fix(rest): the dispatcher's /packages domain is the one implementation of the package read and delete routes (#14503) - #16628

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/rest, @objectstack/runtime, touching 46 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/rest/src/query-multiplicity.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

34 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json b38821d1ce220527e2a7f34e254a96c48e2a9ba3.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 57a8c6a9e7f51e73e55c3955d803541a4254e813 && git checkout 57a8c6a9e7f51e73e55c3955d803541a4254e813
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b38821d1ce220527e2a7f34e254a96c48e2a9ba3 a9f826933de660fc7aa51551132e96ab9f186f6d && git checkout -B drift-repro b38821d1ce220527e2a7f34e254a96c48e2a9ba3 && git merge --no-ff a9f826933de660fc7aa51551132e96ab9f186f6d

node scripts/docs-audit/affected-docs.mjs --json b38821d1ce220527e2a7f34e254a96c48e2a9ba3

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b38821d1ce220527e2a7f34e254a96c48e2a9ba3 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — verdict: PASS WITH FINDINGS

Ruling implemented: yes — option A of #14503, in the ruled order (measure → verify compositions → delete with the survivor pinned). Landing stays gated on the maintainer's answer to the step-2 fork report (5571983259, options A′/B′/C′), which this PR correctly escalated instead of resolving; the draft state is right until that is ruled. Nothing wider than A was taken (no scoped mountPackagesRoute variant, no dispatcher behaviour change); nothing narrower (all three routes are gone, the SHADOWS sentence with them, the survivor pinned on both mounts).

Read: card #14503 and its ruling, the PR head ba6b8311ed fetched into a throwaway ref and read via git show, current origin/main 8ccf7a1df. The PR body was treated as a claim; every line below was measured on the tree.

1. The ruling, verbatim, and what the PR does with it

Ruled: A. The three service-gated routes in packages/rest/src/package-routes.ts that duplicate the dispatcher's /packages and /packages/:id twins are removed, together with the SHADOWS comment; packages/runtime/src/domains/packages.ts is the single implementation. One URL, one body. […] 1. Measure first […] What has a consumer is ported into the dispatcher; what has none is recorded in the changeset as deliberately removed, not silently dropped. 2. Verify that every composition mounting the REST package routes also mounts the dispatcher packages domain; a composition that would lose /packages under the deletion is a fork report to the decision inbox, not a unilateral choice. 3. Then delete, with the 404 wording and the envelope shape of the surviving door pinned so "which door answered" stays observable.

• Step 1: census re-taken on the branch base with controls; source (0 readers) and ?version= multiplicity refusal (0 senders of the repeat; 1 sender of the parameter, the scoped SDK, carded client.packages declares envelopes two mounted surfaces do not emit: get diverges between them, and install/enable/disable declare { package } where the only serving surface sends the bare row #12034) — both recorded as deliberately removed in the changeset, nothing ported. Consistent with the ruling.
• Step 2: the fork exists (scoped mount on plugin-hono-server without createHonoApp) and was filed to the decision inbox, not decided here. Consistent with the ruling.
• Step 3: packages/rest/src/package-routes.ts on main mounted GET {base}/packages, GET {base}/packages/:id, DELETE {base}/packages/:id behind resolvePackageService() (main :944-946); on the head the registrar builds routes = [publishRoute] and nothing else (head :407 is the only path: left). The read cohort, the protocol seam, the _Pin* compile-time types (never re-exported from packages/rest/src/index.ts, so not public API), the registry projection helper and the ?version= reads all went with it.

2. "One implementation" — route census on the head

packages/hono/src/*.ts and packages/plugins/plugin-hono-server/src/*.ts: zero /packages route registrations (grep, non-test). On main the REST registrar carried a second registration for each of the three (package-routes.ts:873, :967 and the list route). After the PR: exactly one each. Claim holds.

Anything silently gone? Unscoped: no — every in-tree composition that mounts the REST registrar also mounts the dispatcher (serve.ts, verify/harness.ts, plugin-dev), and on a stock boot the REST copies were never mounted (the gate ran before PackageServicePlugin registered), so the dispatcher was already the door. Scoped without createHonoApp: yes — those three URLs now fall to the transport's bare 404 with no refusal envelope. This is stated in the changeset and is the open fork; it is the maintainer's call, not a defect of this PR.

