@@ -0,0 +1,15 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a metadata write refused with `NOT_OVERRIDABLE`, `NOT_CREATABLE`, `INVALID_METADATA` or `DESTRUCTIVE_CHANGE` now leaves its `denied` row in `sys_metadata_audit`
+
+Clause-②: no
+Metadata-protocol: none
+
+`sys_metadata_audit.code` has always documented `not_overridable`, `not_creatable`, `invalid_metadata` and `destructive_change` as `denied` values, and the save, publish, rollback and delete doors refuse with exactly those codes. No audit write stamped them, though: only the lock gate (`item_locked`) and the stale-version check (`metadata_conflict`) left a row. A reader of `GET /api/v1/meta/:type/:name/audit` concluded that a refused attempt never happened.
+
+- **The row.** `outcome: 'denied'`, `code` the documented lower-case value, `operation` the door (`save`, `publish`, `rollback` or `delete`), `actor` and `source` as the door's allowed row records them, and `note` the sentence the caller was refused with. The type is filed under its canonical singular, as every other row is.
+- **Where it is written.** Where the door hands the refusal back to its caller, so a refusal raised by any of the gates inside the door is covered, including one added later.
+- **What still writes no row.** A refusal with any other code (`INVALID_REQUEST`, `RESOURCE_CONFLICT`, a driver fault, any 5xx) writes nothing, as before; the column's set of values stays closed. `item_locked` and `metadata_conflict` keep the rows their own gates write and are not written twice. A refusal one door hands back through another is recorded once. The batch package publish keeps its `batch_aborted` row.
+- **No caller change.** The refusal the caller receives is unchanged: the same code, status and message. The audit write is best-effort, as it always was.
@@ -0,0 +1,130 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#28355] The `denied` audit row a single-item metadata door owes for a
+ * refusal that writes no row of its own.
+ *
+ * `sys_metadata_audit.code` documents `not_overridable`, `not_creatable`,
+ * `invalid_metadata` and `destructive_change` as `denied` values, and the four
+ * single-item doors (`saveMetaItem`, `publishMetaItem`, `rollbackMetaItem`,
+ * `deleteMetaItem`) do refuse with exactly those catalogued codes — but only
+ * the lock gate (`item_locked`) and the optimistic-concurrency check
+ * (`metadata_conflict`) ever wrote a row. Every other refusal left the trail
+ * silent, so a reader of `/audit` concluded that a refused attempt never
+ * happened.
+ *
+ * The row is stamped where the door hands the refusal back to its caller,
+ * not at each of the many sites inside the door that can raise one: those
+ * codes are thrown by shared helpers the doors reach in several places
+ * (`refuseOrganizationScopedWrite`, the overlay and create gates, the
+ * authoring-rule and spec gates, the destructive-change gate), so a per-site
+ * write would leave any site added later silent again. One seam per door
+ * reads the code the refusal carries and nothing else.
+ *
+ * What it deliberately does NOT do:
+ *
+ *  - It mints no new value. The map below is closed, and each value is one
+ *    the column already documents. A refusal whose code is not in it — a
+ *    driver fault, `INVALID_REQUEST`, `RESOURCE_CONFLICT`, any 5xx — leaves
+ *    no row, exactly as before; lower-casing whatever `code` arrived would
+ *    turn the column's closed set into an open one (the `batch_aborted`
+ *    argument in the object file).
+ *  - It does not re-stamp `item_locked` or `metadata_conflict`: their gates
+ *    already write their own row, and neither code is in the map.
+ *  - It writes one row per refusal even when one door hands it back through
+ *    another: the first seam to record a refusal marks it, and every outer
+ *    seam it passes through after that leaves it alone.
+ *  - The batch publish keeps its own `batch_aborted` row with the causal code
