fix(objectql, metadata-protocol): deletePackage asks the registry's uninstall refusal before the sys_packages delete

The ADR-0029 extender refusal was decided only by performing the
uninstall, which now runs after the store delete. Its refusal pass becomes
SchemaRegistry.assertPackageUninstallable, which unregisterObjectsByPackage
itself calls (one predicate), and deletePackage asks it before its first
durable step, so the refusal is thrown with nothing removed. The door's
late-withdrawal comment no longer says the refusal arrives there.

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol.ts

@@ -20720,19 +20720,22 @@ export class ObjectStackProtocolImplementation implements
      * so each object's table is torn down once. Per-item failures are collected
      * without aborting the rest.
      *
-     * [#21276] The steps, in order. Nothing durable happens before step 3, so
-     * a refusal at any of steps 1–3 leaves everything as it was:
+     * [#21276] The steps, in order. Nothing durable happens before step 4, so
+     * a refusal at any of steps 1–4 leaves everything as it was:
      *  1. the tenant-scope refusals (`TENANT_SCOPE_REQUIRED`) — pure;
      *  2. the `sys_metadata` read — a read; a failure is thrown;
-     *  3. the `sys_packages` delete through the `package` service — the FIRST
+     *  3. the registry's uninstall refusal (another package extends an object
+     *     this one owns, ADR-0029), asked through
+     *     `SchemaRegistry.assertPackageUninstallable` — pure; thrown as is;
+     *  4. the `sys_packages` delete through the `package` service — the FIRST
      *     durable step; a refusal, returned or thrown, is thrown as this verb's
      *     failure (see {@link packagePersistFailureError});
-     *  4. the per-item `sys_metadata` deletes and table teardown — each refusal
+     *  5. the per-item `sys_metadata` deletes and table teardown — each refusal
      *     is collected in `failed[]`;
-     *  5. the registry withdrawal — a refusal (another package extends an
-     *     object this one owns, ADR-0029) is logged, and the package leaves at
-     *     the next restart, since its stored row is already gone;
-     *  6. the uninstall cleanups — each refusal is reported in `cleanups[]`.
+     *  6. the registry withdrawal — step 3 already asked its refusal; anything
+     *     it still throws is logged, and the package leaves at the next
+     *     restart, since its stored row is already gone;
+     *  7. the uninstall cleanups — each refusal is reported in `cleanups[]`.
      */
     async deletePackage(request: DeletePackageRequest): Promise<DeletePackageResponse> {
         // [#7780] A cross-tenant uninstall must be DECLARED, never inferred from
@@ -20882,6 +20885,26 @@ export class ObjectStackProtocolImplementation implements
             throw metadataReadFailureError(e);
         }
 
+        // [#21276] THE REGISTRY'S UNINSTALL REFUSAL, ASKED BEFORE THE STORE
+        // DELETE. `SchemaRegistry` refuses an uninstall when another package
+        // `extend`s an object this one owns (ADR-0029), and it decides that
+        // before it mutates (#7970). Here that refusal used to be met only at
+        // the registry withdrawal below, after the stored row, the metadata rows
+        // and the tables were already gone. `assertPackageUninstallable` asks
+        // the same predicate (the one copy `unregisterObjectsByPackage` itself
+        // calls) without performing the uninstall, so the refusal is thrown
+        // here, as is, with nothing removed. The HTTP door answers it through
+        // its `catch` around this verb: `500`, nothing changed.
+        //
+        // The registry is reached the way the withdrawal below reaches it. A
+        // registry that does not carry the method (an engine double, a host on
+        // a registry without it) is not asked, and this verb behaves as it did
+        // before the method existed: the refusal surfaces at the withdrawal.
+        const packageRegistry = (this.engine as any)?.registry;
+        if (typeof packageRegistry?.assertPackageUninstallable === 'function') {
+            packageRegistry.assertPackageUninstallable(request.packageId);
+        }
+
         // [#21276] THE STORE DELETE COMES FIRST, and its refusal is this verb's
         // refusal. Triage's ruling: refuse before withdrawing, not undo. Every
         // step above this one only reads; every step below it — the per-item
@@ -20991,18 +21014,16 @@ export class ObjectStackProtocolImplementation implements
 
         // [#2747] Unregister from the in-memory SchemaRegistry too, so the
         // running kernel stops serving the package without waiting for a
-        // restart. Best-effort: the HTTP dispatcher already unregisters
-        // before calling us (second call is a no-op warn), and a package
-        // with live extenders refuses unregistration — that failure is
-        // logged, not fatal (the durable row is gone, so the next boot is
-        // clean either way).
-        //
-        // [#21276] This refusal can still come AFTER the store delete above,
-        // and it stays here. `SchemaRegistry` has no verb that answers "would
-        // this uninstall be refused?" without performing it; a copy of its
-        // extender predicate here would be a second place that must agree with
-        // the first; and performing the uninstall first would withdraw the
-        // package before the store decides.
+        // restart. [#21276] The HTTP door no longer unregisters before calling
+        // this verb; it withdraws only after this verb has answered, and skips
+        // that when this step already did it.
+        //
+        // [#21276] The registry's own refusal (ADR-0029 extenders) was asked
+        // before the store delete, through `assertPackageUninstallable`, so it
+        // does not arrive here. The `catch` stays as a safety net for a
+        // registry that lacks that method, or a throw nothing asked ahead of
+        // time: it is logged, not fatal, because the durable row is already
+        // gone and the next boot is clean either way.
         try {
             (this.engine as any)?.registry?.uninstallPackage?.(request.packageId);
         } catch (e) {