3. Wire contract on the surviving door

• GET /packages/:id → { success, data: <InstalledPackage row>, meta }. Matches GetInstalledPackageResponseSchema (packages/spec/src/api/package-api.zod.ts:96-98, data: InstalledPackageSchema bare). FROM data.package + source TO data — stated in the changeset. ✅
• 404 on both GET and DELETE → deps.error("Package '<id>' not found", 404) → error.code = RESOURCE_NOT_FOUND via packages/runtime/src/error-envelope.ts:120 (standardErrorCodeForHttpStatus, errors.zod.ts:176). ADR-0112 envelope holds; wording change stated. ✅
• Anonymous refusal: both doors used shouldDenyAnonymous (packages.ts:552; removed REST refusePackageRequest). Same status/code. ✅
• Capability refusal code changed and is not in the changeset — see F1.
• GET /packages and DELETE /packages/:id do not match their packages/spec declarations — see F2 (pre-existing on the dispatcher, but the survivor is now the only implementation, so it is the contract).

Findings

F1 — 403 refusal code changes FORBIDDEN → PERMISSION_DENIED on the three routes; undisclosed.
packages/runtime/src/domains/packages.ts:249-256 (requireManageMetadata) and :281-290 (requireReadCapability) call deps.error(message, 403) with no explicit code; packages/runtime/src/error-envelope.ts:120 then derives standardErrorCodeForHttpStatus(403) = PERMISSION_DENIED (packages/spec/src/api/errors.zod.ts:175). The removed REST copies emitted sendError(res, 403, 'FORBIDDEN', …) (main package-routes.ts, the refusePackageRequest write/read branches). Same status, same message text, different error.code — a client branching on err.code === 'FORBIDDEN' for a package read/delete refusal stops matching on any composition that reached the REST copies. Both codes are ADR-0112 standard members, so the envelope holds. Expectation: one row in .changeset/rest-package-routes-single-implementation.md: capability refusals on GET /packages, GET /packages/:id, DELETE /packages/:id answer 403 PERMISSION_DENIED (FROM 403 FORBIDDEN), messages unchanged. Level stays minor.

F2 — the "surviving shape is the spec's own" claim is true only for GET /:id; the list and uninstall shapes do not match spec, and nothing pins them.

• GET /packages answers { packages, total } (packages.ts:585); ListInstalledPackagesResponseSchema (package-api.zod.ts:71-77) requires hasMore: z.boolean(), and declares inputs enabled/limit/cursor the domain does not read (it reads status and an undeclared type, :576-581).
• DELETE /packages/:id answers { success, registryRemoved, persisted } (packages.ts:1296); UninstallPackageApiResponseSchema (package-api.zod.ts:358-364) requires packageId.
• The runtime ledger rows for packages.list / packages.uninstall (packages/runtime/src/route-ledger.ts:336, :339) carry no responseSchema; grep finds no test outside packages/spec referencing either schema.
  This drift predates the PR (the REST copies did not match either), so it is not introduced here — but with one implementation there is now exactly one thing to reconcile. Expectation: (a) the changeset/PR body scope the spec-conformance sentence to GET /packages/:id; (b) a card, not a rider, for reconciling the list and uninstall doors with PackageApiContracts.listPackages / .uninstallPackage (or retiring those declarations under ADR-0049 if the dispatcher's shape is the ruled one).

F3 — scoped SDK binding is stale the moment this merges (disclosed, carded).
packages/client/src/index.ts:366-377: ScopedEnvironmentClient.packages.get(id, version?) returns { package: InstalledPackage } and its docblock says only the REST registrar serves the scoped mount. On this head the scoped door (through the catch-all) answers the bare row and ignores version. Held on #12034 (open, pm:awaiting-maintainer), acknowledged in the PR body. Expectation: #12034 queues in the same train, or its remaining half is named in the changeset as known-stale; either is acceptable. Not blocking.

