fix(runtime): read the tenancy posture loudly at the /keys mint and activation-write gates

Both gates derived the effective tenancy posture through
`DomainHandlerDeps.resolveService`, the dispatcher's capability PROBE, whose
fallback chain absorbs every rejection at every step and answers `undefined`.
So a `tenancy` service that was registered and FAILED to build arrived at both
gates as the same value a deployment that never registered one produces, and
both gates read that as "there is no wall": `POST /keys` minted an
organization-less key it would otherwise refuse, and an organization
administrator's install-wide activation write was served instead of refused.

Measured on the pre-fix tree with a real `ObjectKernel` whose `tenancy` is
registered through a throwing factory: the mint door answered 201 with one row
written and the raw secret echoed once, and the activation door answered 200
with `setActionActive` called.

The identity step already reads this fact through the classified lookup
(`resolveServiceOrLoud`, #13906 decision 1 option A). That made one failure
answer 503 at the identity step and admit at these two gates in the same
deployment, so "what is this deployment's state on the wall question" had two
answers at once. The gates now read the same classification: never registered
stays quiet and behaves exactly as before, every other resolution failure is
re-raised as `AuthzStoreUnavailableError` (503 `SERVICE_UNAVAILABLE`).

`resolveService` keeps its probe contract for every other name and every other
domain; the classified read is a second, opted-into deps facility, so no gate
that was not named here changes behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

packages/runtime/src/domain-handler-registry.ts

@@ -124,6 +124,42 @@ export interface DomainHandlerDeps {
      */
     resolveService<K extends keyof ServiceSlotContracts>(context: HttpProtocolContext, name: K, environmentId?: string): Promise<ServiceSlotContract<K> | undefined>;
     resolveService(context: HttpProtocolContext, name: string, environmentId?: string): any;
+    /**
+     * [#15900 · #13906 decision 1 option A] The CLASSIFIED sibling of
+     * `resolveService`, for a domain gate whose input is an authorization FACT
+     * rather than an optional capability.
+     *
+     * Same chain, same registries, same order — only what a REJECTION means
+     * differs:
+     *
+     *  - branded "never registered" (`isServiceNotRegisteredError`, #13905) →
+     *    `undefined`, quiet. The supported composition, whose behaviour is
+     *    exactly what it was;
+     *  - every other rejection (a factory that threw, a scoped registration
+     *    resolved without a scope id, a circular service dependency) →
+     *    re-raised, for the gate to answer as an OUTAGE rather than as an
+     *    absent fact.
+     *
+     * ⚠️ `resolveService` above stays the contract for everything else, and
+     * that is a boundary rather than an oversight: it is a capability PROBE
+     * whose collapsed `undefined` is the right shape for "is this optional
+     * service installed", and rerouting a NAME through this method for every
+     * domain at once would change every gate that reads it in one stroke —
+     * option C on #15900, explicitly NOT ruled, because nobody has enumerated
+     * those gates. A gate opts IN, one call site at a time, and says at the
+     * call site why its input is not a capability question.
+     *
+     * ⛔ Do not reach for this because it reads as the stricter one. The
+     * classification is only meaningful where "the fact could not be read" and
+     * "the fact is absent" license DIFFERENT answers; where they license the
+     * same answer it buys an outage in place of a working deployment.
+     *
+     * Untyped by slot on purpose, exactly like `resolveService`'s second
+     * overload: its callers address `tenancy`, which has no written
+     * `ServiceSlotContracts` entry, and inventing one here would be a shape
+     * nothing verifies.
+     */
+    resolveServiceOrLoud(context: HttpProtocolContext, name: string, environmentId?: string): Promise<any>;
     /**
      * Unscoped service lookup on the current kernel, typed by the slot.
      *

packages/runtime/src/domains/activation-gate.ts

@@ -79,7 +79,7 @@
 // authorization RUNG off the execution context, which is where "platform
 // operator, NOT a tenant user role" (ADR-0068 D2) still means that. The
 // built-in identity NAME is deliberately no longer imported: see the doc block.
-import { effectiveTenancyPosture } from '@objectstack/core';
+import { effectiveTenancyPosture, AuthzStoreUnavailableError } from '@objectstack/core';
 import { postureEnforcesWall } from '@objectstack/spec/security';
 import type { HttpProtocolContext, HttpDispatcherResult } from '../http-dispatcher.js';
 import type { DomainHandlerDeps } from '../domain-handler-registry.js';
@@ -147,6 +147,10 @@ export const ACTION_ACTIVATION_SUBJECT: ActivationSubject = {
  * validation, so a refused caller writes nothing and learns nothing about the
  * contract. "Write first, refuse second" is the worst shape here — it is
  * #10243 with an audit trail.
+ *
+ * ⚠️ It has THREE exits, not two: a refusal, `undefined` to proceed, and a
+ * THROW. See the posture read below for the class that throws and why a caller
+ * must not absorb it into "no gate to enforce".
  */
 export async function refuseUngrantedActivationWrite(
     deps: DomainHandlerDeps,
@@ -156,11 +160,35 @@ export async function refuseUngrantedActivationWrite(
     const ec: any = context?.executionContext;
     if (ec?.isSystem) return undefined;
 
