@@ -0,0 +1,12 @@
+---
+'@objectstack/service-datasource': patch
+---
+
+fix(service-datasource): the refusal to delete a datasource that objects still use names its reason and the objects in `error.details`
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- `DELETE /api/v1/datasources/:name` on a runtime datasource that objects are still bound to keeps answering `400` `DATASOURCE_ADMIN_ERROR` with the same English message, and now also carries `error.details`: `{ reason: 'objects_bound', count, objects }`. `reason` tells this refusal apart from every other 400 of the datasource admin routes, `count` is the number in the message, and `objects` lists the bound objects' names, sorted, so a client can name them in its own language without reading object metadata. The names come from the same read as the count, so the two cannot disagree.
+- `DatasourceAdminServiceConfig.countBoundObjectsDiagnosed` may now return `objects` (the names it counted); the shipped plugin wiring does. A host whose read reports only a number keeps working, and its refusal carries `count` without `objects`.
+- Every other 400 of these routes answers exactly as before, with no `details`. The degraded-read refusal (`503` `SERVICE_UNAVAILABLE`) is unchanged.
@@ -3,6 +3,11 @@
 import { describe, it, expect, vi } from 'vitest';
 import { HonoHttpServer } from '@objectstack/plugin-hono-server';
 import { registerDatasourceAdminRoutes } from '../admin-routes.js';
+import {
+  DatasourceAdminService,
+  type DatasourceAdminServiceConfig,
+  type StoredDatasource,
+} from '../datasource-admin-service.js';
 import {
   ENTITLED_CREDENTIAL,
   createSessionAuthService,
@@ -368,3 +373,116 @@ describe('registerDatasourceAdminRoutes (real HonoHttpServer)', () => {
     });
   });
 });
+
+/**
+ * [#30444] The bound-object refusal of `DELETE /datasources/:name` names its
+ * reason and the bound objects in `error.details`, over the REAL admin service
+ * and the real routes, so a client can tell it from every other 400 of the
+ * family and name the objects in its own language. Status, code and message
+ * are unchanged.
+ */
+describe('DELETE /datasources/:name — the bound-object refusal carries details (#30444)', () => {
+  interface Opts {
+    /** The diagnosed read the host reports; omit for a host predating it. */
+    diagnosed?: { count: number; degraded: boolean; errors: string[]; objects?: string[] };
+    plainCount?: number;
+  }
+
+  function deleteHarness(opts: Opts = {}) {
+    const records: StoredDatasource[] = [
+      { name: 'parts_db', driver: 'sqlite', origin: 'runtime' } as StoredDatasource,
+      { name: 'code_db', driver: 'sqlite', origin: 'code' } as StoredDatasource,
+    ];
+    const config = {
+      probe: async () => ({ ok: true }),
+      listDatasourceRecords: async () => records,
+      getDatasourceRecord: async (n: string) => records.find((r) => r.name === n),
+      putDatasourceRecord: async () => {},
+      deleteDatasourceRecord: async (n: string) => {
+        const i = records.findIndex((r) => r.name === n);
+        if (i >= 0) records.splice(i, 1);
+      },
+      writeSecret: async () => 'sys_secret://unused',
+      countBoundObjects: async () => opts.plainCount ?? opts.diagnosed?.count ?? 0,
+      ...(opts.diagnosed ? { countBoundObjectsDiagnosed: async () => opts.diagnosed! } : {}),
+      // A DIFFERENT answer from the count's read, on purpose: the names must
+      // come from the read the count came from, never from a second scan.
+      listObjectsBoundTo: async () => [{ name: 'ghost' }],
+      unregisterPool: () => {},
+    } as unknown as DatasourceAdminServiceConfig;
+    const app = mountServices({ 'datasource-admin': new DatasourceAdminService(config) });
+    return {
+      del: (name: string) => app.fetch(json(`/api/v1/datasources/${name}`, { method: 'DELETE' })),
+      exists: (name: string) => records.some((r) => r.name === name),
+    };
+  }
+
+  it('two bound objects: 400 DATASOURCE_ADMIN_ERROR, the same message, and both names sorted in details', async () => {
+    const h = deleteHarness({
+      diagnosed: { count: 2, degraded: false, errors: [], objects: ['part', 'bin'] },
+    });
+
+    const res = await h.del('parts_db');
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      success: false,
+      error: {
+        code: 'DATASOURCE_ADMIN_ERROR',
+        message: "Cannot remove datasource 'parts_db': 2 object(s) are still bound to it.",
+        details: { reason: 'objects_bound', count: 2, objects: ['bin', 'part'] },
+      },
+    });
+    expect(h.exists('parts_db'), 'the refused datasource survives').toBe(true);
+  });
+
+  it('a host whose read reports only the number answers the count without names', async () => {
+    const h = deleteHarness({ plainCount: 3 });
+
+    const body = (await (await h.del('parts_db')).json()) as any;
+
+    expect(body.error.code).toBe('DATASOURCE_ADMIN_ERROR');
+    expect(body.error.details).toEqual({ reason: 'objects_bound', count: 3 });
+  });
+
+  it('a datasource with nothing bound deletes as before (204)', async () => {
+    const h = deleteHarness({ diagnosed: { count: 0, degraded: false, errors: [], objects: [] } });
+
+    const res = await h.del('parts_db');
+
+    expect(res.status).toBe(204);
+    expect(h.exists('parts_db')).toBe(false);
+  });
+
+  it('another 400 of the same door (a code-defined datasource) carries no details', async () => {
+    const h = deleteHarness({ diagnosed: { count: 2, degraded: false, errors: [], objects: ['bin', 'part'] } });
+
+    const res = await h.del('code_db');
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      success: false,
+      error: {
+        code: 'DATASOURCE_ADMIN_ERROR',
+        message: "Datasource 'code_db' is code-defined and cannot be removed at runtime.",
+      },
+    });
+  });
+
+  it('an error that carries a stray `details` but not the 400 envelope answers the bare message', async () => {
+    // A driver or library error may carry a field named `details`; only a
+    // refusal that declared the route's own `400` code relays it.
+    const thrown = Object.assign(new Error('backing store offline'), {
+      details: { host: 'db.internal', table: 'sys_datasource' },
+    });
+    const app = mountServices({ 'datasource-admin': { removeDatasource: async () => { throw thrown; } } });
+
+    const res = await app.fetch(json('/api/v1/datasources/parts_db', { method: 'DELETE' }));
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({
+      success: false,
+      error: { code: 'DATASOURCE_ADMIN_ERROR', message: 'backing store offline' },
+    });
+  });
+});
@@ -277,6 +277,8 @@ describe('#6504 — the plugin wiring composes the count and the verdict correct
     const read = await config.countBoundObjectsDiagnosed!('warehouse');
 