4. Tests (read, not trusted)

• Reddens if a second REST implementation reappears: packages/rest/src/package-publish-mount.test.ts:129-149 (registrar returns exactly ['POST /api/v1/packages/publish'] with and without a package service, and asserts the three former twins absent); packages/rest/src/direct-mount-introspection.test.ts (ledger has only the publish row; the twins are neither mounted nor in OpenAPI on either boot, scoped base included); packages/rest/src/rest-route-ledger.conformance.test.ts:153-181 (mounted direct-mount set ≡ ledger set in both directions, so a resurrected route without a row reds, and a stale row without a mount reds). ✅
• Survivor pinned: packages/runtime/src/domains/packages-single-door.test.ts — 404 wording verbatim with RESOURCE_NOT_FOUND, retired spelling asserted absent, envelope key set ['data','meta','success'], no package wrapper, no source on row or list rows, unscoped and /environments/:id/… through dispatch() with the catch-all-derived subpath, two negative controls (ROUTE_NOT_FOUND). Identity goes through the real resolver, not a bypass. ✅
• Per removed route "gone or refused": the REST absence pins above cover "gone" at the registrar and ledger. There is no pin that the scoped URL on the plugin-hono-server-only composition answers anything in particular — correct, because what it should answer is the open fork.
• The 8 deleted REST pin files (package-delete-status-classification, package-door-producer-key-carry, package-id-registry-read-refusal, package-list-durable-read-refusal, package-list-registry-read-refusal, package-list-writable-carry, package-registry-item-projection, package-routes-query-multiplicity) pinned REST-copy-only behaviour (registry+durable merge, source, ?version=, REST's projection). Dispatcher-side equivalents exist for what survives: packages-writable-verdict.test.ts, packages-readonly-gate.test.ts, packages-serializable-response.test.ts, packages-uninstall-envelope.test.ts (PACKAGE_DELETE_PARTIAL). ✅
• packages/runtime/src/domains/packages.ts diff is comment-only (verified line by line); "behaviour untouched" holds.

5. Changeset and governed paths

• .changeset/rest-package-routes-single-implementation.md: @objectstack/rest minor — matches the ruling. FROM/TO stated for the /:id envelope, 404 wording, source, ?version= + refusal, durable-row merge, DELETE tenancy width (allTenants: true → caller's organization), discovery, and the scoped-mount residue. Missing: F1. No @objectstack/runtime changeset — correct (comments + a test).
• Governed paths (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md): none touched. content/docs/releases/: untouched. The three content/docs edits and packages/qa/dogfood/test/authz-probe-blind-spot.census.ts (94→91, reachable moved with population, blind spot 0) read accurate against the code.

6. CI and mergeability

• Head ba6b8311ed: 37 check runs, all success except two skipped (Console Pin Gate, packed-tarball opt-in); Vercel status success. Lint & Repo Gates green on this head (the check:doc-authoring red was on c1344677dc, fixed).
• GitHub reports mergeable_state: unknown. Measured: git merge-tree --write-tree origin/main(8ccf7a1df) <head> exits 0, no conflicts. The branch is 51 commits behind main (recorded base 8341ed21c); a merge from main before ready-for-review is hygiene, not a blocker.

Summary for the PM

• Ruling A executed as ruled; step-2 fork correctly escalated (5571983259) — that ruling is the landing gate, not this review.
• Required before ready: F1 (one changeset row). Recommended: F2(a) one sentence; F2(b) a card.
• Not approving, not marking ready, no labels changed, no files edited.

Generated by Claude Code

Patch round — F1, F2 and the C′ residue (director seat ruling 5579647072)

Head a9f826933 (was ba6b8311ed). Dispatched by the director seat against the recorded step-2 ruling C′ (#14503, comment 5579647072): land now with the residue disclosed, #16781 carries the scoped mountPackagesRoute variant. ⛔ No scoped dispatcher mount is added here; nothing widened.

What changed

1. origin/main merged (3d35f8fcd, plain merge, base ed7243d52, 61 commits behind → 0). ⛔ No rebase, no amend, no force-push. No textual conflict — git merge exited 0 with nothing to resolve; no generator or --fix re-run was owed and no anchor was hand-edited.

2. One semantic conflict, resolved by keeping this PR's deletion (a9f826933). origin/main landed packages/rest/src/package-door-16019-raw-statement-fault-code.test.ts while this branch was open. It pins the #16019 raw-statement declared-fault code at both REST package doors, and its two DELETE /api/v1/packages/:id cases drive a route this branch removes: the merge is clean textually and red semantically — Error: no handler for DELETE /api/v1/packages/:id, 1 file / 2 tests. Resolution: the two DELETE cases and the deleteWith helper are removed and the docblock records why. They are not re-pointed at the dispatcher — the surviving door uninstalls through protocol.deletePackage and the registry, never through PackageService.delete, so the producer this file doubles has no delete door left in @objectstack/rest. The producer-side half is untouched and still pinned in service-package's delete-driver-fault.test.ts ([#16019] block). The publish half of the file is unchanged and still green.

