@@ -2,12 +2,12 @@
 '@objectstack/metadata-protocol': patch
 ---
 
-fix(metadata-protocol): the by-id OCC comparison answers only for a row the caller reads; every other row gets the write door's answer
+fix(metadata-protocol): the by-id OCC comparison hands a row absent from the caller's read to the write door
 
 Clause-②: no
 Metadata-protocol: none
 
-`updateData` and `deleteData` compare a caller's version token (`If-Match`, or `expectedVersion`) before the write is authorized. On a mismatch they re-read the row as the caller. When that read returns no row, or refuses with a declared client-band status, the comparison is now dropped and the request goes on to the write, whose door answers it: the same status, code and sentence the request gets without a token, and the same a token on an id naming no row gets. This restores the governing text for the write doors (ruling of record 5985885287).
+`updateData` and `deleteData` compare a caller's version token (`If-Match`, or `expectedVersion`) before the write is authorized. On a mismatch they re-read the row as the caller. When that read returns no row, the comparison is now dropped and the request goes on to the write, whose door answers it: the answer the request gets without a token, and the answer a token on an id naming no row gets. This restores the governing text for the write doors (ruling of record 5985885287).
 
-- **Unchanged:** a row the caller reads still answers `409 CONCURRENT_UPDATE` with that row as `currentRecord`, including a row the caller reads but may not write. A matching token, or none, reads nothing more than before. A read that faults (a server-band status, or none declared) still propagates as raised.
-- **The write door's answers:** a caller who may not update or delete the object gets that refusal (`403`), token or none; a caller who may write the object gets `404 RECORD_NOT_FOUND` for a row its read does not return, as for an id naming no row.
+- **Unchanged:** a row the caller reads still answers `409 CONCURRENT_UPDATE` with that row as `currentRecord`, including a row the caller reads but may not write. A caller read that throws — a refusal or a fault — propagates as raised, as before. A matching token, or none, reads nothing more than before.
+- **The write door's answers for a row absent from the caller's read:** a caller who may not update or delete the object gets that refusal (`403`); a caller who may write the object gets `404 RECORD_NOT_FOUND`, as for an id naming no row.
@@ -753,10 +753,11 @@ each row of `updateMany` and of `batch` with `operation: "update"`. A caller who
 update the object gets `404 RECORD_NOT_FOUND` for an id that names no record, and for
 a record its row-level access hides.
 
-A version token (`If-Match`, or `expectedVersion`) changes none of these answers. An
-update or delete carrying a stale token is answered `409 CONCURRENT_UPDATE` only for a
-record the caller can read; for any other id it gets exactly what the same request
-without a token gets.
+A version token (`If-Match`, or `expectedVersion`) is compared only against a record the
+caller can read: a stale token on such a record is answered `409 CONCURRENT_UPDATE`,
+whether or not the caller may write it. For a record the caller's read does not return,
+and for an id that names no record, a stale token changes none of the answers above. A
+caller refused reading the object gets that read refusal.
 
 ### Delete Record
 
 
@@ -23,8 +23,8 @@
  * messages. The module-level declarations only these bodies read (the OCC
  * version-token reading) moved with them, also unedited. One body has changed
  * since: `assertVersionOf`'s mismatch branch now hands a row the caller's own
- * read does not return to the write door instead of answering it (its
- * docblock in `protocol.ts` says why).
+ * read returns no row for to the write door instead of answering it (its
+ * docblock in `protocol.ts` says why); a read that throws still propagates.
  *
  * ## How the moved bodies reach the class
  *
@@ -53,7 +53,6 @@
 import type { ObjectStackProtocolImplementation } from './protocol.js';
 import { ConcurrentUpdateError, MalformedVersionTokenError, canonicalVersionInstant } from './protocol.js';
 import { recordNotFoundError } from '@objectstack/core';
-import { declaredHttpStatus } from '@objectstack/types';
 import { collectInternalWriteResponseFields, omitInternalFieldsFromWriteResponse } from './write-response-internal-fields.js';
 import { isMissingTableError } from '@objectstack/metadata/errors';
 import { canServeApiOperation, resolveSearchFieldResolution } from '@objectstack/spec/data';
@@ -173,19 +172,6 @@ function versionTokensAgree(current: NormalisedVersion, expected: NormalisedVers
     return current.token === expected.token;
 }
 