     expect(read.count, 'the count comes from listObjects(), filtered by datasource').toBe(2);
+    // [#30444] The names ride on the same filtered listing, sorted.
+    expect(read.objects).toEqual(['wh_line', 'wh_order']);
     expect(read.degraded).toBe(true);
     expect(read.errors).toEqual([LOADER_FAILURE]);
     expect(diagnosedCalls, 'the verdict is asked for `object`, the type being counted').toEqual([
@@ -295,6 +297,6 @@ describe('#6504 — the plugin wiring composes the count and the verdict correct
 
     const read = await config.countBoundObjectsDiagnosed!('warehouse');
 
-    expect(read).toEqual({ count: 1, degraded: false, errors: [] });
+    expect(read).toEqual({ count: 1, degraded: false, errors: [], objects: ['wh_order'] });
   });
 });
@@ -658,6 +658,18 @@ export function registerDatasourceAdminRoutes(
     if (envelope?.status === 404 && envelope?.code === 'RESOURCE_NOT_FOUND') {
       return sendError(res, 404, 'RESOURCE_NOT_FOUND', (err as Error).message);
     }
+    // [#30444] A refusal that declared this route's own 400 envelope may carry
+    // `details` (the bound-object refusal of `removeDatasource`: its reason and
+    // the objects' names), relayed as thrown. All three must hold, so a driver
+    // error with a stray `details` field keeps answering the bare message.
+    const details = (err as { details?: unknown } | null | undefined)?.details;
+    if (
+      envelope?.status === 400
+      && envelope?.code === SERVICE_ERROR_CODE[service]
+      && details !== null && typeof details === 'object' && !Array.isArray(details)
+    ) {
+      return sendError(res, 400, SERVICE_ERROR_CODE[service], (err as Error).message, { details });
+    }
     return sendError(res, 400, SERVICE_ERROR_CODE[service], err instanceof Error ? err.message : String(err));
   };
 
 
@@ -188,7 +188,9 @@ export interface IDatasourceAdminService {
 
   /**
    * Remove a runtime datasource. Rejects for code-defined ones and while
-   * objects are still bound to it.
+   * objects are still bound to it; that refusal carries `details`
+   * `{ reason: 'objects_bound', count, objects? }`, `objects` being the bound
+   * objects' names, sorted.
    */
   removeDatasource(name: string): Promise<void>;
 
 
@@ -560,16 +560,24 @@ export class DatasourceAdminServicePlugin implements Plugin {
         const metadata = metadataOf();
         const objects = ((await metadata?.listObjects?.()) ??
           (await metadata?.list('object')) ??
-          []) as Array<{ datasource?: string }>;
-        const count = objects.filter((o) => o?.datasource === datasource).length;
+          []) as Array<{ name?: unknown; datasource?: string }>;
+        // [#30444] The names ride on the same filtered listing as the count,
+        // so a refusal's message and its `details` describe one read.
+        const bound = objects.filter((o) => o?.datasource === datasource);
+        const count = bound.length;
+        const names = bound
+          .map((o) => o.name)
+          .filter((n): n is string => typeof n === 'string')
+          .sort();
         if (typeof metadata?.listDiagnosed !== 'function') {
-          return { count, degraded: false, errors: [] };
+          return { count, degraded: false, errors: [], objects: names };
         }
         const diagnosed = await metadata.listDiagnosed('object');
         return {
           count,
           degraded: diagnosed?.degraded === true,
           errors: Array.isArray(diagnosed?.errors) ? diagnosed.errors : [],
+          objects: names,
         };
       },
 
