@@ -0,0 +1,21 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): a door whose environment's security service cannot be resolved refuses rather than proceeds
+
+Clause-②: no
+Metadata-protocol: none
+
+The REST server's security resolver keeps two answers apart, by the service registry's own "never registered" brand:
+
+- **Not registered** — no `plugin-security`, or a single kernel without a security service — is a deployment with no permission posture (ADR-0106 D6 tier 1). Every door answers it exactly as before, the `/security` doors' `501 NOT_IMPLEMENTED` included.
+- **Registered but unresolvable** — a registered security service whose factory throws, or an environment kernel that cannot be acquired at the security step — is an unhealthy security service (ADR-0106 D6 tier 3). The request answers `503 SERVICE_UNAVAILABLE`, the same answer an unreadable authorization input gives everywhere else, and nothing is served.
+
+These doors ask this resolver:
+
+- the data export; the import template, at its gate and at its column projection; every object-schema read under `/meta` while object-schema masking is on (the default); and the record field-access door — each answers the `503`;
+- the record page, whose access-explanation and field-access parts each carry the `503` as their own part refusal, while the page still answers with the record and every other part;
+- the `/security` doors — the access explanation, the caller's delegable scope, a user's effective access, and the suggested audience bindings with their confirm, dismiss and reopen — each answers the `503` in its family's nested envelope. A caller context whose authorization store cannot be read answers the same `503` at these doors.
+
+On a multi-environment host, an operator who sees this `503` for one environment restores that environment's security service; the other environments are unaffected.
@@ -427,7 +427,13 @@ export function registerRecordPageEndpoints(this: RecordPageRouteHost, basePath:
 
                 const answerExplain = async () => {
                     const out: Record<string, unknown> = {};
-                    const security = await this.resolveSecurityService(environmentId, req);
+                    // Resolved once, inside each operation's own `try`: a
+                    // security service that cannot be resolved is each
+                    // operation's refusal (the `503` `GET /security/explain`
+                    // answers), as the fieldAccess part's is its own, and the
+                    // page still answers. Asked after the caller check, in the
+                    // order that door asks.
+                    let resolvingSecurity: ReturnType<RecordPageRouteHost['resolveSecurityService']> | undefined;
                     for (const operation of new Set(body.explain ?? [])) {
                         try {
                             // `POST /security/explain` answers only an
@@ -436,6 +442,7 @@ export function registerRecordPageEndpoints(this: RecordPageRouteHost, basePath:
                                 out[operation] = { error: { code: 'UNAUTHORIZED', status: 401, message: 'The access-explanation endpoint requires an authenticated caller.' } };
                                 continue;
                             }
+                            const security = await (resolvingSecurity ??= this.resolveSecurityService(environmentId, req));
                             if (typeof security?.explain !== 'function') {
                                 out[operation] = { error: { code: 'NOT_IMPLEMENTED', status: 501, message: 'Access explanation is not available on this deployment.' } };
                                 continue;
 
@@ -16,7 +16,11 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { ObjectKernel, isServiceNotRegisteredError } from '@objectstack/core';
 import { RestServer } from './rest-server';
+// Pays `@objectstack/objectql`'s first load at collection, never inside a clocked case
+// (the route modules import it lazily).
+import '@objectstack/objectql';
 
 const TASK = {
   name: 'task',
@@ -53,13 +57,14 @@ function makeRes() {
 
 /**
  * Boot the export route over a stub protocol, with `security` resolved from
- * `securityServiceProvider` (the 18th positional ctor arg).
+ * `securityServiceProvider` (the 18th positional ctor arg) — or, when
+ * `provider` is given, from that provider itself.
  *
  * `enable` is left undefined on the object so the OBJECT-level gate
  * (`apiAccessDenialFromEnable`) is fully open — every denial these tests observe
  * is therefore the USER-level axis, never the `apiMethods` whitelist.
  */
-function boot(security: any) {
+function boot(security: any, provider?: () => Promise<unknown>) {
   const findData = vi.fn().mockResolvedValue({ object: 'task', records: ROWS });
   const protocol: any = {
     getMetaItems: vi.fn().mockResolvedValue({ items: [TASK] }),
@@ -84,7 +89,7 @@ function boot(security: any) {
     undefined, // analyticsServiceProvider
     undefined, // settingsServiceProvider
     undefined, // serviceExistsProvider
-    security === undefined ? undefined : async () => security,
+    provider ?? (security === undefined ? undefined : async () => security),
   );
   (rest as any).resolveExecCtx = async () => ({ userId: 'test-user' });
   rest.registerRoutes();
@@ -167,6 +172,34 @@ describe('export route — user-level export axis (#3544)', () => {
     expect(findData).not.toHaveBeenCalled();
   });
 
