@@ -0,0 +1,25 @@
+---
+'@objectstack/cli': patch
+'@objectstack/runtime': patch
+---
+
+fix(cli)!: `os serve` refuses to boot when an installed plugin that may provide the crypto provider is refused at boot
+
+Clause-②: yes (narrowing) — `os serve` (and the `serve` child of `os start` and `os dev`) refuses to boot when a plugin `os plugin install` installed is refused at boot and nothing rules out that it provides the crypto provider (`crypto-provider`), where every such refusal was non-fatal and the boot went on; widened beside it: the optional `declaredServices` on `InstalledPluginRefusal` and `LoadedInstalledPlugin` (`@objectstack/runtime`).
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) no key of any schema is added, removed or re-shaped and no stored row is converted: a boot whose installed plugins hold a refusal that may be the crypto provider stops until the operator fixes that plugin or disables it, which is a choice about one installed plugin made by hand, not a mechanical conversion -->
+
+**BREAKING** for a deployment that boots `os serve`, `os start` or `os dev` with an installed plugin (`os plugin install`) that is refused at boot.
+
+- **Before.** A refused installed plugin was printed (`✗ Refused installed plugin id@version (code)`), and the boot went on without it, whatever the refusal.
+- **Now.** The boot stops, before any plugin starts, when a refused installed plugin may provide the crypto provider. That provider seals every secret field, datasource credential and encrypted setting, so the boot does not choose another one. This is the rule a stack `plugins` entry that does not load already follows. A refusal is ruled out, and the boot goes on as before, when:
+  - the plugin's verified artifact declares a tier this host does not run in process (`runtime_undeclared`, `runtime_not_dispatched`);
+  - or the plugin was imported, is an object, and its `providesServices` (ADR-0116) could be read and does not name `crypto-provider`.
+  Every other refusal stops the boot, a loader that fails outright included. A disabled plugin is not a refusal.
+- **What it says.** The refusal names each plugin as `id@version` with its refusal code, and the step that lets the next boot go on. For most codes that is `os plugin disable <id>`.
+  - A record whose directory is not its install directory (`install_dir_unexpected`) is installed again.
+  - An uninstall the boot could not finish (`uninstall_failed`, `record_changed`) is finished by a later boot.
+  - An unreadable disable-state file or installations file is repaired.
+- **`@objectstack/runtime`.** `InstalledPluginRefusal` and `LoadedInstalledPlugin` gain an optional `declaredServices`: what an imported plugin declares in `providesServices`, absent when it was not imported, is not an object, or its declaration could not be read.
+- **Who moves, and the fix.** A deployment whose boot now stops fixes the named plugin (installs it again, trusts its key, or whatever its refusal code names), or runs the step the refusal names, then boots again.
@@ -66,6 +66,7 @@ import {
   refuseTwoCryptoProviderPlugins,
   refuseUnloadedCryptoProviderPlugins,
   refuseSetAsideCryptoProviderPlugins,
+  refuseRefusedInstalledCryptoProviderPlugins,
 } from './serve.js';
 
 // [#10126] Pay the first load of what `serve.ts` reaches through dynamic
@@ -519,6 +520,82 @@ describe('a plugins entry that did not load refuses the boot unless it is ruled
   });
 });
 
