fix(lifecycle): abort unsafe declarative uninstall

core/archipelago/src/api/rpc/package/runtime.rs

@@ -365,8 +365,18 @@ impl RpcHandler {
         // after uninstall. The reconciler owns a manifest map independent of
         // podman state, so a raw `podman rm` alone is not enough.
         if let Some(orchestrator) = &self.orchestrator {
+            let mut teardown_errors = Vec::new();
             for app_id in orchestrator_uninstall_app_ids(package_id) {
-                let _ = orchestrator.remove(&app_id, preserve_data).await;
+                if let Err(err) = orchestrator.remove(&app_id, preserve_data).await {
+                    teardown_errors.push(format!("{app_id}: {err:#}"));
+                }
+            }
+            if !teardown_errors.is_empty() {
+                return Err(anyhow::anyhow!(
+                    "Uninstall {} aborted: failed to remove declarative app unit(s): {}",
+                    package_id,
+                    teardown_errors.join("; ")
+                ));
             }
         }
 
@@ -2182,6 +2192,11 @@ mod tests {
         assert!(!is_missing_container_error("Error: OCI runtime error"));
     }
 
+    #[test]
+    fn single_app_uninstall_targets_its_declarative_unit() {
+        assert_eq!(orchestrator_uninstall_app_ids("cuprate"), vec!["cuprate"]);
+    }
+
     #[test]
     fn runtime_host_ports_are_manifest_derived_for_public_apps() {
         assert_eq!(runtime_host_ports("photoprism"), vec![2342]);