@@ -0,0 +1,41 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol): `getMetaDiagnostics` refuses an unrecognised `type` spelling with the producer's 400 instead of answering "scanned 1 type, 0 problems" (#8924)
+
+<!-- adr-0087: not-required (no-migration-prescription) The same one-method
+`catch` #8855 narrowed is narrowed once more: the request-classification 400
+`canonicalizeMetaRequestType` already raises inside `getMetaItems` is rethrown
+the same way the 503 is. No authorable key is added, renamed, retired or
+tombstoned, no stored shape changes, and the response payload type is
+byte-identical — there is nothing for a conversion entry to convert. -->
+
+This is a **narrowing that makes an already-classified 400 reach the caller**.
+`GET /api/v1/meta/diagnostics?type=<unrecognised-plural-of-a-declared-type>`
+(and the SDK method `client.meta.getDiagnostics({ type })`) used to answer
+`200 {"entries":[],"total":0,"scannedTypes":1,"scannedItems":0,"stats":{}}` —
+"scanned 1 type, no issues" — for a spelling every sibling `/meta` door
+refuses with a 400 that names both accepted spellings. The producer had
+already classified the mistake (`status: 400`, `code: 'INVALID_REQUEST'`,
+raised by `canonicalizeMetaRequestType` inside `getMetaItems`); the
+diagnostics sweep's per-type `catch` swallowed the verdict into a benign
+skip, and `scannedTypes: 1` then published a sweep that scanned nothing as
+coverage. Maintainer ruling 2026-08-20: rethrow the 400 the same way #8855's
+fix rethrows the 503.
+
+**Measured on a booted kernel (real HTTP), before → after:**
+
+```
+GET /api/v1/meta/diagnostics?type=fieldes   200 {"scannedTypes":1,"stats":{}}  →  400 [invalid_request] "… Address it as 'field' or 'fields'."
+GET /api/v1/meta/diagnostics?type=fields    200 (recognised plural)            →  200 unchanged
+GET /api/v1/meta/fieldes                    400                                →  400 unchanged
+```
+
+What is unchanged: recognised plurals (`fields`, `views`, …) still fold and
+answer; a name that is a plural of nothing (`fieldz`) still answers an honest
+`count: 0` entry; a genuine, unclassified listing failure still skips that
+one type instead of failing the sweep; the whole-corpus sweep (no `?type=`)
+cannot produce the refusal at all — its target set comes canonical out of the
+registry. A caller that treated the old `200`-with-empty-stats answer as
+"clean" now hears the refusal that names the accepted spellings.
@@ -63,6 +63,25 @@
 // benign and selective controls with it; a fix that only looked like it worked
 // would leave the outage cases green. The two halves are in one file so a
 // future edit that re-widens the catch is a diff nobody can read as harmless.
+//
+// ---------------------------------------------------------------------------
+// [#8924] The SECOND classified verdict: the request-arm 400
+// ---------------------------------------------------------------------------
+// The same catch swallowed one more producer-classified error: the refusal
+// `canonicalizeMetaRequestType` raises inside `getMetaItems` (`status: 400`,
+// `code: 'INVALID_REQUEST'`) for an unrecognised spelling of a DECLARED type.
+// Only the `request.type` arm can reach it — the full-sweep arm's target set
+// comes canonical out of the registry. Measured on a booted kernel before the
+// fix: `GET /api/v1/meta/diagnostics?type=fieldes` answered
+// `200 {"entries":[],"total":0,"scannedTypes":1,"scannedItems":0,"stats":{}}`
+// — "scanned 1 type, no issues" — while the sibling door `/meta/fieldes`
+// refused the same spelling with the 400 that names both accepted spellings.
+// Ruled 2026-08-20 (option 1): rethrow the 400 the same way the 503 is
+// rethrown. The [#8924] describe below pins the refusal, the two spellings
+// that must KEEP answering (a recognised plural, a plural-of-nothing), and —
+// the positive control — that a genuine listing failure still skips even when
+// it wears an unrelated status, so the guard admits exactly the two
+// classified verdicts and never widens into a blanket throw.
