@@ -0,0 +1,13 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql): a refused member of a multi-package artifact leaves no member of it registered (#31564)
+
+Clause-②: yes (widening) — adds one public method, `SchemaRegistry.recordRestoreOnRefusal`, and refuses nothing that registers today.
+Metadata-protocol: none
+
+The engine's `manifest` service registered an artifact's packages one by one, and each package put back only what it had written itself when it was refused. When a later member was refused, the members registered before it stayed in the running kernel (package records, objects, apps, navigation contributions, kinds, datasource definitions), while the marketplace install door answered `422 PLUGIN_REGISTER_FAILED` and ledgered nothing, so a restart dropped them again.
+
+- **Now.** Every package of one artifact, and then its residual (top-level items no package declares), registers in one restore run. A refusal anywhere in it puts back every entry any of them wrote, in the registry and in the engine's own manifest and datasource-definition maps, and the refusal reaches the caller unchanged. A first install leaves no member registered; a refused upgrade leaves the installed version of every member serving.
+- **Unchanged.** Nothing that registers today is refused: the same bodies are accepted and refused, with the same code, status and sentence. A single-package artifact is answered exactly as before. The residual owner's origin is now recorded once the artifact has registered whole, so a refused artifact records none.
@@ -35,6 +35,8 @@
  *     bound action whose object nobody registers: `422 PLUGIN_REGISTER_FAILED`
  *     in the declared envelope with the engine's sentence, nothing registered,
  *     the ledger exactly as before the call;
+ *   - a multi-package artifact whose second member is refused, on the cloud
+ *     and on the inline branch: neither member registered (#31564);
  *   - an upgrade refused by a registry refusal and by a sealed-vocabulary one:
  *     the same `422`, the installed version still registered and ledgered;
  *   - the remedy a sealed-vocabulary refusal names: once the package that
@@ -279,12 +281,11 @@ const CASES = [
     },
     {
         title: 'an object name two packages of one artifact define',
-        // Only the refused member: the manifest service registers an artifact's
-        // packages one by one, so `com.acme.crm`, registered before
-        // `com.acme.crm.billing` was refused, stays in the RUNNING kernel —
-        // unledgered, so gone at the restart. Measured the same on the inline
-        // branch; not this door's to withdraw, and not pinned here.
-        versionId: 'v1-artifact-object', manifestId: 'com.acme.crm-suite', registered: ['com.acme.crm.billing'],
+        // BOTH members: `com.acme.crm` registered before `com.acme.crm.billing`
+        // was refused, and the engine's `manifest` service puts back every
+        // member of a refused artifact, so the running kernel holds neither —
+        // as the ledger holds neither. The inline branch: below.
+        versionId: 'v1-artifact-object', manifestId: 'com.acme.crm-suite', registered: ['com.acme.crm', 'com.acme.crm.billing'],
         says: 'Object name conflict inside one release artifact: object "crm_account"',
     },
     {
@@ -343,6 +344,22 @@ describe('install-local cloud branch refuses a register the engine refuses, befo
         });
     }
 
+    it('the inline branch: a multi-package artifact whose second member is refused leaves neither member registered', async () => {
+        const { ql, install, installHolder } = await bootPlugin();
+        await installHolder();
+        const before = ledger();
+
+        const res = await install({ manifest: collidingArtifact() });
+
+        expect(res.status, JSON.stringify(res.payload)).toBe(422);
+        expect(res.payload.error.code).toBe('PLUGIN_REGISTER_FAILED');
+        expect(res.payload.error.message).toContain('Object name conflict inside one release artifact: object "crm_account"');
+        expect(ql.registry.getPackage('com.acme.crm')).toBeUndefined();
+        expect(ql.registry.getPackage('com.acme.crm.billing')).toBeUndefined();
+        expect(ql.registry.getObjectOwner('crm_account')).toBeUndefined();
+        expect(ledger()).toEqual(before);
+    });
+
     it('the remedy a bound action\'s refusal names: once the object\'s package is installed, the same install succeeds at once', async () => {
         serveVersions(VERSIONS);
         const { ql, installFromCloud, installHolder } = await bootPlugin();
 
@@ -83,7 +83,7 @@ export interface RegistrationHost {
 /** The bodies of the "Package, app, plugin, driver and datasource registration" section of `ObjectQL`: a stateless facet, called by the class's stubs. */
 export class RegistrationFacet {
   /** The body of `ObjectQL#registerApp`; the method's docblock there is its contract. */
-  static registerApp(this: Pick<RegistrationHost, '_registry' | 'convertPackageBodyForward' | 'invalidateSummaryIndex' | 'logger' | 'manifests' | 'registerDatasourceDef' | 'registerPackageBody'>, registeredBody: any, scope?: ArtifactInstallScope, source: Exclude<InstalledPackageSource, 'authored'> = 'code'): void {
+  static registerApp(this: Pick<RegistrationHost, '_registry' | 'applyExternalDriverFloor' | 'convertPackageBodyForward' | 'datasourceDefs' | 'invalidateSummaryIndex' | 'logger' | 'manifests' | 'registerDatasourceDef' | 'registerPackageBody'>, registeredBody: any, scope?: ArtifactInstallScope, source: Exclude<InstalledPackageSource, 'authored'> = 'code'): void {
       // The CONVERTED body, for everything below — the package record, the
       // live manifest, every item it registers (see {@link convertPackageBodyForward}).
       // [#23972] Refused before anything registers — see the docblock: an
@@ -143,6 +143,14 @@ export class RegistrationFacet {
           }
       }
       this.invalidateSummaryIndex(); // new objects may add/change summary fields
+      // [#31564] Inside a run another caller opened — the `manifest` service
+      // registers every package of one artifact in one run — a refusal of a
+      // LATER package puts this one back too. Its writes outside the registry
+      // are recorded for that run below, before each first write; the summary
+      // index, dropped above, is dropped again once the registry is put back.
+      // Outside such a run nothing is recorded (see
+      // {@link SchemaRegistry.recordRestoreOnRefusal}).
+      this._registry.recordRestoreOnRefusal('summaryIndex', () => () => this.invalidateSummaryIndex());
       this.logger.debug('Registering package manifest', { id, namespace });
 
       // [#28697] What remains can only be refused part-way, by the registry's
@@ -163,6 +171,14 @@ export class RegistrationFacet {
 
       // Store manifest for defaultDatasource lookup
       if (id) {
+        this._registry.recordRestoreOnRefusal(`manifest\u0000${id}`, () => {
+          const had = this.manifests.has(id);
+          const held = this.manifests.get(id);
+          return () => {
+            if (had) this.manifests.set(id, held);
+            else this.manifests.delete(id);
+          };
+        });
         this.manifests.set(id, manifest);
       }
 
@@ -174,7 +190,19 @@ export class RegistrationFacet {
           ? manifest.datasources
           : Object.entries(manifest.datasources).map(([name, def]) => ({ name, ...(def as any) }));
         for (const ds of dsList) {
-          if (ds?.name) this.registerDatasourceDef(ds);
+          if (!ds?.name) continue;
+          const name: string = ds.name;
+          // Put back with the definition: the driver floor it decides
+          // (`applyExternalDriverFloor`, which `registerDatasourceDef` runs).
+          this._registry.recordRestoreOnRefusal(`datasourceDef\u0000${name}`, () => {
+            const held = this.datasourceDefs.get(name);
+            return () => {
+              if (held) this.datasourceDefs.set(name, held);
+              else this.datasourceDefs.delete(name);
+              this.applyExternalDriverFloor(name);
+            };
+          });
+          this.registerDatasourceDef(ds);
         }
       }