[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

Requested by 田騏 · project thread

Fixes #31232

Clause-②: yes (narrowing)
Metadata-protocol: none

维护者速读

• 改了什么：卸载动词本身（protocol.deletePackage）现在在动任何东西之前，先问一遍「卸载前守卫」。runtime 把停用门/卸载门已经在用的那个检查注册成守卫：如果别的已启用包有生效中的校验规则在读这个包通过 objectExtensions 加的字段，进程内卸载也直接拒绝，抛 409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE，消息同门上那句话，列出每条规则。拒绝时什么都不读、不动。
• 为什么改：fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227 只让 HTTP 卸载门拒绝；平台内部直接调用卸载的路径（cloud 的卸载 AI 工具、本地安装的配对安装回滚、非托管导入回滚）不走那道门，仍会把字段撤掉，之后那条规则会让该对象的每次写入都报 400 VALIDATION_FAILED，而包已没了，无法再启用。
• 风险与回滚：这是一次收窄（BREAKING）：进程内调用方以前能卸载成功的请求，在有依赖规则时改为被 409 拒绝；两个回滚路径会把拒绝当作「未能完全删除」的残留照常报告。没有依赖规则的卸载、已停用包的卸载、没注册守卫的协议，行为都不变。没改 spec、没加错误码。fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227 已合并，本 PR 已合入 main：拒绝文案用卸载措辞，HTTP 门和卸载动词的守卫共用同一个函数 packageUninstallDependentRulesRefusal。回滚就是 revert 本 PR。
• 先看：packages/metadata-protocol/src/protocol-package-uninstall.ts（askUninstallGuards 及其在 deletePackage 里的调用位置：退役键拒绝之后、第一次读库之前）；packages/runtime/src/domains/packages.ts 的 ensureDependentRulesUninstallGuard / packageUninstallDependentRulesRefusal；packages/runtime/src/domains/packages-disable-module-extension-fields.test.ts 末尾的 [#31232] describe。
• 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run src/domains/packages-disable-module-extension-fields.test.ts -t 31232，预期 4 条全绿：进程内卸载被 409 拒绝且什么都没读没动、HTTP 门答同一句话、两条 CONTROL（无依赖的包照常卸载并清停用记录；规则在租户覆盖层关掉后照常卸载）。
• 需要你做的：维护者在 PR 上确认这次收窄（进程内卸载动词在有依赖规则时改为拒绝）。

What changes

After #31227 the package door (DELETE /api/v1/packages/:id) refuses an uninstall that would withdraw a field an active validation rule of another enabled package reads. The uninstall verb itself, protocol.deletePackage in @objectstack/metadata-protocol, never asked, so every in-process caller withdrew the field unchecked. This adds the seat-ruled seam and fills it:

• The seam (@objectstack/metadata-protocol). ObjectStackProtocolImplementation#registerUninstallGuard(name, guard), the before-half of registerUninstallCleanup. A guard is handed { packageId, actor? } and answers undefined (proceed) or { code, status, message } (refuse). deletePackage asks every registered guard in registration order right after its retired-key refusal and BEFORE its first read (sys_metadata), the registry's own refusal, the store delete, the per-item deletes, the registry withdrawal and the cleanups; the first refusal is thrown as an Error carrying the guard's message, code and status. A guard that throws refuses with its throw. One guard per name; a second registration replaces the first. The types UninstallGuard and UninstallGuardRefusal are exported from the package entry. With no guard registered the verb is byte-for-byte the old path.
• The registration (@objectstack/runtime). ensureDependentRulesUninstallGuard(ctx) registers, once per protocol, the guard runtime.package-dependent-rules, called from AppPlugin.start beside ensurePackageStateUninstallCleanup (the after-half packages: DELETE /api/v1/packages/:id deletes unattributed (no actor), and the in-process deletePackage leaves the per-environment disable record behind #31023 added). The guard resolves the engine's registry when it is asked and answers packageUninstallDependentRulesRefusal(registry, packageId): the doors' verdict readDisableDependentRules and sentence disableDependentRulesMessage under the lead Package 'ID' cannot be uninstalled, as the wire pair 409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE. @objectstack/metadata-protocol imports nothing from the runtime and holds no copy of the rule.
• No spec change, no new error code. The code is the one already ledgered under @objectstack/runtime.

