@@ -0,0 +1,20 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/runtime': patch
+---
+
+fix(metadata-protocol,runtime)!: the in-process uninstall verb is refused while an active validation rule reads a field the package adds through `objectExtensions`
+
+Clause-②: yes (narrowing) — `protocol.deletePackage` now refuses, with `409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`, an uninstall it used to perform for an in-process caller: one whose package adds a field through `objectExtensions` that an active validation rule of another enabled package reads.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no stored row changes shape: what moves is the uninstall verb's answer to a request that would leave a validation rule reading a withdrawn field. Nothing at rest records that answer, so there is nothing for a migration to rewrite. -->
+
+**BREAKING** accept-set narrowing at the uninstall verb (`@objectstack/metadata-protocol`, `@objectstack/runtime`): `deletePackage` asks every registered pre-uninstall guard before it reads or moves anything, and the runtime registers the dependent-rule check the package doors ask as one.
+
+- **Before.** An in-process caller of `protocol.deletePackage` (a host's own uninstall tool, install-local's pair-install undo, the unmanaged-import rollback) withdrew the package's `objectExtensions` fields with no check. Another enabled package's active validation rule that read one of those fields then failed closed, so every write to that rule's object answered `400 VALIDATION_FAILED`, and with the package gone there was nothing left to re-enable.
+- **Now.** While such a rule exists, `deletePackage` throws before it reads or moves anything: an error with `code` `PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`, `status` `409`, and the package doors' sentence in its uninstall form under the lead `Package 'ID' cannot be uninstalled` (`… which the uninstall would withdraw — PACKAGE · OBJECT · RULE (reads FIELD). Switch off or change that rule first, or keep the package installed.`), naming every such rule with the fields it reads. `DELETE /api/v1/packages/:id` answers the same refusal through the same function, so the door and the verb cannot drift. The stored rows, the running registry, the environment's disable record and the uninstall cleanups are untouched. An uninstall no rule depends on, and an uninstall of a package that is already disabled, proceed exactly as before.
+- **The seam.** `ObjectStackProtocolImplementation#registerUninstallGuard(name, guard)` is the before-half of `registerUninstallCleanup`: a guard answers `undefined` to let the uninstall proceed, or `{ code, status, message }` to refuse it; guards are asked in registration order and the first refusal is thrown; a guard that throws refuses with its throw. The types `UninstallGuard` and `UninstallGuardRefusal` are exported from `@objectstack/metadata-protocol`. A protocol with no guard registered uninstalls exactly as before. `AppPlugin` registers the runtime's guard (`runtime.package-dependent-rules`) at start, beside the disable-record clear.
+- **Who moves.** An in-process caller that uninstalls a package whose field another package's active rule reads. The pair-install undo and the unmanaged-import rollback report the refusal as residue in their own failure answer, as they report any refused uninstall.
+
+**The remedy.** Switch off or change the rules the message names first (a packaged rule can be switched off through the tenant overlay), then uninstall.
@@ -135,7 +135,7 @@ export type {
     SeedTenancySplit,
     SeedTenancyCollision,
 } from './migrations/seed-tenancy-backfill.js';
-export type { UninstallCleanup, UninstallCleanupOutcome, UninstallDeclared } from './protocol.js';
+export type { UninstallCleanup, UninstallCleanupOutcome, UninstallDeclared, UninstallGuard, UninstallGuardRefusal } from './protocol.js';
 export { captureUninstallDeclared } from './protocol.js';
 // [#9960] The ONE declared shape of the `deletePackage` seam, exported so the
 // two consumers that speak it (`@objectstack/rest`'s direct-mount package
 
@@ -12,7 +12,8 @@
  * `onMetadataMutation`, `emitMetadataMutation`, `attachMetadataMutationPubSub`,
  * `detachMetadataMutationPubSub`, `applyRemoteMetadataMutation`,
  * `onMetaItemPublished`, `getOverlayRepo` moved out of `protocol.ts` whole by
- * `scripts/codemod-split-protocol.mjs`.
+ * `scripts/codemod-split-protocol.mjs`; `registerUninstallGuard` (#31232) was
+ * written here in the same shape, beside `registerUninstallCleanup`.
  *
  * A MOVE, not a redesign. `ProtocolClassHeadFacet` is a stateless facet over the host
  * (ruling 6624345766): each static method below is the body of the class
@@ -52,6 +53,7 @@ import type {
     UninstallCleanup,
     UninstallCleanupOutcome,
     UninstallDeclared,
+    UninstallGuard,
 } from './protocol-package-lifecycle-types.js';
 import { METADATA_MUTATION_CLUSTER_CHANNEL } from './protocol-mutation-events.js';
 import type {
@@ -104,6 +106,11 @@ export class ProtocolClassHeadFacet {
         host.uninstallCleanups.set(name, cleanup);
     }
 
