@@ -0,0 +1,19 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql)!: uninstalling a base package is refused while its paired `.custom` package is installed, naming the pair (409, the extender-refusal family) (#28408)
+
+Clause-②: no (narrowing) — `SchemaRegistry.assertPackageUninstallable`, and so `uninstallPackage`, `unregisterObjectsByPackage` without `force`, the protocol's `deletePackage` and `DELETE /api/v1/packages/:id`, now refuse the uninstall of a base while the registry holds its paired customization package (`BASE.custom`), an uninstall that succeeded before; nothing is widened.
+Metadata-protocol: none
+Skills-docs: none — no file under `skills/**` teaches uninstalling a package, so every taught use stays true.
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: a registry state that refuses an uninstall gains one more cause, answered with the existing RESOURCE_CONFLICT / 409 refusal, so there is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing at the package uninstall (`@objectstack/objectql`, ADR-0146 D3).
+
+- **Before.** A base package uninstalled while its paired customization package (`hotcrm.custom` for `hotcrm`) was installed. Every customization in the pair was stranded: nothing served it, and nothing said why.
+- **Now.** The uninstall is refused `409 RESOURCE_CONFLICT`, in the same refusal an extended object already gets (ADR-0029), before anything is removed. The message names the pair and opens with the way out: delete the pair first, exporting it before that to keep its customizations (`GET /api/v1/packages/PAIR/export`). When the base is also extended, one refusal names the extenders and the pair. The thrown error carries the pair as `customizationPackageId`.
+- **Unchanged.** Uninstalling the pair itself; a base with no installed pair; `force`, which still means not asking; a dependent that is not the base's own pair (ADR-0141 D3 still defers it). On `DELETE /api/v1/packages/:id` a base the deployment ships is still refused `422 WRITABLE_PACKAGE_REQUIRED` first.
+
+**The remedy.** Export the pair if you want to keep its customizations, delete it, then uninstall the base.
@@ -122,7 +122,14 @@ export async function deletePackage(this: Pick<PackageUninstallHost, 'deleteMeta
     // the same predicate (the one copy `unregisterObjectsByPackage` itself
     // calls) without performing the uninstall, so the refusal is thrown
     // here, as is, with nothing removed. The HTTP door answers it through
-    // its `catch` around this verb: `500`, nothing changed.
+    // its `catch` around this verb, with the refusal's own `409
+    // RESOURCE_CONFLICT`: nothing changed.
+    //
+    // [#28408, ADR-0146 D3] The same question also refuses a base whose
+    // paired customization package (`<base>.custom`) the registry holds,
+    // naming the pair, in the same refusal; both causes ride on one throw.
+    // It is asked here, before the store delete, for the same reason: a base
+    // removed under its pair strands every customization the pair holds.
     //
     // The registry is reached the way the withdrawal below reaches it. A
     // registry that does not carry the method (an engine double, a host on
 
@@ -24,6 +24,17 @@
  *  4. `unregisterObjectsByPackage` and `uninstallPackage` refuse with that
  *     same refusal, by calling it (not a copy of its predicate), and `force`
  *     still means "do not ask".
+ *
+ * #28408 (ADR-0146 D3) — it also refuses a base while the registry holds its
+ * paired customization package, `<base>.custom` (the epic's two-minute check:
+ * 「卸载 HotCRM 被拒并点名 `hotcrm.custom`」). Pinned in the second block:
+ *  5. the pair present: the same `RESOURCE_CONFLICT` / 409, naming the pair,
+ *     the way out (delete it, exporting it first) leading, and nothing mutated;
+ *  6. the pair absent — or a `.custom` package that is not this base's pair —
+ *     answers as before;
+ *  7. both causes: ONE refusal carrying the extenders and the pair;
+ *  8. the pair itself uninstalls as before, after which the base does (the
+ *     prescription is a real way out), and `force` still does not ask.
  */
 
 import { describe, it, expect, beforeEach, vi } from 'vitest';
@@ -158,3 +169,114 @@ describe('#21276 SchemaRegistry.assertPackageUninstallable', () => {
     expect(ask).not.toHaveBeenCalled();
   });
 });
+
+describe('#28408 (ADR-0146 D3) a base whose paired customization package is installed', () => {
+  const BASE = 'hotcrm';
+  const PAIR = 'hotcrm.custom';
+
+  /** The base with one object nothing extends, and (unless told not to) its pair. */
+  function withBase(opts: { pair?: string | false } = {}) {
+    const r = new SchemaRegistry({ multiTenant: false });
+    (r as any).logLevel = 'silent';
+    r.installPackage({ id: BASE, name: 'HotCRM', version: '3.2.1', type: 'app', namespace: 'crm' } as any, 'marketplace');
+    r.registerObject({ name: 'account', fields: {} } as any, BASE, 'crm', 'own');
+    const pair = opts.pair ?? PAIR;
+    if (pair !== false) {
+      // Declares the base, as the paired package does (`^<major>`, ADR-0146 D3).
