@@ -0,0 +1,12 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): `DELETE /api/v1/packages/:id` credits its deletes to the signed-in user, and the uninstall verb clears the package's disable record for every caller
+
+Clause-②: no
+Metadata-protocol: none
+
+The package `DELETE` door now hands `deletePackage` the request's authenticated user, as the other package write doors already do (ADR-0146 D1), so each metadata row the uninstall removes is credited to that user: the audit log row's user and the history tombstone's `recorded_by`. A caller with no user id (a system context) still sends no actor, and its deletes stay unattributed.
+
+A deleted package's per-environment disable record is now cleared by the uninstall verb itself, through a runtime uninstall cleanup (`runtime.package-state`) that `AppPlugin` registers on the protocol. Before, only the HTTP door cleared it, so an in-process `deletePackage` (a host's uninstall tool, install-local's `DELETE` and pair-install undo, the unmanaged-import rollback) left the id listed and the next boot brought a reinstalled package back disabled. The clear writes the key the boot reads, in the host's package-state store when one is registered and the file under `OS_HOME` otherwise; a store that refuses shows as that cleanup's failed outcome in the uninstall's `cleanups`. On a kernel that registers no such cleanup, the door still clears the record itself.
@@ -162,6 +162,7 @@ describe('[#23214] a real createHonoApp host refuses a repeated single-valued na
         const { send, protocol } = await boot();
         const answer = await send('DELETE', `/packages/${PKG}?keepData=true`);
         expect(answer.status).toBe(200);
-        expect(protocol.deletePackage.mock.calls.map((c) => c[0])).toEqual([{ packageId: PKG, keepData: true }]);
+        // [#31023] The door also credits the delete to the signed-in author (ADR-0146 D1).
+        expect(protocol.deletePackage.mock.calls.map((c) => c[0])).toEqual([{ packageId: PKG, keepData: true, actor: AUTHOR.userId }]);
     });
 });
@@ -31,7 +31,7 @@ import { describeSeedLocale, resolveSeedLocaleForLoad } from './seed-locale.js';
 import { declareSeedSource, recordOrganizationReplay, type SeedLandingReport } from './seed-settlement.js';
 import { loadDisabledPackageIds } from './package-state-store.js';
 import { readServedWithheldFieldReaders, servedWithheldFieldReadersMessage } from './domains/packages.js';
-import { asPackageStateStore, PACKAGE_STATE_STORE_PLUGIN_NAME } from './package-state-host-store.js';
+import { asPackageStateStore, ensurePackageStateUninstallCleanup, PACKAGE_STATE_STORE_PLUGIN_NAME } from './package-state-host-store.js';
 import type { IFieldFileService, IMetadataService, IObjectQLEngine, II18nService } from '@objectstack/spec/contracts';
 import { FIELD_FILE_SERVICE } from '@objectstack/spec/contracts';
 import { normalizeFlowFunctionEntry, type NormalizedFlowFunction } from '@objectstack/spec/automation';
@@ -1396,6 +1396,11 @@ export class AppPlugin implements Plugin {
 
     start = async (ctx: PluginContext) => {
         this.refuseLatePackageStateStore(ctx);
+        // [#31023] The uninstall verb clears a deleted package's disable record
+        // under the key this plugin's boot seed reads. Before the empty-env
+        // return: an empty env is where every package arrives by hydration or
+        // install, and is deleted the same way.
+        ensurePackageStateUninstallCleanup(ctx, this.projectContext?.environmentId);
         if (this.empty) {
             ctx.logger.debug('[AppPlugin] empty env — no app payload, skipping start', {
                 pluginName: this.name,
 
