@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 //
 // [#21062] A public lookup picker whose FIRST display field declares a masking
-// rule serves its rows, on a real boot, to a caller the rule applies to.
+// rule served its rows, on a real boot, to a caller the rule applies to.
 //
 // The picker searches and sorts by one key. It is the first display field the
 // caller may query on, by the security service's published answer
@@ -10,13 +10,21 @@
 // searched or sorted on, so a picker keyed on it answered `403` to every such
 // caller.
 //
-// What is asserted, by class, for a visitor with no session on a deployment
-// that registers no profile for public forms: the scene is real (a system read
-// carries the stored values); the rows are sorted on the next queryable display
-// field, and the search matches it; the masked field is still served, masked;
-// a signed-in caller reaching the same door is served the same (the door builds
-// its own context); and a picker whose only display field is masked answers
-// the engine's refusal, `403 PERMISSION_DENIED`.
+// [#21079] On a deployment that registers no profile for public forms, the
+// picker's context resolves NO permission set, and an empty set list is the
+// ADR-0056 D2 deny baseline: the engine refuses that caller at object
+// admission, before any field guard. So on this fixture every picker answers
+// `403 PERMISSION_DENIED` and serves nothing — the key it composes is unchanged
+// (the unit pin `public-form-lookup-picker-queryable-key.test.ts` holds that),
+// but no row leaves the door. The picker is retired on its own card; until
+// then this is what it answers here.
+//
+// What is asserted, by class, for a visitor with no session on that
+// deployment: the scene is real (a system read carries the stored values); the
+// listing and the search are both refused at object admission, with no stored
+// value in the answer; a signed-in caller reaching the same door is refused the
+// same (the door builds its own context); and a picker whose only display field
+// is masked is refused with the same code and status.
 //
 // `bootStack` with the real `SecurityPlugin`, `ObjectQL`, SQL driver, REST and
 // auth layers. `@objectstack/rest` resolves to its BUILT output here (no source
@@ -38,7 +46,6 @@ const SEED = [
   { name: 'Alpha Synthetic', [KEY]: 'SYNTH3CCC' },
   { name: 'Charlie Synthetic', [KEY]: 'SYNTH2BBB' },
 ];
-const BY_NAME = ['Alpha Synthetic', 'Bravo Synthetic', 'Charlie Synthetic'];
 
 const PqkeyContact = ObjectSchema.create({
   name: CONTACT,
@@ -103,19 +110,19 @@ const pqkeyStack = defineStack({
 type Stack = Parameters<typeof bootStack>[0];
 type Row = Record<string, unknown>;
 
-function expectServedMasked(rows: Row[]): void {
-  const stored = new Map(SEED.map((r) => [r.name, r[KEY]]));
-  for (const row of rows) {
-    const value = row[KEY];
-    expect(typeof value, 'the masked field is served, as a string').toBe('string');
-    expect(value).not.toBe(stored.get(String(row.name)));
-    expect(String(value)).toContain('*');
-  }
+/** [#21079] The deny baseline's answer at the door: refused at object admission, nothing served. */
+async function expectRefusedAtAdmission(res: Response, what: string): Promise<void> {
+  const text = await res.clone().text();
+  expect(res.status, `${what}: ${text}`).toBe(403);
+  const refusal = (await res.json()) as { code?: unknown; error?: { code?: unknown }; data?: unknown };
+  expect(refusal.code ?? refusal.error?.code, what).toBe('PERMISSION_DENIED');
+  expect(refusal.data, `${what}: no row is served`).toBeUndefined();
+  for (const row of SEED) expect(text, `${what}: no stored value leaves the door`).not.toContain(String(row[KEY]));
 }
 
-describe('[#21062] a public picker whose first display field is masked serves rows sorted on the next queryable one', () => {
+describe('[#21062] a public picker whose first display field is masked: [#21079] refused at object admission on a deployment without the public-form profile', () => {
   it(
-    'to a visitor with no session and to a signed-in caller; a picker with no queryable display field is refused',
+    'to a visitor with no session and to a signed-in caller; a picker with no queryable display field is refused the same',
     async () => {
       const stack = await bootStack(pqkeyStack as unknown as Stack);
       try {
@@ -130,24 +137,14 @@ describe('[#21062] a public picker whose first display field is masked serves ro
           ['a visitor with no session', (path: string) => stack.api(path)],
           ['a signed-in caller', (path: string) => stack.apiAs(token, 'GET', path)],
         ] as const) {
-          const listed = await call('/forms/pqkey-intake/lookup/contact');
-          expect(listed.status, who).toBe(200);
-          const rows = ((await listed.json()) as { data: Row[] }).data;
-          expect(rows.map((r) => r.name), `${who}: sorted on the next queryable display field`).toEqual(BY_NAME);
-          expectServedMasked(rows);
-
-          const searched = await call('/forms/pqkey-intake/lookup/contact?q=Charlie');
-          expect(searched.status, who).toBe(200);
-          const hits = ((await searched.json()) as { data: Row[] }).data;
-          expect(hits.map((r) => r.name), `${who}: the search matches the next queryable display field`)
-            .toEqual(['Charlie Synthetic']);
-          expectServedMasked(hits);
+          await expectRefusedAtAdmission(await call('/forms/pqkey-intake/lookup/contact'), `${who}: the listing`);
+          await expectRefusedAtAdmission(await call('/forms/pqkey-intake/lookup/contact?q=Charlie'), `${who}: the search`);
         }
 
-        const refused = await stack.api('/forms/pqkey-intake/lookup/contact_masked_only');
-        expect(refused.status).toBe(403);
-        const refusal = (await refused.json()) as { code?: unknown; error?: { code?: unknown } };
-        expect(refusal.code ?? refusal.error?.code).toBe('PERMISSION_DENIED');
+        await expectRefusedAtAdmission(
+          await stack.api('/forms/pqkey-intake/lookup/contact_masked_only'),
+          'a picker with no queryable display field',
+        );
       } finally {
         await stack.stop();
       }
 