+  it('a wired security provider that REJECTS → 503 SERVICE_UNAVAILABLE, and NOTHING is read', async () => {
+    // A door whose security service cannot be resolved refuses rather than
+    // proceeds: a service that is registered but unresolvable is not "no
+    // security service" (ADR-0106 D6 tier 3; ADR-0049).
+    const { route, findData } = boot(undefined, async () => {
+      throw new Error('the security service failed to construct');
+    });
+    const out = await run(route);
+
+    expect(out.getStatus()).toBe(503);
+    expect(out.getJson()).toMatchObject({ code: 'SERVICE_UNAVAILABLE' });
+    expect(findData).not.toHaveBeenCalled();
+    expect(out.chunks.join('')).toBe('');
+  });
+
+  it('a provider rejecting with the registry\'s "never registered" brand → allowed, as with no security service at all', async () => {
+    // The registry's own rejection for a slot nothing ever registered, from a
+    // real kernel: the one rejection that means "no permission posture here".
+    const kernel = new ObjectKernel({ skipSystemValidation: true, gracefulShutdown: false } as any);
+    const provider = () => kernel.getServiceAsync('security');
+    await expect(provider()).rejects.toSatisfy(isServiceNotRegisteredError);
+    const { route, findData } = boot(undefined, provider);
+    const out = await run(route);
+
+    expect(out.getStatus()).toBe(200);
+    expect(findData).toHaveBeenCalled();
+  });
+
   it('the object-level 405 still precedes the user-level 403', async () => {
     // Two gates, two questions: `apiMethods` decides whether the OBJECT exposes
     // export (405), this axis decides whether the CALLER may use it (403). An
 
@@ -2834,7 +2834,9 @@ export class RestServer {
      * every other permission gate here and `/me/permissions`' documented
      * fail-open. Service PRESENT but unable to answer → fail CLOSED: it resolves
      * permission sets to decide, and a resolution failure must never read as a
-     * grant (ADR-0049).
+     * grant (ADR-0049). A service that is registered but cannot be RESOLVED is
+     * not "no security service": {@link resolveSecurityService} refuses the
+     * request first (`503`), before this gate is asked anything.
      */
     private async enforceExportPermission(
         req: any,
@@ -2891,7 +2893,8 @@ export class RestServer {
      *
      * Fail stance, as {@link enforceExportPermission}'s: no security service,
      * or one without `explain`, → allow (no permission sets exist to deny
-     * with); `explain` throwing → deny, never read as a grant. One direction is
+     * with); `explain` throwing → deny, never read as a grant; a service that
+     * cannot be resolved → the resolver's `503`. One direction is
      * stricter than a write: `explain` denies a caller whose permission sets
      * resolve EMPTY, where the middleware skips its CRUD gate — reachable only
      * on a deployment that configures no baseline set at all, and in the closed
@@ -4435,7 +4438,11 @@ export class RestServer {
      * The returned function REJECTS with {@link ObjectSchemaMaskEvaluationError}
      * on D6 tier 3 — the security service threw. Call sites answer 5xx via
      * {@link sendFieldVisibilityFault}; they must never fall back to the
-     * unmasked body.
+     * unmasked body. This resolution itself rejects with
+     * {@link AuthzStoreUnavailableError} — D6 tier 3 as well — when the caller's
+     * context or the environment's security service cannot be resolved; call
+     * sites rethrow it to the route's `503`. Only a security service that is
+     * NOT REGISTERED reaches tier 1.
      */
     private async resolveObjectMasker(
         environmentId: string | undefined,
@@ -5940,16 +5947,30 @@ export class RestServer {
     /**
      * [#3547] Resolve the environment's `security` service — the ENVIRONMENT's
      * kernel service (its evaluator / FieldMasker are bound to that kernel's
-     * data engine). Mirrors the resolver in registerSecurityExplainEndpoints.
-     * Returns `undefined` when no security service is reachable (no
-     * plugin-security / single-kernel without a provider), so callers degrade
-     * gracefully.
+     * data engine).
      *
-     * [#30192] The provider resolves the environment's kernel itself now
+     * [#30192] The provider resolves the environment's kernel itself
      * (`rest-api-plugin`'s environment-scoped seam), so this asks it for the
      * REQUEST's environment, the shared resolver's answer, and nothing else.
-     * The host's occupant is no longer a fallback: an environment whose kernel
-     * carries no security service, or cannot be acquired, answers `undefined`.
+     * The host's occupant is never a fallback.
+     *
+     * A door whose environment's security service cannot be resolved refuses
+     * rather than proceeds. The two answers are told apart by the registry's
+     * own "never registered" brand, never by message text:
+     *
+     *  - NOT REGISTERED → `undefined`: no provider is wired, the environment's
+     *    kernel registers no `security` service (the provider absorbs the
+     *    branded rejection), or that branded rejection reaches this resolver.
+     *    The deployment has no permission posture at all (no plugin-security,
+     *    or a single kernel without one), and each caller's documented
+     *    degradation for that case stands (ADR-0106 D6 tier 1).
+     *  - REGISTERED BUT UNRESOLVABLE → {@link AuthzStoreUnavailableError}, the
+     *    door's `503 SERVICE_UNAVAILABLE`: every other rejection — a registered
+     *    factory that threw, or the environment's kernel failing to be
+     *    acquired at this step. An unhealthy security service must not open a
+     *    door (ADR-0106 D6 tier 3), and a resolution failure never reads as a
+     *    grant (ADR-0049). The same classification the tenancy read makes
+     *    (`resolveAnonymousFormTenancy`).
      *
      * Typed as a PARTIAL {@link ISecurityService}: an implementation may omit a
      * method it cannot honour, so every call site must keep feature-detecting
@@ -5963,8 +5984,10 @@ export class RestServer {
         try {
             const envId = await this.resolveRequestEnvironmentId(environmentId, req);
             return await this.securityServiceProvider(envId);
+        } catch (err) {
+            if (isServiceNotRegisteredError(err)) return undefined;
+            throw new AuthzStoreUnavailableError('security', err);
         }
-        catch { return undefined; }
     }
 
