runtime: uninstalling a package (DELETE /packages/:id) withdraws its extension fields with no scan, so another package's active validation rule that reads one breaks every write (#30379 follow-up) #30999

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Filing gate: ① a named location, from card #30379 (PR #30825, merged 1de7def003). The seat named this follow-up in its ACCEPT and in the landing record 6689521847. ⛔ Not a claim.

维护者速读

停用包时，现在会先查有没有别的包的生效校验规则还在读它加的字段，有就拒绝(#30825)。卸载包(DELETE /packages/:id)同样会撤掉这些字段，却没有这一步检查：卸载后，那条规则会让该对象的所有写入失败。这张卡让卸载门复用同一个检查。

Today

• The disable door asks readDisableDependentRules (packages/runtime/src/domains/packages.ts) before disablePackage and refuses with 409 PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE.
• DELETE /packages/:id reaches the uninstall path, which withdraws the package's extension fields from the served fold without that scan (named by the [Decision] A package can be disabled while an enabled package's validation rule reads one of its extension fields, and then every write to that object is refused #30379 contract review; re-measure at branch start).

Expected

• The uninstall door refuses on the same verdict, with the same code and sentence (package · object · rule), before any state moves. Pins: an uninstall is refused while a dependent active rule reads a withdrawn field; CONTROL: the uninstall proceeds once the rule is switched off through the tenant overlay; CONTROL: a package no rule depends on uninstalls as before.
• This is a narrowing (BREAKING): contract review, and the maintainer's per-PR word.

Suggested grade: p2 · S · domain:server.