3. F1 — capability-refusal error.code, one changeset row (d417f9464). Capability refusals on GET /packages, GET /packages/:id and DELETE /packages/:id answer 403 PERMISSION_DENIED; the removed REST copies emitted sendError(res, 403, 'FORBIDDEN', …). Measured on the merged tree: requireManageMetadata (packages/runtime/src/domains/packages.ts:254) and requireReadCapability (:287) call deps.error(message, 403) with no code, and packages/runtime/src/error-envelope.ts:120 derives one from the status via standardErrorCodeForHttpStatus, which maps 403 to PERMISSION_DENIED (packages/spec/src/api/errors.zod.ts:175). Same status, same message — both cohort strings ("Managing packages requires the manage_metadata capability." and "Reading packages requires the studio.access or setup.access capability.") are byte-identical on the two doors. Both codes are ADR-0112 standard members, so the envelope holds; what moves is that a client branching on err.code === 'FORBIDDEN' for a package read or delete refusal stops matching on any composition that really did reach the REST copies. Level unchanged: @objectstack/rest minor.

4. F2 — the spec-conformance claim scoped, the drift named as pre-existing (d417f9464). The changeset now claims spec conformance for GET /packages/:id only (its { success, data, meta } is GetInstalledPackageResponseSchema, data: InstalledPackageSchema bare). The other two are named as pre-existing drift that this release neither introduces nor changes, carded on #16781: GET /packages answers { packages, total } (packages.ts:599) while ListInstalledPackagesResponseSchema requires hasMore (package-api.zod.ts:76); DELETE /packages/:id answers { success, registryRemoved, persisted } (packages.ts:1354) while UninstallPackageApiResponseSchema requires packageId (package-api.zod.ts:360). The missing responseSchema on the runtime ledger rows for packages.list / packages.uninstall is named there too.

5. C′ residue, verbatim in the changeset (d417f9464): "On a plugin-hono-server composition with enableProjectScoping and no createHonoApp, the scoped /api/v1/environments/:id/packages[/:id] routes have no door until #16781 lands (ruled C′ on #14503)." Mirrored in the PR body's Boundary paragraph, where "the ruling's step 2 makes this the maintainer's call" is replaced by the recorded ruling (5579647072, C′) and #16781.

Tests — counts on a9f826933, all through scripts/pm/os-verify-lock.sh, VERDICT lines read

Gate exit codes — verbatim, redirected before capture, never a bare $?

The two that were red on the raw diff — check:system-context-census and check:doc-authoring — are 0 on this head. No exit 3 (NOT MEASURED) in this round; no gate is reported as green that was not measured.

Declared narrowing. This round changed two files (the changeset and one @objectstack/rest test). The roster node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derives for the full PR diff at this head is 145 commands; the families that read this round's two paths are the changeset family, nul-bytes, test-source-alias and cross-package-test-inputs, all run above, plus the two docs gates the dispatch named. The rest of the farm is left to CI, which is the run that owns it. origin/main advanced to b38821d1c during this round (2 commits) — the merge above is against ed7243d52.

Not done, deliberately

• Not marked ready, not merged, no auto-merge, no label changes — the ruling reserves those for the director seat.
• No scoped mountPackagesRoute variant, and no change to either drifting response shape: both are finding(runtime): scoped /api/v1/environments/:id/packages[/:id] has no dispatcher door on a plugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781's, per C′.
• The ruling comment's ledger line reads objectstack#12708; the card actually filed for B′ and named in the dispatch is finding(runtime): scoped /api/v1/environments/:id/packages[/:id] has no dispatcher door on a plugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781, whose body cites this PR and the C′ ruling. finding(runtime): scoped /api/v1/environments/:id/packages[/:id] has no dispatcher door on a plugin-hono-server-only composition after #16628 (B′ follow-up to #14503) #16781 is what the changeset and body now reference.

Generated by Claude Code

Contract review (CONTRACT_REVIEW_TIER, isolated seat) — PR #16628 @ a9f8269 — re-review

Verdict: PASS — conditional only on the CI run for a9f826933 finishing green (state at posting time in §6). Nothing in the tree blocks landing; the three prior findings are discharged, the semantic test conflict was resolved as a legitimate narrowing (not a skipped test), and no governed path is touched.

Read: head a9f826933de660fc7aa51551132e96ab9f186f6d fetched into a throwaway ref and read via git show / git diff (never checked out); merge-base with origin/main is ed7243d52; origin/main at read time b38821d1c. The PR body, the patch-round comment (5580072783) and the changeset were treated as claims; every line below was measured on the tree.