+ *    in `note`; it is not one of these doors.
+ *
+ * `note` carries {@link clientFacingFailureText}: it is wire-visible through
+ * `GET /meta/:type/:name/audit`, and these refusals declare a 4xx, so their
+ * sentence is the one the caller was already shown.
+ */
+
+import type { MetadataAuditEntry } from './protocol.js';
+import { canonicalMetaType, clientFacingFailureText } from './protocol.js';
+
+/**
+ * The catalogued refusal codes (ADR-0112, SCREAMING) whose door stamps a
+ * `denied` row, and the persisted audit value each one is stored as (D6b —
+ * the column keeps its own lower-case vocabulary).
+ */
+export const REFUSAL_AUDIT_CODES: Readonly<Record<string, string>> = Object.freeze({
+    NOT_OVERRIDABLE: 'not_overridable',
+    NOT_CREATABLE: 'not_creatable',
+    INVALID_METADATA: 'invalid_metadata',
+    DESTRUCTIVE_CHANGE: 'destructive_change',
+});
+
+/** The door a refusal left, and the request fields its row is keyed on. */
+export interface RefusalAuditDoor {
+    operation: 'save' | 'publish' | 'rollback' | 'delete';
+    type: unknown;
+    name: unknown;
+    actor: unknown;
+    source: string;
+}
+
+/**
+ * Name-mangled like `__pendingAudit`: an internal hand-off between two seams,
+ * never a wire field. `clientFacingFailureText` / `clientFacingFailureCode`
+ * read `message` / `code` only.
+ */
+type RefusalWithAuditMark = { code?: unknown; __refusalAudited?: true };
+
+/**
+ * The row `err` owes at `door`, or `null` when it owes none: its code is not
+ * one of {@link REFUSAL_AUDIT_CODES}, an earlier seam already recorded it, or
+ * the request names no item to key the row on.
+ */
+export function refusalAuditEntry(err: unknown, door: RefusalAuditDoor): MetadataAuditEntry | null {
+    if (err === null || typeof err !== 'object') return null;
+    const refusal = err as RefusalWithAuditMark;
+    if (refusal.__refusalAudited) return null;
+    if (typeof refusal.code !== 'string' || !Object.prototype.hasOwnProperty.call(REFUSAL_AUDIT_CODES, refusal.code)) return null;
+    // No row without an identity: the trail is keyed on `(type, name)`, and
+    // minting one for a request that names no item would file a fictional
+    // item in a compliance ledger.
+    if (typeof door.type !== 'string' || door.type === '') return null;
+    if (typeof door.name !== 'string' || door.name === '') return null;
+    return {
+        // The writer refuses a non-canonical type; the door may be handed a
+        // plural spelling it has not folded yet when the refusal comes first.
+        type: canonicalMetaType(door.type),
+        name: door.name,
+        organizationId: null,
+        operation: door.operation,
+        outcome: 'denied',
+        // adr0112-ok: D6b — persisted audit column, its own vocabulary
+        code: REFUSAL_AUDIT_CODES[refusal.code]!,
+        ...(typeof door.actor === 'string' && door.actor !== '' ? { actor: door.actor } : {}),
+        source: door.source,
+        note: clientFacingFailureText(err, refusal.code),
+    };
+}
+
+/**
+ * Run a door's body; when it refuses with a code that owes a row, record the
+ * row and rethrow the same refusal untouched.
+ *
+ * `record` is the protocol's own `recordMetadataAudit`, handed in as a
+ * closure so a spy set on the instance is the one reached. It is best-effort
+ * by contract (ADR-0010 §3.6) and never replaces the refusal the caller gets.
+ */
+export async function withRefusalAudit<T>(
+    record: (entry: MetadataAuditEntry) => Promise<void>,
+    door: RefusalAuditDoor,
+    run: () => Promise<T>,
+): Promise<T> {
+    try {
+        return await run();
+    } catch (err) {
+        const entry = refusalAuditEntry(err, door);
+        if (entry) {
+            (err as RefusalWithAuditMark).__refusalAudited = true;
+            await record(entry);
+        }
+        throw err;
+    }
+}
@@ -536,9 +536,11 @@ describe('code-only metadata types are refused on every kernel (#5086)', () => {
 
