@@ -0,0 +1,16 @@
+---
+'@objectstack/types': patch
+'@objectstack/rest': patch
+---
+
+fix(types): a write to a registered object whose table is missing answers `500 DATABASE_ERROR`, as the read does, instead of `404 OBJECT_NOT_FOUND` "is not registered"
+
+Clause-②: no (an existing refusal is re-classified to an existing catalog code; nothing accepted today is refused)
+Metadata-protocol: none
+
+A registered object whose table was never created (a datasource that was never provisioned, schema drift) answered its two data doors differently. `GET /api/v1/data/:object` answered `500 DATABASE_ERROR`, which the SQL driver declares at its read exits. `POST /api/v1/data/:object` answered `404 OBJECT_NOT_FOUND` with "Object '…' is not registered", because the write paths leave the driver's own error undeclared and the shared data-error classification read its missing-relation line (`no such table: …`, Postgres `42P01 relation "…" does not exist`) as an unregistered object whenever the relation named the request's object.
+
+No unregistered name reaches a driver: the protocol's registry gate and the engine's name resolution both refuse one first, with the structured `OBJECT_NOT_FOUND` that the classification still answers `404`. So a driver's missing-relation line always means a registered object's storage is missing. The classification now answers it the sanitised, logged `500 DATABASE_ERROR` in every case, and the insert, update and delete doors agree with the read.
+
+- **What changes for a caller.** A write to such an object gets `500 {"error":"Internal data error","code":"DATABASE_ERROR"}` instead of a `404`. A bulk-import row that fails this way carries the same verdict. The driver text is withheld from the client and written to the server log, where the `404` used to leave no line.
+- **Unchanged.** An unregistered object is still `404 OBJECT_NOT_FOUND` on every door. A missing relation that names some other table was already `500 DATABASE_ERROR`.
@@ -485,10 +485,13 @@ describe('[#22741] §3 — controls: what the predicate must NOT change', () =>
   it.each([
     ['SQLite', `SQLITE_ERROR: no such table: ${OBJECT}`],
     ['Postgres', `relation "${OBJECT}" does not exist`],
-  ])('CONTROL [#22868] — a real %s unknown-object text on the requested object still answers 404', (_driver, text) => {
+  ])('CONTROL [#22868] — a real %s missing-relation text on the requested object keeps the heuristic\'s reading', (_driver, text) => {
+    // [#27702] That reading is a store fault, not `OBJECT_NOT_FOUND`: no
+    // unregistered name reaches a driver, so the relation is a registered
+    // object's missing storage.
     const door = mapDataError(new Error(text), OBJECT);
-    expect(door.status).toBe(404);
-    expect(door.body.code).toBe('OBJECT_NOT_FOUND');
+    expect(door.status).toBe(500);
+    expect(door.body.code).toBe('DATABASE_ERROR');
   });
 
   it('CONTROL [#22868] — the same object-naming texts, thrown by anything but the sandbox, keep the heuristic\'s 404', () => {
 
@@ -171,8 +171,9 @@ async function bootStack(makePlugin: () => any, opts: { withAnalytics?: boolean
     // Registering an object after bootstrap misses the boot-time schema sync,
     // so nothing has issued this table's DDL. The mingo driver this fixture used
     // before #4065 created a table on first touch and hid that; on SQL the
-    // insert fails with `no such table`, which the REST error mapper turns into
-    // a 404 OBJECT_NOT_FOUND — a routing-shaped symptom for a DDL-shaped cause.
+    // insert fails with `no such table`, which the REST error mapper used to
+    // turn into a 404 OBJECT_NOT_FOUND — a routing-shaped symptom for a
+    // DDL-shaped cause (a 500 DATABASE_ERROR since #27702).
     await ql.syncObjectSchema('task');
     for (const o of authzResolverObjects) ql.registry.registerObject(o.def as never, o.owner);
     // A real `single` install's Default Organization: the writes below derive
 