-/**
- * Did the caller's own read of a row REFUSE, rather than fault? A refusal
- * declares a client-band status (`4xx`, in either spelling
- * `declaredHttpStatus` reads) — the read door's verdict on this caller, which
- * says nothing about the row. A server-band status, or none at all (a bare
- * driver `Error`), is a fault, and the OCC comparison lets it propagate as
- * raised rather than read it as "the caller reads no row".
- */
-function isCallerReadRefusal(e: unknown): boolean {
-    const status = declaredHttpStatus(e);
-    return status !== undefined && status < 500;
-}
-
 /**
  * The `ObjectStackProtocolImplementation` members the functions below read —
  * every one of them, and no other; each function's `this` is the `Pick` of the
@@ -244,18 +230,13 @@ export async function assertVersionOf(
         // it names, turning a resolvable conflict into an unresolvable one.
         const currentVersion = currentToken.instant ?? currentToken.token;
         const expectedVersionText = expected.instant ?? expected.token;
-        // A row the caller's own read does not return — absent, or the read
-        // refused — is no conflict this gate may report, and no answer of its
-        // own either: the comparison is dropped and the write door answers,
-        // exactly as it answers the same request without a token. The
-        // method's docblock in `protocol.ts` carries the reasoning.
-        let visible: unknown;
-        try {
-            visible = await this.readAsCaller(object, id, context);
-        } catch (e) {
-            if (!isCallerReadRefusal(e)) throw e;
-            return;
-        }
+        // A row the caller's own read RETURNS NO ROW for is no conflict this
+        // gate may report, and no answer of its own either: the comparison is
+        // dropped and the write door answers, as it answers the same request
+        // without a token. ONLY an absent row: a read that throws — a refusal
+        // or a fault — propagates as raised. The method's docblock in
+        // `protocol.ts` carries the reasoning.
+        const visible = await this.readAsCaller(object, id, context);
         if (!visible) return;
         throw new ConcurrentUpdateError({
             currentVersion,
 
@@ -384,19 +384,23 @@ describe('[#4435] deleteManyData reports per id, not per request', () => {
   });
 });
 
-describe('a stale version token on a row the caller does not read gets the write door\'s answer, as no token does', () => {
+describe('a stale version token on a row absent from the caller\'s read gets the write door\'s answer, as no token does', () => {
   // The by-id OCC comparison runs before the write is authorized. When the
   // tokens disagree it re-reads the row as the caller, and a row that read
-  // does not return — absent, or the read refused — leaves the answer to the
-  // write door: what the same request without a token gets, status, code and
-  // sentence, which is also what a token on an id naming no row gets (ruling
-  // of record 5985885287: a row the caller cannot read answers what a
-  // nonexistent id answers, on update and delete alike).
+  // RETURNS NO ROW for leaves the answer to the write door: what the same
+  // request without a token gets, status, code and sentence, which is also
+  // what a token on an id naming no row gets (ruling of record 5985885287: a
+  // row the caller cannot read answers what a nonexistent id answers, on
+  // update and delete alike). Only an absent row is handed over: a caller
+  // read that THROWS — a refusal or a fault — propagates as raised.
   const CURRENT = '2026-10-30T08:00:00.000Z';
   const STALE = '2001-01-01T00:00:00.000Z';
   const CALLER = { userId: 'u1' };
   const MISSING = 'definitely_not_a_row';
   const row = (id: string) => ({ id, title: 'x', updated_at: CURRENT });
+  /** The read door's refusal of a caller without the object's read grant. */
+  const readRefusalError = () =>
+    Object.assign(new Error('Reading this object is not permitted.'), { code: 'PERMISSION_DENIED', status: 403 });
 
   /** A refused call as the doors render it: status, code and sentence. */
   const answerOf = (run: () => Promise<unknown>) => run().then(
@@ -423,21 +427,31 @@ describe('a stale version token on a row the caller does not read gets the write
         expect(store.get('real')).toEqual(row('real'));
       });
 
