+    /**
+     * One boot over `stores`, with `createStandaloneStack`'s two options:
+     * `MetadataPlugin` reading an (empty) artifact under the environment, and
+     * `ObjectQLPlugin` with the `environmentId` and `hydrateMetadataFromDb`.
+     */
+    async function boot(stores: Stores, beforeBoot?: (engine: ObjectQL) => void): Promise<Booted> {
+        const kernel = new ObjectKernel({ logger: { level: 'silent' }, gracefulShutdown: false });
+        live.push(kernel);
+        const root = mkdtempSync(join(tmpdir(), 'os-23689-'));
+        roots.push(root);
+        const artifact = join(root, 'objectstack.json');
+        writeFileSync(artifact, JSON.stringify({
+            manifest: { id: 'com.qa.empty', name: 'empty', version: '0.0.0', type: 'app' },
+            objects: [], views: [], apps: [], flows: [], requires: [],
+        }));
+        const engine = new ObjectQL();
+        engine.registerDriver(makeMemoryDriver(stores), true);
+        await kernel.use(new MetadataPlugin({
+            watch: false, artifactWatch: false, environmentId: ENV,
+            artifactSource: { mode: 'local-file', path: artifact }, rootDir: root,
+        }));
+        await kernel.use(new ObjectQLPlugin({ ql: engine, environmentId: ENV, hydrateMetadataFromDb: true }));
+        beforeBoot?.(engine);
+        await kernel.bootstrap();
+        return { kernel, engine, protocol: kernel.getService('protocol'), metadata: kernel.getService('metadata') };
+    }
+
+    const save = (k: Booted, name: string, label: string, enable?: Record<string, unknown>) =>
+        k.protocol.saveMetaItem({ type: 'object', name, item: objectBody(name, label, enable) });
+
+    async function copyOf(k: Booted, name: string) {
+        const listed = ((await k.metadata.listObjects()) as Array<{ name?: string }>).find((o) => o?.name === name);
+        return { copy: await k.metadata.getObject(name), listed };
+    }
+
+    const withShippedPackage = (engine: ObjectQL) => {
+        engine.registerApp({
+            id: SHIPPED_PKG, name: SHIPPED_PKG, version: '1.0.0', type: 'app',
+            objects: [objectBody(SHIPPED, 'Shipped')],
+        });
+    };
+
+    it('created after boot with exposure off: a copy at once, carrying its declaration', async () => {
+        const k = await boot(new Map());
+        expect((await save(k, NAME, 'Gadget', { apiEnabled: false })).success).toBe(true);
+
+        const { copy, listed } = await copyOf(k, NAME);
+        expect(copy).toMatchObject({ label: 'Gadget', enable: { apiEnabled: false }, _provenance: 'org' });
+        expect(listed).toBeDefined();
+    });
+
+    it('saved exposed, then turned off: the copy says so before the save returns', async () => {
+        const k = await boot(new Map());
+        expect((await save(k, NAME, 'Gadget', { apiEnabled: true })).success).toBe(true);
+        expect((await save(k, NAME, 'Gadget Q', { apiEnabled: false })).success).toBe(true);
+
+        expect((await copyOf(k, NAME)).copy)
+            .toMatchObject({ label: 'Gadget Q', enable: { apiEnabled: false }, _provenance: 'org' });
+    });
+
+    it('saved with exposure off, then a restart: the boot gives the hydrated object its copy (no mutation fires for it)', async () => {
+        const stores: Stores = new Map();
+        const k1 = await boot(stores);
+        expect((await save(k1, NAME, 'Gadget', { apiEnabled: false })).success).toBe(true);
+        expect((await save(k1, OTHER, 'Other', { apiEnabled: true })).success).toBe(true);
+        await k1.kernel.shutdown();
+
+        const k2 = await boot(stores);
+        expect(k2.engine.registry.getObject(NAME)).toMatchObject({ enable: { apiEnabled: false } });
+        expect((await copyOf(k2, NAME)).copy)