Tests

• packages/metadata-protocol/src/protocol.uninstall-guards.test.ts (new, 6 cases), a protocol over an engine double that counts every step that reads or moves something (the sys_metadata read, the registry's uninstallability question, the store delete, the registry withdrawal, the cleanups):
  • a refusing guard: the verb rejects with the guard's code, status and message, and all five counts are 0;
  • each guard is handed the package id and the request's actor; the first refusal wins, a later guard is not asked, counts 0;
  • a guard that throws: the same error object is rejected, counts 0;
  • a second registration under one name replaces the first;
  • CONTROL: guards that answer nothing, every step runs once;
  • CONTROL: a bare protocol (no guard registered), every step runs once, as before.
• packages/runtime/src/domains/packages-disable-module-extension-fields.test.ts, new top-level describe [#31232] (4 cases) in the shared dependent-rule harness, on a real kernel (ObjectQL on SQLite, MetadataPlugin, AppPlugin), the verb called in process on the kernel's protocol service. Two writable packages extend the app's object with one field each; a third package's active rule reads the first one's field.
  • Refusal. deletePackage rejects with 409 and the code; the message equals the exported builder over the exported verdict under the uninstall lead. Nothing was read or moved: findEnvironmentRows, deleteMetaItem, runUninstallCleanups and registry.uninstallPackage were never called, the package and its field are still served, the state file is unchanged, and a write to the object lands.
  • The door answers the same sentence. DELETE /packages/:id answers 409, the code, the same message, no details.
  • CONTROL: no dependent. The second package, disabled first, uninstalls in process; the verb's cleanups include runtime.package-state, the package leaves the registry, its field leaves the served object, its disable record is cleared, and the guard stays registered.
  • CONTROL: rule switched off through the tenant overlay. The first package then uninstalls in process, its field leaves the served object, and a write to the object lands.

Acceptance notes

• Re-measure at branch start (premise holds). On this rig with the guard call removed from the verb: the in-process deletePackage answered { success: false, deletedCount: 0, failedCount: 0, cleanups: [runtime.package-state ok] } without throwing, the package left the registry and its field left the served object, and the next write to the object answered 400 VALIDATION_FAILED: Validation rule 'qz_tier_known' could not be evaluated (runtime: No such key: qz_tier) — write rejected.
• Uninstall form in use. fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227 landed (57675a21). The guard's sentence is the builder's uninstall form, formatPackageDisableDependents(lead, dependents, { operation: 'uninstall' }) ("which the uninstall would withdraw", "or keep the package installed"). The in-process refusal pin holds that sentence word for word.
• The door and the guard share packageUninstallDependentRulesRefusal. The DELETE /api/v1/packages/:id arm asks that one function, with no inline scan, and answers its code, status and message. The door keeps its check ahead of resolveProtocol (seat ruling A), because a host whose protocol has no deletePackage or no guard registered uninstalls through the registry. With a guard registered, the door answers first and the verb's guard is not reached on that path. An ablation of the door's call shows the guard alone answers the identical 409, code and message.
• The two rollback callers. Install-local's pair-install undo and the unmanaged-import rollback already catch a thrown uninstall and report it as residue in their own failure answer, so a refusal there leaves the partial package installed and says so; nothing new is swallowed.
• Not covered: install-local's own DELETE door. DELETE /api/v1/marketplace/install-local/:manifestId (@objectstack/cloud-connection) does not call deletePackage: it withdraws through registry.uninstallPackage and runs the cleanups itself, so it neither asks the guards nor the verdict. Raised in the report for the seat; outside this card's file surface.

Verification

Ablation: the guard call removed from the verb, the refusal pins go red

node scripts/ablation-replace.mjs replaced await askUninstallGuards(this.uninstallGuards, request); in protocol-package-uninstall.ts with a marker assignment (anchor 1 -> 0, blob 24b1fe27dc2a -> b53ac531fceb on the first spelling, whose comment marker no build emits, so it was restored and redone with a code marker), @objectstack/metadata-protocol was rebuilt, and node scripts/ablation-dist-preflight.mjs found the marker in dist/index.js and dist/index.cjs (the runtime suite reaches the verb through that dist/). Then restored (blob equals HEAD, git diff HEAD empty), rebuilt, and the preflight --absent leg found the marker in none of the 24 built files.

