@@ -0,0 +1,24 @@
+---
+'@objectstack/metadata-core': minor
+'@objectstack/rest': patch
+'@objectstack/runtime': patch
+---
+
+The object-schema field mask (ADR-0106 D1) judges an action param that names another object's field through `objectOverride` against that object, not the one being served.
+
+Clause-②: yes (widening)
+
+**What a user saw.** A `delegated_admin` may invite members, and the invite door admits them, but `GET /meta/object/sys_user` served that principal no `invite_user` action. The action's `role` param is `{ field: 'role', objectOverride: 'sys_member' }`: it names `sys_member.role`. The mask read every param's `field` as a field of the served object, so a caller denied `sys_user.role` lost the whole action. A plain `member` lost it the same way. The member is now served the action too, and still not offered it: the action's `requiresMembershipReach` predicate excludes the member grade.
+
+**The rule.** A param whose `objectOverride` names another object reads that object's field. It is judged against the caller's readable fields on that object, and it is not a reference to the served object's fields. The action is still dropped when the caller cannot read the field there, and when that object's readable fields cannot be determined (no answer from the security service, a security service that throws, or an object that does not exist). Nothing about the other object is served on a guess. The rest of the param is still read against the served object: `visible`, an option's `visibleWhen`, `defaultValue`, and an explicit `name` that differs from `field`. A `name` that only repeats `field` is read as that field. With `defaultFromRow`, the param also reads `field` from the served object's row, so `field` is judged against the served object too. An exempt caller (platform admin, `isSystem`) is served the whole schema, as before.
+
+**The API (`@objectstack/metadata-core`), additive.**
+
+- `relateObjectSchemaMaskPosture(posture, ...documents)` completes a `project` posture for the documents it is about to mask. It reads the caller's readable fields on each other object their action params name through `objectOverride`. It runs after the fetch, because only the document names those objects. It returns every other posture, and any document with no such param, unchanged, and it never throws.
+- The `project` member of `ObjectSchemaMaskPosture` gains two optional fields. `relate` asks the posture's question (same caller, same security service) about another object. `resolveObjectSchemaMaskPosture` sets it. `related` holds the answers. A `project` posture built without `related` gets no answers, so `applyObjectSchemaMask` drops every action with such a param.
+- `applyObjectSchemaMask` folds each related read it withholds into the fingerprint, written as `object.field`. Two callers who are denied the same fields on the served object but differ on the other object get different validators. An unrestricted caller's ETag is unchanged.
+- The shared contract fixture `FLS_CONTRACT_OBJECT` (`@objectstack/metadata-core/testing`) gains two actions whose params read `contact` fields through `objectOverride`. The contract's projection cases now require the readable one to be served and the denied one to be dropped. An exit that never relates its posture fails the contract by name.
+
+**Every exit relates its posture (`@objectstack/rest`, `@objectstack/runtime`).** These exits relate the posture after the fetch, before the projection: the shared item, layered and list chains, `RestServer`'s cached read and published read, and the runtime dispatcher's mask. The `/meta` diff route masks `fields` only and needs no relate step.
+
+**Measured on a showcase boot.** We read every object schema (78 objects, by-name read and list read) as five principals: a platform admin, an org owner, an admin, a `delegated_admin` and a `member`. Before and after this change, the only served action that moved is `sys_user.invite_user`, which is now served to the `delegated_admin` and the `member`. This repository has two authored params with `objectOverride`: `sys_user.invite_user`'s `role` and `sys_member.invite_user`'s `email` (on `sys_invitation`). The second was served to all five principals before and after.
@@ -115,6 +115,8 @@ describe('org-admin affordances follow the membership grade (served metadata ×
   const tokens = {} as Record<Grade, string>;
   const sessionUser = {} as Record<Grade, Record<string, unknown>>;
   const served = {} as Record<Grade, Map<string, ServedAction>>;
+  /** The field names each grade is served per object — what the metadata-plane field mask left. */
+  const servedFields = {} as Record<Grade, Record<string, string[]>>;
   let features: Record<string, unknown>;
   /** A representative row per object — the binding a row action is evaluated against. */
   const rowOf = {} as Record<string, Record<string, unknown>>;
@@ -181,11 +183,13 @@ describe('org-admin affordances follow the membership grade (served metadata ×
       expect(session.status).toBe(200);
       sessionUser[grade] = ((await session.json()) as { user: Record<string, unknown> }).user;
       served[grade] = new Map();
+      servedFields[grade] = {};
       for (const object of OBJECTS) {
         const meta = await stack.apiAs(tokens[grade], 'GET', `/meta/object/${object}`);
         expect(meta.status, `${grade} reads /meta/object/${object}`).toBe(200);
-        const body = (await meta.json()) as { item?: { actions?: ServedAction[] } };
+        const body = (await meta.json()) as { item?: { actions?: ServedAction[]; fields?: Record<string, unknown> } };
         for (const action of body.item?.actions ?? []) served[grade].set(`${object}.${action.name}`, action);
+        servedFields[grade][object] = Object.keys(body.item?.fields ?? {});
       }
     }
   }, 240_000);
@@ -224,16 +228,6 @@ describe('org-admin affordances follow the membership grade (served metadata ×
     return gateAdmits(grade, site);
   };
 