@@ -0,0 +1,181 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#27702] A registered object whose table is missing is answered the same
+ * classified error on its insert as on its read — never `OBJECT_NOT_FOUND`.
+ *
+ * ## What was measured
+ *
+ * The object is registered after the DDL ran, so the engine resolves it and
+ * the driver addresses a table that was never created — the card's setup (a
+ * code object bound to a datasource whose table was never provisioned).
+ *
+ * | door | producer of the answer | before |
+ * |---|---|---|
+ * | `GET /data/:object`, `GET /data/:object/:id` | driver-sql's declared read-exit fault (`backendStatementFault`) | `500 DATABASE_ERROR` |
+ * | `POST /data/:object` | the boundary's text classification of the raw driver error (`classifyDataError`) | `404 OBJECT_NOT_FOUND` "Object '…' is not registered" |
+ *
+ * The write paths leave the driver as the dialect's raw error by design (the
+ * boundary turns a unique violation into a 409, an unknown column into a 400),
+ * so the boundary's missing-relation limb is what answered the insert. It read
+ * "the relation the caller named is missing" as "the object is not
+ * registered" — but no unregistered name reaches a driver: the protocol's
+ * registry gate and the engine's own name resolution refuse it first, with the
+ * structured `OBJECT_NOT_FOUND` that the classifier matches above every text
+ * limb. A missing relation is therefore always a registered object whose
+ * storage is missing, and the read's verdict for it is the classified one.
+ *
+ * ## What is pinned
+ *
+ * - each door answers the same status and code for the missing table;
+ * - that answer is the read's `500 DATABASE_ERROR`;
+ * - the control: an unregistered object is still `404 OBJECT_NOT_FOUND` on
+ *   both doors — the gate's answer, untouched.
+ *
+ * The SQLite cell always runs. The live Postgres cell (`42P01 relation "…"
+ * does not exist`, the card's dialect) runs when `OS_TEST_POSTGRES_URL` is
+ * set and is a named skip otherwise.
+ *
+ * Ablation: restoring the attributed missing-relation 404 in
+ * `@objectstack/types`' `classifyDataError` turns the agreement cells and the
+ * insert's own cell red (the POST answers 404 again), while the control stays
+ * green.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
+import { RestServer } from './rest-server';
+import { installDefaultOrganization } from './default-organization.testkit.js';
+
+/** Registered after the DDL, so its table never exists. */
+const OBJECT = 'wh_note_27702';
+/** Never registered. */
+const GHOST = 'wh_ghost_27702';
+
+const NOTE = {
+  name: OBJECT,
+  label: 'Warehouse note',
+  sharingModel: 'public_read_write',
+  fields: { title: { name: 'title', type: 'text', label: 'Title' } },
+};
+
+interface Cell {
+  id: 'sqlite' | 'pg';
+  label: string;
+  env: string | null;
+  config: () => Record<string, unknown> | null;
+}
+
+const CELLS: readonly Cell[] = [
+  { id: 'sqlite', label: 'sqlite', env: null, config: () => ({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }) },
+  {
+    id: 'pg',
+    label: 'live postgres',
+    env: 'OS_TEST_POSTGRES_URL',
+    config: () => (process.env.OS_TEST_POSTGRES_URL ? { client: 'pg', connection: process.env.OS_TEST_POSTGRES_URL } : null),
+  },
+];
+
+function createMockServer() {
+  const noop = () => {};
+  return { get: noop, post: noop, put: noop, delete: noop, patch: noop, use: noop, listen: async () => {}, close: async () => {} };
+}
+
+function makeRes() {
+  const res: any = {
+    write: () => true, end: () => {}, setHeader: () => {},
+    header: () => res,
+    status: (code: number) => { res._status = code; return res; },
+    json: (body: any) => { res._json = body; return res; },
+  };
+  return res;
+}
+
+interface Answer {
+  status: number;
+  code: unknown;
+}
+
+for (const cell of CELLS) {
+  const config = cell.config();
+  describe.skipIf(!config)(
+    `[#27702] a registered object whose table is missing — insert and read agree — ${cell.label}${config ? '' : ` (skipped: set ${cell.env} to run this cell)`}`,
+    () => {
+      let engine: ObjectQL;
+      let driver: any;
+      let call: (method: string, path: string, req: Record<string, unknown>) => Promise<Answer>;
+
