test: pin the uninstall refusal asked before the store delete — registry, protocol and door

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.package-delete-refusal.test.ts

@@ -107,7 +107,7 @@ const thrownDatabaseError: StoreDelete = async () => {
 };
 
 /** One process over `world`. A second call over the same world is a restart. */
-function boot(world: World, storeDelete: StoreDelete = landed) {
+function boot(world: World, storeDelete: StoreDelete = landed, opts: { uninstallRefusal?: Error } = {}) {
   const rows = new Map<string, { manifest: Record<string, unknown>; status: string; enabled: boolean }>();
   const registry = {
     installPackage(manifest: Record<string, unknown>) {
@@ -117,6 +117,12 @@ function boot(world: World, storeDelete: StoreDelete = landed) {
     },
     getPackage: (id: string) => rows.get(id),
     getAllPackages: () => [...rows.values()],
+    // The real `SchemaRegistry` verb: asks the uninstall's ADR-0029 refusal and
+    // mutates nothing. It refuses only when the case says another package
+    // extends an object this one owns.
+    assertPackageUninstallable(_id: string) {
+      if (opts.uninstallRefusal) throw opts.uninstallRefusal;
+    },
     uninstallPackage(id: string) {
       world.steps.push('registry.uninstallPackage');
       return rows.delete(id);
@@ -236,6 +242,28 @@ describe('#21276 deletePackage — a refused sys_packages delete fails the unins
   });
 });
 
+describe('#21276 deletePackage — the registry\'s uninstall refusal is asked BEFORE the store delete', () => {
+  it('another package extends an object this one owns: the refusal is thrown as is, and the sys_packages row survives', async () => {
+    const extender = new Error(
+      'Cannot uninstall package "com.example.leave": object "leave_request" is extended by com.example.addon. Uninstall extenders first.',
+    );
+    const world = makeWorld();
+    const before = snapshot(world);
+    const { impl, registry } = boot(world, landed, { uninstallRefusal: extender });
+
+    const err = await rejectionOf(impl.deletePackage({ packageId: PKG, allTenants: true }));
+
+    // The registry's own error, unwrapped: the door answers it as it always did.
+    expect(err).toBe(extender);
+    // Asked before the first durable step: not even the store delete ran.
+    expect(world.steps).toEqual([]);
+    expect(snapshot(world)).toEqual(before);
+    expect(registry.getPackage(PKG)).toBeDefined();
+    // …and a restart therefore still has the package, whole.
+    expect(boot(world).registry.getPackage(PKG)).toBeDefined();
+  });
+});
+
 describe('#21276 the restart — a fresh process over the same store holds the package as the uninstall reported it', () => {
   it.each(REFUSALS)('after a %s refusal, the package comes back WITH its metadata and grants', async (_label, _code, refusal) => {
     const world = makeWorld();

packages/objectql/src/registry-assert-package-uninstallable.test.ts

@@ -0,0 +1,82 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #21276 — `SchemaRegistry.assertPackageUninstallable` asks the uninstall's
+ * ADR-0029 refusal without performing the uninstall.
+ *
+ * `deletePackage` (`@objectstack/metadata-protocol`) must decide this refusal
+ * before it deletes the stored `sys_packages` row, and the only place the
+ * registry used to decide it was inside `unregisterObjectsByPackage`, which
+ * mutates when it does not refuse. The refusal pass (#7970) is now this one
+ * method, and `unregisterObjectsByPackage` calls it: ONE predicate.
+ *
+ * Pinned here:
+ *  1. it refuses with the uninstall's exact sentence, and mutates nothing;
+ *  2. it answers normally for an uninstallable package, and mutates nothing;
+ *  3. `unregisterObjectsByPackage` still refuses with that same sentence, by
+ *     calling this method (not a copy of its predicate), and `force` still
+ *     means "do not ask".
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { SchemaRegistry } from './registry';
+
+const REFUSAL =
+  'Cannot uninstall package "com.owner": object "alpha" is extended by com.ext1, com.ext2. Uninstall extenders first.';
+
+/** Every contributor of every object the fixture registers, as plain data. */
+function contributorsOf(registry: SchemaRegistry) {
+  return ['free', 'alpha', 'beta'].map((name) => ({
+    name,
+    resolves: registry.getObject(name) !== undefined,
+    contributors: registry.getObjectContributors(name).map((c) => `${c.packageId}:${c.ownership}`),
+  }));
+}
+
+describe('#21276 SchemaRegistry.assertPackageUninstallable', () => {
+  let registry: SchemaRegistry;
+
+  beforeEach(() => {
+    registry = new SchemaRegistry({ multiTenant: false });
+    // `free` is walked FIRST and is not extended; `alpha` is the first
+    // refusable object, with two extenders; `beta` is refusable too.
+    registry.registerObject({ name: 'free', fields: {} } as any, 'com.owner', 'base', 'own');
+    registry.registerObject({ name: 'alpha', fields: {} } as any, 'com.owner', 'base', 'own');
+    registry.registerObject({ name: 'beta', fields: {} } as any, 'com.owner', 'base', 'own');
+    registry.registerObject({ name: 'alpha', fields: {} } as any, 'com.ext1', undefined, 'extend');
+    registry.registerObject({ name: 'alpha', fields: {} } as any, 'com.ext2', undefined, 'extend');
+    registry.registerObject({ name: 'beta', fields: {} } as any, 'com.ext3', undefined, 'extend');
+  });
+
+  it('refuses with the uninstall\'s exact sentence, and mutates nothing', () => {
+    const before = contributorsOf(registry);
+
+    expect(() => registry.assertPackageUninstallable('com.owner')).toThrow(REFUSAL);
+
+    expect(contributorsOf(registry)).toEqual(before);
+    expect(before.every((o) => o.resolves)).toBe(true);
+  });
+
+  it('answers normally for a package nothing extends, and mutates nothing', () => {
+    registry.registerObject({ name: 'free', fields: {} } as any, 'com.ext1', undefined, 'extend');
+    const before = contributorsOf(registry);
+
+    expect(() => registry.assertPackageUninstallable('com.ext1')).not.toThrow();
+    expect(() => registry.assertPackageUninstallable('com.unknown')).not.toThrow();
+
+    expect(contributorsOf(registry)).toEqual(before);
+  });
+
+  it('unregisterObjectsByPackage refuses with the same sentence BY calling it; force does not ask', () => {
+    const ask = vi.spyOn(registry, 'assertPackageUninstallable');
+
+    expect(() => registry.unregisterObjectsByPackage('com.owner')).toThrow(REFUSAL);
+    expect(ask).toHaveBeenCalledTimes(1);
+    expect(ask).toHaveBeenCalledWith('com.owner');
+    expect(registry.getObject('free')).toBeDefined();
+
+    ask.mockClear();
+    registry.unregisterObjectsByPackage('com.owner', true);
+    expect(ask).not.toHaveBeenCalled();
+  });
+});

