fix(runtime): the tenancy posture seam tells "never registered" from "registered and failed" at the runtime door

resolveExecutionContext swallowed every rejection of the tenancy read into
"no posture", and no posture skips both posture-conditional API-key
refusals — so a tenancy service that was registered and failed to build
read as a deployment with no wall. Apply #13906 decision 1 option A the way
rest-server.ts already does: absorb only the registry's branded
"never registered" rejection; re-raise everything else as
AuthzStoreUnavailableError (503 SERVICE_UNAVAILABLE).

Two nets between the resolver and the transport envelope are told the same
thing: the dispatcher's service facade hands the resolver the classified
rejection for 'tenancy' (resolveService is a capability probe that
collapsed it to undefined), and resolveRequestScope's catch re-raises only
the branded outage via rethrowAuthzStoreUnavailable, degrading everything
else to anonymous as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Author: claude

packages/runtime/src/http-dispatcher.tenancy-posture-outage.test.ts

@@ -218,9 +218,36 @@ describe('[#13906 / 1A] the outage reaches the transport envelope as 503 SERVICE
         return { status: res.statusCode as number, body: res.body };
     }
 
-    it('on the wire (real route, real `errorResponseBase`): 503 with a declared `SERVICE_UNAVAILABLE` envelope, never a served 2xx', async () => {
+    // The wire route is `GET /automation` with the ex-member key, chosen by
+    // MEASUREMENT on the unrepaired tree so that each tenancy state answers
+    // differently and no domain-side 503 is in the way (`POST /keys` answers
+    // its own `503 Data service not available` against a fixture engine
+    // with no `insert`, so it cannot pin this seam):
+    //
+    //   tenancy service   | before (origin/main) | after
+    //   ------------------|----------------------|-------
+    //   healthy isolated  | 401 UNAUTHENTICATED  | 401 — the membership refusal, unchanged
+    //   never registered  | 501 NOT_IMPLEMENTED  | 501 — admitted, then "no automation service", unchanged
+    //   registered+FAILED | 501 NOT_IMPLEMENTED  | 503 SERVICE_UNAVAILABLE
+    //
+    // The 501 on the failed leg is the defect on the wire: byte-for-byte the
+    // "never registered" answer, i.e. the ex-member was ADMITTED.
+    const AUTOMATION = 'GET /api/v1/automation';
+    const withKey = { headers: { 'x-api-key': RAW_EXMEMBER }, query: {} };
+
+    it('POSITIVE CONTROL on the wire: healthy `isolated` tenancy → the ex-member key is refused on the anonymous floor (401)', async () => {
+        const handlers = await mountOn(kernelWith('healthy-isolated'));
+        const { status, body } = await drive(handlers[AUTOMATION], withKey);
+        expect(status).toBe(401);
+        expect(body?.error?.code).toBe('UNAUTHENTICATED');
+    });
+
+    it('REPAIRED on the wire (real route, real `errorResponseBase`): registered and FAILING → 503 with a declared `SERVICE_UNAVAILABLE` envelope', async () => {
+        // SUPERSEDED PIN, quoted — measured on origin/main:
+        //     expect(status).toBe(501);
+        //     expect(body?.error?.code).toBe('NOT_IMPLEMENTED');
         const handlers = await mountOn(kernelWith('factory-throws'));
-        const { status, body } = await drive(handlers['POST /api/v1/keys'], { headers: { 'x-api-key': RAW_EXMEMBER }, body: { name: 'k' }, query: {} });
+        const { status, body } = await drive(handlers[AUTOMATION], withKey);
         expect(status).toBe(503);
         expect(BaseResponseSchema.safeParse(body).success).toBe(true);
         expect(body?.success).toBe(false);
@@ -229,6 +256,13 @@ describe('[#13906 / 1A] the outage reaches the transport envelope as 503 SERVICE
         expect(body?.error?.code).toBe('SERVICE_UNAVAILABLE');
     });
 
+    it('THE COLLAPSE IS ENDED on the wire: never registered keeps its 501 (admitted, no automation service) — only the FAILED leg moved', async () => {
+        const handlers = await mountOn(kernelWith('unregistered'));
+        const { status, body } = await drive(handlers[AUTOMATION], withKey);
+        expect(status).toBe(501);
+        expect(body?.error?.code).toBe('NOT_IMPLEMENTED');
+    });
+
     it('CONTROL on the wire: with tenancy never registered the same door serves — the no-tenancy composition is untouched', async () => {
         const handlers = await mountOn(kernelWith('unregistered'));
         const { status } = await drive(handlers['GET /api/v1/health'], { headers: {} });

