@@ -0,0 +1,14 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): the approvals, email, sharing, sharing-rule and analytics routes answer from the request's environment kernel when one REST plugin fronts many environments
+
+Clause-②: no
+Metadata-protocol: none
+
+- **What was wrong.** On a host that mounts one `RestApiPlugin` in front of many environment kernels (the hosted runtime shape), the five provider seams the plugin hands `RestServer` for `approvals`, `email`, `sharing`, `sharingRules` and `analytics` read the HOST kernel's service whatever environment they were asked for, and the unscoped (hostname-routed) mount asked them for no environment at all. The environment's own services were never reached: `GET /api/v1/approvals/requests` answered `{ data: [] }`, `GET /api/v1/approvals/requests/:id` answered 501, and the sharing, sharing-rule and email doors answered 501, on every hosted environment. The record page's approvals part answered no requests.
+- **What changes.** Given an environment id and a registered `kernel-manager`, each of the five providers now reads its slot on that environment's kernel (`kernelManager.getOrCreate(id)`), the same acquisition the data routes make. The routes pass the id the shared request→environment resolution answered: the `/environments/:environmentId` param on the scoped mount, else the host's `kernel-resolver` (or the hostname / `X-Environment-Id` chain) on the unscoped one. There is no fallback to the host's occupant: an environment whose kernel carries no such service gets the door's own "not configured" answer.
+- **Analytics.** `POST /analytics/dataset/query` already read the environment's service first, and now reads it alone: when the environment's kernel carries no analytics service, or cannot be acquired, the answer is the route's 501 rather than the host's service.
+- **Unchanged.** A single-kernel deployment (no `kernel-manager`) reads all five services on the plugin's own kernel exactly as before, for every route and every id. The reserved `platform` id and a request the resolver places in no environment also read the plugin's own kernel.
+- **No migration.** No configuration, route, response shape or export changes.
@@ -28,10 +28,11 @@
  *   `register` call, which runs while registration runs, and the class's one
  *   `routeManager` reassignment wraps `registerMetadataEndpointsInner`, never
  *   this registrar.
- * - `kernelManager` and `analyticsServiceProvider` go as GETTERS. The body's
- *   `resolveService` reads both at REQUEST time, and neither field is
- *   `readonly`, so a value copied at registration could part from it. The
- *   getter reads the field the handler read, when it read it.
+ * - `analyticsServiceProvider` goes as a GETTER. The body's `resolveService`
+ *   reads it at REQUEST time, and the field is not `readonly`, so a value
+ *   copied at registration could part from it. The getter reads the field the
+ *   handler read, when it read it. (`kernelManager` went the same way until
+ *   #30011 moved the environment-kernel lookup into the provider itself.)
  *
  * Module-level helpers stay where they were and are imported from the modules
  * `rest-server.ts` imports them from. The one helper declared in
@@ -66,12 +67,11 @@ import { mayReadPendingDrafts, type RestServer } from './rest-server.js';
  * one of them, and no other. Each is typed AS the class member (an indexed
  * access on the class), so a change to a member's signature on the class is a
  * change here too, and naming a member the class does not have is a compile
- * error. See the module header for why `kernelManager` and
- * `analyticsServiceProvider` are getters.
+ * error. See the module header for why `analyticsServiceProvider` is a
+ * getter.
  */
 export interface AnalyticsRouteHost {
     readonly routeManager: RestServer['routeManager'];
-    readonly kernelManager: RestServer['kernelManager'];
     readonly analyticsServiceProvider: RestServer['analyticsServiceProvider'];
     resolveRequestEnvironmentId: RestServer['resolveRequestEnvironmentId'];
     resolveExecCtx: RestServer['resolveExecCtx'];
@@ -88,23 +88,23 @@ export interface AnalyticsRouteHost {
  */
 export function registerAnalyticsEndpoints(this: AnalyticsRouteHost, basePath: string): void {
     const isScoped = basePath.includes('/environments/:environmentId');
-    // Resolve the ENVIRONMENT's analytics service first — its strategy
-    // bridges are bound to the env kernel's own data engine. The host
-    // provider (whose 'data' is the host kernel's engine) is only a
-    // fallback: serving a tenant's dataset query from the host engine
-    // reads the WRONG database and silently aggregates over nothing
-    // (the staging "Total Spend: 0 on a populated table" incident).
-    const resolveService = async (environmentId?: string, req?: any) => {
+    // The ENVIRONMENT's analytics service — its strategy bridges are bound to
+    // the env kernel's own data engine. Serving a tenant's dataset query from
+    // the host engine reads the WRONG database and silently aggregates over
+    // nothing (the staging "Total Spend: 0 on a populated table" incident).