+      r.installPackage(
+        {
+          id: pair, name: 'HotCRM customizations', version: '1.0.0', type: 'app', namespace: 'crm_custom',
+          dependencies: { [BASE]: '^3' },
+        } as any,
+        'authored',
+      );
+    }
+    return r;
+  }
+
+  /** What an uninstall would change: package records and object contributors, as plain data. */
+  function stateOf(r: SchemaRegistry) {
+    return {
+      packages: r.getAllPackages().map((p) => p.manifest.id).sort(),
+      account: r.getObjectContributors('account').map((c) => `${c.packageId}:${c.ownership}`),
+    };
+  }
+
+  it('the pair present: RESOURCE_CONFLICT / 409 naming it, the way out first, and nothing mutated', () => {
+    const r = withBase();
+    const before = stateOf(r);
+    expect(before.packages, 'precondition: the base and its pair are installed').toEqual([BASE, PAIR]);
+
+    const err = thrownBy(() => r.assertPackageUninstallable(BASE));
+
+    expect({ code: err.code, status: err.status, httpStatus: err.httpStatus }).toEqual({
+      code: 'RESOURCE_CONFLICT',
+      status: 409,
+      httpStatus: 409,
+    });
+    expect({
+      packageId: err.packageId,
+      customizationPackageId: err.customizationPackageId,
+      extendedObjects: err.extendedObjects,
+      extenders: err.extenders,
+    }).toEqual({ packageId: BASE, customizationPackageId: PAIR, extendedObjects: [], extenders: [] });
+    expect(err.message.startsWith(`Delete the customization package "${PAIR}" first`), err.message).toBe(true);
+    expect(err.message).toContain(`GET /api/v1/packages/${PAIR}/export`);
+    expect(stateOf(r)).toEqual(before);
+
+    // `uninstallPackage` asks it, so the uninstall itself is the same refusal
+    // and removes nothing: the base keeps its record and its object.
+    const viaUninstall = thrownBy(() => r.uninstallPackage(BASE));
+    expect({ code: viaUninstall.code, status: viaUninstall.status, message: viaUninstall.message }).toEqual({
+      code: err.code,
+      status: err.status,
+      message: err.message,
+    });
+    expect(stateOf(r)).toEqual(before);
+  });
+
+  it('the pair absent: answers as before — and a .custom package that is not this base\'s pair changes nothing', () => {
+    expect(() => withBase({ pair: false }).assertPackageUninstallable(BASE)).not.toThrow();
+    // `hotcrmx.custom` is another base's pair, and `hotcrm.extras` is a
+    // dependent that is not the pair, whose uninstall protection ADR-0141 D3
+    // still defers: both declare the base, and neither is the id `hotcrm`
+    // derives.
+    for (const other of ['hotcrmx.custom', 'hotcrm.extras']) {
+      const r = withBase({ pair: other });
+      expect(() => r.assertPackageUninstallable(BASE), other).not.toThrow();
+      expect(r.uninstallPackage(BASE), other).toBe(true);
+    }
+  });
+
+  it('both causes: ONE refusal carrying the extenders and the pair', () => {
+    const r = withBase();
+    r.registerObject({ name: 'account', fields: {} } as any, 'com.addon', undefined, 'extend');
+    const before = stateOf(r);
+
+    const err = thrownBy(() => r.assertPackageUninstallable(BASE));
+
+    expect({ code: err.code, status: err.status }).toEqual({ code: 'RESOURCE_CONFLICT', status: 409 });
+    expect(err.customizationPackageId).toBe(PAIR);
+    expect(err.extendedObjects).toEqual([{ objectName: 'account', extenders: ['com.addon'] }]);
+    expect(err.extenders).toEqual(['com.addon']);
+    expect(err.message.startsWith(
+      `Uninstall the package that extends an object of "${BASE}" (com.addon) and delete the customization package "${PAIR}" first`,
+    ), err.message).toBe(true);
+    expect(err.message).toContain('"account"');
+    expect(stateOf(r)).toEqual(before);
+  });
+
+  it('the pair itself uninstalls as before, and then the base does; force still does not ask', () => {
+    const r = withBase();
+    expect(() => r.assertPackageUninstallable(PAIR)).not.toThrow();
+    expect(r.uninstallPackage(PAIR)).toBe(true);
+    expect(r.uninstallPackage(BASE)).toBe(true);
+    expect(stateOf(r).packages).toEqual([]);
+
+    const forced = withBase();