-  /**
-   * The one site the metadata-plane field mask (ADR-0106) withholds below
-   * tenant-admin grade: `sys_user.invite_user`'s `role` param names
-   * `sys_user.role`, a field those callers cannot read, so the whole action is
-   * dropped from their `/meta/object/sys_user` — independently of this gate.
-   * Every other site must be served to every grade, or a verdict below would be
-   * the mask's rather than the gate's.
-   */
-  const MASKED_BELOW_TENANT_ADMIN = ['sys_user.invite_user'];
-
   it('the session face carries each grade under its projected name, and no other grade', () => {
     // The capability half of every composed predicate is ON here, so each
     // verdict below is decided by the grade term alone.
@@ -251,12 +245,30 @@ describe('org-admin affordances follow the membership grade (served metadata ×
     expect(ALL.filter((site) => gateAdmits(grade, site))).toEqual(ALL.filter((site) => EXPECTED[grade].includes(site)));
   });
 
+  // Every site is served to every grade, so each verdict below is the gate's
+  // rather than the metadata-plane field mask's.
   it.each(Object.keys(EXPECTED) as Grade[])('%s is offered, on its own served metadata, exactly those it is served', (grade) => {
     const unserved = ALL.filter((site) => !served[grade].has(site));
-    const tenantAdmin = grade === 'owner' || grade === 'admin';
-    expect(unserved).toEqual(tenantAdmin ? [] : MASKED_BELOW_TENANT_ADMIN);
+    expect(unserved).toEqual([]);
     const shown = ALL.filter((site) => offered(grade, site));
-    expect(shown).toEqual(ALL.filter((site) => EXPECTED[grade].includes(site) && !unserved.includes(site)));
+    expect(shown).toEqual(ALL.filter((site) => EXPECTED[grade].includes(site)));
+  });
+
+  it('[#21884] a delegated_admin is offered Invite User on sys_user; a plain member is not — by the reach gate, not the field mask', () => {
+    // `invite_user`'s `role` param names `sys_member.role` through
+    // `objectOverride`. Neither grade is served `sys_user.role`, so a mask that
+    // read the param as THIS object's field withheld the action from both. Both
+    // ARE served `sys_member.role`, the field the param actually names.
+    for (const grade of ['delegated_admin', 'member'] as const) {
+      expect(servedFields[grade].sys_user, `${grade} is not served sys_user.role`).not.toContain('role');
+      expect(servedFields[grade].sys_member, `${grade} is served sys_member.role`).toContain('role');
+      expect(served[grade].has('sys_user.invite_user'), `${grade} is served sys_user.invite_user`).toBe(true);
+    }
+    expect(offered('delegated_admin', 'sys_user.invite_user')).toBe(true);
+    // The member is served the same action and is still not offered it: the
+    // served `requiresMembershipReach` predicate excludes its grade.
+    expect(gateAdmits('member', 'sys_user.invite_user')).toBe(false);
+    expect(offered('member', 'sys_user.invite_user')).toBe(false);
   });
 
   it('a plain member sees none of them on the member, invitation and team lists', () => {