• protocol.uninstall-guards.test.ts: 5 red, 1 green (the bare-protocol CONTROL, which registers no guard). Refusal case: promise resolved "{ success: false, …(5) }" instead of rejecting.
• [#31232] describe: the refusal case red (the in-process uninstall was not refused), the door case red by cascade (expected { status: 404 … } to deeply equal { status: 409 … }: the unrefused uninstall had already removed the package); both CONTROLs green.

Rework 1 at head ec3a142 (after #31227 landed)

• node scripts/pm/dispatch-gates.mjs --commands derived 73 commands; all 73 exit 0. --ran: 73 derived, 73 run, 0 NOT-MEASURED, 0 UNRUN.
• pnpm --filter @objectstack/runtime test: 555 files, 8953 tests passed, 19 skipped. pnpm --filter @objectstack/metadata-protocol test: 325 files, 22542 tests passed, 26 skipped. Typecheck on both, and eslint packages/metadata-protocol packages/runtime --no-inline-config: exit 0.
• Harness packages-disable-module-extension-fields.test.ts + package-state-host-store.test.ts: 56/56 (fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227's 4 and this PR's 4).
• Dogfood battery not rerun on this head (declared narrowing; last full run green at e052b19).

Local gates and suites at head e052b19 (after merging main)

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 67 commands; all 67 exit 0. check:dual-build-cjs-loads first exited 3 before a full pnpm build and was rerun after it; check:test-source-alias first exited 1 on the new metadata-protocol test (the protocol reaches @objectstack/lint through a dynamic import) and was fixed by a module-top import '@objectstack/lint', as the gate prescribes.
• --ran reconciliation: 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN.
• pnpm --filter @objectstack/metadata-protocol test: 323 files passed, 22533 tests passed, 26 skipped; typecheck exit 0.
• pnpm --filter @objectstack/runtime test: 555 files passed, 8943 tests passed, 19 skipped; typecheck exit 0.
• eslint packages/metadata-protocol packages/runtime --no-inline-config (the root pnpm lint over the touched packages): exit 0.
• Dogfood battery (pnpm --filter @objectstack/dogfood test, full, no shard): 435 files passed, 3 skipped; 3610 tests passed, 41 skipped.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (packages/spec is not touched.)
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes.
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (Not touched.)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/runtime, touching 34 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/metadata-protocol/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

47 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json f5e23e2f7c570d14da0f012e0857f4be7c6636d2.

⛔ 14 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/metadata-protocol/src/index.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 226 client-bound route-ledger rows — the other 163 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 163: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 33 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f5e23e2f7c570d14da0f012e0857f4be7c6636d2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c5ba18fc1852de05bc2cdd861d6a482ff249e8a3 — the merge of head 1cc4d5f3a94ed3891005625fa4b4bf3c0332fb01 into base f5e23e2f7c570d14da0f012e0857f4be7c6636d2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c5ba18fc1852de05bc2cdd861d6a482ff249e8a3 && git checkout c5ba18fc1852de05bc2cdd861d6a482ff249e8a3
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f5e23e2f7c570d14da0f012e0857f4be7c6636d2 1cc4d5f3a94ed3891005625fa4b4bf3c0332fb01 && git checkout -B drift-repro f5e23e2f7c570d14da0f012e0857f4be7c6636d2 && git merge --no-ff 1cc4d5f3a94ed3891005625fa4b4bf3c0332fb01

node scripts/docs-audit/affected-docs.mjs --json f5e23e2f7c570d14da0f012e0857f4be7c6636d2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f5e23e2f7c570d14da0f012e0857f4be7c6636d2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

Seat audit: one re-run on head ec3a1429c9a87fc42a876ec60f2289d7ee5da233 (rework 1, after #31227 landed).

