@@ -0,0 +1,12 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a refused `targetNamespace` on an unmanaged install answers `400 INVALID_REQUEST` with the reason, as documented
+
+Clause-②: no
+Metadata-protocol: none
+
+An unmanaged install whose `targetNamespace` the namespace rule refuses (`Acme`, `my-ns`, too long), or that names a shared namespace (`base`, `system`, `sys`), was refused with a 400 that carried no code. The boundary answered it as `VALIDATION_ERROR`, and the install-local door (`POST /api/v1/marketplace/install-local`) withheld the reason, answering only that it was in the server log.
+
+Both refusals now answer `400 INVALID_REQUEST`, the code the install-modes guide and the other rename refusals already give, with `details.targetNamespace`. Through the install-local door the answer now carries the reason, for example `Invalid package namespace 'Acme' on targetNamespace. ...`. Nothing else changes: the refusal still comes before anything is written, and a `targetPackageId` the id rule refuses still answers `VALIDATION_ERROR`.
@@ -36,6 +36,7 @@ import '@objectstack/runtime';
 import { MarketplaceInstallLocalPlugin } from './marketplace-install-local-plugin.js';
 import { declareInstallerPlatformOwner, installerAuthService, withInstallerGrants } from './install-local-principal.fixtures.js';
 import { LocalManifestSource } from './local-manifest-source.js';
+import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
 
 const ROUTE = '/api/v1/marketplace/install-local';
 const INSTALLER = 'usr_installer';
@@ -567,3 +568,61 @@ describe('install-local — `targetNamespace` renames an unmanaged copy, and onl
         });
     }
 });
+
+describe('install-local — the import\'s own `targetNamespace` refusal, as the door answers it (#30794)', () => {
+    // The REAL copy-once import, not a double: the refusal is judged by its
+    // plan before the engine is asked anything, so an empty engine suffices.
+    const realImporter = () => {
+        const protocol = new ObjectStackProtocolImplementation({ registry: {} } as any, () => new Map()) as any;
+        return (request: any) => protocol.importUnmanagedPackage(request);
+    };
+
+    for (const [label, targetNamespace, sentence] of [
+        ['a value the namespace declaration refuses', 'Acme', "Invalid package namespace 'Acme' on `targetNamespace`"],
+        ['a platform-reserved namespace', 'sys', "`targetNamespace` 'sys' is a platform-reserved namespace"],
+    ] as const) {
+        it(`${label}: 400 INVALID_REQUEST, the reason in the body and \`details.targetNamespace\`; nothing written`, async () => {
+            const h = await mount(dir, { importer: realImporter() });
+            const res = await h.install({ manifest: crm({ installModes: BOTH }), installMode: 'unmanaged', targetNamespace });
+            expect(res.status, JSON.stringify(res.payload)).toBe(400);
+            expect(res.payload.error.code).toBe('INVALID_REQUEST');
+            expect(res.payload.error.message).toContain(sentence);
+            expect(res.payload.error.message).not.toContain('the reason is in the server log');
+            expect(res.payload.error.details).toEqual({ targetNamespace });
+            expect(h.register).not.toHaveBeenCalled();
+            expect(h.ledgerHas('com.example.crm')).toBe(false);
+        });
+    }
+});
+
+describe('install-local — Q6 after a RENAMED copy: the managed install is admitted; after an unrenamed one, refused (#30794)', () => {
+    // The ruling (record 6709037798, Q6 = B): a copy renamed into a namespace
+    // of its own does not hold the source namespace, so a later managed
+    // install of the same source package is not refused. A copy that kept the
+    // source namespace still holds it, and Q6 (step 1f) refuses as written.
+    const renamedCopyHeld: RegistryState = {
+        owners: { acme: ['com.example.crm-copy'] },
+        packages: { 'com.example.crm-copy': { manifest: { id: 'com.example.crm-copy', namespace: 'acme' } } },
+    };
+    const unrenamedCopyHeld: RegistryState = {
+        owners: { crm: ['com.example.crm-copy'] },
+        packages: { 'com.example.crm-copy': { manifest: { id: 'com.example.crm-copy', namespace: 'crm' } } },
+    };
+
+    it('beside a copy renamed to `acme`: the managed install of `com.example.crm` proceeds to its own steps', async () => {
+        const h = await mount(dir, { registry: renamedCopyHeld });
+        const res = await h.install({ manifest: crm({ installModes: BOTH }) });
+        expect(res.payload?.error?.code, JSON.stringify(res.payload)).not.toBe('RESOURCE_CONFLICT');
+        expect(h.register).toHaveBeenCalledTimes(1);
+    });
+
+    it('TWIN: beside a copy that kept `crm`, the same install is refused 409 RESOURCE_CONFLICT, before any write', async () => {
+        const h = await mount(dir, { registry: unrenamedCopyHeld });
+        const res = await h.install({ manifest: crm({ installModes: BOTH }) });
+        expect(res.status).toBe(409);
+        expect(res.payload.error.code).toBe('RESOURCE_CONFLICT');
+        expect(res.payload.error.details).toEqual({ namespace: 'crm', base: 'com.example.crm-copy' });
+        expect(h.register).not.toHaveBeenCalled();
+        expect(h.ledgerHas('com.example.crm')).toBe(false);
+    });
+});
@@ -954,20 +954,22 @@ describe('planUnmanagedImport — `targetNamespace`, the rename-on-install (#307
         }
     });
 
