fix(plugin-security): an unreachable namespace verdict undoes the position create or rename it guarded

Claude-Session: https://claude.ai/code/session_013j5gkUCpqQiti4GgPqqmnt
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/position-write-through.test.ts

@@ -508,6 +508,18 @@ describe('[C2 stage S10, ADR-0048 addendum N.2/N.3] one namespace — a create o
     expect(await b.envRows(held)).toEqual([]);
   });
 
+  it('a verdict the door cannot reach is no admission: the create and the rename are undone, and the failure is the answer', async () => {
+    const b = await boot();
+    const created: any = await create(b, { name: 'yard_lead', label: 'Yard lead' });
+    const unreadable = Object.assign(new Error('registry unreadable'), { code: 'METADATA_STORE_UNAVAILABLE', status: 503 });
+    vi.spyOn(b.protocol, 'packagedBaseRefusal').mockImplementation(() => { throw unreadable; });
+    expect(await refusalOf(create(b, { name: 'dock_lead', label: 'Dock lead' }))).toBe(unreadable);
+    expect(await b.rows('dock_lead')).toEqual([]);
+    expect(await refusalOf(patch(b, created.id, { name: 'gate_lead' }))).toBe(unreadable);
+    expect((await b.rows('yard_lead')).map((r) => r.id)).toEqual([created.id]);
+    expect(await b.rows('gate_lead')).toEqual([]);
+  });
+
   it('control: the engine\'s own refusals keep their answer — a reserved identity name stays VALIDATION_FAILED', async () => {
     const b = await boot();
     // The platform holds `org_admin` too, but the engine's rule validator refuses

packages/plugins/plugin-security/src/position-write-through.ts

@@ -379,13 +379,17 @@ export function createPositionWriteThrough(
       const createdRows: Record<string, unknown>[] = [];
       for (const created of written) createdRows.push((await readRowById(ql, created.id)) ?? created);
       // [S10] A name a package or a built-in holds is not taken: the door's
-      // refusal is the answer, asked before any definition is saved.
-      for (const row of createdRows) {
-        const refusal = heldPositionNameRefusal(door, row.name);
-        if (refusal) {
-          await undoInsert(written);
-          throw refusal;
+      // refusal is the answer, asked before any definition is saved. A verdict
+      // the door could not reach (it re-raises anything but its refusal) is
+      // no answer either: the rows go, and the failure is the answer.
+      try {
+        for (const row of createdRows) {
+          const refusal = heldPositionNameRefusal(door, row.name);
+          if (refusal) throw refusal;
         }
+      } catch (e) {
+        await undoInsert(written);
+        throw e;
       }
       const saved: Record<string, unknown>[] = [];
       for (const row of createdRows) {
@@ -425,14 +429,16 @@ export function createPositionWriteThrough(
     }
 
     // [S10] A rename into a name a package or a built-in holds is not taken:
-    // the door's refusal is the answer, and the row gets its old values back.
-    // An edit that keeps such a name stands down below.
-    for (const { pre, post } of posts) {
-      const refusal = pre.name !== post.name ? heldPositionNameRefusal(door, post.name) : null;
-      if (refusal) {
-        await undoUpdate(targets, patch);
-        throw refusal;
+    // the door's refusal (or its failure to answer) is the answer, and the row
+    // gets its old values back. An edit that keeps such a name stands down below.
+    try {
+      for (const { pre, post } of posts) {
+        const refusal = pre.name !== post.name ? heldPositionNameRefusal(door, post.name) : null;
+        if (refusal) throw refusal;
       }
+    } catch (e) {
+      await undoUpdate(targets, patch);
+      throw e;
     }
 
     // Every new definition first; the old names' definitions go only once all landed.