packages/runtime/src/http-dispatcher.ts

@@ -2,6 +2,11 @@
 
 import {
     ObjectKernel, getEnv, evaluateAuthGate, isAuthGateAllowlisted,
+    // [#13906 decision 1 A] The identity step's net re-raises ONLY the loud
+    // authz-store outage (the `.catch` shape `@objectstack/core` prescribes for
+    // every seam between `resolveAuthzContext` and a door), and the tenancy
+    // read is classified by the REGISTRY's own "never registered" brand.
+    rethrowAuthzStoreUnavailable, isServiceNotRegisteredError,
 } from '@objectstack/core';
 import { isMcpServerEnabled, looksLikeInternalErrorLeak, INTERNAL_ERROR_MESSAGE, resolveThrownHttpError, demotedDeclaredCode, declaredUserMessage } from '@objectstack/types';
 import { measureServerTiming, allowPerfDisclosure, isPerfDisclosurePrincipal } from '@objectstack/observability';
@@ -535,7 +540,20 @@ export class HttpDispatcher {
         // ctx.userId/roles/permissions/tenantId via opCtx.context.
         try {
             context.executionContext = await this.timedResolveExecutionContext({
-                getService: (n: string) => this.resolveService(this.requestKernel(context), n, context.environmentId),
+                // [#13906 decision 1 A] `resolveService` is a capability PROBE:
+                // its fallback chain absorbs every rejection at every step and
+                // answers `undefined`, which is the right shape for "is this
+                // optional service installed" and the wrong shape for the ONE
+                // authorization INPUT the resolver reads through this facade.
+                // For `tenancy` the resolver must see the registry's CLASSIFIED
+                // rejection — branded "never registered" (absorbed, the
+                // supported no-tenancy composition) versus unbranded
+                // "registered and failed to build" (re-raised, so the door
+                // answers 503 instead of admitting on a posture it could not
+                // read). Every other name keeps the probe.
+                getService: (n: string) => n === 'tenancy'
+                    ? this.resolveServiceOrLoud(this.requestKernel(context), n, context.environmentId)
+                    : this.resolveService(this.requestKernel(context), n, context.environmentId),
                 // Resolve ObjectQL from the per-request kernel DIRECTLY. The scoped
                 // `resolveService('objectql', envId)` factory can return a different
                 // instance that doesn't see THIS env's rows (the gotcha
@@ -564,7 +582,17 @@ export class HttpDispatcher {
                 // (the scoped prefix is stripped only by the caller, later).
                 acceptOAuthAccessToken: /^(?:\/projects\/[^/]+)?\/mcp(?:[/?]|$)/.test(cleanPath),
             });
-        } catch {
+        } catch (err) {
+            // [#13906 decision 1 A / #13279] The ONE fault that must stay loud:
+            // an authorization input that exists and could not be read (a
+            // failed permission-store read, a `tenancy` service that is
+            // registered and failed to build). Swallowing it here answered an
+            // outage as an anonymous request — a 401 byte-identical to a caller
+            // with no credential, which is the "changed disguise" the shared
+            // `rethrowAuthzStoreUnavailable` exists to end. It re-raises that
+            // class by brand and returns `undefined` for everything else, so
+            // every other fault still degrades exactly as before:
+            rethrowAuthzStoreUnavailable(err);
             // anonymous request — leave executionContext undefined
         }
     }
@@ -2120,6 +2148,52 @@ export class HttpDispatcher {
         return services[name];
     }
 
+    /**
+     * [#13906 decision 1 A] Resolve a service whose ABSENCE is a supported
+     * composition but whose FAILURE is an outage — today only the `tenancy`
+     * read the identity step feeds `resolveExecutionContext`.
+     *
+     * `resolveService` above is a capability probe: every step of its chain
+     * absorbs every rejection and falls through, so a factory that threw and a
+     * name nothing registered both come back as `undefined`. That collapse is
+     * the defect #13906 repaired one seam over (`rest-server.ts`), and the
+     * classification here is the same one, taken from the REGISTRY rather than
+     * from message text (#13905):
+     *
+     *  - branded "never registered" → `undefined`, quiet;
+     *  - every other rejection (a factory that threw, a scoped registration
+     *    resolved without a scope id, a circular service dependency) →
+     *    re-raised unbranded, for the resolver to answer as
+     *    `AuthzStoreUnavailableError` (503).
+     *
+     * The chain order is `resolveService`'s (scoped lookup on the host kernel
+     * first, then the request's own kernel), so WHICH registry answers is
+     * unchanged; only what a rejection MEANS is. A host with no async accessor
+     * (`KernelBase`-shaped, e.g. `LiteKernel`) supports no service factories,
+     * so "not registered" is the only fault it can report — it keeps the quiet
+     * probe, which is the same classification rather than a second collapse.
+     */
+    private async resolveServiceOrLoud(kernel: any, name: string, scopeId?: string): Promise<any> {
+        const classified = async (read: () => Promise<any>): Promise<{ found: boolean; value?: any }> => {
+            try {
+                const svc = await read();
+                return svc != null ? { found: true, value: svc } : { found: false };
+            } catch (err) {
+                if (isServiceNotRegisteredError(err)) return { found: false };
+                throw err;
+            }
+        };
+        if (scopeId && typeof this.defaultKernel.getServiceAsync === 'function') {
+            const scoped = await classified(() => this.defaultKernel.getServiceAsync(name, scopeId));
+            if (scoped.found) return scoped.value;
+        }
+        if (typeof kernel?.getServiceAsync === 'function') {
+            const own = await classified(() => kernel.getServiceAsync(name));
+            return own.found ? own.value : undefined;
+        }
+        return this.resolveService(kernel, name, scopeId);
+    }
+
     /**
      * Get the ObjectQL service which provides access to SchemaRegistry.
      * Tries multiple access patterns since kernel structure varies.