+    /** The body of `ObjectStackProtocolImplementation#registerUninstallGuard`; the method's docblock there is its contract. */
+    static registerUninstallGuard(host: Pick<ProtocolHost, 'uninstallGuards'>, name: string, guard: UninstallGuard): void {
+        host.uninstallGuards.set(name, guard);
+    }
+
     /** The body of `ObjectStackProtocolImplementation#runUninstallCleanups`; the method's docblock there is its contract. */
     static async runUninstallCleanups(host: Pick<ProtocolHost, 'uninstallCleanups'>, request: Pick<DeletePackageRequest, 'packageId' | 'actor'> & { declared?: UninstallDeclared },): Promise<UninstallCleanupOutcome[]> {
         const cleanups: UninstallCleanupOutcome[] = [];
 
@@ -259,6 +259,7 @@ export interface ProtocolHost {
     readonly tenantAuthoredWriteRefusal: ObjectStackProtocolImplementation['tenantAuthoredWriteRefusal'];
     readonly throwMetadataServiceUnavailable: ObjectStackProtocolImplementation['throwMetadataServiceUnavailable'];
     readonly uninstallCleanups: ObjectStackProtocolImplementation['uninstallCleanups'];
+    readonly uninstallGuards: ObjectStackProtocolImplementation['uninstallGuards'];
     readonly uninstalledNamedBaseRefusal: ObjectStackProtocolImplementation['uninstalledNamedBaseRefusal'];
     readonly unknownDatasourceSaveRefusal: ObjectStackProtocolImplementation['unknownDatasourceSaveRefusal'];
     readonly unknownGrantObjectSaveRefusal: ObjectStackProtocolImplementation['unknownGrantObjectSaveRefusal'];
 
@@ -54,6 +54,37 @@ export type UninstallCleanup = (args: {
     declared?: UninstallDeclared;
 }) => Promise<{ success: boolean; removed: number; error?: string }>;
 
+/**
+ * [#31232] A guard's answer to "may this package be uninstalled now?": the
+ * refusal {@link ObjectStackProtocolImplementation.deletePackage} throws, as
+ * the guard spelled it — `code` (a ledgered error code), `status` (its HTTP
+ * status) and `message` (the sentence the caller is shown). `undefined` lets
+ * the uninstall proceed.
+ */
+export interface UninstallGuardRefusal {
+    code: string;
+    status: number;
+    message: string;
+}
+
+/**
+ * [#31232] Pre-uninstall guard: the BEFORE-half of {@link UninstallCleanup}.
+ * A plugin that owns a verdict this package must not know (the runtime's
+ * dependent-rule scan reads the schema registry's fold, which lives above this
+ * package and must not be imported here) registers it by name, and
+ * {@link ObjectStackProtocolImplementation.deletePackage} asks every guard,
+ * in registration order, before it reads or moves anything; the first refusal
+ * is thrown as the verb's refusal, with nothing removed.
+ *
+ * A guard only reads: it is asked before the uninstall is decided, so it must
+ * not write. A guard that throws instead of answering refuses the uninstall
+ * with its throw — an uninstall a guard could not judge does not proceed.
+ */
+export type UninstallGuard = (args: {
+    packageId: string;
+    actor?: string;
+}) => UninstallGuardRefusal | undefined | Promise<UninstallGuardRefusal | undefined>;
+
 /**
  * [ADR-0090 D5, ADR-0131 D4] The security-catalog names an uninstalled package
  * held. A grant names its set, and the package's sets are served from the
 
@@ -57,10 +57,11 @@ export interface PackageUninstallHost {
     readonly packagelessAddress: ObjectStackProtocolImplementation['packagelessAddress'];
     readonly runUninstallCleanups: ObjectStackProtocolImplementation['runUninstallCleanups'];
     readonly shouldDropStorage: ObjectStackProtocolImplementation['shouldDropStorage'];
+    readonly uninstallGuards: ObjectStackProtocolImplementation['uninstallGuards'];
 }
 