+describe('an installed plugin refused at boot refuses the boot unless it is ruled out as the crypto provider', () => {
+  type Refused = Parameters<typeof refuseRefusedInstalledCryptoProviderPlugins>[0][number];
+  const refusalOf = (refused: Refused[]): Error | undefined => {
+    try { refuseRefusedInstalledCryptoProviderPlugins(refused); }
+    catch (err) { return err as Error; }
+    return undefined;
+  };
+  const refused = (id: string, error: Refused['error'], declaredServices?: string[]): Refused =>
+    ({ id, version: '1.0.0', error, message: 'x', ...(declaredServices ? { declaredServices } : {}) });
+
+  it('a plugin refused before its import says nothing it provides, and is refused, named with its reason and the way to boot without it', () => {
+    for (const error of ['tree_changed', 'signature_invalid', 'signature_key_revoked', 'artifact_changed', 'manifest_invalid', 'entry_missing', 'import_failed'] as const) {
+      const refusal = refusalOf([refused('com.acme.kms', error)]);
+      expect(refusal, error).toBeInstanceOf(HostCryptoProviderRefusal);
+      expect(refusal!.message).toContain(`installed plugin com.acme.kms@1.0.0 was refused (${error})`);
+      expect(refusal!.message).toContain(`'${CRYPTO_PROVIDER_SERVICE}'`);
+      expect(refusal!.message).toContain('os plugin disable com.acme.kms');
+    }
+  });
+
+  it('a plugin refused after its import is judged by what it declares: the provider is refused, other services or none are ruled out', () => {
+    for (const error of ['not_a_plugin', 'signature_conflict', 'plugin_name_taken', 'kernel_refused'] as const) {
+      expect(refusalOf([refused('com.acme.kms', error, [CRYPTO_PROVIDER_SERVICE])]), error).toBeInstanceOf(HostCryptoProviderRefusal);
+      expect(refusalOf([refused('com.acme.widgets', error, ['widgets'])]), error).toBeUndefined();
+      expect(refusalOf([refused('com.acme.plain', error, [])]), error).toBeUndefined();
+      // Imported, but its declaration could not be read: nothing rules it out.
+      expect(refusalOf([refused('com.acme.unread', error)]), error).toBeInstanceOf(HostCryptoProviderRefusal);
+    }
+  });
+
+  it('CONTROL: a tier this host does not run in process is ruled out; no refusal is not refused', () => {
+    expect(refusalOf([refused('com.acme.sandboxed', 'runtime_not_dispatched'), refused('com.acme.untiered', 'runtime_undeclared')])).toBeUndefined();
+    expect(refusalOf([])).toBeUndefined();
+  });
+
+  it('the loader failing outright is refused, with no plugin to disable', () => {
+    const refusal = refusalOf([{ id: '*', version: '*', error: 'loader_failed', message: 'x' }]);
+    expect(refusal).toBeInstanceOf(HostCryptoProviderRefusal);
+    expect(refusal!.message).toContain('the installed plugins could not be read (loader_failed)');
+    expect(refusal!.message).not.toContain('os plugin disable');
+  });
+
+  it('a code os plugin disable cannot clear names its own step instead of the disable', () => {
+    for (const [error, step] of [
+      ['install_dir_unexpected', 'Install com.acme.kms again (os plugin install)'],
+      ['uninstall_failed', 'com.acme.kms is being uninstalled'],
+      ['record_changed', 'com.acme.kms is being uninstalled'],
+      ['disabled_state_unreadable', "Repair this environment's disable-state file"],
+    ] as const) {
+      const refusal = refusalOf([refused('com.acme.kms', error)]);
+      expect(refusal, error).toBeInstanceOf(HostCryptoProviderRefusal);
+      expect(refusal!.message).toContain(`installed plugin com.acme.kms@1.0.0 was refused (${error})`);
+      expect(refusal!.message).toContain(step);
+      expect(refusal!.message).not.toContain('os plugin disable');
+    }
+    const mixed = refusalOf([refused('com.acme.one', 'tree_changed'), refused('com.acme.two', 'install_dir_unexpected')]);
+    expect(mixed!.message).toContain('boot without it: os plugin disable com.acme.one.');
+    expect(mixed!.message).toContain('Install com.acme.two again (os plugin install)');
+    expect(mixed!.message).not.toContain('os plugin disable com.acme.two');
+  });
+
+  it('every refused plugin is named, and the ruled-out ones are not', () => {
+    const refusal = refusalOf([
+      refused('com.acme.one', 'tree_changed'),
+      refused('com.acme.widgets', 'kernel_refused', ['widgets']),
+      refused('com.acme.sandboxed', 'runtime_not_dispatched'),
+      refused('com.acme.two', 'signature_key_untrusted'),
+    ]);
+    expect(refusal!.message).toContain('com.acme.one@1.0.0 was refused (tree_changed)');
+    expect(refusal!.message).toContain('com.acme.two@1.0.0 was refused (signature_key_untrusted)');
+    expect(refusal!.message).toContain('os plugin disable com.acme.one, os plugin disable com.acme.two');
+    expect(refusal!.message).not.toContain('com.acme.widgets');
+    expect(refusal!.message).not.toContain('com.acme.sandboxed');
+  });
+});
+
 describe('a plugins entry the standalone boot sets aside refuses the boot unless it is ruled out as the crypto provider', () => {
   const refusalOf = async (authored: unknown, importSpecifier: (specifier: string) => Promise<unknown>): Promise<Error | undefined> => {
     try { await refuseSetAsideCryptoProviderPlugins(authored, importSpecifier); }
@@ -692,6 +769,15 @@ describe('the wiring inside run()', () => {
     expect(host).toBeGreaterThan(check);
   });
 