 
 import { describe, it, expect, vi } from 'vitest';
 import { ErrorCode } from '@objectstack/spec/api';
@@ -249,3 +268,84 @@ describe('[#8855] the discrimination is selective, not a blanket refusal', () =>
         expect(res.scannedTypes).toBe(SWEPT_TYPES.length);
     });
 });
+
+describe('[#8924] a caller error the producer classified is refused loudly, never published as "0 problems"', () => {
+    /** A healthy engine — the only failure in play is the caller's spelling. */
+    function healthyEngine() {
+        return {
+            registry: emptyRegistry(),
+            find: vi.fn(async () => []),
+            findOne: vi.fn(async () => null),
+        } as any;
+    }
+
+    it("an unrecognised spelling of a declared type rejects with the producer's 400, not 200-with-empty-stats", async () => {
+        const p = new ObjectStackProtocolImplementation(healthyEngine());
+
+        // Before the fix this RESOLVED with
+        // `{ entries: [], total: 0, scannedTypes: 1, scannedItems: 0, stats: {} }`
+        // — the exact payload objectui's DiagnosticsPage renders as "All clear".
+        const caught = await rejection(() => p.getMetaDiagnostics({ type: 'fieldes' }));
+
+        // The ADR-0112 envelope is the contract: code + status, and the code
+        // must be in the declared wire vocabulary.
+        expect(caught?.status).toBe(400);
+        expect(caught?.code).toBe('INVALID_REQUEST');
+        expect(ErrorCode.safeParse(caught?.code).success).toBe(true);
+        // The refusal TEACHES: it names both accepted spellings at the moment
+        // of the mistake. Asserted on top of code+status, never instead.
+        expect(caught.message).toContain("'field'");
+        expect(caught.message).toContain("'fields'");
+    });
+
+    it('a recognised plural still answers — what is refused is the unrecognised spelling, not the plural form', async () => {
+        const p = new ObjectStackProtocolImplementation(healthyEngine());
+
+        const res: any = await p.getMetaDiagnostics({ type: 'fields' });
+        expect(res.total).toBe(0);
+        expect(res.scannedTypes).toBe(1);
+        expect(res.stats.fields).toEqual({ count: 0, locked: 0, packages: [] });
+    });
+
+    it('a name that is a plural of NOTHING still answers benignly — the second verdict (#8421) lives on the mint door, not here', async () => {
+        const p = new ObjectStackProtocolImplementation(healthyEngine());
+
+        // `metaUrlSpellingRefusal('fieldz')` is null: 'fieldz' reaches for no
+        // declared type, so the request-boundary refusal deliberately stays
+        // silent and the sweep answers an honest count-0 entry for it.
+        const res: any = await p.getMetaDiagnostics({ type: 'fieldz' });
+        expect(res.total).toBe(0);
+        expect(res.scannedTypes).toBe(1);
+        expect(res.stats.fieldz).toEqual({ count: 0, locked: 0, packages: [] });
+    });
+
+    it('a genuine listing failure wearing an UNRELATED status still skips — the guard admits exactly the two classified verdicts', async () => {
+        // The positive control for the fix itself, constructed deliberately
+        // because the benign-skip population is empty in kernel scope (six
+        // booted scopes, zero skips) — nothing exercises this by accident.
+        // A widened guard (`if (status)` / rethrow-everything) turns every
+        // benign skip into a sweep failure; this test is what goes red.