 /** The body of `ObjectStackProtocolImplementation#deletePackage`; the method's docblock there is its contract. */
-export async function deletePackage(this: Pick<PackageUninstallHost, 'deleteMetaItem' | 'engine' | 'environmentId' | 'findEnvironmentRows' | 'getServicesRegistry' | 'packagelessAddress' | 'runUninstallCleanups' | 'shouldDropStorage'>, request: DeletePackageRequest): Promise<DeletePackageResponse> {
+export async function deletePackage(this: Pick<PackageUninstallHost, 'deleteMetaItem' | 'engine' | 'environmentId' | 'findEnvironmentRows' | 'getServicesRegistry' | 'packagelessAddress' | 'runUninstallCleanups' | 'shouldDropStorage' | 'uninstallGuards'>, request: DeletePackageRequest): Promise<DeletePackageResponse> {
     // [ADR-0131 D6/D12] An uninstall is environment-wide by construction:
     // every `sys_metadata` row bound to the package, in this environment,
     // whatever organization a legacy row was stored under. The
@@ -83,6 +84,25 @@ export async function deletePackage(this: Pick<PackageUninstallHost, 'deleteMeta
             throw err;
         }
     }
+
+    // [#31232] THE PRE-UNINSTALL GUARDS, ASKED BEFORE ANYTHING IS READ OR
+    // MOVED. A plugin that owns a verdict this package must not know
+    // registers it as a guard (`registerUninstallGuard`); the runtime
+    // registers its dependent-rule scan, so an uninstall that would withdraw
+    // a field an active validation rule of another enabled package reads is
+    // refused here for EVERY caller of this verb (a host's own uninstall
+    // tool, install-local's pair-install undo, the unmanaged-import
+    // rollback), not only at the package door that asks it first. This
+    // package holds no copy of the rule.
+    //
+    // Each guard is asked in registration order and the first refusal is
+    // thrown, spelled as the guard answered it (`code`, `status`, `message`):
+    // nothing has been read or removed yet, so there is nothing to undo. A
+    // guard's own throw propagates as is — an uninstall a guard could not
+    // judge does not proceed. With no guard registered nothing is asked, and
+    // the verb behaves exactly as it did before guards existed.
+    await askUninstallGuards(this.uninstallGuards, request);
+
     const where: Record<string, unknown> = { package_id: request.packageId };
     // [#8136] This read is the uninstall's FIRST database touch, and until
     // now it sat outside every `try` in this method — the per-item `catch`
@@ -392,6 +412,26 @@ export async function deletePackage(this: Pick<PackageUninstallHost, 'deleteMeta
     };
 }
 
+/**
+ * [#31232] Ask every registered pre-uninstall guard, in registration order,
+ * and throw the first refusal one answers: an `Error` carrying the guard's
+ * `message`, with its `code` and `status`. Asked by {@link deletePackage}
+ * before it reads or moves anything; a guard's own throw propagates.
+ */
+async function askUninstallGuards(
+    guards: PackageUninstallHost['uninstallGuards'],
+    request: DeletePackageRequest,
+): Promise<void> {
+    for (const guard of guards.values()) {
+        const refusal = await guard({
+            packageId: request.packageId,
+            ...(request.actor ? { actor: request.actor } : {}),
+        });
+        if (!refusal) continue;
+        throw Object.assign(new Error(refusal.message), { code: refusal.code, status: refusal.status });
+    }
+}
+
 /**
  * [#31186] The event the uninstall verb hands the `audit` slot's
  * `recordPackageLifecycleEvent` — declared here, structurally, so this package
 
@@ -527,6 +527,7 @@ import type {
     UninstallCleanup,
     UninstallCleanupOutcome,
     UninstallDeclared,
+    UninstallGuard,
 } from './protocol-package-lifecycle-types.js';
 export { captureUninstallDeclared } from './protocol-package-lifecycle-types.js';
 export type {
@@ -537,6 +538,8 @@ export type {
     UninstallCleanup,
     UninstallCleanupOutcome,
     UninstallDeclared,
+    UninstallGuard,
+    UninstallGuardRefusal,
 } from './protocol-package-lifecycle-types.js';
 import { METADATA_MUTATION_CLUSTER_CHANNEL } from './protocol-mutation-events.js';
 import type {
@@ -761,6 +764,9 @@ export class ObjectStackProtocolImplementation implements
     /** [#2747] Named uninstall cleanups, run by {@link deletePackage}. */
     private uninstallCleanups = new Map<string, UninstallCleanup>();
 