+  it('refuses a refused installed plugin that may provide the crypto provider right after the installed plugins register, before the host provider is built', () => {
+    const register = SERVE.indexOf('const installedPluginsBoot = await registerInstalledPlugins({ kernel, track: trackPlugin });');
+    const check = SERVE.indexOf('refuseRefusedInstalledCryptoProviderPlugins(installedPluginsBoot?.refused ?? []);');
+    const host = SERVE.indexOf('hostCrypto = createHostCryptoProvider(() => localCryptoProvider.resolve());');
+    expect(register).toBeGreaterThan(0);
+    expect(check).toBeGreaterThan(register);
+    expect(host).toBeGreaterThan(check);
+  });
+
   it('refuses a set-aside entry that may provide the crypto provider before the standalone stack replaces the authored plugins', () => {
     const branch = SERVE.indexOf('if (useArtifactFallback || shouldBootWithLibrary(config)) {');
     const check = SERVE.indexOf('await refuseSetAsideCryptoProviderPlugins(');
 
@@ -83,7 +83,7 @@ import { missingProviderMessage } from '../utils/capability-preflight.js';
 // app-declared package wins there (per commit 5a90c56d1).
 import { resolveDeploymentAppName } from '@objectstack/plugin-email';
 import { createHash } from 'node:crypto';
-import { resolveObjectStackHome } from '@objectstack/runtime';
+import { resolveObjectStackHome, type InstalledPluginRefusal } from '@objectstack/runtime';
 import { LOG_LEVELS, resolveLogLevel, readLogLevelEnv } from '../utils/log-level.js';
 // The ONE port contract — range, reader and refusal prose — shared with the two
 // commands that spawn this one (#12673). `serve`'s own door below calls it
@@ -4787,9 +4787,11 @@ export default class Serve extends Command {
       // environment's trusted keys, the unpacked tree, the `runtime` tier) and
       // registered here, after the config's own `plugins`, while the kernel
       // still takes plugins. Only `runtime: 'node'` is dispatched; a refused
-      // plugin is printed by name and the boot goes on without it. No
-      // installations file, no read. See `../utils/installed-plugins-boot.ts`.
+      // plugin is printed by name, and the boot goes on without it unless it
+      // may provide the crypto provider: see the function. No installations
+      // file, no read. See `../utils/installed-plugins-boot.ts`.
       const installedPluginsBoot = await registerInstalledPlugins({ kernel, track: trackPlugin });
+      refuseRefusedInstalledCryptoProviderPlugins(installedPluginsBoot?.refused ?? []);
 
       // Register REST API and Dispatcher plugins (consume http.server + protocol services)
       //
@@ -6483,6 +6485,69 @@ export function refuseUnloadedCryptoProviderPlugins(unloaded: readonly UnloadedS
   );
 }
 