@@ -48,6 +48,9 @@ import { describe, it, expect, vi, beforeAll, afterAll, beforeEach, afterEach }
 import { SchemaRegistry } from '@objectstack/objectql';
 import { HttpDispatcher } from '../http-dispatcher.js';
 import { bindCatalogFromTables } from '../security/security-catalog.testkit.js';
+// Paid during collection, not inside a case's clock: the package-state store's
+// `standalone-stack.ts` loads it lazily.
+import '@objectstack/metadata';
 
 const PKG = 'com.acme.crm';
 const ALPHA = 'org_alpha';
@@ -339,7 +342,8 @@ describe('[#20515] what the rule leaves unchanged', () => {
     it('the operator\'s uninstall proceeds naming no organization, and its disable lands — the positive control that makes `switchedOff` false above mean something', async () => {
         const r = rig();
         expect((await r.call('DELETE', 'admin', `/packages/${PKG}`)).status).toBe(200);
-        expect(r.deleteRequests).toEqual([{ packageId: PKG }]);
+        // [#31023] The signed-in operator is the actor; still no organization.
+        expect(r.deleteRequests).toEqual([{ packageId: PKG, actor: 'u_admin' }]);
         const d = rig();
         expect((await d.call('PATCH', 'admin', `/packages/${PKG}/disable`)).status).toBe(200);
         expect(switchedOff(d)).toBe(true);
 
@@ -67,6 +67,9 @@ import { SchemaRegistry } from '@objectstack/objectql';
 import { HttpDispatcher } from '../http-dispatcher.js';
 import { bindCatalogFromTables } from '../security/security-catalog.testkit.js';
 import { loadDisabledPackageIds, setPackageDisabled } from '../package-state-store.js';
+// Paid during collection, not inside a case's clock: the package-state store's
+// `standalone-stack.ts` loads it lazily.
+import '@objectstack/metadata';
 
 const PKG = 'com.acme.crm';
 /** `PKG`'s paired customization package (ADR-0146 D3): the id `customizationPackageId` derives. */
@@ -311,7 +314,8 @@ describe('[ADR-0131 D6] DELETE /packages/:id names no organization, whoever the
             const answer = await r.call('DELETE', who, `/packages/${PKG}`);
             expect(answer.status).toBe(200);
             expect(answer.body?.data).toMatchObject({ packageId: PKG, success: true, registryRemoved: true });
-            expect(r.deleteRequests).toEqual([{ packageId: PKG }]);
+            // [#31023] The signed-in operator is the actor; still no organization.
+            expect(r.deleteRequests).toEqual([{ packageId: PKG, actor: 'u_admin' }]);
             expect(await observed(r)).toEqual({
                 detailStatus: 404,
                 listed: false,
 
@@ -27,6 +27,10 @@
 import { describe, it, expect, vi } from 'vitest';
 import { SchemaRegistry } from '@objectstack/objectql';
 import { HttpDispatcher } from '../http-dispatcher.js';
+import { PACKAGE_STATE_UNINSTALL_CLEANUP } from '../package-state-host-store.js';
+// Paid during collection, not inside a case's clock: the package-state store's
+// `standalone-stack.ts` loads it lazily.
+import '@objectstack/metadata';
 