+    const ask = vi.spyOn(forced, 'assertPackageUninstallable');
+    forced.unregisterObjectsByPackage(BASE, true);
+    expect(ask).not.toHaveBeenCalled();
+    expect(forced.getObject('account')).toBeUndefined();
+  });
+});
@@ -46,7 +46,7 @@ import { SystemFieldName, scalarOverridesPackagedBase } from '@objectstack/spec/
 import { resolveTenancyPosture, resolveSearchPinyinEnabled } from '@objectstack/types';
 import { postureEnforcesWall } from '@objectstack/spec/security';
 import { provisionSearchCompanion, SEARCH_COMPANION_FIELD } from './search-companion.js';
-import { ObjectStackManifest, ManifestSchema, InstalledPackage, InstalledPackageSchema, InstalledPackageSourceSchema, type InstalledPackageSource, checkFieldCompleteness } from '@objectstack/spec/kernel';
+import { ObjectStackManifest, ManifestSchema, InstalledPackage, InstalledPackageSchema, InstalledPackageSourceSchema, type InstalledPackageSource, checkFieldCompleteness, customizationPackageId } from '@objectstack/spec/kernel';
 import { DEFAULT_FLOW_FUNCTION_EFFECT } from '@objectstack/spec/automation';
 import { AppSchema, ActionSchema } from '@objectstack/spec/ui';
 import { applyProtection } from '@objectstack/spec/shared';
@@ -2790,6 +2790,19 @@ const EXTENDED_OBJECTS_LISTED = 5;
  * in registration order — and the prescription names every extending package,
  * so one answer is the whole way out rather than the first step of several.
  *
+ * [#28408, ADR-0146 D3] …and the uninstall refusal of a base whose paired
+ * customization package is installed: `<base>.custom`, the id
+ * {@link customizationPackageId} derives, held by this registry. That package
+ * holds every customization of the base, so uninstalling the base under it
+ * would strand them all, with nothing serving them and nothing saying why.
+ * ADR-0146 puts this refusal in this family and this shape, so it is this
+ * class rather than a sibling: one refusal, decided by the same method and
+ * raised at the same doors. When both causes hold, the ONE refusal carries
+ * both, and its prescription is the whole way out — uninstall the extenders
+ * and delete the pair. The pair is named by id, with the way to keep what it
+ * holds before it is deleted: its own export door. The class keeps its name
+ * because ADR-0141 and ADR-0146 cite it as the anchor of this family.
+ *
  * ⛔ Unexported, like its siblings: a consumer compares `code`, never
  * `instanceof` (see the note over the `*_CODE` constants).
  */
@@ -2804,25 +2817,53 @@ class PackageUninstallExtendedError extends Error {
   readonly extendedObjects: readonly ExtendedObjectOfUninstall[];
   /** Every extending package, once each, in the order the objects name them. */
   readonly extenders: readonly string[];
+  /**
+   * [#28408, ADR-0146 D3] The base's paired customization package, when this
+   * registry holds it — `undefined` when that is not a cause of this refusal.
+   */
+  readonly customizationPackageId: string | undefined;
 
-  constructor(packageId: string, extendedObjects: readonly ExtendedObjectOfUninstall[]) {
+  constructor(
+    packageId: string,
+    extendedObjects: readonly ExtendedObjectOfUninstall[],
+    customizationPackage?: string,
+  ) {
     const extenders = [...new Set(extendedObjects.flatMap((o) => o.extenders))];
     const listed = extendedObjects
       .slice(0, EXTENDED_OBJECTS_LISTED)
       .map((o) => `object "${o.objectName}" is extended by ${o.extenders.join(', ')}`);
     const more = extendedObjects.length - listed.length;
+    const extendersStep = extendedObjects.length === 0 ? undefined :
+      `the ${extenders.length === 1 ? 'package that extends' : 'packages that extend'} ` +
+      `${extendedObjects.length === 1 ? 'an object' : 'objects'} of "${packageId}"`;
+    const extendersFact = extendedObjects.length === 0 ? undefined :
+      `${listed.join('; ')}${more > 0 ? `; and ${more} more extended object${more === 1 ? '' : 's'}` : ''}`;
+    // The pair's step names its own export door, so "export it or delete it"
+    // is one instruction: export to keep what it holds, then delete it.