+            .toMatchObject({ label: 'Gadget', enable: { apiEnabled: false }, _provenance: 'org' });
+        expect((await copyOf(k2, OTHER)).copy).toMatchObject({ enable: { apiEnabled: true } });
+    });
+
+    it('deleted: the copy is gone and the listing no longer names it', async () => {
+        const stores: Stores = new Map();
+        const k1 = await boot(stores);
+        expect((await save(k1, NAME, 'Gadget', { apiEnabled: true })).success).toBe(true);
+        await k1.kernel.shutdown();
+        const k = await boot(stores);
+        expect((await copyOf(k, NAME)).copy).toBeDefined();
+
+        expect(await k.protocol.deleteMetaItem({ type: 'object', name: NAME })).toMatchObject({ success: true, reset: true });
+
+        await vi.waitFor(async () => {
+            const { copy, listed } = await copyOf(k, NAME);
+            expect(copy).toBeUndefined();
+            expect(listed).toBeUndefined();
+        });
+    });
+
+    it('a code package\'s object gets no copy from the boot pass or from a runtime edit beside it', async () => {
+        const stores: Stores = new Map();
+        const k1 = await boot(stores, withShippedPackage);
+        expect((await save(k1, NAME, 'Gadget', { apiEnabled: true })).success).toBe(true);
+        await k1.kernel.shutdown();
+
+        const k = await boot(stores, withShippedPackage);
+        expect(k.engine.registry.getObject(SHIPPED)).toMatchObject({ label: 'Shipped' });
+        // The code package's objects reach this service from the artifact, never from this pass.
+        expect(await k.metadata.getObject(SHIPPED)).toBeUndefined();
+        expect((await save(k, NAME, 'Gadget Q', { apiEnabled: false })).success).toBe(true);
+        await new Promise((resolve) => setTimeout(resolve, 150));
+        expect(await k.metadata.getObject(SHIPPED)).toBeUndefined();
+        expect((await copyOf(k, NAME)).copy).toMatchObject({ enable: { apiEnabled: false } });
+    });
+});
@@ -1107,6 +1107,10 @@ export class ObjectQLPlugin implements Plugin {
     // skip it in that case.
     if (this.environmentId === undefined) {
         await this.bridgeObjectsToMetadataService(ctx);
+    } else if (this.hydrateMetadataFromDb) {
+        // The runtime-authored objects the hydration above just put in this
+        // kernel's own registry. See {@link bridgeRuntimeObjectsToMetadataService}.
+        await this.bridgeRuntimeObjectsToMetadataService(ctx);
     }
     // Arm the incremental per-manifest bridge for everything after start() —
     // marketplace install / rehydrate register through the `manifest`
@@ -2436,6 +2440,56 @@ export class ObjectQLPlugin implements Plugin {
     }
   }
 
+  /**
+   * The boot half of {@link followRuntimeObjectCopy} on a kernel with an
+   * `environmentId` that hydrates its own `sys_metadata`
+   * (`hydrateMetadataFromDb`: `os dev`, `os serve`, `os start` and the cloud
+   * single-environment runtime): copy each RUNTIME-AUTHORED object the
+   * hydration put in the registry into the `metadata` service.
+   *
+   * The full {@link bridgeObjectsToMetadataService} stays off on this shape
+   * (cross-project leakage, and the code packages' objects come from the
+   * artifact). But nothing else gives a hydrated runtime object a copy, and no
+   * mutation fires for it after boot: an object saved with `apiEnabled: false`
+   * and then restarted was served by both exposure gates, which read an absent
+   * copy as "no declaration". `hydrateMetadataFromDb` is set only on a kernel
+   * whose registry is its own, so every object this pass copies is one this
+   * environment authored. Same write as the follow: tenant-authored owner rows
+   * only, through `registerInMemory` (no persistence, no announce).