 const PKG = 'com.acme.app';
 const SESSION_USER = 'u_author';
@@ -52,6 +56,12 @@ function boot(caller: Record<string, unknown>) {
         rollbackToPackageCommit: vi.fn(async (_r: any) => ({ success: true, revertedCommits: [], failed: [] })),
         reassignOrphanedMetadata: vi.fn(async (r: any) => ({ success: true, reassignedCount: 0, reassigned: [], targetPackageId: r.targetPackageId })),
         duplicatePackage: vi.fn(async (r: any) => ({ success: true, copiedCount: 0, failedCount: 0, targetPackageId: r.targetPackageId, copied: [], failed: [] })),
+        // [#31023] Its outcome names the runtime's disable-record cleanup, so the
+        // door leaves the record to the verb and writes no state file here.
+        deletePackage: vi.fn(async (_r: any) => ({
+            success: true, deletedCount: 1, failedCount: 0, deleted: [], failed: [],
+            cleanups: [{ name: PACKAGE_STATE_UNINSTALL_CLEANUP, success: true, removed: 0 }],
+        })),
     };
     const services: Record<string, unknown> = { objectql: { registry }, protocol };
     const get = (n: string) => services[n] ?? null;
@@ -149,3 +159,32 @@ describe('[#28414] the publish-drafts visibility flip re-saves each app as the s
         expect(await flip({ ...SYSTEM }, { actor: SPOOFED })).not.toHaveProperty('actor');
     });
 });
+
+/**
+ * [#31023, ADR-0146 D1] `DELETE /packages/:id` hands the uninstall verb the
+ * session user, as its sibling doors do, so each metadata delete the verb
+ * performs is credited to that user. It sent no actor at all. Its query takes
+ * `keepData` alone, so no request-supplied name can reach the actor.
+ */
+describe('[#31023] DELETE /packages/:id hands the uninstall verb the session user', () => {
+    async function del(caller: Record<string, unknown>, query: Record<string, string> = {}) {
+        const { dispatcher, protocol } = boot(caller);
+        const res = await dispatcher.dispatch('DELETE', `/packages/${PKG}`, undefined, query, { request: { headers: {} } } as any);
+        const status = res.response?.status ?? (res.handled ? 200 : 0);
+        expect(status, `expected 200, got ${JSON.stringify(res.response)}`).toBe(200);
+        expect(protocol.deletePackage).toHaveBeenCalledTimes(1);
+        return protocol.deletePackage.mock.calls[0][0] as Record<string, unknown>;
+    }
+
+    it('a signed-in caller\'s delete names the caller', async () => {
+        expect(await del(AUTHOR)).toEqual({ packageId: PKG, actor: SESSION_USER });
+    });
+
+    it('beside keepData, the caller is still named', async () => {
+        expect(await del(AUTHOR, { keepData: 'true' })).toEqual({ packageId: PKG, keepData: true, actor: SESSION_USER });
+    });
+
+    it('CONTROL: a system context names no one — no actor is invented', async () => {
+        expect(await del(SYSTEM)).toEqual({ packageId: PKG });
+    });
+});
@@ -29,6 +29,9 @@ import { join } from 'node:path';
 import { SchemaRegistry } from '@objectstack/objectql';
 import { unknownQueryParamRefusalMessage } from '@objectstack/rest';
 import { HttpDispatcher } from '../http-dispatcher.js';
+// Paid during collection, not inside a case's clock: the package-state store's
+// `standalone-stack.ts` loads it lazily.
+import '@objectstack/metadata';
 
 const PKG = 'com.acme.app';
 
@@ -168,8 +171,9 @@ describe('[#26857] DELETE /packages/:id — a misspelled keep-data flag is refus
     });
 
     it.each([
-        ['true', { packageId: PKG, keepData: true }],
-        ['1', { packageId: PKG, keepData: true }],
+        // [#31023] The signed-in caller rides as the actor (ADR-0146 D1).
+        ['true', { packageId: PKG, keepData: true, actor: AUTHOR.userId }],
+        ['1', { packageId: PKG, keepData: true, actor: AUTHOR.userId }],
     ])('preserves the declared `keepData=%s`: deletePackage receives %j', async (keepData, received) => {
         const { dispatcher, acts } = boot();
         const answer = await call(dispatcher, 'DELETE', `/packages/${PKG}`, undefined, { keepData });
 
@@ -28,6 +28,9 @@ import { describe, it, expect, vi } from 'vitest';
 import { SchemaRegistry } from '@objectstack/objectql';
 import { repeatedQueryParamMessage } from '@objectstack/rest';
 import { HttpDispatcher } from '../http-dispatcher.js';
+// Paid during collection, not inside a case's clock: the package-state store's
+// `standalone-stack.ts` loads it lazily.
+import '@objectstack/metadata';
 
 const PKG = 'com.acme.app';
 
@@ -82,10 +85,11 @@ describe('[#23214] DELETE /packages/:id — `keepData` is one flag', () => {
     });
 
     it.each([
-        ['true', { packageId: PKG, keepData: true }],
-        ['1', { packageId: PKG, keepData: true }],
-        [['true'], { packageId: PKG, keepData: true }],
-        [undefined, { packageId: PKG }],
+        // [#31023] The signed-in caller rides as the actor (ADR-0146 D1).
+        ['true', { packageId: PKG, keepData: true, actor: AUTHOR.userId }],
+        ['1', { packageId: PKG, keepData: true, actor: AUTHOR.userId }],
+        [['true'], { packageId: PKG, keepData: true, actor: AUTHOR.userId }],
+        [undefined, { packageId: PKG, actor: AUTHOR.userId }],
     ])('preserves one `keepData` (%j): deletePackage receives %j', async (keepData, received) => {
         const { dispatcher, protocol } = boot();
         const answer = await call(dispatcher, 'DELETE', `/packages/${PKG}`, undefined, keepData === undefined ? {} : { keepData });
 