+    // [#15900, ruled 2026-09-06 — option A] The posture is an authorization
+    // INPUT here, so the two ways it can be missing are two different facts:
+    //
+    //  - **never registered** ⇒ no posture, and no refusal. Unchanged, and load
+    //    bearing: ADR-0093 D4/D5 makes a deployment with no tenancy service the
+    //    same shape as `single`, where install-level and org-level are ONE
+    //    scope and the org admin who already cleared `manage_metadata` is the
+    //    right authority. Refusing here would lock every single-organization
+    //    operator out of their own switch.
+    //  - **registered and unable to answer** ⇒ how far this install-wide row
+    //    reaches was never READ, so whether the operator is required was never
+    //    DECIDED. Serving the write there is #13906 decision 1 option A's
+    //    permissive direction at a second door — 「A posture that could not be
+    //    READ is not a posture that is ABSENT.」 — so it is answered as an
+    //    outage (503), never as a permit.
+    //
+    // Told apart by the REGISTRY's brand (#13905) inside `resolveServiceOrLoud`,
+    // never by message text; the branded class is already absorbed there, so
+    // anything reaching this `catch` is a `tenancy` that is wired and broke.
+    //
+    // ⛔ The plain `resolveService` probe is what this gate used to read, and it
+    // collapses the two: a factory that threw and a name nothing registered
+    // both arrived as the same absent posture, and this gate then returned
+    // `undefined` — no refusal — for both.
     let posture;
     try {
-        posture = effectiveTenancyPosture(await deps.resolveService(context, 'tenancy'));
-    } catch {
-        posture = undefined;
+        posture = effectiveTenancyPosture(await deps.resolveServiceOrLoud(context, 'tenancy'));
+    } catch (err) {
+        throw new AuthzStoreUnavailableError('tenancy', err);
     }
     if (!posture || !postureEnforcesWall(posture)) return undefined;
 

packages/runtime/src/domains/keys.ts

@@ -31,7 +31,7 @@
  *    organization is re-checked here, against `sys_member`, at mint time.
  */
 
-import { isGrantActive, effectiveTenancyPosture } from '@objectstack/core';
+import { isGrantActive, effectiveTenancyPosture, AuthzStoreUnavailableError } from '@objectstack/core';
 import { postureEnforcesWall } from '@objectstack/spec/security';
 
 import { generateApiKey } from '../security/api-key.js';
@@ -104,17 +104,38 @@ export async function handleKeysRequest(
 
     // The EFFECTIVE posture, from the kernel's `tenancy` service — what is
     // ENFORCED, not what `OS_TENANCY_POSTURE` requested (ADR-0093 D4/D5: a
-    // requested-but-unenforceable wall resolves to `single`). An absent service
-    // means we cannot tell, and the honest answer to that at MINT time is to
-    // mint: refusing would block key creation on a deployment that may have no
-    // wall at all.
+    // requested-but-unenforceable wall resolves to `single`).
+    //
+    // [#15900, ruled 2026-09-06 — option A] "No service" and "the service could
+    // not be built" are TWO facts, and only one of them licenses a mint:
+    //
+    //  - **never registered** ⇒ no posture, and the honest answer at MINT time
+    //    is to mint. That is the deliberate choice this comment has always
+    //    recorded, and it is unchanged: refusing would block key creation on a
+    //    deployment that may have no wall at all, and a no-tenancy composition
+    //    is supported. ⚠️ It applies to THIS class only — it is not a statement
+    //    about a posture that could not be read.
+    //  - **registered and unable to answer** ⇒ the posture is an authorization
+    //    INPUT that was never READ, so whether this key needs an organization
+    //    was never DECIDED. Minting there hands back a long-lived credential on
+    //    a question nobody answered — the permissive direction #13906 decision 1
+    //    option A ruled against at the identity seam, whose words govern here
+    //    too: 「A posture that could not be READ is not a posture that is
+    //    ABSENT.」 Answered as an outage (503), never as a mint.
+    //
+    // The split is taken from the REGISTRY's own brand (#13905), never from
+    // message text, and the two classes arrive here already told apart —
+    // `resolveServiceOrLoud` absorbs the branded "never registered" and answers
+    // `undefined`, so anything that REJECTS is a `tenancy` that is wired and
+    // broken. ⛔ Hence no `isServiceNotRegisteredError` re-test below: a second
+    // copy of the classification is a second thing to drift.
     let tenancyPosture;
     try {
         tenancyPosture = effectiveTenancyPosture(
-            await deps.resolveService(context, 'tenancy' as any, context.environmentId),
+            await deps.resolveServiceOrLoud(context, 'tenancy', context.environmentId),
         );
-    } catch {
-        tenancyPosture = undefined;
+    } catch (err) {
+        throw new AuthzStoreUnavailableError('tenancy', err);
     }
     const walled = tenancyPosture ? postureEnforcesWall(tenancyPosture) : false;