fix(rest): make requiresService nav gate fire in single-kernel deployments (ADR-0057 D10)

resolveExecCtx leaves kernel undefined on the single-kernel fallback path (no kernelManager), so ctx.__kernel was undefined → resolveRegisteredServices returned null → the gate failed OPEN (Organizations still shown in single-tenant). This is the primary OSS deployment mode (and the verify harness). Add a single-env serviceExistsProvider wired from the plugin's ctx.getService; resolveRegisteredServices now probes the per-request kernel (multi-env) OR that provider (single-env).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/rest/src/rest-api-plugin.ts

@@ -185,8 +185,13 @@ export function createRestApiPlugin(config: RestApiPluginConfig = {}): Plugin {
 
             ctx.logger.info('Hydrating REST API from Protocol...');
 
+            // Single-env service-existence probe for nav capability gates
+            // (ADR-0057 D10). Multi-env uses the per-request kernel instead.
+            const serviceExistsProvider = (name: string): boolean => {
+                try { return ctx.getService<any>(name) != null; } catch { return false; }
+            };
             try {
-                const restServer = new RestServer(server, protocol, config.api as any, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider);
+                const restServer = new RestServer(server, protocol, config.api as any, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, serviceExistsProvider);
                 restServer.registerRoutes();
 
                 ctx.logger.info('REST API successfully registered');

packages/rest/src/rest-server.ts

@@ -542,6 +542,10 @@ export class RestServer {
     private i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>;
     private analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>;
     private settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>;
+    /** Sync probe: is a kernel service registered? Single-env path for nav
+     *  capability gates (ADR-0057 D10) — resolveExecCtx sets no kernel in
+     *  single-kernel deployments, so this prevents the gate failing open. */
+    private serviceExistsProvider?: (name: string) => boolean;
 
     constructor(
         server: IHttpServer,
@@ -560,6 +564,7 @@ export class RestServer {
         i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>,
         analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>,
         settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>,
+        serviceExistsProvider?: (name: string) => boolean,
     ) {
         this.protocol = protocol;
         this.config = this.normalizeConfig(config);
@@ -577,6 +582,7 @@ export class RestServer {
         this.i18nServiceProvider = i18nServiceProvider;
         this.analyticsServiceProvider = analyticsServiceProvider;
         this.settingsServiceProvider = settingsServiceProvider;
+        this.serviceExistsProvider = serviceExistsProvider;
     }
 
     /**
@@ -1151,7 +1157,18 @@ export class RestServer {
      * behaviour). ADR-0057 addendum D10.
      */
     private async resolveRegisteredServices(kernel: any, items: any[]): Promise<Set<string> | null> {
-        if (!kernel || typeof kernel.getServiceAsync !== 'function') return null;
+        // Prefer the per-request kernel (multi-env, resolved via kernelManager).
+        // Fall back to the single-env service-existence provider — in single-kernel
+        // deployments resolveExecCtx never sets a kernel, so without this the gate
+        // would fail open (ADR-0057 D10).
+        let probe: ((name: string) => Promise<boolean>) | null = null;
+        if (kernel && typeof kernel.getServiceAsync === 'function') {
+            probe = async (name) => { try { return (await kernel.getServiceAsync(name)) != null; } catch { return false; } };
+        } else if (this.serviceExistsProvider) {
+            const exists = this.serviceExistsProvider;
+            probe = async (name) => { try { return exists(name) === true; } catch { return false; } };
+        }
+        if (!probe) return null;
         const wanted = new Set<string>();
         const walk = (e: any): void => {
             if (!e || typeof e !== 'object') return;
@@ -1163,10 +1180,7 @@ export class RestServer {
         for (const it of items) walk(it);
         if (wanted.size === 0) return new Set();
         const registered = new Set<string>();
-        for (const name of wanted) {
-            try { if ((await kernel.getServiceAsync(name)) != null) registered.add(name); }
-            catch { /* service not registered -> leave out */ }
-        }
+        for (const name of wanted) { if (await probe(name)) registered.add(name); }
         return registered;
     }