 
@@ -333,10 +333,15 @@ export interface DatasourceAdminServiceConfig {
    * whose metadata service predates the verdict cannot report the distinction,
    * so its absence means "unchanged behaviour", never "complete". A host that
    * supplies it gets a removal that refuses rather than guesses.
+   *
+   * `objects` names the bound objects the count was taken over, from the SAME
+   * read, so the refusal's message and its `details` cannot disagree. Optional,
+   * so a host that reports only the number keeps working: its refusal then
+   * carries the count without the names.
    */
   countBoundObjectsDiagnosed?: (
     datasource: string,
-  ) => Promise<{ count: number; degraded: boolean; errors: string[] }>;
+  ) => Promise<{ count: number; degraded: boolean; errors: string[]; objects?: string[] }>;
   /**
    * [ADR-0015 §4.2 · #25277] The objects that name `datasource` as theirs, each
    * with its `external` binding as declared (absent when it has none) — the
@@ -527,6 +532,41 @@ function assertSecretNotEmpty(heading: string, secret: SecretInput | undefined):
   );
 }
 
+/**
+ * The refusal {@link DatasourceAdminService.removeDatasource} answers while
+ * objects are still bound to the datasource.
+ *
+ * The answer stays `400` `DATASOURCE_ADMIN_ERROR` with its English sentence;
+ * what this adds is `details`, so a client can tell this refusal from every
+ * other 400 of the family and name the objects in its own language without
+ * re-reading object metadata:
+ *
+ *     { reason: 'objects_bound', count: 2, objects: ['bin', 'part'] }
+ *
+ * `reason` is the discriminator, snake_case like the other `details.reason`
+ * values of the ADR-0112 envelope. `count` is the number in the message.
+ * `objects` is the full list, sorted, present when the host's read names them
+ * (`countBoundObjectsDiagnosed` with `objects`); a host that reports only a
+ * number gets `count` alone.
+ *
+ * `code` and `status` are set so the admin routes' `badRequest` can recognise a
+ * refusal that declared its own envelope and relay its `details`, the same way
+ * it relays the `503` and `404` ones; both are required there.
+ */
+function boundObjectsError(name: string, count: number, objects: string[] | undefined): Error {
+  const err = new Error(
+    `Cannot remove datasource '${name}': ${count} object(s) are still bound to it.`,
+  ) as Error & { code?: string; status?: number; details?: Record<string, unknown> };
+  err.code = 'DATASOURCE_ADMIN_ERROR';
+  err.status = 400;
+  err.details = {
+    reason: 'objects_bound',
+    count,
+    ...(objects ? { objects: [...objects].sort() } : {}),
+  };
+  return err;
+}
+
 function metadataIncompleteError(message: string, errors: string[]): Error {
   const err = new Error(message) as Error & { code?: string; status?: number; cause?: unknown };
   err.code = 'SERVICE_UNAVAILABLE';
@@ -1154,9 +1194,10 @@ export class DatasourceAdminService implements IDatasourceAdminService {
       throw new Error(`Datasource '${name}' is code-defined and cannot be removed at runtime.`);
     }
 
-    const bound = this.config.countBoundObjectsDiagnosed
-      ? await this.config.countBoundObjectsDiagnosed(name)
-      : { count: await this.config.countBoundObjects(name), degraded: false, errors: [] };
+    const bound: { count: number; degraded: boolean; errors: string[]; objects?: string[] } =
+      this.config.countBoundObjectsDiagnosed
+        ? await this.config.countBoundObjectsDiagnosed(name)
+        : { count: await this.config.countBoundObjects(name), degraded: false, errors: [] };
 
     if (bound.degraded) {
       throw metadataIncompleteError(
@@ -1168,11 +1209,9 @@ export class DatasourceAdminService implements IDatasourceAdminService {
       );
     }
 
-    if (bound.count > 0) {
-      throw new Error(
-        `Cannot remove datasource '${name}': ${bound.count} object(s) are still bound to it.`,
-      );
-    }
+    // [#30444] One read: the count in the message and the names in `details`
+    // both come from `bound`, so they cannot disagree.
+    if (bound.count > 0) throw boundObjectsError(name, bound.count, bound.objects);
 
     await this.config.deleteDatasourceRecord(name);
     if (existing.external?.credentialsRef) await this.tryRemoveSecret(existing.external.credentialsRef);