@@ -1,10 +1,14 @@
 ---
-'@objectstack/rest': patch
+'@objectstack/rest': minor
 ---
 
-fix(rest): a public form's lookup picker searches and sorts by the first display field the caller may query, so a picker whose first display field is masked for its caller serves its rows instead of answering 403 (#21062)
+fix(rest)!: a public form's lookup picker searches and sorts by the first display field the caller may query, so a picker whose first display field is masked for its caller serves its rows instead of answering 403 (#21062)
 
-Clause-②: no
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a change of which display field the public lookup picker (`GET /forms/:slug/lookup/:field`) searches and sorts by: the first display field the caller may query, by the security service's answer, where it used to be the first display field. No authorable key, spelling, export or stored shape moves: `@objectstack/rest` exports nothing new and nothing less, `FormFieldPublicPickerSchema` keeps parsing every value it parsed, and no stored row is read or rewritten. A picker's `displayFields` keep their meaning as the projected fields. The other categories are closed on facts: the package publishes (not `unpublished`); no ADR-0087 id covers which field a picker keys on (not `already-registered`); and the change is route behaviour, not a declaration (not `runtime-interface-only` / `type-surface-only`). -->
+
+**BREAKING**: this widens what the public lookup picker serves and narrows it in one composition. The narrowing: with a security service that lacks `ISecurityService.getQueryableFields`, or that answers no answer for the object, the picker passes over every display field whose declaration carries a `maskingRule`, for every caller, including a caller the rule is lifted for. So its search and order move to the next display field that declares no rule, and a picker whose display fields all declare a rule is refused `403 PERMISSION_DENIED` without the engine being asked, where it used to be served. The security service this repository ships implements the method, so a deployment using it is not narrowed. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
 
 **What changed.** The public lookup picker (`GET /forms/:slug/lookup/:field`)
 matches the visitor's search and orders its rows by one key. That key used to
@@ -23,14 +27,18 @@ row, masked, as before.
 running a query.
 
 **Unchanged.** A picker with no masked display field, and a caller the masking
-rule is lifted for, keep the first display field as the key. A deployment with
-no security service keeps the first display field. A security service that
-cannot say which fields are queryable (it predates the method, or has no answer
-for the object) gets the fallback its contract prescribes: every display field
-whose declaration carries a `maskingRule` is passed over, whoever the caller is.
+rule is lifted for, keep the first display field as the key, with the security
+service this repository ships. A deployment with no security service keeps the
+first display field.
 
 **What to do.** Nothing. To choose the field a picker searches when its first
 display field is masked for some of its callers, list a field those callers may
 query among `displayFields`: the first such entry is the one searched and
 sorted on. A picker whose only display fields are masked for its callers is
 refused, so give it one they may query.
+
+**What to do after upgrading, if your security service predates `getQueryableFields`.**
+Implement `getQueryableFields` on it: it answers which fields a caller may filter,
+sort, group or aggregate by, and the picker then keys on the first display field
+in that answer. Until it does, give each picker at least one display field that
+declares no `maskingRule`, or the picker is refused for every caller.
@@ -394,3 +394,29 @@ describe('[#21062] a security service that cannot give the query answer passes o
         });
     }
 });
+
+/**
+ * The narrowing the changeset declares (`Clause-②: yes (narrowing)`). With a
+ * security service that cannot give the query answer, the fallback passes over
+ * every display field declaring a masking rule WHOEVER the caller is, so for a
+ * caller the rule is lifted for, a picker whose display fields all declare one
+ * goes from served to refused. Its control is the same caller and picker with
+ * the service that answers: served.
+ */
+describe('[#21062] the declared narrowing: a security service without the query answer refuses a picker whose display fields all declare a masking rule', () => {
+    let h: Harness;
+    beforeAll(async () => { h = await boot([MEMBER_SET, GUEST_UNMASK_SET]); }, 60_000);
+    afterAll(async () => { try { await h?.engine.destroy(); } catch { /* noop */ } });
+
+    it('a caller the rule is lifted for is refused 403 PERMISSION_DENIED, and the engine is never asked', async () => {
+        const served = await h.lookup('c_only');
+        expect(served.status, `control, the service that answers: ${JSON.stringify(served.body)}`).toBe(200);
+
+        for (const older of [withoutQueryAnswer(h.security), { ...h.security, getQueryableFields: async () => undefined }]) {
+            const before = h.finds().length;
+            const refused = await h.lookup('c_only', undefined, older);
+            expect({ status: refused.status, code: refused.body?.code }).toEqual({ status: 403, code: 'PERMISSION_DENIED' });
+            expect(h.finds().length - before, 'the engine was asked').toBe(0);
+        }
+    });
+});