@@ -0,0 +1,23 @@
+---
+'@objectstack/cli': patch
+'@objectstack/runtime': patch
+---
+
+fix(cli)!: the one-shot secret commands choose the crypto provider from the installed plugins too, by `os serve`'s rule
+
+Clause-②: yes (narrowing) — `os secret rewrap`, `os secret orphans` and the data migrations' settings arm refuse to run when a plugin `os plugin install` installed is refused and nothing rules out that it provides the crypto provider (`crypto-provider`), and when a config plugin and an installed plugin both declare it, where they ran without reading the installed plugins; widened beside it: the optional `leaveUninstallsPending` on `LoadInstalledPluginsInput` (`@objectstack/runtime`).
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) no key of any schema is added, removed or re-shaped and no stored row is converted: a one-shot run whose installed plugins hold a refusal that may be the crypto provider stops until the operator fixes that plugin or disables it, which is a choice about one installed plugin made by hand, not a mechanical conversion -->
+
+**BREAKING** for a deployment that runs `os secret rewrap`, `os secret orphans` or a data migration with an installed plugin (`os plugin install`) that `os serve` would refuse to boot with, or with a crypto provider declared both in the host config's `plugins` and by an installed plugin.
+
+- **Before.** A one-shot run chose the crypto provider from the host config's `plugins` only. The installed plugins of the project were not read.
+- **Now.** The installed plugins are read beside the config's `plugins`, through the loader `os serve`'s boot reads them with, and judged by the same rule:
+  - an installed plugin that loads and declares `crypto-provider` is the plugin the run seals and opens with;
+  - a refused installed plugin that may provide it refuses the run, naming the plugin, its refusal code and the step `os serve`'s refusal names;
+  - two declaring plugins, config or installed, are refused, both named;
+  - an installed plugin whose name a config plugin, or an installed plugin read before it, takes is refused as `plugin_name_taken`, as `os serve` refuses it.
+  The run registers and removes none of the installed plugins: a pending uninstall is left for the next boot.
+- **`@objectstack/runtime`.** `loadInstalledPlugins` takes an optional `leaveUninstallsPending`. When it is set, a pending uninstall is neither finished nor loaded.
+- **Who moves, and the fix.** A deployment whose one-shot run now stops runs the step the refusal names (fix the installed plugin, or `os plugin disable <id>`), or keeps one declaration of the crypto provider, then runs it again.
@@ -7,6 +7,7 @@ import {
   loadInstalledPlugins,
   pluginInstallationsFile,
   type InstalledPluginRefusal,
+  type InstalledPluginsLoad,
 } from '@objectstack/runtime';
 import { isExitSignal } from './format.js';
 import { pluginEnvironmentId } from './plugin-install.js';
@@ -75,17 +76,23 @@ function withDeclaredServices(declaredServices: string[] | undefined, refusal: I
   return declaredServices === undefined ? refusal : { ...refusal, declaredServices };
 }
 
-export async function registerInstalledPlugins(input: {
-  kernel: BootKernel;
-  track(name: string): void;
-}): Promise<InstalledPluginsBoot | null> {
+/**
+ * The installed plugins of this project and environment, verified and imported
+ * by the runtime's loader with this host's parts (module header), and nothing
+ * registered: `null` when there is no installations file. A loader that throws
+ * outright is one `loader_failed` refusal. `os serve` registers what this
+ * answers ({@link registerInstalledPlugins}); a one-shot command reads it
+ * without registering, with `leaveUninstallsPending`, so it removes nothing.
+ */
+export async function loadHostInstalledPlugins(
+  opts: { leaveUninstallsPending?: boolean } = {},
+): Promise<InstalledPluginsLoad | null> {
   const environmentId = pluginEnvironmentId();
   if (!existsSync(pluginInstallationsFile(environmentId))) return null;
-
-  let result: Awaited<ReturnType<typeof loadInstalledPlugins>>;
   try {
-    result = await loadInstalledPlugins({
+    return await loadInstalledPlugins({
       environmentId,
+      leaveUninstallsPending: opts.leaveUninstallsPending,
       resolveKeys: async (keyIds) => {
         const read = await readTrustedKeys(keyIds, { databaseUrl: process.env.OS_DATABASE_URL, json: false });
         if (!read.ok) throw new Error(read.message);
@@ -99,13 +106,21 @@ export async function registerInstalledPlugins(input: {
     });
   } catch (error) {
     if (isExitSignal(error)) throw error;
-    result = {
+    return {
       loaded: [],
       removed: [],
       disabled: [],
       refused: [{ id: '*', version: '*', error: 'loader_failed', message: `the installed-plugin loader failed (${thrownMessage(error)}); no installed plugin was loaded.` }],
     };
   }
+}
+
+export async function registerInstalledPlugins(input: {
+  kernel: BootKernel;
+  track(name: string): void;
+}): Promise<InstalledPluginsBoot | null> {
+  const result = await loadHostInstalledPlugins();
+  if (result === null) return null;
 
   const out: InstalledPluginsBoot = { loaded: [], refused: [...result.refused] };
   for (const { record, kept } of result.removed) {