@@ -17,11 +17,14 @@
  * What is pinned, by caller class (the picker's own context — the route builds
  * it, the session is not read):
  *
- * - masked classes — the deployment registers no `guest_portal` set (the
- *   context resolves no set), or registers one that does not hold the
- *   capability the rule names: rows are sorted, and searched, on the next
- *   queryable display field; the masked field is still served, masked; and no
- *   request the engine receives names the masked field;
+ * - masked class — the deployment registers a `guest_portal` set that does not
+ *   hold the capability the rule names: rows are sorted, and searched, on the
+ *   next queryable display field; the masked field is still served, masked;
+ *   and no request the engine receives names the masked field;
+ * - [#21079] the deployment registers no `guest_portal` set, so the context
+ *   resolves no set: the ADR-0056 D2 deny baseline refuses every picker at
+ *   object admission (`403 PERMISSION_DENIED`), while the key it composes is
+ *   unchanged and still never names the masked field;
  * - a picker with no queryable display field answers the engine's own refusal
  *   for those fields, and the engine is never asked;
  * - controls — a picker with no masked display field, and a caller the rule is
@@ -286,8 +289,78 @@ describe('[#21062] the fixture is authorable', () => {
     });
 });
 
+/**
+ * [#21079] The deployment registers no guest set, so the picker's context
+ * resolves NO permission set — and an empty set list is the ADR-0056 D2 deny
+ * baseline: the engine refuses that caller at object admission, before any
+ * field guard, whatever the query names. The field answers are unchanged (the
+ * masked field is readable and not queryable, and the key the picker composes
+ * is still the next queryable display field), but nothing is served: every
+ * picker on this deployment answers `403 PERMISSION_DENIED`. The picker itself
+ * is retired on its own card; until then this is what it answers here.
+ */
+describe('[#21062] a picker whose first display field is masked for its caller — the deployment registers no guest set (the context resolves none): [#21079] refused at object admission', () => {
+    let h: Harness;
+    beforeAll(async () => { h = await boot([MEMBER_SET]); }, 60_000);
+    afterAll(async () => { try { await h?.engine.destroy(); } catch { /* noop */ } });
+
+    /** The deny baseline's answer at the door: refused at object admission, nothing served. */
+    function expectRefusedAtAdmission(res: { status: number; body: any }): void {
+        expect({ status: res.status, code: res.body?.code }, JSON.stringify(res.body)).toEqual({ status: 403, code: 'PERMISSION_DENIED' });
+        expect(res.body?.data, 'no row is served').toBeUndefined();
+        for (const stored of Object.values(STORED_BY_ID)) expect(JSON.stringify(res.body)).not.toContain(stored);
+    }
+
+    it('the premise: the security service answers the masked field readable and not queryable', async () => {
+        const context = { permissions: ['guest_portal'], anonymous: true };
+        expect(await h.security.getReadableFields(CONTACT, context)).toContain(MASKED);
+        expect(await h.security.getQueryableFields(CONTACT, context)).not.toContain(MASKED);
+        expect(await engineRefusal(h.engine, [MASKED])).toMatchObject({ status: 403, code: 'PERMISSION_DENIED' });
+    });
+
+    it('[#21079] the picker whose first display field is masked is refused at object admission', async () => {
+        expectRefusedAtAdmission(await h.lookup('c_first'));
+    });
+
+    it('[#21079] its search is refused at object admission too', async () => {
+        expectRefusedAtAdmission(await h.lookup('c_first', 'Brav'));
+    });
+
+    it('never uses the masked field as a key', async () => {
+        const before = h.finds().length;
+        await h.lookup('c_first');
+        await h.lookup('c_first', 'Brav');
+        const asked = h.finds().slice(before);
+        expect(asked).toHaveLength(2);
+        for (const query of asked) {
+            expect(queriedFields(query)).not.toContain(MASKED);
+            expect(query.orderBy).toEqual([{ field: 'name', order: 'asc' }]);
+        }
+    });
+
+    it('[#21079] a picker with no queryable display field answers 403 PERMISSION_DENIED, as the engine does, and the engine is never asked', async () => {
+        const reference = await engineRefusal(h.engine, PICKERS.c_only.displayFields);
+        expect(reference).toMatchObject({ status: 403, code: 'PERMISSION_DENIED' });
+        const before = h.finds().length;
+        for (const q of [undefined, 'A']) {
+            const res = await h.lookup('c_only', q);
+            expectRefusedAtAdmission(res);
+            expect({ status: res.status, code: res.body?.code }).toEqual({ status: reference!.status, code: reference!.code });
+        }
+        expect(h.finds().length - before, 'the engine was asked').toBe(0);
+    });
+
+    it('[#21079] control: a picker with no masked display field still keys on its first display field, and is refused at object admission too', async () => {
+        const before = h.finds().length;
+        expectRefusedAtAdmission(await h.lookup('c_control'));
+        expectRefusedAtAdmission(await h.lookup('c_control', 'Charl'));
+        const asked = h.finds().slice(before);
+        expect(asked).toHaveLength(2);
+        for (const query of asked) expect(query.orderBy).toEqual([{ field: 'name', order: 'asc' }]);
+    });
+});
+
 for (const [label, sets] of [
-    ['the deployment registers no guest set (the context resolves none)', [MEMBER_SET]],
     ['the guest set does not hold the capability the rule names', [MEMBER_SET, GUEST_SET]],
 ] as const) {
     describe(`[#21062] a picker whose first display field is masked for its caller — ${label}`, () => {