+      const dropTable = async () => {
+        if (cell.id === 'sqlite') return;
+        await driver?.execute(`drop table if exists ${OBJECT}`).catch(() => {});
+      };
+
+      beforeAll(async () => {
+        driver = new SqlDriver(config as any);
+        await dropTable();
+        engine = new ObjectQL();
+        engine.registerDriver(driver, true);
+        await engine.init();
+        await installDefaultOrganization(engine);
+        // After the DDL: the registry holds the object, the database has no table for it.
+        engine.registry.registerObject(NOTE as any, '@objectstack/rest');
+
+        const protocol = new ObjectStackProtocolImplementation(engine as any);
+        const rest = new RestServer(createMockServer() as any, protocol as any, { api: { requireAuth: false } } as any);
+        (rest as any).resolveExecCtx = async () => ({ userId: 'test-user' });
+        rest.registerRoutes();
+        call = async (method, path, req) => {
+          const route = rest.getRoutes().find((r: any) => r.method === method && r.path === path);
+          expect(route, `${method} ${path}`).toBeDefined();
+          const res = makeRes();
+          await route!.handler({ method, params: {}, query: {}, body: {}, headers: {}, ...req } as any, res);
+          return { status: res._status ?? 200, code: res._json?.code };
+        };
+      }, 60_000);
+
+      afterAll(async () => {
+        await dropTable();
+        await engine?.destroy().catch(() => {});
+      }, 60_000);
+
+      const insert = (object: string) =>
+        call('POST', '/api/v1/data/:object', { params: { object }, body: { title: 'first' } });
+      const list = (object: string) => call('GET', '/api/v1/data/:object', { params: { object } });
+      const read = (object: string) => call('GET', '/api/v1/data/:object/:id', { params: { object, id: 'rec_1' } });
+
+      it('premise: the object is registered and its table is missing', async () => {
+        expect(engine.getSchema(OBJECT)).toBeDefined();
+        await expect(driver.find(OBJECT, {})).rejects.toBeTruthy();
+      }, 60_000);
+
+      it('the read answers the classified store fault: 500 DATABASE_ERROR', async () => {
+        expect(await list(OBJECT)).toEqual({ status: 500, code: 'DATABASE_ERROR' });
+        expect(await read(OBJECT)).toEqual({ status: 500, code: 'DATABASE_ERROR' });
+      }, 60_000);
+
+      it('the insert answers the same, never OBJECT_NOT_FOUND', async () => {
+        const answer = await insert(OBJECT);
+        expect(answer.code).not.toBe('OBJECT_NOT_FOUND');
+        expect(answer).toEqual({ status: 500, code: 'DATABASE_ERROR' });
+      }, 60_000);
+
+      it('insert and read agree', async () => {
+        expect(await insert(OBJECT)).toEqual(await list(OBJECT));
+      }, 60_000);
+
+      it('the update and delete doors answer the same', async () => {
+        const update = await call('PATCH', '/api/v1/data/:object/:id', { params: { object: OBJECT, id: 'rec_1' }, body: { title: 'second' } });
+        const remove = await call('DELETE', '/api/v1/data/:object/:id', { params: { object: OBJECT, id: 'rec_1' } });
+        expect(update).toEqual({ status: 500, code: 'DATABASE_ERROR' });
+        expect(remove).toEqual({ status: 500, code: 'DATABASE_ERROR' });
+      }, 60_000);
+
+      it('control: an unregistered object is still 404 OBJECT_NOT_FOUND on both doors', async () => {
+        expect(await insert(GHOST)).toEqual({ status: 404, code: 'OBJECT_NOT_FOUND' });
+        expect(await list(GHOST)).toEqual({ status: 404, code: 'OBJECT_NOT_FOUND' });
+      }, 60_000);
+    },
+  );
+}
@@ -20,8 +20,8 @@
  * What the file owns, in the order a thrown error meets it:
  *
  *   classification  {@link mapDataError} — the error → `{ status, body }` table,
- *                   with {@link declaredHttpStatus}, {@link isScriptFaultMessage}
- *                   and {@link missingRelationIsObject} as its judgements and
+ *                   with {@link declaredHttpStatus} and {@link isScriptFaultMessage}
+ *                   as its judgements and
  *                   {@link DATA_STORE_FAULT} / {@link UNCLASSIFIED_FAULT} as its
  *                   two sanitised 5xx terminals.
  *   resolution      {@link resolveErrorResponse} — the same answer WITHOUT
 