+        const unlistable = SWEPT_TYPES.find((t) => t !== 'object')!;
+        const engine = {
+            registry: emptyRegistry({
+                listItems: (type: string) => {
+                    if (type === unlistable) {
+                        throw Object.assign(
+                            new Error(`type ${unlistable} is not listable in this kernel scope`),
+                            { status: 500 },
+                        );
+                    }
+                    return [];
+                },
+            }),
+            find: vi.fn(async () => []),
+            findOne: vi.fn(async () => null),
+        } as any;
+        const p = new ObjectStackProtocolImplementation(engine);
+
+        const res: any = await p.getMetaDiagnostics({});
+        expect(res.stats[unlistable]).toBeUndefined();
+        expect(Object.keys(res.stats)).toHaveLength(SWEPT_TYPES.length - 1);
+        expect(res.stats.object).toEqual({ count: 0, locked: 0, packages: [] });
+    });
+});
@@ -5105,7 +5105,11 @@ export class ObjectStackProtocolImplementation implements
      * layer on top of spec validation).
      *
      * `type` may be either a singular (`'view'`) or plural (`'views'`)
-     * identifier; the underlying `getMetaItems` already normalises.
+     * identifier; the underlying `getMetaItems` already normalises. An
+     * UNRECOGNISED spelling of a declared type (`'viewes'`) is refused with
+     * the 400 `getMetaItems` raises for it, not swallowed into a
+     * "scanned 1 type, 0 problems" answer — see the [#8924] note in the
+     * per-type catch below.
      *
      * Implementation note: leverages the `_diagnostics` already
      * decorated onto items by `getMetaItems()` to avoid running
@@ -5203,6 +5207,49 @@ export class ObjectStackProtocolImplementation implements
                 // nobody can re-ask, while a false "real" costs one 503 the
                 // caller can retry.
                 if ((error as { status?: unknown } | null | undefined)?.status === 503) throw error;
+                // [#8924] TWO error classes leave through this catch — the 503
+                // above and the 400 below — under ONE rule: an error the
+                // producer already stamped with a status is a CLASSIFIED
+                // VERDICT, and this sweep may not overrule a verdict into
+                // silence. Everything else is a genuine listing failure nobody
+                // classified, and for those the benign skip below is the ruled
+                // disposition (maintainer, 2026-08-20, option 1).
+                //
+                //  * 503 (#8855, above): the store outage — "whether rows
+                //    exist is UNKNOWN". Swallowing it published an outage as
+                //    "0 problems".
+                //  * 400 (#8924, here): the request-classification refusal
+                //    `canonicalizeMetaRequestType` raises INSIDE `getMetaItems`
+                //    (`status: 400`, `code: 'INVALID_REQUEST'`) for an
+                //    unrecognised spelling of a DECLARED type (`fieldes`,
+                //    `viewes`, `capabilitys`, …). Only the `request.type` arm
+                //    can produce it — the full-sweep arm's `targetTypes` come
+                //    canonical out of the registry — so rethrowing it cannot
+                //    fail a whole-corpus sweep. Swallowing it answered
+                //    `200 {"scannedTypes":1,"stats":{}}` — "scanned 1 type,
+                //    no issues" — to a spelling every sibling `/meta` door
+                //    refuses with a 400 that names both accepted spellings
+                //    (measured: 27 such spellings on a booted kernel, while
+                //    objectui's DiagnosticsPage paints that payload as "All
+                //    clear"). The producer classified the caller's mistake;
+                //    the caller gets to hear it. Declared = enforced.
+                //
+                // What still takes the `continue`: a listing failure with no
+                // status, or any status that is not one of the two verdicts
+                // above (the registry listing is not a guarded read, so its
+                // failures arrive unclassified). That skip is genuine — a
+                // kernel scope that cannot enumerate one type must not fail
+                // the whole governance sweep — and measured to have NO
+                // producer in kernel scope today (six booted scopes, zero
+                // skips), which is exactly why it stays a guard rather than
+                // becoming a payload field (`skippedTypes` was considered and
+                // ruled out as motiveless).
+                //
+                // By `status` and not by `code`, mirroring the 503 test above
+                // and its direction argument: a false "real" is loud and
+                // correctable at the caller; a false "benign" silently
+                // mis-answers a question nobody re-asks.
+                if ((error as { status?: unknown } | null | undefined)?.status === 400) throw error;
                 continue;
             }
             const items: any[] = Array.isArray(listed?.items)