@@ -0,0 +1,21 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/rest': patch
+---
+
+fix(runtime)!: the package write doors refuse a query parameter they do not read, so `DELETE /packages/:id?keepdata=true` no longer drops the tables the caller asked to keep
+
+Clause-②: yes (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition, stored row or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What changes is the answer the package write doors give a request that carries a query parameter they never read: it is refused instead of ignored. The remedy is a request edit (spell the declared flag exactly, or send no query parameter), never a rewrite of a package source or a stored row. The other categories are closed on facts: both packages publish (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** accept-set narrowing at the package write doors of the runtime dispatcher, and at `RestServer`'s `POST /api/v1/packages/publish`.
+
+- **Before.** Each door read the query names it knew and ignored every other one. `DELETE /api/v1/packages/:id?keepdata=true` (or `?keep_data=true`) was not `?keepData=true`, so the uninstall dropped the package's object tables, the ones the caller asked to keep, and answered `200`. Every other write door performed its act whatever names rode on the query string.
+- **Now.** Each door declares the names it reads and refuses any other `400 VALIDATION_ERROR` before anything is deleted, installed or changed. The message is the one every closed-query door answers (`unknownQueryParamRefusalMessage`, `@objectstack/rest`): it names each parameter it did not understand and lists the ones the door supports. The capability gate still answers first, so a caller without `manage_metadata` keeps its `403`, and a repeated declared flag keeps its `supplied N times` refusal.
+- **The declared names.** `DELETE /packages/:id`: `keepData`. `POST /packages` (install): `overwrite`. Every other write door takes none: `PATCH /packages/:id`, `PATCH …/enable`, `PATCH …/disable`, `POST …/publish`, `…/publish-drafts`, `…/discard-drafts`, `…/revert`, `…/rollback`, `…/commits/:commitId/revert`, `…/adopt-orphans`, `…/duplicate`, and `RestServer`'s `POST /packages/publish`.
+- **Unchanged.** A call with no query parameter, and the declared flags (`?keepData=true` / `?keepData=1`, `?overwrite=true`), which is how the Console and the client SDK call these doors. Read-only `GET` doors are not touched.
+- **Who sees it.** A script, tool or AI agent that misspells a flag or adds any other query parameter to a package write door now gets `400` instead of the act.
+
+**The remedy.** Spell the declared flag exactly (`keepData`, `overwrite`), or send the request without query parameters.
@@ -0,0 +1,75 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#26857] `POST /packages/publish` declares its closed query set — EMPTY —
+ * and refuses any name on the query string `400 VALIDATION_ERROR` with the
+ * repo's one recognition sentence (`unknownQueryParamRefusalMessage`), before
+ * the package service is resolved or asked to publish.
+ *
+ * Measured before this change: `POST /api/v1/packages/publish?dryRun=true`
+ * published for real and answered `200`; the handler never read the query.
