@@ -0,0 +1,12 @@
+---
+'@objectstack/cloud-connection': patch
+---
+
+fix(cloud-connection): an unmanaged install-local refusal that points at the server log now writes the log line
+
+Clause-②: no
+Metadata-protocol: none
+
+`POST /api/v1/marketplace/install-local` with `installMode: 'unmanaged'` answers a refused import with the import's own code and status. When the refusal's message may not be quoted back (it declared its 4xx through `statusCode` or the validation shape rather than a numeric `status`), the answer says "the reason is in the server log". Until now the door wrote that log line only for a 5xx, so a 4xx refusal sent the operator to a log that held nothing about it.
+
+The door now follows one rule at every status: whenever the answer uses that fallback sentence, it writes the `warn` line naming the package, the status, the code and the import's own message. A refusal whose reason reaches the response body writes no line. The status, the code and the response shape are unchanged.
@@ -389,6 +389,37 @@ describe('install-local — the `unmanaged` branch is the import, and nothing of
         expect(h.logger.warn.mock.calls.map((call: any[]) => String(call[0])).join('\n')).toContain('SQLITE_ERROR');
     });
 
+    // A 4xx refusal either carries its reason in the body, or writes the log
+    // line the body points at. Each throw below resolves to a 4xx through a
+    // declaration other than a numeric `status`, so its message is withheld.
+    it.each([
+        ['`statusCode` 409', Object.assign(new Error('Record is locked by approval apv_7'), { statusCode: 409, code: 'RECORD_LOCKED' })],
+        ['the validation shape (no status)', Object.assign(new Error('Validation failed: crm_lead.plan is required'), {
+            code: 'VALIDATION_FAILED',
+            fields: [{ field: 'plan', code: 'required', message: 'plan is required' }],
+        })],
+    ])('a 4xx refusal declared by %s: the body carries its reason, or the log line it points at is written', async (_label, thrown) => {
+        const h = await mount(dir, { importer: async () => { throw thrown; } });
+        const res = await h.install({ manifest: crm({ installModes: BOTH }), installMode: 'unmanaged' });
+        expect(res.status, JSON.stringify(res.payload)).toBeGreaterThanOrEqual(400);
+        expect(res.status).toBeLessThan(500);
+        const warned = h.logger.warn.mock.calls.map((call: any[]) => String(call[0])).join('\n');
+        if (res.payload.error.message.includes('the reason is in the server log')) {
+            expect(warned).toContain(thrown.message);
+        } else {
+            expect(res.payload.error.message).toContain(thrown.message);
+        }
+    });
+
+    it('a 4xx refusal whose reason reaches the body writes no log line', async () => {
+        const refusal = Object.assign(new Error("Package 'com.example.crm' already has a writable copy."), { status: 409, code: 'RESOURCE_CONFLICT' });
+        const h = await mount(dir, { importer: async () => { throw refusal; } });
+        const res = await h.install({ manifest: crm({ installModes: BOTH }), installMode: 'unmanaged' });
+        expect(res.status).toBe(409);
+        expect(res.payload.error.message).toBe(refusal.message);
+        expect(h.logger.warn.mock.calls.map((call: any[]) => String(call[0])).join('\n')).not.toContain(refusal.message);
+    });
+
     it('a runtime whose protocol has no copy-once import answers 503 SERVICE_UNAVAILABLE — never a managed install instead', async () => {
         const h = await mount(dir, { importer: null });
         const res = await h.install({ manifest: crm({ installModes: BOTH }), installMode: 'unmanaged' });
 
@@ -3598,7 +3598,8 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
      *    (uncopyable content, collisions, an owned namespace, an existing
      *    target) and this door answers each with the verb's own code and
      *    status, the message when the verb declared it a refusal, and
-     *    `details`; a 5xx's message is withheld and logged;
+     *    `details`; any other message is withheld and logged, at any
+     *    status, so the log line the answer points at exists;
      *  - translation bundles are COPIED by the verb as `translation` items, so
      *    they reload at every boot with the environment's translations — this
      *    install writes no ledger entry for a rehydrate to replay;
@@ -3651,20 +3652,27 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             } as Parameters<NonNullable<UnmanagedImporter['importUnmanagedPackage']>>[0]);
         } catch (err: any) {
             const resolved = resolveThrownHttpError(err, 500);
-            if (resolved.status >= 500) {
+            // [#29822] One rule, whatever the status: the fallback sentence
+            // promises a log line, so whenever it IS the answer, the line is
+            // written. `clientFacingFailureText` quotes only a refusal that
+            // declared a 4xx `status`; a 4xx this door resolves from another
+            // declaration (`statusCode`, the validation shape) gets the
+            // fallback too, and used to get no log line. A quoted reason
+            // needs no log line: the caller already has it.
+            const fallback = `The unmanaged install of '${manifestId}' failed; the reason is in the server log.`;
+            const message = clientFacingFailureText(err, fallback);
+            if (message === fallback) {
                 ctx.logger?.warn?.(
-                    `[MarketplaceInstallLocal] the unmanaged install of ${manifestId} failed: ${err?.message ?? err}`,
+                    `[MarketplaceInstallLocal] the unmanaged install of ${manifestId} failed (${resolved.status} `
+                    + `${resolved.code}): ${err?.message ?? err}`,
                 );
             }
             const details = isPlainObject(err?.details) ? err.details : undefined;
             return c.json({
                 success: false,
                 error: {
                     code: resolved.code,
-                    message: clientFacingFailureText(
-                        err,
-                        `The unmanaged install of '${manifestId}' failed; the reason is in the server log.`,
-                    ),
+                    message,
                     ...(details ? { details } : {}),
                 },
             }, resolved.status as any);