packages/objectql/src/registry.ts

@@ -3311,45 +3311,68 @@ export class SchemaRegistry {
     }
   }
 
+  /**
+   * [#21276] Would uninstalling `packageId` be refused? Throws the refusal
+   * {@link unregisterObjectsByPackage} (and so {@link uninstallPackage}) would
+   * raise, and returns normally otherwise. It reads `objectContributors` and
+   * mutates nothing, so a caller can ask before a step it cannot take back:
+   * `deletePackage` (`@objectstack/metadata-protocol`) asks it before it
+   * deletes the stored `sys_packages` row, so an uninstall this registry would
+   * refuse is refused with nothing removed.
+   *
+   * [#7970] THE REFUSAL PASS — the whole decision, taken before a single
+   * contribution is removed. This check used to live inline in the mutation
+   * walk of {@link unregisterObjectsByPackage}, one object at a time, so a
+   * package owning `account` (free) and `contact` (extended by another
+   * package) lost `account` on the way to refusing over `contact`: the guard
+   * that exists to keep a registry whole was itself reached through a
+   * mutation, and nothing rolled it back. Same predicate and same iteration
+   * order as the inline check it replaced, so the same object still refuses
+   * with the same message.
+   *
+   * ⛔ ONE predicate: {@link unregisterObjectsByPackage} calls this method
+   * rather than keeping its own copy, so the question asked ahead and the
+   * refusal raised by the uninstall cannot disagree. `force` is not a
+   * parameter here: forcing means not asking, and stays the caller's choice.
+   *
+   * @throws Error if the package owns an object another package extends (ADR-0029)
+   */
+  assertPackageUninstallable(packageId: string): void {
+    for (const [fqn, contributors] of this.objectContributors.entries()) {
+      const ownedHere = contributors.some(
+        c => c.packageId === packageId && c.ownership === 'own'
+      );
+      if (!ownedHere) continue;
+      // Extenders from other packages
+      const otherExtenders = contributors.filter(
+        c => c.packageId !== packageId && c.ownership === 'extend'
+      );
+      if (otherExtenders.length > 0) {
+        throw new Error(
+          `Cannot uninstall package "${packageId}": object "${fqn}" is extended by ` +
+          `${otherExtenders.map(c => c.packageId).join(', ')}. Uninstall extenders first.`
+        );
+      }
+    }
+  }
+
   /**
    * Unregister all objects contributed by a package.
    *
    * [#7970] **Refuses before it mutates.** If any object this package owns is
    * extended by another package (ADR-0029), the call throws having removed
-   * nothing — the refusal is decided across every object first. Callers may
-   * therefore treat a throw as a no-op, which is what lets
-   * {@link uninstallPackage} run this verb ahead of its own mutations.
+   * nothing — the refusal is decided across every object first, by
+   * {@link assertPackageUninstallable}. Callers may therefore treat a throw as
+   * a no-op, which is what lets {@link uninstallPackage} run this verb ahead of
+   * its own mutations.
    *
    * @throws Error if trying to uninstall an owner that has extenders
    */
   unregisterObjectsByPackage(packageId: string, force: boolean = false): void {
-    // [#7970] REFUSAL PASS — the whole decision, taken before a single
-    // contribution is removed. This check used to live inline in the mutation
-    // walk below, one object at a time, so a package owning `account` (free)
-    // and `contact` (extended by another package) lost `account` on the way to
-    // refusing over `contact`: the guard that exists to keep a registry whole
-    // was itself reached through a mutation, and nothing rolled it back. Same
-    // predicate and same iteration order as the inline check it replaces, so
-    // the same object still refuses with the same message — what changed is
-    // only that no removal precedes the throw.
-    if (!force) {
-      for (const [fqn, contributors] of this.objectContributors.entries()) {
-        const ownedHere = contributors.some(
-          c => c.packageId === packageId && c.ownership === 'own'
-        );
-        if (!ownedHere) continue;
-        // Extenders from other packages
-        const otherExtenders = contributors.filter(
-          c => c.packageId !== packageId && c.ownership === 'extend'
-        );
-        if (otherExtenders.length > 0) {
-          throw new Error(
-            `Cannot uninstall package "${packageId}": object "${fqn}" is extended by ` +
-            `${otherExtenders.map(c => c.packageId).join(', ')}. Uninstall extenders first.`
-          );
-        }
-      }
-    }
+    // [#7970] REFUSAL PASS — see {@link assertPackageUninstallable}, which holds
+    // the one copy of the predicate ([#21276] extracted so it can be asked
+    // without uninstalling).
+    if (!force) this.assertPackageUninstallable(packageId);
 
     // MUTATION PASS — carries no refusal of its own; the pass above already
     // proved every removal below is allowed. Keep it that way: a second copy of

packages/runtime/src/domains/packages.ts

@@ -2112,11 +2112,15 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
             // the uninstall, and its refusal (another package extends an object
             // this one owns, ADR-0029) is the request's refusal.
             //
-            // With a persisted half, that refusal now arrives AFTER the stored
-            // rows were deleted — the registry has no verb that answers it
-            // without performing it. It is reported as `registryRemoved: false`
-            // on the answer rather than as a failure the store does not bear
-            // out: the package leaves the running process at the next restart.
+            // With a persisted half, that refusal does not arrive here:
+            // `deletePackage` asks it (`SchemaRegistry.assertPackageUninstallable`)
+            // before its store delete and throws it with nothing removed, which
+            // the `catch` above answers — `500`, nothing changed. This `try`
+            // stays as a safety net for a registry without that method, or a
+            // throw nothing asked ahead of time. The stored rows are already
+            // gone by then, so it is reported as `registryRemoved: false`
+            // rather than as a failure the store does not bear out, and the
+            // package leaves the running process at the next restart.
             if (registry.getPackage(id) !== undefined) {
                 if (persists) {
                     try {