The ruling this re-review holds the PR to

#14503, comment 5579647072 (director seat, decision batch #84, 2026-09-08):

Ruled: C′ — land PR #16628 now with the residue disclosed in the changeset; card B′ as a follow-up. […] Execution for #16628 before landing (contract review 5578894182): F1 — one changeset row for the capability-refusal error.code 403 FORBIDDEN → 403 PERMISSION_DENIED; F2 — scope the "surviving shape is the spec's own" claim to GET /packages/:id and name the hasMore / packageId drift as pre-existing; changeset states the C′ residue verbatim ("a scoped composition without the catch-all has no /packages door until <B′ card>"); merge origin/main. Then ready + auto-merge by the director seat (non-governed, @objectstack/rest minor).

The ruling's ledger line says objectstack#12708; the B′ card actually filed and referenced by the changeset and body is #16781. The patch round disclosed that discrepancy itself; the tree references #16781 consistently, which is the card that exists.

Prior findings (review 5578894182 @ ba6b831) — discharged?

Also owed by the ruling: merge origin/main — done (3d35f8fcd, plain merge, base ed7243d52, no textual conflict; git merge-tree --write-tree origin/main a9f826933 against today's b38821d1c exits 0 as well). C′ residue verbatim — present as the last sentence of the changeset: "On a plugin-hono-server composition with enableProjectScoping and no createHonoApp, the scoped /api/v1/environments/:id/packages[/:id] routes have no door until #16781 lands (ruled C′ on #14503)."

Numbered verification

1. Diff surface and governed paths. git diff ed7243d52..a9f826933 --name-status: 38 files, +945 / −4032. 1 changeset added; 3 content/docs pages (none under releases/); 1 dogfood census; 26 files under packages/rest/src (8 test files deleted, 1 source-level module package-routes.ts cut 800 lines, ledger/server/composition/plugin edits, 13 tests re-pointed incl. the #16019 file); packages/runtime/src/domains/packages.ts (comment-only — diff read line by line, no executable hunk) plus the new packages-single-door.test.ts; 2 scripts. Governed paths (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/): none — grep over the name list returns nothing. Governed Surface Queue Guard: success.

2. The semantic conflict — package-door-16019-raw-statement-fault-code.test.ts.

• What main landed (PR fix(driver-sql, driver-turso): SqlDriver.execute() declares a backend refusal as DATABASE_ERROR/500 instead of leaking the dialect's error object #16650, 001a83b04): a REST door pin with 6 cases; two drive DELETE /api/v1/packages/:id through registerPackageRoutes with a PackageService double whose delete throws the declared DATABASE_ERROR/500 fault (AFTER) or returns { success: false } (BEFORE → PACKAGE_DELETE_FAILED).
• Why it was red after the merge: on this branch the registrar mounts only POST /packages/publish (packages/rest/src/package-routes.ts:406-407 is the only path:), so the file's own drive() throws no handler for DELETE /api/v1/packages/:id. Read, not inferred — the helper is at :110.
• What this PR did: removed the two DELETE cases and deleteWith, left the four publish-side cases byte-for-byte, and rewrote the docblock to say why ("no delete-door subject for THIS producer is left in this package to pin"). Diff read in full.
• Is the looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 delete-door code still pinned somewhere that survives? Producer half: yes — packages/services/service-package/src/delete-driver-fault.test.ts, its [#16019] block: the declared fault propagates identity-unchanged out of PackageService.delete (rejects.toBe(fault), with status 500 / code DATABASE_ERROR asserted on the object) and the undeclared ancestor still takes branch ③ — untouched by this PR. Door half: there is no surviving door for it, and that is correct, not a gap. The dispatcher's DELETE /packages/:id (packages/runtime/src/domains/packages.ts:1255-1361) never calls PackageService.delete; it calls protocol.deletePackage(...) and wraps that in errorFromThrown(e, 500). PackageService.delete is reached from there only inside packages/metadata-protocol/src/protocol.ts:18543-18556, the "DB-created base packages vanish from GET /packages after server restart #2532 counterpart" sys_packages cleanup, which is try { pkgSvc.delete(id) } catch (e) { console.warn(...) } — a declared DATABASE_ERROR from the producer is swallowed to a warning on this door and never reaches the wire. So the looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 door contract ("the declared fault's code answers at the door") has no subject on the surviving DELETE; re-pointing the two cases at the dispatcher would have asserted something false.
• Verdict on the deletion: a legitimate narrowing, not "never skip a test". The subject of the two cases (a REST door that calls PackageService.delete directly) is what the packages/rest package read routes claim to SHADOW their dispatcher twins, but the dispatcher answers /packages and /packages/:id on a stock showcase boot #14503 ruling removes; the cases are deleted with the subject, the reason is in the docblock, the producer-side pin survives, and no it.skip / describe.skip / .todo was introduced anywhere in the diff (grep over the 38 files: 0). The REST absence pins (package-publish-mount.test.ts:141, direct-mount-introspection.test.ts:135/289) red if the delete door ever comes back, which is the moment the door half would be owed again.

