@@ -0,0 +1,12 @@
+---
+'@objectstack/cloud-connection': patch
+---
+
+fix(cloud-connection): an installed app whose register the engine refuses at boot is listed as not loaded, with the refusal's code and sentence
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+An earlier build could ledger a cloud-fetched install whose register the engine refuses (a default page that is not a record page, an object another package owns, two packages of one artifact defining one object, and the like). At every boot the rehydrate meets the same refusal, logs `rehydrate failed`, loads nothing of the package and keeps its ledger entry. `GET /api/v1/marketplace/install-local` listed such an entry as installed, with `withSampleData` and no `notLoaded` marker, so Installed Apps showed an app that the runtime does not hold.
+
+The rehydrate now records a register refusal (a throw declaring a 4xx status, the rule the install door uses to refuse it) where it records the protocol-range refusal. The listing then marks the entry `notLoaded: { code, message }` in place of `withSampleData`: `code` is the refusal's ADR-0112 code and `message` is the engine's sentence, the same one the boot logs. The `notLoaded` marker is now a closed union of two arms. The protocol arm `{ code: 'OS_PROTOCOL_INCOMPATIBLE', requiredRange }` is unchanged. A healthy entry is listed as before. DELETE and a compatible reinstall still act on the marked entry. A register fault that declares no 4xx is not marked, because the next boot can load it. A failure after a successful register is not marked either, because the package is loaded. The console's Installed Apps already shows a non-protocol code as "not loaded".
@@ -394,7 +394,7 @@ import {
     type ObjectOwnerDeclaration,
     type RedeclaredOwnerFieldRefusal,
 } from '@objectstack/metadata-protocol';
-import { resolveThrownHttpError } from '@objectstack/types';
+import { resolveThrownHttpError, type ThrownHttpError } from '@objectstack/types';
 import { unknownQueryParamRefusalMessage } from '@objectstack/rest';
 
 /** What the auth service's in-process session read answers, as `AuthSessionApi` declares it. */
@@ -1209,19 +1209,34 @@ function seedDatasetsOf(manifest: any): PurgeSeedDataset[] {
 }
 
 /**
- * [#21822] The marker the GET listing puts on a ledger entry this boot's
- * `kernel:ready` rehydrate refused to load: the refusal's `code` and the range
- * the package declares.
+ * [#21822, #31566] The marker the GET listing puts on a ledger entry this
+ * boot's `kernel:ready` rehydrate refused to load. A CLOSED union, one arm per
+ * refusal the rehydrate records, each arm's members named one by one:
  *
- * CLOSED: exactly these two members, named one by one from the handshake's own
- * diagnostic, the way `protocolIncompatibleAnswer` names its `details`. ⛔ Not a
- * spread of the diagnostic: a member added to it later does not reach the
- * listing without a decision here.
+ *   - [#21822] ADR-0087 D1's handshake refused the entry's declared protocol
+ *     range: the refusal's `code` and the range the package declares, from the
+ *     handshake's own diagnostic, the way `protocolIncompatibleAnswer` names
+ *     its `details`;
+ *   - [#31566] the engine refused the entry's register
+ *     ({@link isDeclaredRegisterRefusal}): the refusal's `code` (the resolver's
+ *     ADR-0112 vocabulary member — the engine's own code when it is
+ *     registered, otherwise the code its declared status derives, never one
+ *     coined here) and its sentence. A refusal judges before any of the
+ *     artifact's writes stand, so nothing of the entry is loaded.
+ *
+ * ⛔ Not a spread of the diagnostic or the error: a member added to either
+ * later does not reach the listing without a decision here, and neither does a
+ * third arm.
  */
-interface NotLoadedMarker {
-    code: ProtocolIncompatibleDiagnostic['code'];
-    requiredRange: ProtocolIncompatibleDiagnostic['requiredRange'];
-}
+type NotLoadedMarker =
+    | {
+        code: ProtocolIncompatibleDiagnostic['code'];
+        requiredRange: ProtocolIncompatibleDiagnostic['requiredRange'];
+    }
+    | {
+        code: ThrownHttpError['code'];
+        message: ThrownHttpError['message'];
+    };
 
 /**
  * [ADR-0093 D4/D5, ADR-0105 D1 / #5262] Is an organization wall actually IN
@@ -1429,9 +1444,10 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
      */
     private readonly bootUserCodeIds = new Set<string>();
     /**
-     * [#21822] What this boot's `kernel:ready` rehydrate refused to load under
-     * ADR-0087 D1's handshake, keyed by manifest id: the refused entry's
-     * `installedAt` and the marker the GET listing serves for it.
+     * [#21822, #31566] What this boot's `kernel:ready` rehydrate refused to
+     * load — under ADR-0087 D1's handshake, or because the engine refused its
+     * register — keyed by manifest id: the refused entry's `installedAt` and
+     * the marker the GET listing serves for it ({@link NotLoadedMarker}).
      *
      * The record of what the rehydrate DID, written by it alone, never a second
      * judgement of the ledger: the listing does not re-run the handshake.
@@ -1613,7 +1629,28 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
                 // `packages[]` bundle included, whatever its entry states
                 // ([#28534], {@link asMarketplaceRegistration}), a ledger entry
                 // written before that rule included.
-                await manifestService!.register(asMarketplaceRegistration(converted), { source: 'marketplace' });
+                try {
+                    await manifestService!.register(asMarketplaceRegistration(converted), { source: 'marketplace' });
+                } catch (err: unknown) {
+                    // [#31566] A register the engine REFUSED (a declared 4xx,
+                    // {@link isDeclaredRegisterRefusal}) is a ledger entry an
+                    // earlier build wrote before the install door refused it
+                    // (#31478). It meets the same refusal at every boot, and
+                    // nothing of it is loaded — a refused artifact registers
+                    // none of its members — so it is recorded where #21822's
+                    // refusal is, and the listing marks it not loaded instead
+                    // of installed. A fault (no 4xx declared) is not recorded:
+                    // the next boot can load it. Either way the catch below
+                    // logs it, as before.
+                    if (isDeclaredRegisterRefusal(err)) {
+                        const refusal = resolveThrownHttpError(err);
+                        this.refusedAtRehydrate.set(entry.manifestId, {
+                            installedAt: entry.installedAt,
+                            marker: { code: refusal.code, message: refusal.message },
+                        });
+                    }
+                    throw err;
+                }
                 // Sync schemas so the driver creates tables for the newly-
                 // registered objects (idempotent — already-synced tables
                 // are no-ops).
@@ -3220,6 +3257,12 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
      *   { …, "installedAt": "…", "notLoaded": { "code": "OS_PROTOCOL_INCOMPATIBLE", "requiredRange": "^16" } }
      *
      * read from what the rehydrate recorded ({@link refusedAtRehydrate}).
+     * [#31566] An entry whose register the engine refused at the rehydrate (an
+     * earlier build ledgered it) is marked the same way, with that refusal's
+     * code and sentence ({@link NotLoadedMarker}):
+     *
+     *   { …, "notLoaded": { "code": "INVALID_METADATA", "message": "Page \"…\" of package \"…\": …" } }
+     *
      * `notLoaded` stands in place of `withSampleData`: none of the package's
      * objects are registered, so no seed row is read for it and the listing
      * makes no claim about its rows — omitted, not `false`, for the reason