+    /** [#31232] Named pre-uninstall guards, asked by {@link deletePackage} before it reads or moves anything. */
+    private uninstallGuards = new Map<string, UninstallGuard>();
+
     /**
      * Awaited per-type mutation projectors (ADR-0094), keyed by singular
      * metadata type. Unlike {@link publishMaterializers} (publish-only,
@@ -1379,6 +1385,7 @@ export class ObjectStackProtocolImplementation implements
             tenantAuthoredWriteRefusal: (...a) => protocol.tenantAuthoredWriteRefusal(...a),
             throwMetadataServiceUnavailable: (...a) => protocol.throwMetadataServiceUnavailable(...a),
             get uninstallCleanups() { return protocol.uninstallCleanups; },
+            get uninstallGuards() { return protocol.uninstallGuards; },
             uninstalledNamedBaseRefusal: (...a) => protocol.uninstalledNamedBaseRefusal(...a),
             unknownDatasourceSaveRefusal: (...a) => protocol.unknownDatasourceSaveRefusal(...a),
             unknownGrantObjectSaveRefusal: (...a) => protocol.unknownGrantObjectSaveRefusal(...a),
@@ -1413,6 +1420,27 @@ export class ObjectStackProtocolImplementation implements
         return ProtocolClassHeadFacet.registerUninstallCleanup(protocolHost(this), name, cleanup);
     }
 
+    /**
+     * [#31232] Register a named pre-uninstall guard: the before-half of
+     * {@link registerUninstallCleanup}. {@link deletePackage} asks every
+     * registered guard, in registration order, before it reads or moves
+     * anything, and throws the first refusal one answers as its own, with
+     * `code` and `status` as the guard spelled them; nothing is removed. A
+     * guard that throws refuses with its throw. With no guard registered the
+     * verb behaves exactly as it did before guards existed.
+     *
+     * Called by a plugin that owns a verdict this package must not know — the
+     * runtime registers its dependent-rule scan (an active validation rule of
+     * another enabled package reading a field the package adds through
+     * `objectExtensions`), the one the package doors ask, so every caller of
+     * the verb is refused on the verdict those doors answer, and this package
+     * holds no copy of it. One guard per name; a second registration replaces
+     * the first (idempotent re-init).
+     */
+    registerUninstallGuard(name: string, guard: UninstallGuard): void {
+        return ProtocolClassHeadFacet.registerUninstallGuard(protocolHost(this), name, guard);
+    }
+
     /**
      * Run every registered uninstall cleanup for one package and report each
      * outcome (ADR-0086 D3, #2747) — THE one runner of the registry above.
@@ -10915,7 +10943,10 @@ export class ObjectStackProtocolImplementation implements
      *
      * [#21276] The steps, in order. Nothing durable happens before step 4, so
      * a refusal at any of steps 1–4 leaves everything as it was:
-     *  1. the retired-key refusal (`INVALID_REQUEST`) — pure;
+     *  1. the retired-key refusal (`INVALID_REQUEST`) — pure; then [#31232]
+     *     every registered pre-uninstall guard ({@link registerUninstallGuard}),
+     *     in registration order — the first refusal is thrown with its own
+     *     `code` and `status`, a guard's throw as is;
      *  2. the `sys_metadata` read — a read; a failure is thrown;
      *  3. the registry's uninstall refusal (another package extends an object
      *     this one owns, ADR-0029), asked through
@@ -10938,6 +10969,7 @@ export class ObjectStackProtocolImplementation implements
         const readEngine = () => this.engine;
         const readGetServicesRegistry = () => this.getServicesRegistry;
         const readEnvironmentId = () => this.environmentId;
+        const readUninstallGuards = () => this.uninstallGuards;
         const host: ThisParameterType<typeof deletePackage> = {
             deleteMetaItem: (...a) => this.deleteMetaItem(...a),
             get engine() { return readEngine(); },
@@ -10947,6 +10979,7 @@ export class ObjectStackProtocolImplementation implements
             packagelessAddress: (...a) => this.packagelessAddress(...a),
             runUninstallCleanups: (...a) => this.runUninstallCleanups(...a),
             shouldDropStorage: (...a) => this.shouldDropStorage(...a),
+            get uninstallGuards() { return readUninstallGuards(); },
         };
         return deletePackage.call(host, request);
     }