-    it('refuses a value the namespace declaration refuses — 400, naming `targetNamespace`, never sanitised', () => {
+    it('refuses a value the namespace declaration refuses — INVALID_REQUEST / 400, naming `targetNamespace`, never sanitised', () => {
         for (const targetNamespace of ['Acme', 'a', 'my-ns', '1acme', 'acme_namespace_too_long']) {
             const err = (() => { try { plan(renamableBody(), { targetNamespace }); } catch (e) { return e as any; } })();
             const envelope = resolveThrownHttpError(err);
-            expect([envelope.status, envelope.code]).toEqual([400, 'VALIDATION_ERROR']);
+            expect([envelope.status, envelope.code]).toEqual([400, 'INVALID_REQUEST']);
+            expect(err.details).toEqual({ targetNamespace });
             expect(err.message).toContain(`Invalid package namespace '${targetNamespace}' on \`targetNamespace\``);
         }
     });
 
-    it('refuses a platform-reserved namespace — `base`, `system`, `sys` — 400', () => {
+    it('refuses a platform-reserved namespace — `base`, `system`, `sys` — INVALID_REQUEST / 400, naming `targetNamespace`', () => {
         for (const targetNamespace of ['base', 'system', 'sys']) {
             const err = (() => { try { plan(renamableBody(), { targetNamespace }); } catch (e) { return e as any; } })();
             const envelope = resolveThrownHttpError(err);
-            expect([envelope.status, envelope.code]).toEqual([400, 'VALIDATION_ERROR']);
+            expect([envelope.status, envelope.code]).toEqual([400, 'INVALID_REQUEST']);
+            expect(err.details).toEqual({ targetNamespace });
             expect(err.message).toContain(`\`targetNamespace\` '${targetNamespace}' is a platform-reserved namespace`);
         }
     });
 
@@ -480,16 +480,26 @@ export function planUnmanagedImport(
         const declared = ManifestSchema.shape.namespace.safeParse(targetNamespace);
         if (!declared.success) {
             const rule = declared.error.issues[0]?.message ?? 'See `manifest.namespace`';
-            throw invalidRequest(
+            // `INVALID_REQUEST` / 400 with `details.targetNamespace`, as the
+            // documented refusal row and the rename refusal below answer: a
+            // code-less 400 reaches the boundary as the status-derived
+            // `VALIDATION_ERROR`, and the install-local door withholds its reason.
+            throw refusal(
+                'INVALID_REQUEST',
+                400,
                 `Invalid package namespace '${targetNamespace}' on \`targetNamespace\`. ${rule}. It becomes the `
                 + 'copy\'s `manifest.namespace` and the prefix of every copied object name.',
+                { targetNamespace },
             );
         }
         if (PLATFORM_RESERVED_NAMESPACES.has(targetNamespace)) {
-            throw invalidRequest(
+            throw refusal(
+                'INVALID_REQUEST',
+                400,
                 `\`targetNamespace\` '${targetNamespace}' is a platform-reserved namespace `
                 + `(${[...PLATFORM_RESERVED_NAMESPACES].map((ns) => `'${ns}'`).join(', ')}), which many packages share, `
                 + 'so it cannot carry one copy\'s names. Name a namespace of the copy\'s own.',
+                { targetNamespace },
             );
         }
     }