                 expect(err?.status).toBe(403);
                 expect(metaRows(rows)).toEqual([]);
-                // Stronger than "no row landed": no write was even attempted,
-                // so there is nothing for a raw-engine path to have done.
-                expect(writes).toEqual([]);
+                // Stronger than "no row landed": no metadata write was even
+                // attempted, so there is nothing for a raw-engine path to have
+                // done. [#28355] The one engine call the refusal makes is its
+                // own `denied` row in the audit trail, and nothing else.
+                expect(writes).toEqual([{ op: 'insert', table: 'sys_metadata_audit' }]);
             });
         }
 
 
@@ -171,8 +171,13 @@ describe('[#21716] pin 2 — an env-wide _lock: full row binds an organization w
                 expect({ code: err.code, status: err.status }, operation)
                     .toEqual({ code: 'NOT_OVERRIDABLE', status: 403 });
             }
-            // [ADR-0131 D6] Refused before the `_lock` gate: nothing is written.
-            expect(inserted).toEqual([]);
+            // [ADR-0131 D6] Refused before the `_lock` gate: no metadata row and
+            // no `item_locked` row is written. [#28355] Each refusal leaves its
+            // own `not_overridable` row in the audit trail, and nothing else.
+            expect(inserted.map((i) => [i.table, i.values.operation, i.values.code])).toEqual([
+                ['sys_metadata_audit', 'save', 'not_overridable'],
+                ['sys_metadata_audit', 'delete', 'not_overridable'],
+            ]);
         });
 
         it(`${kernel} kernel: an org-scoped publish and rollback are refused the same way (the shared write gate)`, async () => {
 
@@ -235,10 +235,41 @@ describe('#9157 — the population, re-derived from the code rather than from th
         // the failure mode this whole describe block exists to prevent.
         expect(starts.length).toBeGreaterThan(20);
 
+        // [#28355] The four single-item doors are public wrappers (the refusal
+        // audit) over a private `…Unaudited` body, and both read their request
+        // shape from a module-level alias (`type SaveMetaItemRequest = {…}`): a
+        // private member's type is not published. So a signature naming such an
+        // alias is read from the alias, and a wrapper is judged by the body it
+        // delegates to — that is where the fold is.
+        const memberSlice = (line: number) => {
+            const k = starts.findIndex((s) => s.line === line);
+            const end = k >= 0 ? starts[k + 1]?.line : lines.findIndex((l, i) => i > line && METHOD_OR_PRIVATE.test(l));
+            return lines.slice(line, end === undefined || end < 0 ? lines.length : end).join('\n');
+        };
+        const METHOD_OR_PRIVATE = /^ {4}(?:private |protected )?(?:static )?(?:async )?[A-Za-z_][A-Za-z0-9_]*\s*\(/;
+        const aliasLiteral = (name: string): string | undefined => {
+            const at = src.indexOf(`\ntype ${name} = {`);
+            if (at < 0) return undefined;
+            const open = src.indexOf('{', at);
+            let depth = 0;
+            for (let i = open; i < src.length; i++) {
+                if (src[i] === '{') depth++;
+                else if (src[i] === '}' && --depth === 0) return src.slice(open, i + 1);
+            }
+            return undefined;
+        };
+        const delegateBody = (body: string): string => {
+            const to = /this\.([A-Za-z_][A-Za-z0-9_]*Unaudited)\(request\)/.exec(body)?.[1];
+            if (to === undefined) return body;
+            const line = lines.findIndex((l) => l.startsWith(`    private async ${to}(`));
+            expect(line, `the wrapper delegates to '${to}', which the scan cannot find`).toBeGreaterThanOrEqual(0);
+            return memberSlice(line);
+        };
+
         const unfolded: string[] = [];
         const folded: string[] = [];
         for (let k = 0; k < starts.length; k++) {
-            const body = lines.slice(starts[k]!.line, starts[k + 1]?.line ?? lines.length).join('\n');
+            const body = delegateBody(lines.slice(starts[k]!.line, starts[k + 1]?.line ?? lines.length).join('\n'));
             // The PARAMETER LIST exactly — walked by paren balance rather than
             // guessed at with a character budget, so a long request type cannot
             // push `type: string` outside the window and drop a verb silently.
@@ -249,7 +280,9 @@ describe('#9157 — the population, re-derived from the code rather than from th
                 if (body[i] === '(') depth++;
                 else if (body[i] === ')' && --depth === 0) { close = i; break; }
             }
-            const sig = body.slice(open, close + 1);
+            const declared = body.slice(open, close + 1);
+            const alias = /^\(\s*request\??\s*:\s*([A-Z][A-Za-z0-9_]*)\s*\)$/.exec(declared)?.[1];
+            const sig = alias === undefined ? declared : (aliasLiteral(alias) ?? declared);
             // A REQUIRED `type: string` in the request object — the shape a
             // `/meta/:type` path segment arrives as. `type?:` is a query-string
             // FILTER (`/meta/diagnostics?type=`, `/meta/_drafts?type=`), a