3. Changeset (.changeset/rest-package-routes-single-implementation.md): @objectstack/rest: minor — matches the ruling. F1 row: present and accurate (derivation in the table above). F2 scoping: present, names both drift cases and #16781. C′ residue: present, verbatim in the ruled form with #16781 as the <B′ card>. All earlier rows (FROM data.package TO data, source removed, durable-row merge removed, ?version= + refusal removed, 404 wording, DELETE tenancy width, discovery, ledger rows) unchanged from the prior review. No @objectstack/runtime changeset — still correct (comments + a test). Check Changeset: success.

4. PR body "Boundary" paragraph: cites "the director seat recorded C′ on #14503 (comment 5579647072, decision batch #84, 2026-09-08)" and "#16781 carries the scoped mountPackagesRoute variant … together with the F2 response-shape reconciliation"; the earlier "maintainer's call" phrasing is gone; the withdrawn "a repo not in this session" attribution stays withdrawn. ✅

5. Route census on the head — unchanged from ba6b831.

packages/hono/src/*.ts and packages/plugins/plugin-hono-server/src/*.ts (non-test): zero /packages registrations. Every other /packages mention in packages/rest/src non-test files is docblock prose describing the removal.

6. CI on a9f826933 (read at posting time, 35 check runs): 24 success, 2 skipped (Console Pin Gate, Packed-tarball smoke opt-in), 9 in_progress, 0 failure. Still running at 06:06Z: Test Core 4/6 and 5/6, Dogfood Regression Gate 1/3–3/3, Temporal Conformance (live PG + MySQL), Build Core, Dogfood Verify CLI, Lint & Repo Gates. Already green: all four Type Check jobs, Test Core 1/2/3/6, Build Docs, Check Changeset, Governed Surface Queue Guard, the three claim/part-of guards, Spec property liveness, docs links. The verdict above is conditional on those nine completing green; the two that were red on earlier heads (Dogfood — the #13260 census; Lint & Repo Gates — check:doc-authoring) were green on ba6b831 and the round-5 diff touches neither input. mergeable_state reported blocked — that is the draft/required-review state, not a conflict; merge-tree against b38821d1c is clean.

Residual findings

R1 — informational, not blocking: the surviving DELETE /packages/:id cannot surface a sys_packages driver fault at all. Consequence of the reading in §2: on the one implementation, a durable-row delete that fails (no such table, FK restriction, lock timeout — the exact family delete-driver-fault.test.ts reproduces) is logged by protocol.deletePackage and the door still answers 200 { success: true, registryRemoved, persisted } — and per the #2532 comment at that site, the row left behind re-hydrates the package on the next restart. Pre-existing dispatcher behaviour, reachable on every stock boot before this PR, so not introduced here and not a defect of this PR; the REST copy that could answer 500 DATABASE_ERROR for it was never mounted on a stock boot. Expectation: none for landing. Recommended: one line on #16781 (which already owns the uninstall-shape reconciliation) or on #16019 noting that with the REST door gone, the declared delete fault has a producer pin but no wire-observable door, so the card's "two doors" narrative is now one door with a swallow.

R2 — housekeeping, not blocking: the ruling comment's ledger line reads objectstack#12708 while the filed card is #16781. Already disclosed by the patch round; the tree is consistent on #16781. Expectation: the director seat corrects the ledger line on #14503 if it is load-bearing anywhere; nothing owed in this PR.

Summary for the director seat

• All three ruled pre-landing items (F1 row, F2 scoping + card, C′ residue verbatim) and the origin/main merge are on the tree as ruled.
• The looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 test edit is a narrowing whose subject the ruling removed; the producer pin survives; no test is skipped.
• Nothing blocks landing except CI finishing on this head. Not approving, not marking ready, no labels changed, no files edited; throwaway ref deleted.

Generated by Claude Code