+   */
+  private async bridgeRuntimeObjectsToMetadataService(ctx: PluginContext): Promise<void> {
+    if (!this.ql?.registry) return;
+    let metadataService: IMetadataService | undefined;
+    try {
+      metadataService = ctx.getService<IMetadataService>('metadata');
+    } catch {
+      return; // no metadata service on this kernel — there is no copy to keep
+    }
+    if (!metadataService) return;
+    const failed: string[] = [];
+    let copied = 0;
+    for (const obj of this.ql.registry.getAllObjects()) {
+      try {
+        if (await this.mirrorRuntimeObject(metadataService, obj.name)) copied++;
+      } catch {
+        failed.push(obj.name);
+      }
+    }
+    if (copied > 0) {
+      ctx.logger.debug('Copied runtime-authored objects into the metadata service', { count: copied });
+    }
+    if (failed.length > 0) {
+      ctx.logger.error(
+        `[ObjectQLPlugin] the metadata service holds no copy of runtime-authored object(s) ${failed.map((n) => `'${n}'`).join(', ')}: `
+        + 'the registry, the data door and REST serve them, but the MCP exposure gates read an absent copy as "no '
+        + 'declaration" and serve them even when their API exposure is off, and MCP does not list them. Fix: restart '
+        + 'this process; if it recurs, check that the metadata service accepts in-memory registration.',
+        undefined,
+        { objects: failed },
+      );
+    }
+  }
+
   /**
    * Keep the metadata service's copy of a RUNTIME-AUTHORED object current after
    * boot, and take it out when the object is deleted.
@@ -2478,12 +2532,17 @@ export class ObjectQLPlugin implements Plugin {
    *    Afterwards the registry is asked again: a re-creation that landed while
    *    the removal was awaiting its loaders has its copy put back.
    *
-   * Armed on the kernel shape the bridge runs on (no `environmentId`): a
-   * project-scoped kernel's service is sourced from the artifact and holds no
-   * copy of the registry to keep current.
+   * Armed on every kernel shape. On a kernel with an `environmentId` (`os dev`
+   * as `env_local`, the cloud single-environment runtime) the service is
+   * sourced from the artifact and the boot bridge does not run, so a
+   * runtime-authored object had no copy there at all: both exposure gates read
+   * that absence as "no declaration" and served an object saved with
+   * `apiEnabled: false`. The copy written here is the object THIS kernel's
+   * authoring door just saved, so the cross-project leakage the full bridge is
+   * gated against does not arise. Its boot half on that shape is
+   * {@link bridgeRuntimeObjectsToMetadataService}.
    */
   private followRuntimeObjectCopy(ctx: PluginContext, evt: { name: string; state: string }): void {
-    if (this.environmentId !== undefined) return;
     if (typeof evt?.name !== 'string' || evt.name === '') return;
     // An async function runs synchronously up to its first `await`: the
     // refresh of a served runtime object is done before this call returns.
 
@@ -0,0 +1,102 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * Test scaffolding for the two `storage-upload-*.wall.test.ts` files: each pays
+ * its booted wall's FIRST load at module scope, with
+ * `await warmUpUploadWallBoot()`, never inside a clocked window.
+ *
+ * The convention is the repo's: "clocked windows measure behaviour, never
+ * loading — a test that boots a real plugin chain pays its first load at
+ * module top" (AGENTS.md, Build & Test). vitest clocks a file's hooks and test
+ * bodies and reports their sum as the file's duration — the module line the
+ * hourly timing table reads — while the module's own evaluation runs during
+ * COLLECTION, which no clock covers.
+ *
+ * Why these files need it: both boot the same walled stack in their
+ * `beforeAll`, and the first `bootStack` in a process is 2.3 to 2.8 s slower
+ * than every later one (measured per boot, 4 vCPU: 3.2 to 3.8 s against 0.9 to
+ * 1.2 s). The difference is first use, not the boot: the default datasource's
+ * driver and better-auth's entries are `import()`ed lazily from inside the
+ * boot, sql.js compiles its WASM, and every path runs cold. Without this, that
+ * cost lands in the `beforeAll`, and the timing table charges it to the file.