     /**
@@ -6264,13 +6287,12 @@ export class RestServer {
     private registerSecurityExplainEndpoints(basePath: string): void {
         // [#23050 slice 6] The body moved to `security-routes.ts`. This literal
         // hands it every member it reads — the list IS its dependency on this
-        // class (see `SecurityExplainRouteHost`, and that module's header for why
-        // `securityServiceProvider` is a getter).
-        const readSecurityServiceProvider = () => this.securityServiceProvider;
+        // class (see `SecurityExplainRouteHost`). The `security` slot is read through
+        // {@link resolveSecurityService}, the server's one resolver, so this
+        // family classifies a rejection exactly as every other door does.
         const host: SecurityExplainRouteHost = {
             routeManager: this.routeManager,
-            get securityServiceProvider() { return readSecurityServiceProvider(); },
-            resolveRequestEnvironmentId: (...a) => this.resolveRequestEnvironmentId(...a),
+            resolveSecurityService: (...a) => this.resolveSecurityService(...a),
             resolveExecCtx: (...a) => this.resolveExecCtx(...a),
             enforceAuth: (...a) => this.enforceAuth(...a),
         };
@@ -6402,13 +6424,12 @@ export class RestServer {
     private registerSecurityEndpoints(basePath: string): void {
         // [#23050 slice 6] The body moved to `security-routes.ts`. This literal
         // hands it every member it reads — the list IS its dependency on this
-        // class (see `SecurityRouteHost`, and that module's header for why
-        // `securityServiceProvider` is a getter).
-        const readSecurityServiceProvider = () => this.securityServiceProvider;
+        // class (see `SecurityRouteHost`). The `security` slot is read through
+        // {@link resolveSecurityService}, the server's one resolver, so this
+        // family classifies a rejection exactly as every other door does.
         const host: SecurityRouteHost = {
             routeManager: this.routeManager,
-            get securityServiceProvider() { return readSecurityServiceProvider(); },
-            resolveRequestEnvironmentId: (...a) => this.resolveRequestEnvironmentId(...a),
+            resolveSecurityService: (...a) => this.resolveSecurityService(...a),
             resolveExecCtx: (...a) => this.resolveExecCtx(...a),
             enforceAuth: (...a) => this.enforceAuth(...a),
         };
 