+    const pairStep = customizationPackage === undefined ? undefined :
+      `the customization package "${customizationPackage}" first (to keep its customizations, export it ` +
+      `before that: GET /api/v1/packages/${customizationPackage}/export)`;
+    const extendersReason = 'a package cannot be uninstalled while another package extends an object it owns ' +
+      '(objectExtensions, ADR-0029)';
+    const pairReason = 'while its paired customization package is installed, which would strand every ' +
+      'customization it holds (ADR-0146 D3)';
     super(
-      `Uninstall the ${extenders.length === 1 ? 'package that extends' : 'packages that extend'} ` +
-        `${extendedObjects.length === 1 ? 'an object' : 'objects'} of "${packageId}" first ` +
-        `(${extenders.join(', ')}), then uninstall "${packageId}" again: a package cannot be ` +
-        `uninstalled while another package extends an object it owns (objectExtensions, ADR-0029). ` +
-        `Cannot uninstall package "${packageId}": ${listed.join('; ')}` +
-        `${more > 0 ? `; and ${more} more extended object${more === 1 ? '' : 's'}` : ''}.`,
+      extendersStep !== undefined && pairStep !== undefined
+        ? `Uninstall ${extendersStep} (${extenders.join(', ')}) and delete ${pairStep}, then uninstall ` +
+          `"${packageId}" again: ${extendersReason}, nor ${pairReason}. Cannot uninstall package ` +
+          `"${packageId}": ${extendersFact}; and its customization package "${customizationPackage}" is installed.`
+        : pairStep !== undefined
+          ? `Delete ${pairStep}, then uninstall "${packageId}" again: a package cannot be uninstalled ` +
+            `${pairReason}. Cannot uninstall package "${packageId}": its customization package ` +
+            `"${customizationPackage}" is installed.`
+          : `Uninstall ${extendersStep} first (${extenders.join(', ')}), then uninstall "${packageId}" again: ` +
+            `${extendersReason}. Cannot uninstall package "${packageId}": ${extendersFact}.`,
     );
     this.name = 'PackageUninstallExtendedError';
     this.packageId = packageId;
     this.extendedObjects = extendedObjects;
     this.extenders = extenders;
+    this.customizationPackageId = customizationPackage;
   }
 }
 
@@ -5631,13 +5672,23 @@ export class SchemaRegistry {
    * its prescription is the whole way out. The decision is unchanged: the
    * package is refused exactly when the first such object exists.
    *
+   * [#28408, ADR-0146 D3] It also refuses while this registry holds the
+   * package's paired customization package — the id
+   * {@link customizationPackageId} derives from `packageId`, so the pair is
+   * found by id alone, whichever door created or installed it. The same
+   * refusal, carrying both causes when both hold. Uninstalling the pair itself
+   * asks nothing of this kind: a `.custom` id derives no pair of its own. An
+   * id that derives no valid pair id (`@acme/crm`) cannot have one installed,
+   * so it is not asked either.
+   *
    * ⛔ ONE predicate: {@link unregisterObjectsByPackage} calls this method
    * rather than keeping its own copy, so the question asked ahead and the
    * refusal raised by the uninstall cannot disagree. `force` is not a
    * parameter here: forcing means not asking, and stays the caller's choice.
    *
    * @throws PackageUninstallExtendedError (`RESOURCE_CONFLICT` / 409) if the
-   *   package owns an object another package extends (ADR-0029)
+   *   package owns an object another package extends (ADR-0029), or its
+   *   paired customization package is installed (ADR-0146 D3)
    */
   assertPackageUninstallable(packageId: string): void {
     const extended: ExtendedObjectOfUninstall[] = [];
@@ -5654,7 +5705,11 @@ export class SchemaRegistry {
         extended.push({ objectName: fqn, extenders: otherExtenders.map(c => String(c.packageId)) });
       }
     }
-    if (extended.length > 0) throw new PackageUninstallExtendedError(packageId, extended);
+    const pair = customizationPackageId(packageId);
+    const installedPair = pair.ok && this.getPackage(pair.value) !== undefined ? pair.value : undefined;
+    if (extended.length > 0 || installedPair !== undefined) {
+      throw new PackageUninstallExtendedError(packageId, extended, installedPair);
+    }
   }
 
   /**
@@ -5668,7 +5723,8 @@ export class SchemaRegistry {
    * its own mutations.
    *
    * @throws PackageUninstallExtendedError (`RESOURCE_CONFLICT` / 409) if trying
-   *   to uninstall an owner that has extenders — {@link assertPackageUninstallable}'s
+   *   to uninstall an owner that has extenders, or a base whose paired
+   *   customization package is installed — {@link assertPackageUninstallable}'s
    */
   unregisterObjectsByPackage(packageId: string, force: boolean = false): void {
     // [#7970] REFUSAL PASS — see {@link assertPackageUninstallable}, which holds