@@ -34,6 +34,14 @@
 // sanitised, logged 500; per the direction on this issue the safe way to be
 // wrong is loud, never silently 404.
 //
+// [#27702] The attributed half is gone too: a missing relation is a sanitised,
+// logged 500 even when it names the request's own object. No unregistered name
+// reaches a driver (the registry gates refuse it first, with a structured
+// `OBJECT_NOT_FOUND`), so that relation belongs to a registered object whose
+// storage is missing, and its read already answers `500 DATABASE_ERROR`.
+// § 2's last cell and § 3's driver cell pin it; the reverse-verification table
+// below is #5462's, measured before this change.
+//
 // ---------------------------------------------------------------------------
 // Reverse verification, direction predicted BEFORE running
 // ---------------------------------------------------------------------------
@@ -337,57 +345,58 @@ describe('[#5462] a missing relation is attributed, or it is a fault', () => {
         expect(r.body.code).toBe('DATABASE_ERROR');
     });
 
-    it('a qualified relation name still attributes: schema prefixes are stripped', () => {
-        // Prime Directive #6 — object name IS table name — is what makes the
-        // comparison sound; the schema/catalog qualifier is not part of it.
+    it('[#27702] the requested object\'s OWN relation is a fault too, in every spelling', () => {
+        // These used to attribute to a 404 "Object 'acct' is not registered".
+        // The registry gates refuse an unregistered name before any driver
+        // sees it, so a driver missing the object's own relation is reporting
+        // a REGISTERED object whose storage is missing — the read of it
+        // answers this same `500 DATABASE_ERROR`
+        // (`data-door-missing-relation-registered-object.test.ts`).
         for (const message of [
+            'no such table: acct',
             'no such table: main.acct',
+            'relation "acct" does not exist',
             'relation "public.acct" does not exist',
             'SQLITE_ERROR: no such table: "acct"',
+            'no such table: ACCT',
         ]) {
             const r = mapDataError(driverError(message), 'acct');
-            expect(r.status, message).toBe(404);
-            expect(r.body.code, message).toBe('OBJECT_NOT_FOUND');
+            expect(r.status, message).toBe(500);
+            expect(r.body.code, message).toBe('DATABASE_ERROR');
         }
     });
-
-    it('attribution is case-insensitive, matching object-name resolution', () => {
-        const r = mapDataError(driverError('no such table: ACCT'), 'acct');
-        expect(r.status).toBe(404);
-        expect(r.body.code).toBe('OBJECT_NOT_FOUND');
-    });
 });
 
 // ---------------------------------------------------------------------------
 // 3. The genuine unknown object must stay a quiet 404 (③)
 // ---------------------------------------------------------------------------
 //
-// The half of the semantics this change is not allowed to break. Both producers
-// of the verdict are checked, because #3770's whole point is that they land on
-// ONE wire envelope.
+// The half of the semantics this change is not allowed to break. Since #27702
+// the registry gate is the verdict's only producer: the driver's missing-table
+// line no longer is, because no unregistered name reaches a driver.
 