packages/runtime/src/package-uninstall-store-refusal.integration.test.ts

@@ -21,11 +21,13 @@
  *  2. After a restart, the package is still there and still disabled.
  *  3. CONTROL: an ordinary delete removes it — `404` in the same process, `404`
  *     after a restart (no resurrection) — and clears its disable record.
- *  4. The step that can still refuse after the store delete — the registry
- *     withdrawal, when another package extends an object this one owns
- *     (ADR-0029) — is answered as the stored state stands: `200` with
- *     `registryRemoved: false`, the process serving the package until it
- *     restarts, and gone after the restart.
+ *  4. The registry's own uninstall refusal — another package extends an object
+ *     this one owns (ADR-0029) — is decided BEFORE the store delete
+ *     (`SchemaRegistry.assertPackageUninstallable`, asked by `deletePackage`):
+ *     the door answers `500` and nothing changes — the stored rows, the
+ *     registry entry and the disable record are all intact, in the same
+ *     process and after a restart. That is the envelope the door gave when it
+ *     withdrew the package itself first.
  *
  * ## The composition — the shipped pieces, booted twice over one database file
  *
@@ -247,28 +249,33 @@ describe('#21276 CONTROL — an ordinary delete removes the package, and a resta
   });
 });
 
-describe('#21276 the refusal that can still come after the store delete — an ADR-0029 extender', () => {
-  it('200 with registryRemoved: false; the process serves the package until it restarts, and the restart does not', async () => {
+describe('#21276 the registry\'s uninstall refusal (an ADR-0029 extender) is decided before the store delete', () => {
+  it('500, and nothing changes: stored rows, registry entry and disable record intact, in the same process and after a restart', async () => {
     const dir = newDir();
     const first = await boot(dir);
     await seed(first);
     // Another package extends an object this one owns, so the registry refuses
-    // to withdraw it. Registered in memory only: nothing about it is stored.
+    // the uninstall. Registered in memory only: nothing about it is stored.
     first.engine.registry.registerObject({ name: 'leave_request', fields: { title: { type: 'text' } } } as any, PKG, 'leave', 'own');
     const fqn = first.engine.registry.getAllObjects(PKG).map((o: any) => o.name).find((n: string) => n.endsWith('leave_request'));
     first.engine.registry.registerObject({ name: fqn, fields: { note: { type: 'text' } } } as any, OTHER_PKG, undefined, 'extend');
 
     const answer = await first.call('DELETE', `/${PKG}`);
 
-    expect(answer.status).toBe(200);
-    expect(answer.body?.data).toMatchObject({ packageId: PKG, success: true, registryRemoved: false });
-    expect((await first.call('GET', `/${PKG}`)).status).toBe(200);
-    expect(await first.metadataRows()).toEqual([]);
-    expect(loadDisabledPackageIds(ENV).has(PKG)).toBe(false);
+    expect({ status: answer.status, code: answer.code }).toEqual({ status: 500, code: 'INTERNAL_ERROR' });
+    const detail = await first.call('GET', `/${PKG}`);
+    expect(detail.status).toBe(200);
+    expect(detail.body?.data).toMatchObject({ enabled: false, status: 'disabled' });
+    expect(first.engine.registry.getObject(fqn)).toBeDefined();
+    expect(await first.metadataRows()).toEqual(['view/leave_list']);
+    expect(loadDisabledPackageIds(ENV).has(PKG)).toBe(true);
     await first.destroy();
 
     const restarted = await boot(dir);
 
-    expect((await restarted.call('GET', `/${PKG}`)).status).toBe(404);
+    const after = await restarted.call('GET', `/${PKG}`);
+    expect(after.status).toBe(200);
+    expect(after.body?.data).toMatchObject({ enabled: false, status: 'disabled' });
+    expect(await restarted.metadataRows()).toEqual(['view/leave_list']);
   });
 });