+ *
+ * Both halves (AGENTS.md route rule 5): a REFUSAL pin — status, code, the
+ * shared sentence, and `publish` never called — beside a PRESERVATION pin on
+ * the call without a query.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { registerPackageRoutes } from './package-routes.js';
+import { unknownQueryParamRefusalMessage } from './query-allowlist.js';
+
+const AUTHOR = { resolveExecutionContext: async () => ({ userId: 'u_pkg', systemPermissions: ['manage_metadata'] }) };
+const VIEWER = { resolveExecutionContext: async () => ({ userId: 'u_viewer', systemPermissions: [] as string[] }) };
+
+const BODY = { manifest: { id: 'com.acme.app', version: '1.0.0' }, metadata: {} };
+
+function mount(options: typeof AUTHOR) {
+  const server: any = { get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn(), patch: vi.fn(), use: vi.fn() };
+  const service = { publish: vi.fn().mockResolvedValue({ success: true }) };
+  registerPackageRoutes(server, () => service as any, '/api/v1', options);
+  const handler = server.post.mock.calls.find((args: unknown[]) => args[0] === '/api/v1/packages/publish')?.[1];
+  expect(handler, 'POST /api/v1/packages/publish must be mounted').toBeDefined();
+  return { handler, service };
+}
+
+async function publish(handler: any, query: Record<string, unknown>) {
+  const out: { status?: number; body?: any } = {};
+  const res: any = {
+    status(code: number) { out.status = code; return res; },
+    json(body: any) { out.body = body; return res; },
+    send(body: any) { out.body = body; return res; },
+    header() { return res; },
+  };
+  await handler({ method: 'POST', body: BODY, params: {}, query, headers: {} }, res);
+  return out;
+}
+
+describe('[#26857] POST /packages/publish — a closed, empty query set', () => {
+  it.each([
+    [{ dryRun: 'true' }],
+    [{ dryRun: ['true', 'true'] }],
+    [{ dryRun: 'true', force: '1' }],
+  ])('refuses %j before the package service publishes', async (query) => {
+    const { handler, service } = mount(AUTHOR);
+    const out = await publish(handler, query);
+    expect(out.status, JSON.stringify(out)).toBe(400);
+    expect(out.body?.success).toBe(false);
+    expect(out.body?.error?.code).toBe('VALIDATION_ERROR');
+    expect(out.body?.error?.message).toBe(unknownQueryParamRefusalMessage(query, []));
+    expect(service.publish).not.toHaveBeenCalled();
+  });
+
+  it('preserves the call without a query: publish runs once and the route answers 200', async () => {
+    const { handler, service } = mount(AUTHOR);
+    const out = await publish(handler, {});
+    expect(out.status).toBe(200);
+    expect(service.publish).toHaveBeenCalledTimes(1);
+  });
+
+  it('answers a caller without manage_metadata 403 first: the capability gate outranks the query', async () => {
+    const { handler, service } = mount(VIEWER);
+    const out = await publish(handler, { dryRun: 'true' });
+    expect(out.status).toBe(403);
+    expect(service.publish).not.toHaveBeenCalled();
+  });
+});
@@ -21,6 +21,7 @@ import {
 import { classifiedRefusalAnswer, nestedRefusalEnvelope, sandboxFaultAnswer } from './error-response.js';
 import { mountDirectRoutes, type DirectMountedRoute } from './direct-mount.js';
 import { logError } from './log.js';
+import { unknownQueryParamRefusalMessage } from './query-allowlist.js';
 
 /**
  * [#7033 / #7023] The authorization gate for the REST package transport.
@@ -370,6 +371,13 @@ export interface PackageRoutesOptions {
   } | undefined>;
 }
 
+/**
+ * [#26857] The closed query set of `POST /packages/publish`. **Measured**:
+ * EMPTY — the handler reads the session and the body (`manifest`,
+ * `metadata`), never the query string.
+ */
+const PACKAGE_PUBLISH_PARAMS: readonly string[] = Object.freeze([]);
+
 /**
  * Register the REST package management route.
  *
@@ -486,6 +494,16 @@ export function registerPackageRoutes(
     handler: async (req, res) => {
     try {
       if (await refusePackageRequest(options, req, res)) return;
+      // [#26857] Recognition next, over the measured closed set, before the
+      // package service is resolved or asked: an unknown name is refused
+      // `400`, never ignored. The repo's one recognition sentence, written
+      // through this surface's own `sendError` envelope (the module answers
+      // every body through it), not `refuseUnknownQueryParams`' bare body.
+      const unknownQuery = unknownQueryParamRefusalMessage(req?.query, PACKAGE_PUBLISH_PARAMS);
+      if (unknownQuery !== undefined) {
+        sendError(res, 400, 'VALIDATION_ERROR', unknownQuery);
+        return;
+      }
       // Resolved HERE, not at composition (#7563). Authorization runs first so
       // an anonymous prober cannot read a deployment's capability composition
       // off this seam.