• Failing: Test Core (8/8) (job 128585785658) → @objectstack/example-todo test/overdue-escalation-days-overdue.test.ts, one case Test timed out in 5000ms ("every {{ currentTask.… }} hole in the escalation body names a key the row carries"); Test Core is its aggregate. Every other check on the head is success or skipped.
• Not this PR's: a flow test in the todo example. It uninstalls no package, so neither the new guard nor the door's refusal runs on that path. This is a known queue flake: anchor Queue-flake anchor: test/overdue-escalation-days-overdue.test.ts #31311, tracked under the p0 card example-todo: loop-body-iteration.test.ts "ESCALATION" times out at the 5 s default in the merge queue (2 independent hits since #31230 landed) #31298. Its fix PR test(example-todo): boot the loop-body kernel once per file under a measured budget #31312 covered only loop-body-iteration.test.ts, so there is nothing to port for this file yet.
• Action: failed jobs re-run once through the relay. A second failure on this signature stops here and waits for the Queue-flake anchor: test/overdue-escalation-days-overdue.test.ts #31311 fix.

[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

Contract review

Served-tier: TIER_DEFAULT
Head-sha: ec3a1429c9a87fc42a876ec60f2289d7ee5da233
Local-runs: none

① Derived judgments

• Face: accept-set narrowing at the in-process uninstall verb (Clause-②: yes (narrowing) in the PR body and the changeset; title fix(metadata-protocol,runtime)!:). No path under packages/spec/**, no ADR or skills file, no governed path, no new error code, no new route. Diff read in full: 11 files, +518/−13.
• The seam is the before-half of the existing one. registerUninstallGuard(name, guard) sits beside registerUninstallCleanup in the class-head facet, with the same Map-by-name shape and the same replace-on-re-register rule. deletePackage asks the guards in askUninstallGuards right after the retired-key refusal and before its first sys_metadata read. So a refusal moves nothing, pinned by five zero counts in protocol.uninstall-guards.test.ts. A guard's throw propagates, and the code fails closed on a guard that cannot judge. With no guard registered the loop is empty, and the bare-protocol CONTROL pins the old path.
• Layering held. @objectstack/metadata-protocol imports nothing from the runtime and holds no copy of the rule. The verdict lives in the runtime and is registered once per protocol (WeakSet) from AppPlugin.start, beside ensurePackageStateUninstallCleanup. The registry is resolved when the guard is asked, not captured at boot.
• One function for door and verb (rework 1). packageUninstallDependentRulesRefusal builds readDisableDependentRules + disableDependentRulesMessage(…, { operation: 'uninstall' }) as 409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE. Both the guard and the DELETE /packages/:id arm answer through it, so the two cannot drift. The door keeps its check ahead of resolveProtocol (seat ruling A): a host whose protocol has no deletePackage or no guard still gets the refusal, and fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227's "verb never reached" pin still holds. The dev's ablation shows the guard alone answers the identical 409, code and message.
• The rollback callers. The install-local pair-install undo (marketplace-install-local-plugin.ts pairInstallWriteFailure) and the unmanaged-import rollback already catch a thrown uninstall and report it as residue. A refusal there leaves the partial package installed, says so, and logs at error. Nothing new is swallowed.

② Semver level

• Narrowing: an uninstall the verb performed for an in-process caller is now refused ⇒ BREAKING for those callers. It is declared with ! and a BREAKING changeset paragraph covering Before, Now, the seam, Who moves and the remedy. The new method and the two exported types are additive. The patch bumps on both packages follow the repo's changeset-no-major practice for declared narrowings, as fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227 did.

③ Boundary flags

• Security/permission boundary: none moved. The guard only reads the registry, and the door's requireWritablePackage and auth stay ahead of its check.
• Not closed here, filed: install-local's own DELETE /api/v1/marketplace/install-local/:manifestId withdraws through registry.uninstallPackage without the verb, so it asks neither guard nor audit → cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row #31283.
• Merge needs the maintainer's per-PR word (narrowing).