@@ -57,9 +57,13 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
+import { AuthzStoreUnavailableError, ObjectKernel, isServiceNotRegisteredError } from '@objectstack/core';
 // `.js` on purpose — NodeNext resolution requires the extension, and this
 // package's TEST_DEBT ceiling has no margin for another TS2835 (#7248).
 import { RestServer } from './rest-server.js';
+// Pays `@objectstack/objectql`'s first load at collection, never inside a clocked case
+// (the route modules import it lazily).
+import '@objectstack/objectql';
 
 const EXPLAIN = '/api/v1/security/explain';
 const DELEGABLE = '/api/v1/security/my-delegable-scope';
@@ -113,15 +117,22 @@ type Answer = { status: number; body: any };
  *                MISSING the method is the other half (the route's own
  *                duck-type check), which is how both routes reach 501 while
  *                still being driven normally.
+ * @param wiring  overrides for the two reads every arm begins with: the
+ *                security provider itself, and the caller's context.
  */
-function boot(service?: any, context: any = CALLER) {
+function boot(
+    service?: any,
+    context: any = CALLER,
+    wiring: { provider?: () => Promise<unknown>; execCtx?: () => Promise<unknown> } = {},
+) {
     const rest = new RestServer(
         mockServer() as any,
         { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: {} }) } as any,
         { api: { requireAuth: false } } as any,
     );
-    (rest as any).resolveExecCtx = async () => context;
-    if (service !== undefined) (rest as any).securityServiceProvider = async () => service;
+    (rest as any).resolveExecCtx = wiring.execCtx ?? (async () => context);
+    if (wiring.provider) (rest as any).securityServiceProvider = wiring.provider;
+    else if (service !== undefined) (rest as any).securityServiceProvider = async () => service;
     rest.registerRoutes();
 
     const route = (method: string, path: string) => {
@@ -496,3 +507,34 @@ describe('[#20603] /security/explain — a classified service refusal keeps its
         expectNestedEnvelope(await boot(throwingExplain(unknown)).explainPost(), 404, 'OBJECT_NOT_FOUND');
     });
 });
+
+describe('an authorization input that cannot be read answers the explain family\'s 503, never its 500 or 501', () => {
+    const healthy = { explain: vi.fn().mockResolvedValue(DECISION), describeDelegableScope: vi.fn().mockResolvedValue({}) };
+
+    it('a security service that cannot be resolved → 503 SERVICE_UNAVAILABLE, and nothing is asked of it', async () => {
+        const doors = boot(undefined, CALLER, {
+            provider: async () => { throw new Error('the security service failed to construct'); },
+        });
+        expectNestedEnvelope(await doors.explainPost(), 503, 'SERVICE_UNAVAILABLE');
+        expectNestedEnvelope(await doors.explainGet(), 503, 'SERVICE_UNAVAILABLE');
+        expectNestedEnvelope(await doors.delegable(), 503, 'SERVICE_UNAVAILABLE');
+    });
+
+    it('a caller context whose authorization store cannot be read → 503 SERVICE_UNAVAILABLE', async () => {
+        const doors = boot(healthy, CALLER, {
+            execCtx: async () => { throw new AuthzStoreUnavailableError('sys_user_permission_set', new Error('store down')); },
+        });
+        expectNestedEnvelope(await doors.explainPost(), 503, 'SERVICE_UNAVAILABLE');
+        expectNestedEnvelope(await doors.delegable(), 503, 'SERVICE_UNAVAILABLE');
+        expect(healthy.explain).not.toHaveBeenCalled();
+    });
+
+    it('the registry\'s "never registered" rejection keeps the 501 — no security service on this deployment', async () => {
+        const kernel = new ObjectKernel({ skipSystemValidation: true, gracefulShutdown: false } as any);
+        const provider = () => kernel.getServiceAsync('security');
+        await expect(provider()).rejects.toSatisfy(isServiceNotRegisteredError);
+        const doors = boot(undefined, CALLER, { provider });
+        expectNestedEnvelope(await doors.explainPost(), 501, 'NOT_IMPLEMENTED');
+        expectNestedEnvelope(await doors.delegable(), 501, 'NOT_IMPLEMENTED');
+    });
+});