-      it('the caller\'s read REFUSES: the write door\'s refusal answers, never the read\'s', async () => {
-        // A declared client-band status in either spelling is a refusal.
-        for (const readRefusal of [
-          () => Object.assign(new Error('Reading this object is not permitted.'), { code: 'PERMISSION_DENIED', status: 403 }),
-          () => Object.assign(new Error('Reading this object is not permitted.'), { code: 'PERMISSION_DENIED', statusCode: 403 }),
-        ]) {
-          const { p, store } = makeProtocol({ real: row('real') }, { refuse: 'u1', readRefusal });
-          const stale = await answerOf(() => write(p, 'real', STALE));
-          const noToken = await answerOf(() => write(p, 'real'));
-          const missing = await answerOf(() => write(p, MISSING, STALE));
-          expect(stale).toEqual(noToken);
-          expect(stale.message).toBe(writeRefusal().message);
-          expect(withoutId(missing, MISSING)).toEqual(withoutId(stale, 'real'));
-          expect(store.get('real')).toEqual(row('real'));
-        }
+      it('the caller\'s read REFUSES and the write is refused too: the read refusal propagates, with the write\'s status and code', async () => {
+        // A caller holding neither grant. The refused read is the answer, so its
+        // sentence is the read door's: status and code are compared here, the
+        // sentence deliberately is not.
+        const { p, store } = makeProtocol({ real: row('real') }, { refuse: 'u1', readRefusal: readRefusalError });
+        const stale = await answerOf(() => write(p, 'real', STALE));
+        const noToken = await answerOf(() => write(p, 'real'));
+        const missing = await answerOf(() => write(p, MISSING, STALE));
+        expect(stale).toEqual({ code: 'PERMISSION_DENIED', status: 403, message: readRefusalError().message });
+        expect({ code: noToken.code, status: noToken.status }).toEqual({ code: stale.code, status: stale.status });
+        expect({ code: missing.code, status: missing.status }).toEqual({ code: stale.code, status: stale.status });
+        expect(store.get('real')).toEqual(row('real'));
+      });
+
+      it('the caller\'s read REFUSES and the write door admits the write (a write grant without a read grant): the read refusal propagates and nothing is written', async () => {
+        const { p, store, update, del } = makeProtocol({ real: row('real') }, { readRefusal: readRefusalError });
+        await expect(write(p, 'real', STALE)).rejects.toMatchObject({ code: 'PERMISSION_DENIED', status: 403 });
+        expect(update).not.toHaveBeenCalled();
+        expect(del).not.toHaveBeenCalled();
+        expect(store.get('real')).toEqual(row('real'));
+        // Control: without a token the same double admits the same write, so the
+        // pin above is not vacuous.
+        await write(p, 'real');
+        if (verb === 'updateData') expect(store.get('real')).toMatchObject({ title: 'y' });
+        else expect(store.has('real')).toBe(false);
       });
 
       it('a hidden row, the write admitted up to its read question: the write door\'s 404, for the row and for no row alike', async () => {
@@ -451,10 +465,11 @@ describe('a stale version token on a row the caller does not read gets the write
         expect(store.get('real')).toEqual(row('real'));
       });
 
-      it('a read that FAULTS propagates as raised, and the write is never asked', async () => {
+      it('a read that FAULTS, or throws any other 4xx, propagates as raised, and the write is never asked', async () => {
         for (const fault of [
           new Error('connection reset'),
           Object.assign(new Error('store unavailable'), { code: 'SERVICE_UNAVAILABLE', status: 503 }),
+          Object.assign(new Error('bad read'), { code: 'VALIDATION_FAILED', statusCode: 400 }),
         ]) {
           const { p, update, del } = makeProtocol({ real: row('real') }, { readRefusal: () => fault });
           await expect(write(p, 'real', STALE)).rejects.toBe(fault);
 