Implemented-by: claude/project-thread-qrn7nl
Reviewed-by: session_017ihL2dLQEXWGsE2SZ3Qn5F

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

席位核对 — ACCEPT · domain:server#4 · Head-sha: ec3a1429c9a87fc42a876ec60f2289d7ee5da233

• Shape: draft → main, Fixes #31232 once, Clause-②: yes (narrowing) and Metadata-protocol: none line-initial, ! title, BREAKING changeset (@objectstack/metadata-protocol + @objectstack/runtime patch). 11 files, +518/−13. Not governed, under 3000 lines. No spec, skills or ADR diff, so no Fable review is due.
• Diff read by the seat: guards are asked before the verb's first read, so a refusal moves nothing (five zero counts pinned). The runtime registers the doors' verdict once per protocol. The door and the guard share packageUninstallDependentRulesRefusal in its uninstall form, and the door keeps its check ahead of resolveProtocol (ruling A).
• Premise measured: with the guard call removed, the in-process deletePackage withdrew the field, and the next write answered 400 VALIDATION_FAILED (qz_tier_known … No such key: qz_tier). That is the break the card names (report round 0). The ablation turned 5 of 6 protocol pins and the in-process refusal pin red.
• Gates (check-runs on the head): 52 runs: 37 success, 15 skipped, 0 failed (Test Core (8/8) passed on its one re-run after the Queue-flake anchor: test/overdue-escalation-days-overdue.test.ts #31311 queue flake; audit 6715764127). Dev at ec3a142: dispatch-gates --ran 73/73, 0 NOT-MEASURED; runtime 8953 and metadata-protocol 22542 tests pass; typecheck and eslint exit 0 (report 6715746644).
• Accepted deviations: the dogfood battery was not rerun at ec3a142 (declared narrowing: the rework delta is the door's call site and one builder argument, pinned by the runtime harness). It was last green in full at e052b19, and CI's queue run carries the dogfood shards.
• Out of scope: install-local's own DELETE door bypasses the verb → cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row #31283 (finding).
• Landing: Tier: none, but this is a BREAKING narrowing ⇒ it waits on the maintainer's word on this PR (pm:awaiting-merge). On approval: landing checks, label cleared, then pr_ready + automerge_enable through the relay.

[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 1cc4d5f3a94ed3891005625fa4b4bf3c0332fb01
Local-runs: none

① Derived judgments

• Face: accept-set narrowing at the in-process uninstall verb (Clause-②: yes (narrowing) in the PR body and the changeset; title fix(metadata-protocol,runtime)!:). No path under packages/spec/**, no ADR or skills file, no governed path, no new error code, no new route. Diff read in full: 11 files, +518/−13.
• The seam is the before-half of the existing one. registerUninstallGuard(name, guard) sits beside registerUninstallCleanup in the class-head facet, with the same Map-by-name shape and the same replace-on-re-register rule. deletePackage asks the guards in askUninstallGuards right after the retired-key refusal and before its first sys_metadata read. So a refusal moves nothing, pinned by five zero counts in protocol.uninstall-guards.test.ts. A guard's throw propagates, and the code fails closed on a guard that cannot judge. With no guard registered the loop is empty, and the bare-protocol CONTROL pins the old path.
• Layering held. @objectstack/metadata-protocol imports nothing from the runtime and holds no copy of the rule. The verdict lives in the runtime and is registered once per protocol (WeakSet) from AppPlugin.start, beside ensurePackageStateUninstallCleanup. The registry is resolved when the guard is asked, not captured at boot.
• One function for door and verb (rework 1). packageUninstallDependentRulesRefusal builds readDisableDependentRules + disableDependentRulesMessage(…, { operation: 'uninstall' }) as 409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE. Both the guard and the DELETE /packages/:id arm answer through it, so the two cannot drift. The door keeps its check ahead of resolveProtocol (seat ruling A): a host whose protocol has no deletePackage or no guard still gets the refusal, and fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227's "verb never reached" pin still holds. The dev's ablation shows the guard alone answers the identical 409, code and message.
• Union merge (round 2). 1cc4d5f3 is ec3a1429 plus one merge of origin/main at 8ef25237 (feat(audit): a package uninstall writes one package_uninstall ledger row about the package itself #31286). Against the reviewed diff, the PR's added and removed lines differ only in the deletePackage host Pick list, which now names both 'environmentId' (feat(audit): a package uninstall writes one package_uninstall ledger row about the package itself #31286) and 'uninstallGuards', plus one blank line's position. The guards are still asked right after the retired-key refusal, before the first read. feat(audit): a package uninstall writes one package_uninstall ledger row about the package itself #31286's recordPackageUninstall still runs at the end. The protocol host carries both getters (dev report 6716273817).
• The rollback callers. The install-local pair-install undo (marketplace-install-local-plugin.ts pairInstallWriteFailure) and the unmanaged-import rollback already catch a thrown uninstall and report it as residue. A refusal there leaves the partial package installed, says so, and logs at error. Nothing new is swallowed.