+ *
+ * It is `@objectstack/verify`'s `warmUpBoot` (`boot-warm-up.testkit.ts`, which
+ * that package does not export) with this package's boot: the same two plugins
+ * the files mount, under the same two environment variables. So the lazily
+ * loaded code is loaded under the environment the files' own boots load it
+ * under (`bootStack` sets `NODE_ENV` itself, first, in both), and a module
+ * that reads its environment once, when it is first loaded, reads the same
+ * values either way. Afterwards the WHOLE environment is put back as it was —
+ * the two variables, and every variable the boot set (`NODE_ENV` among them) —
+ * so the file's first hook starts from the environment it would have started
+ * from without this.
+ *
+ * ⛔ It shares nothing a case asserts on. It boots an app of its own (no
+ * objects), on its own in-memory database and its own storage root, with
+ * plugin instances of its own, and stops it before the file's first hook runs.
+ * What stays warm is process-level: the module registry, sql.js's compiled
+ * WASM and the JIT.
+ *
+ * ⛔ Call it at module scope, on a line of its own, never in a hook: vitest
+ * clocks a hook with `hookTimeout` exactly as it clocks a test with
+ * `testTimeout`. And never answer a recurrence by raising a timeout.
+ */
+
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { bootStack } from '@objectstack/verify';
+import { StorageServicePlugin } from '@objectstack/service-storage';
+import { OrganizationsPlugin } from '../organizations-plugin.js';
+
+/** The environment both files' `beforeAll` sets before its boot. */
+const WALLED_BOOT_ENV = [
+  ['OS_TENANCY_POSTURE', 'isolated'],
+  ['OS_AUTH_MEMBERSHIP_POLICY', 'invite-only'],
+] as const;
+
+/**
+ * Boot a throwaway app on the walled stack the upload-wall files boot, sign
+ * the seeded admin in, sign one member up, and stop.
+ */
+export async function warmUpUploadWallBoot(): Promise<void> {
+  const envBefore = { ...process.env };
+  for (const [name, value] of WALLED_BOOT_ENV) process.env[name] = value;
+  const rootDir = mkdtempSync(join(tmpdir(), 'upload-wall-warm-up-'));
+  try {
+    // A fresh configuration object per call: `bootStack`'s instance rule keys
+    // on identity, and nothing here may be shared with the file's own boot.
+    const stack = await bootStack(
+      {
+        manifest: {
+          id: 'com.example.uploadwallwarmup',
+          namespace: 'uploadwallwarmup',
+          version: '0.0.1',
+          type: 'app',
+          name: 'Upload Wall Warm-up',
+        },
+        objects: [],
+      } as never,
+      {
+        extraPlugins: [
+          new OrganizationsPlugin(),
+          new StorageServicePlugin({ adapter: 'local', local: { rootDir }, bindToSettings: false }),
+        ],
+      },
+    );
+    try {
+      await stack.signIn();
+      await stack.signUp('upload-wall-warm-up@verify.test');
+    } finally {
+      await stack.stop();
+    }
+  } finally {
+    rmSync(rootDir, { recursive: true, force: true });
+    for (const name of Object.keys(process.env)) {
+      if (!(name in envBefore)) delete process.env[name];
+    }
+    for (const [name, value] of Object.entries(envBefore)) {
+      if (value !== undefined && process.env[name] !== value) process.env[name] = value;
+    }
+  }
+}
@@ -52,6 +52,13 @@ import { join } from 'node:path';
 import { bootStack, type VerifyStack } from '@objectstack/verify';
 import { StorageServicePlugin } from '@objectstack/service-storage';
 import { OrganizationsPlugin } from './organizations-plugin.js';
+import { warmUpUploadWallBoot } from './__tests__/upload-wall-warm-up.testkit.js';
+
+// The walled boot's first load (lazily imported drivers and better-auth entries,
+// sql.js's WASM compile) is paid here, during collection, so the `beforeAll`
+// below clocks the boot and not the loading (AGENTS.md: clocked windows
+// measure behaviour, never loading). See the helper for what it shares: nothing.
+await warmUpUploadWallBoot();
 
 const APP = {
   manifest: {