@@ -159,7 +159,7 @@ import { parseBooleanParam } from '../query-param.js';
 import { setPackageDisabled } from '../package-state-store.js';
 // [#30962] The host seam for the same state: a store a host registers as the
 // `package-state-store` service replaces the file at every door below.
-import { asPackageStateStore, PACKAGE_STATE_STORE_SERVICE } from '../package-state-host-store.js';
+import { asPackageStateStore, PACKAGE_STATE_STORE_SERVICE, PACKAGE_STATE_UNINSTALL_CLEANUP } from '../package-state-host-store.js';
 import type { HttpProtocolContext, HttpDispatcherResult } from '../http-dispatcher.js';
 import type { DomainHandlerDeps, DomainRoute } from '../domain-handler-registry.js';
 import { readDispatchedBody } from '../deferred-request-body.js';
@@ -413,7 +413,8 @@ function requireManageMetadata(deps: DomainHandlerDeps, context: HttpProtocolCon
  * doors, so attribution cannot drift from authorization. [#28414] Every
  * package door that stamps history or a commit reads it: `publish-drafts`
  * (and its app re-save), `discard-drafts`, `commits/:commitId/revert`,
- * `rollback`, `adopt-orphans` and `duplicate`. A body `actor` is ignored, not
+ * `rollback`, `adopt-orphans` and `duplicate`, and [#31023] the package
+ * `DELETE`, whose verb credits each metadata delete. A body `actor` is ignored, not
  * refused, so a client still sending one keeps working and is recorded as
  * itself. No caller acts on behalf of another identity through these doors
  * (measured: the console and the SDK send none, the CLI calls none); one that
@@ -3804,12 +3805,21 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
             //
             // [#20492] `protocol` is the one resolved above, before the registry
             // was touched.
+            //
+            // [#31023, ADR-0146 D1] The actor is the request's authenticated
+            // user, resolved as every sibling package write door resolves it
+            // (`resolvePackageWriteActor`), so each metadata delete the verb
+            // performs is credited to that user in `sys_audit_log` and
+            // `sys_metadata_history`. A caller with no user id sends no
+            // `actor`, and the deletes stay unattributed, as before.
             if (protocol && typeof protocol.deletePackage === 'function') {
                 try {
                     const keepData = query?.keepData === 'true' || query?.keepData === '1';
+                    const actor = resolvePackageWriteActor(_context);
                     persisted = await protocol.deletePackage({
                         packageId: id,
                         ...(keepData ? { keepData: true } : {}),
+                        ...(actor ? { actor } : {}),
                     });
                 } catch (e: any) {
                     // [#21276] Nothing was touched on this path: the registry
@@ -3872,7 +3882,19 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
             // Same best-effort try/catch as the install arm above: the
             // uninstall itself already happened, so a state-store failure must
             // not turn it into a 500.
-            if (persists ? existed : registryRemoved) {
+            //
+            // [#31023] The verb clears the record itself when the runtime's
+            // uninstall cleanup is registered on its protocol
+            // (`ensurePackageStateUninstallCleanup`, from `AppPlugin.start`),
+            // so every in-process caller of `deletePackage` gets the clear,
+            // not only this door; its outcome rides on `persisted.cleanups`.
+            // The verb runs its cleanups for every id it is asked to
+            // uninstall, so with it a 404 here clears a record naming an id
+            // that is neither installed nor stored. This door writes the
+            // record only when the verb did not: a host with no persisted
+            // half, or a protocol on a kernel that registered no such cleanup.
+            const verbClearedState = persisted?.cleanups?.some((c) => c?.name === PACKAGE_STATE_UNINSTALL_CLEANUP) === true;
+            if (!verbClearedState && (persists ? existed : registryRemoved)) {
                 try {
                     await writePackageStateAfterChange(deps, _context, id, false);
                 } catch (err) {