+    //
+    // [#30011] The provider resolves the environment's kernel itself now, as
+    // its four siblings do, so this asks it for the REQUEST's environment
+    // (the shared resolver's answer) and nothing else. The host provider is
+    // no longer a fallback: the door answers from the request's environment
+    // alone. When the environment's kernel carries no analytics service, or
+    // could not be acquired, the answer is the 501 below.
+    const resolveService = async (environmentId: string | undefined, req: any) => {
+        if (!this.analyticsServiceProvider) return undefined;
         try {
             const envId = await this.resolveRequestEnvironmentId(environmentId, req);
-            if (envId && envId !== 'platform' && this.kernelManager) {
-                const kernel = await this.kernelManager.getOrCreate(envId);
-                const svc = await kernel.getServiceAsync<any>('analytics').catch(() => undefined);
-                if (svc) return svc;
-            }
-        } catch { /* fall back to the host service */ }
-        if (!this.analyticsServiceProvider) return undefined;
-        try { return await this.analyticsServiceProvider(environmentId); }
+            return await this.analyticsServiceProvider(envId);
+        }
         catch { return undefined; }
     };
 
 
@@ -84,6 +84,7 @@ export const APPROVAL_RECORD_LOCK_PARAMS: readonly string[] = [];
 export interface ApprovalsRouteHost {
     readonly routeManager: RestServer['routeManager'];
     readonly approvalsServiceProvider: RestServer['approvalsServiceProvider'];
+    resolveRequestEnvironmentId: RestServer['resolveRequestEnvironmentId'];
     resolveExecCtx: RestServer['resolveExecCtx'];
     enforceAuth: RestServer['enforceAuth'];
 }
@@ -102,9 +103,18 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
     const dataPath = basePath;
     const isScoped = basePath.includes('/environments/:environmentId');
 
-    const resolveService = async (environmentId?: string) => {
+    // [#30011] The provider is asked for the environment the REQUEST is in,
+    // through the one resolver every REST-owned route shares: the scoped
+    // param when the mount carries one, else the host's request→environment
+    // answer (a hostname-routed request arrives here with no id at all).
+    // Passing the raw `undefined` on the unscoped mount is how a hosted
+    // environment's approvals were read from the host kernel.
+    const resolveService = async (environmentId: string | undefined, req: any) => {
         if (!this.approvalsServiceProvider) return undefined;
-        try { return await this.approvalsServiceProvider(environmentId); }
+        try {
+            const envId = await this.resolveRequestEnvironmentId(environmentId, req);
+            return await this.approvalsServiceProvider(envId);
+        }
         catch { return undefined; }
     };
     const respond501 = (res: any) => res.status(501).json({
@@ -236,7 +246,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                 const environmentId = isScoped ? req.params?.environmentId : undefined;
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
-                const svc = await resolveService(environmentId);
+                const svc = await resolveService(environmentId, req);
                 if (!svc) {
                     // No approvals plugin loaded — return empty list rather than 501
                     // so Console badge polls don't spam the error log on deployments
@@ -332,7 +342,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                 const environmentId = isScoped ? req.params?.environmentId : undefined;
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
-                const svc = await resolveService(environmentId);
+                const svc = await resolveService(environmentId, req);
                 if (!svc) return respond501(res);
                 const row = await readableRequestOr404(svc, req.params.id, context, res);
                 if (!row) return;
@@ -362,7 +372,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
                 if (refuseUnknownQueryParams(req, res, APPROVAL_RECORD_LOCK_PARAMS)) return;
-                const svc = await resolveService(environmentId);
+                const svc = await resolveService(environmentId, req);
                 if (!svc || typeof svc.getRecordLock !== 'function') return respond501(res);
                 const { object, recordId } = req.params;
                 const lock = await svc.getRecordLock(object, recordId, context ?? {});
@@ -401,7 +411,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                     const environmentId = isScoped ? req.params?.environmentId : undefined;
                     const context = await this.resolveExecCtx(environmentId, req);
                     if (this.enforceAuth(req, res, context)) return;
-                    const svc = await resolveService(environmentId);
+                    const svc = await resolveService(environmentId, req);
                     if (!svc) return respond501(res);
                     const body = req.body ?? {};
                     try {
@@ -441,7 +451,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                 const environmentId = isScoped ? req.params?.environmentId : undefined;
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
-                const svc = await resolveService(environmentId);