 describe('[#5462] a real unknown object is still 404 OBJECT_NOT_FOUND, still silent', () => {
     const registryGate = (object: string) =>
         Object.assign(new Error(`Object '${object}' not found`), {
             code: 'OBJECT_NOT_FOUND', status: 404, object,
         });
 
-    it('the driver limb: the missing table IS the object asked for', () => {
-        const r = mapDataError(driverError('no such table: ghost'), 'ghost');
+    it('the registry gate is the 404\'s source (#3770)', () => {
+        const r = mapDataError(registryGate('ghost'), 'ghost');
         expect(r.status).toBe(404);
         expect(r.body.code).toBe('OBJECT_NOT_FOUND');
         expect(r.body.error).toBe("Object 'ghost' is not registered");
     });
 
-    it('gate and driver still produce the identical envelope (#3770)', () => {
-        expect(mapDataError(registryGate('ghost'), 'ghost'))
-            .toEqual(mapDataError(driverError('no such table: ghost'), 'ghost'));
-    });
-
-    it('the Postgres spelling of the same condition also stays 404', () => {
-        const r = mapDataError(driverError('relation "ghost" does not exist'), 'ghost');
-        expect(r.status).toBe(404);
-        expect(r.body.code).toBe('OBJECT_NOT_FOUND');
+    it('[#27702] the driver limb no longer answers it: a missing table behind a name is a store fault', () => {
+        // An unregistered name never reaches a driver — the gate above refuses
+        // it — so the driver's missing-relation line, in either dialect, is
+        // about a registered object whose storage is missing.
+        for (const message of ['no such table: ghost', 'relation "ghost" does not exist']) {
+            const r = mapDataError(driverError(message), 'ghost');
+            expect(r.status, message).toBe(500);
+            expect(r.body.code, message).toBe('DATABASE_ERROR');
+        }
     });
 
     it('the engine-authored limbs are untouched', () => {
@@ -414,7 +423,7 @@ describe('[#5462] a real unknown object is still 404 OBJECT_NOT_FOUND, still sil
                 version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
             }),
             getMetaTypes: vi.fn().mockResolvedValue([]),
-            findData: vi.fn().mockRejectedValue(driverError('no such table: ghost')),
+            findData: vi.fn().mockRejectedValue(registryGate('ghost')),
         });
 
         const res = await callRoute(rest, 'GET', '/api/v1/data/:object', { params: { object: 'ghost' } });
@@ -567,10 +576,9 @@ describe('[#8264] anchored on the driver quoted template, not a bare conjunction
 
     it('§5b decision 2 (the 404 limb): an unquoted "relation <name> does not exist" no longer silently 404s', () => {
         // Crafted to isolate decision 2, which the card's own example cannot
-        // reach: `missingRelationIsObject`'s Postgres branch tolerates
-        // UNQUOTED names (it answers a different, narrower question — which
-        // relation, once one is already suspected), so it still extracts
-        // `acct` and matches it to the object. Under the OLD predicate this
+        // reach: the attribution helper of the time (removed by #27702)
+        // tolerated UNQUOTED names, so it still extracted `acct` and matched
+        // it to the object. Under the OLD predicate this
         // fell through to the `looksLikeMissingRelation` OR-limb of
         // `looksLikeUnknownObject` and silently answered 404 — the exact
         // second consequence the card's own text never measured.
@@ -588,9 +596,9 @@ describe('[#8264] anchored on the driver quoted template, not a bare conjunction
         }
     });
 
-    it('§5d the quoted form still attributes to 404 when the relation IS the object — decision 2, real case, unchanged', () => {
+    it('§5d [#27702] the quoted form names the object itself and is a store fault, not a 404', () => {
         const r = mapDataError(driverError('relation "ghost" does not exist'), 'ghost');
-        expect(r.status).toBe(404);
-        expect(r.body.code).toBe('OBJECT_NOT_FOUND');
+        expect(r.status).toBe(500);
+        expect(r.body.code).toBe('DATABASE_ERROR');
     });
 });