② Semver level

• Narrowing: an uninstall the verb performed for an in-process caller is now refused ⇒ BREAKING for those callers. It is declared with ! and a BREAKING changeset paragraph covering Before, Now, the seam, Who moves and the remedy. The new method and the two exported types are additive. The patch bumps on both packages follow the repo's changeset-no-major practice for declared narrowings, as fix(runtime)!: refuse a package uninstall while an active validation rule reads a field it adds #31227 did.

③ Boundary flags

• Security/permission boundary: none moved. The guard only reads the registry, and the door's requireWritablePackage and auth stay ahead of its check.
• Not closed here, filed: install-local's own DELETE /api/v1/marketplace/install-local/:manifestId withdraws through registry.uninstallPackage without the verb, so it asks neither guard nor audit → cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row #31283.
• Merge needs the maintainer's per-PR word (narrowing).

Implemented-by: claude/project-thread-qrn7nl
Reviewed-by: session_017ihL2dLQEXWGsE2SZ3Qn5F

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · marchtian · session_017ihL2dLQEXWGsE2SZ3Qn5F

席位核对 — ACCEPT · domain:server#4 · Head-sha: 1cc4d5f3a94ed3891005625fa4b4bf3c0332fb01

• Shape: draft → main, Fixes #31232 once, Clause-②: yes (narrowing) and Metadata-protocol: none line-initial, ! title, BREAKING changeset (@objectstack/metadata-protocol + @objectstack/runtime patch). 11 files, +518/−13. Not governed, under 3000 lines. No spec, skills or ADR diff, so no Fable review is due.
• Diff read by the seat: guards are asked before the verb's first read, so a refusal moves nothing (five zero counts pinned). The runtime registers the doors' verdict once per protocol. The door and the guard share packageUninstallDependentRulesRefusal in its uninstall form, and the door keeps its check ahead of resolveProtocol (ruling A).
• Premise measured: with the guard call removed, the in-process deletePackage withdrew the field, and the next write answered 400 VALIDATION_FAILED (qz_tier_known … No such key: qz_tier). That is the break the card names (report round 0). The ablation turned 5 of 6 protocol pins and the in-process refusal pin red.
• Gates (check-runs on the head): 48 runs: 35 success, 13 skipped, 0 failed. Dev at 1cc4d5f: metadata-protocol guard/cleanup/delete-refusal/declared-capture 36/36, plugin-audit package-lifecycle-audit 9/9, runtime harness + store-refusal + package-state-host-store 67/67; typecheck, eslint and check:durability-log-level exit 0 (report 6716273817). At ec3a142: dispatch-gates --ran 73/73, 0 NOT-MEASURED (report 6715746644).
• Head note: 1cc4d5f3 is ec3a1429 (PASS + ACCEPT 6715909724) plus one union merge of origin/main after feat(audit): a package uninstall writes one package_uninstall ledger row about the package itself #31286 landed. Its only conflict was the shared host list in deletePackage, and the PR's own lines are otherwise unchanged.
• Accepted deviations: the dogfood battery was not rerun at ec3a142 (declared narrowing: the rework delta is the door's call site and one builder argument, pinned by the runtime harness). It was last green in full at e052b19, and CI's queue run carries the dogfood shards.
• Out of scope: install-local's own DELETE door bypasses the verb → cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row #31283 (finding).
• Landing: Tier: none, BREAKING narrowing. The maintainer approved it in the card thread (「同意」 at 2026-11-08T02:07Z, and 「我批准过的，后续应该你跟进」). pm:awaiting-merge is cleared with this record, and the seat lands it: pr_ready + automerge_enable through the relay.