packages/runtime/src/security/resolve-execution-context.ts

@@ -15,8 +15,14 @@
  * synthesis live in ONE place now (`@objectstack/core`), shared with the REST
  * server, so the two entry points can never drift on authorization again.
  *
- * Always resolves — never throws. Anonymous requests yield
- * `{ isSystem: false, positions: [], permissions: [] }`.
+ * Resolves for every request it can ANSWER — anonymous requests yield the
+ * guest envelope (`{ isSystem: false, positions: [], permissions: [] }`) —
+ * and throws `AuthzStoreUnavailableError` (503) for the one class of fault
+ * that leaves the answer undetermined: an authorization INPUT that exists and
+ * could not be read (a permission-store read that failed, #13279; a `tenancy`
+ * service that is registered and failed to build, #13906 decision 1 A). The
+ * dispatcher's net (`HttpDispatcher.resolveRequestScope`) re-raises exactly
+ * that class and degrades everything else to anonymous, as before.
  */
 
 import type { ExecutionContext } from '@objectstack/spec/kernel';
@@ -30,6 +36,13 @@ import {
   assembleExecutionContextOrGuest,
   type EntryLocalization,
   effectiveTenancyPosture,
+  // [#13906 decision 1 A] The loud answer for an authorization input that
+  // exists and could not be read, and the REGISTRY's own "never registered"
+  // brand that lets the tenancy seam absorb the supported no-tenancy
+  // composition while every other rejection stays loud. Never message text
+  // (#13905).
+  AuthzStoreUnavailableError,
+  isServiceNotRegisteredError,
 } from '@objectstack/core';
 
 /**
@@ -168,11 +181,35 @@ export async function resolveExecutionContext(opts: ResolveOptions): Promise<Exe
   // Layer 0 wall, so admission and the wall can never disagree. Deliberately not
   // `OS_TENANCY_POSTURE`: that is what the operator ASKED for, and under
   // ADR-0093 D4/D5 a requested-but-unenforceable wall resolves to `single`.
-  // Absent service ⇒ undefined ⇒ no posture-conditional refusal.
+  //
+  // [#13906 decision 1 A, at this door] `undefined` is not a neutral value
+  // here: `resolveAuthzContext` gates BOTH posture-conditional API-key
+  // refusals (`organization_required`, `organization_membership_ended`) on a
+  // PRESENT posture, so "no posture" means "no wall". The seam used to resolve
+  // EVERY rejection to that — and a `tenancy` service that was registered and
+  // FAILED to build read as a deployment with no tenancy at all. Two facts,
+  // told apart by the registry's own brand, the way `rest-server.ts` already
+  // does on both of its wirings:
+  //
+  //  - never registered → branded → `undefined`, quiet. The supported
+  //    no-tenancy composition: no wall exists, and refusing there would break
+  //    every single-organization embedder.
+  //  - registered and FAILED to build → unbranded → re-raised as the same loud
+  //    answer a failed permission-store read gives (#13279): the posture is an
+  //    authorization INPUT, so admission was never decided. A posture that
+  //    could not be READ is not a posture that is ABSENT.
+  //
+  // A facade that resolves `undefined` instead of rejecting (the dispatcher's
+  // capability PROBE, `resolveService`) still reads as absent — which is why
+  // `HttpDispatcher.resolveRequestScope` hands THIS read the classified
+  // rejection rather than the probe's collapsed answer.
   let tenancyPosture;
   try {
     tenancyPosture = effectiveTenancyPosture(await opts.getService('tenancy'));
-  } catch {
+  } catch (err) {
+    if (!isServiceNotRegisteredError(err)) {
+      throw new AuthzStoreUnavailableError('tenancy', err);
+    }
     tenancyPosture = undefined;
   }