+/**
+ * Refuse a boot in which a plugin `os plugin install` installed was refused at
+ * boot and nothing rules out that it provides the crypto provider
+ * ({@link CRYPTO_PROVIDER_SERVICE}): the rule
+ * {@link refuseUnloadedCryptoProviderPlugins} keeps for the stack's `plugins`.
+ *
+ * A refusal is ruled out when the plugin's verified artifact declares a tier
+ * this host does not run in process (`runtime_undeclared`,
+ * `runtime_not_dispatched`), or when the plugin was imported and what it
+ * declares in `providesServices` (ADR-0116) could be read and does not name
+ * the provider. Every other refusal, the loader's own failure included, says
+ * nothing it provides, and is refused. A disabled plugin is not a refusal.
+ *
+ * The refusal names each plugin with its refusal code and the step that lets
+ * the next boot go on: `os plugin disable <id>` for most codes. A code that
+ * `os plugin disable` cannot clear names its own step instead: a record whose
+ * directory is not its install directory is checked before the disabled set,
+ * so it is installed again; an uninstall the boot could not finish is finished
+ * by a later boot; an unreadable disable-state file, or installations file,
+ * is repaired; a loader that failed outright is fixed.
+ */
+export function refuseRefusedInstalledCryptoProviderPlugins(refused: readonly InstalledPluginRefusal[]): void {
+  const stopping = refused.filter(({ error, declaredServices }) => {
+    if (error === 'runtime_undeclared' || error === 'runtime_not_dispatched') return false;
+    return declaredServices === undefined || declaredServices.includes(CRYPTO_PROVIDER_SERVICE);
+  });
+  if (stopping.length === 0) return;
+  const unnamed = ({ id }: InstalledPluginRefusal): boolean => id === '*' || id === '?';
+  const label = (r: InstalledPluginRefusal): string =>
+    unnamed(r) ? `the installed plugins could not be read (${r.error})` : `installed plugin ${r.id}@${r.version} was refused (${r.error})`;
+  /** The step for a code `os plugin disable` cannot clear; `null` when it can. */
+  const ownStep = ({ id, error }: InstalledPluginRefusal): string | null => {
+    switch (error) {
+      case 'install_dir_unexpected':
+        return `Install ${id} again (os plugin install): its record names a directory that is not its install directory.`;
+      case 'uninstall_failed':
+      case 'record_changed':
+        return `${id} is being uninstalled: fix what stopped it, and a later boot finishes the uninstall.`;
+      case 'disabled_state_unreadable':
+        return "Repair this environment's disable-state file: until it reads, no installed plugin can be disabled.";
+      case 'records_unreadable':
+        return "Repair this project's installations file.";
+      case 'loader_failed':
+        return 'Fix what failed the installed-plugin loader.';
+      default:
+        return null;
+    }
+  };
+  const disables = [...new Set(stopping.filter((r) => !unnamed(r) && ownStep(r) === null).map(({ id }) => `os plugin disable ${id}`))];
+  const steps = [
+    ...(disables.length > 0
+      ? [`Fix what refused ${disables.length === 1 ? 'it' : 'them'}, or boot without ${disables.length === 1 ? 'it' : 'them'}: ${disables.join(', ')}.`]
+      : []),
+    ...new Set(stopping.map(ownStep).filter((step): step is string => step !== null)),
+  ];
+  throw new HostCryptoProviderRefusal(
+    `Refusing to boot: ${stopping.map(label).join('; ')}, and nothing rules out that `
+    + `${stopping.length === 1 ? 'it provides' : 'one of them provides'} the crypto provider ('${CRYPTO_PROVIDER_SERVICE}'). `
+    + 'It seals every secret field, datasource credential and encrypted setting, so this boot does not choose another one. '
+    + steps.join(' '),
+  );
+}
+
 /**
  * Refuse a boot that would set aside a `plugins` entry which may provide the
  * crypto provider ({@link CRYPTO_PROVIDER_SERVICE}).
 
@@ -34,6 +34,15 @@ vi.mock('./format.js', () => ({ isExitSignal: () => false }));
 
 import { registerInstalledPlugins } from './installed-plugins-boot.js';
 
+// Paid at collection, not inside a clocked case: what the code under test
+// reaches through dynamic `import()`s (`check:test-source-alias`).
+import '@objectstack/service-datasource';
+import '@objectstack/driver-turso';
+import '@objectstack/driver-sql';
+import '@objectstack/platform-objects/plugin';
+import '@objectstack/plugin-security';
+import '@objectstack/rest';
+
 let dir: string;
 
 beforeEach(() => {
@@ -121,6 +130,29 @@ describe('the serve wiring of installed plugins', () => {
     expect(k.used).toEqual([]);
   });
 
+  it('a plugin refused here carries what the loader read it declares; one the loader could not read carries none', async () => {
+    const kms = { name: 'kms', init() {} };
+    const dup = { name: 'host-plugin', init() {} };
+    const unread = { name: 'unread', init() {} };
+    stub.load = async () => ({
+      loaded: [
+        { record: record('com.acme.kms'), plugin: kms, declaredServices: ['crypto-provider'] },
+        { record: record('com.acme.dup'), plugin: dup, declaredServices: [] },
+        { record: record('com.acme.unread'), plugin: unread },
+      ],
+      refused: [],
+      disabled: [],
+      removed: [],
+    });
+    const k = kernel({ taken: ['host-plugin'], use: async () => { throw new Error('no'); } });
+    const out = await boot(k);
+    expect(out?.refused).toEqual([
+      { id: 'com.acme.kms', version: '1.0.0', error: 'kernel_refused', message: 'no', declaredServices: ['crypto-provider'] },
+      expect.objectContaining({ id: 'com.acme.dup', error: 'plugin_name_taken', declaredServices: [] }),
+      { id: 'com.acme.unread', version: '1.0.0', error: 'kernel_refused', message: 'no' },
+    ]);
+  });
+
   it('reads nothing when this project has no installations file', async () => {
     rmSync(stub.installationsFile);
     stub.load = async () => { throw new Error('the loader ran'); };