@@ -3327,9 +3327,10 @@ function simpleHash(str: string): string {
  * and includes both the current server-side version and the current record
  * payload so the client can render an informed conflict-resolution UI
  * ("Reload latest" vs. "Overwrite anyway"). The record is the row as the
- * caller reads it, and a row the caller cannot read is never a conflict: the
- * write door answers it, as it answers the same request without a token
- * (#23586, see `assertVersionOf`).
+ * caller reads it, and a row the caller's read returns no row for is never a
+ * conflict: the write door answers it, as it answers the same request without
+ * a token; a caller read that is refused propagates as that refusal (#23586,
+ * see `assertVersionOf`).
  *
  * NOTE: This is an *application-level* compare-and-set — not an atomic
  * storage-layer CAS. There is a small TOCTOU window between the version
@@ -14748,10 +14749,10 @@ export class ObjectStackProtocolImplementation implements
         //
         // OCC is asked the way `deleteData` asks it — a probe only when the
         // caller sent a token ({@link assertVersionMatch}) — and a row that
-        // probe does not find, or that the caller's own read does not return,
-        // is left to the engine's answer: OCC has never treated a missing
-        // record as a concurrency conflict, and a row the caller cannot read
-        // answers what a missing one does ({@link assertVersionOf}).
+        // probe does not find, or that the caller's own read returns no row
+        // for, is left to the engine's answer: OCC has never treated a missing
+        // record as a concurrency conflict, and a row absent from the caller's
+        // read answers what a missing one does ({@link assertVersionOf}).
         await this.assertVersionMatch(request.object, request.id, request.expectedVersion, request.context);
         const opts: any = { where: { id: request.id } };
         if (request.context !== undefined) opts.context = request.context;
@@ -14989,7 +14990,8 @@ export class ObjectStackProtocolImplementation implements
      * and the by-id update's existence check, asked only after `engine.update`
      * has judged and resolved the write (`updateData`, and the bulk faces
      * through {@link assertRecordExists}) — so an update by id answers the same
-     * refusal whether or not the id exists, as delete does, token or none.
+     * refusal whether or not the id exists, as delete does. With a mismatched
+     * token, a caller whose read of the row is refused gets that read refusal.
      */
     private async probeRecord(object: string, id: string): Promise<any> {
         return this.engine.findOne(object, { where: { id }, context: { isSystem: true } } as any);
@@ -15096,32 +15098,29 @@ export class ObjectStackProtocolImplementation implements
      *    the caller's own read is. `currentVersion` stays the token this
      *    comparison ran on. A caller who reads the row but may not write it
      *    gets this `409` too: the row it is shown is one it can GET anyway;
-     *  - no row, or a read that REFUSES (a declared `4xx`) → no answer from
-     *    this gate at all. The comparison is dropped and the request goes on
-     *    to the write, whose door answers it: the stale token then gets
-     *    exactly the answer the same request without a token gets — status,
-     *    code and sentence — and so does a token on an id that names no row
-     *    ("Record not found → no check" above), so the two cannot answer
-     *    apart. That is the governing text for the write doors (ruling of
-     *    record 5985885287): a row the caller cannot read answers what a
-     *    nonexistent id answers, on update and delete alike.
-     *
-     * Why the write door's answer and not one of this gate's own: this gate
-     * runs BEFORE the write is authorized, so any answer it gives for a row the
-     * caller cannot read — a `404`, or the read door's refusal rethrown —
-     * differs from the write door's for every caller the write door refuses
-     * first (no update or delete grant, the delegated-administration gate on
-     * the RBAC tables), and from what an id naming no row gets. Handing over
-     * loses no guard: the write door refuses a by-id write of a row the
-     * caller cannot read (the security layer asks the read question ahead of
-     * the write and answers `recordNotFoundError`), and a token that could not
-     * be compared never lets a write land that the same request without a
-     * token would not.
+     *  - no row — the read RETURNS none → no answer from this gate at all.
+     *    The comparison is dropped and the request goes on to the write,
+     *    whose door answers it: the stale token then gets exactly the answer
+     *    the same request without a token gets, and so does a token on an id
+     *    that names no row ("Record not found → no check" above). That is the
+     *    governing text for the write doors (ruling of record 5985885287): a
+     *    row the caller cannot read answers what a nonexistent id answers, on
+     *    update and delete alike;
+     *  - a read that THROWS — a refusal (the caller's read grant withheld) or
+     *    a fault — propagates as raised, exactly as it did before the
+     *    absent-row handover existed. A refused read is not an absent row,
+     *    and only an absent row is handed over.
+     *
+     * Why the write door's answer for an absent row, and not one of this
+     * gate's own: this gate runs BEFORE the write is authorized, so a `404` of
+     * its own differs from the write door's answer for every caller the write
+     * door refuses first (no update or delete grant), and from what an id
+     * naming no row gets. For an absent row the write door holds the guard
+     * itself: it asks the caller's read question ahead of a by-id write, and a
+     * row that read does not return is answered `recordNotFoundError`.
      *
      * The read is issued only on a mismatch: a request whose token agrees, or
-     * that sends none, reads exactly what it read before. A read that FAULTS —
-     * a server-band status, or none declared at all — propagates as raised: a
-     * store fault is no verdict about the caller.
+     * that sends none, reads exactly what it read before.
      */
     private assertVersionOf(
         object: string,