+                const svc = await resolveService(environmentId, req);
                 if (!svc || typeof svc.recall !== 'function') return respond501(res);
                 const body = req.body ?? {};
                 try {
@@ -480,7 +490,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                     const environmentId = isScoped ? req.params?.environmentId : undefined;
                     const context = await this.resolveExecCtx(environmentId, req);
                     if (this.enforceAuth(req, res, context)) return;
-                    const svc = await resolveService(environmentId);
+                    const svc = await resolveService(environmentId, req);
                     if (!svc) return respond501(res);
                     const body = req.body ?? {};
                     try {
@@ -529,7 +539,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                     const environmentId = isScoped ? req.params?.environmentId : undefined;
                     const context = await this.resolveExecCtx(environmentId, req);
                     if (this.enforceAuth(req, res, context)) return;
-                    const svc = await resolveService(environmentId);
+                    const svc = await resolveService(environmentId, req);
                     if (!svc) return respond501(res);
                     const body = req.body ?? {};
                     try {
@@ -585,7 +595,7 @@ export function registerApprovalsEndpoints(this: ApprovalsRouteHost, basePath: s
                 const environmentId = isScoped ? req.params?.environmentId : undefined;
                 const context = await this.resolveExecCtx(environmentId, req);
                 if (this.enforceAuth(req, res, context)) return;
-                const svc = await resolveService(environmentId);
+                const svc = await resolveService(environmentId, req);
                 if (!svc) return respond501(res);
                 // The parent door's lookup and 404 first: an unknown id and a
                 // request the caller cannot see are not an empty audit trail.
 
@@ -189,6 +189,7 @@ function refuse(res: any, message: string): void {
 export interface EmailRouteHost {
     readonly routeManager: RestServer['routeManager'];
     readonly emailServiceProvider: RestServer['emailServiceProvider'];
+    resolveRequestEnvironmentId: RestServer['resolveRequestEnvironmentId'];
     resolveExecCtx: RestServer['resolveExecCtx'];
     enforceAuth: RestServer['enforceAuth'];
 }
@@ -247,7 +248,14 @@ export function registerEmailEndpoints(this: EmailRouteHost, basePath: string):
                 // answered the wiring question, and "not configured" and
                 // "configured and unusable" both mean this deployment cannot
                 // send mail — one 501, no fact lost by folding them.
-                const emailService = await seamOrUndefined(() => this.emailServiceProvider!(environmentId));
+                //
+                // [#30011] Asked for the REQUEST's environment — the scoped
+                // param, else the shared request→environment resolver — so a
+                // hosted environment's send goes through its own kernel's
+                // email service, never the host's. Resolved inside the seam,
+                // so a resolver fault takes the same 501 as any other.
+                const emailService = await seamOrUndefined(async () =>
+                    this.emailServiceProvider!(await this.resolveRequestEnvironmentId(environmentId, req)));
                 if (!emailService || typeof emailService.send !== 'function') {
                     res.status(501).json({
                         code: 'NOT_IMPLEMENTED',
 
@@ -84,6 +84,7 @@ export interface RecordPageRouteHost {
     readonly routeManager: RestServer['routeManager'];
     readonly approvalsServiceProvider: ((environmentId?: string) => Promise<any | undefined>) | undefined;
     resolveProtocol: RestServer['resolveProtocol'];
+    resolveRequestEnvironmentId: RestServer['resolveRequestEnvironmentId'];
     resolveExecCtx: RestServer['resolveExecCtx'];
     enforceAuth: RestServer['enforceAuth'];
     enforceApiAccess: RestServer['enforceApiAccess'];
@@ -429,7 +430,14 @@ export function registerRecordPageEndpoints(this: RecordPageRouteHost, basePath:
                 const answerApprovals = async () => {
                     try {
                         const provider = this.approvalsServiceProvider;
-                        const svc = provider ? await provider(environmentId).catch(() => undefined) : undefined;
+                        // [#30011] The REQUEST's environment, through the shared
+                        // resolver, as the `/approvals` door asks it — the raw
+                        // `undefined` of the unscoped mount read the host's.
+                        const svc = provider
+                            ? await this.resolveRequestEnvironmentId(environmentId, req)
+                                .then((envId) => provider(envId))
+                                .catch(() => undefined)
+                            : undefined;
                         if (!svc) return { requests: [], lock: null };
                         const rows: any[] = (await svc.listRequests({ object, recordId: id }, context ?? {})) ?? [];
                         const pending = rows.find((r) => r?.status === 'pending');