@@ -0,0 +1,24 @@
+---
+'@objectstack/formula': minor
+'@objectstack/lint': minor
+'@objectstack/mcp': minor
+'@objectstack/spec': minor
+---
+
+fix(lint)!: publish refuses a validation rule (or another fail-closed predicate) that orders a text or boolean field against a number, instead of warning that it "evaluates to null" and then refusing every write (#29904)
+
+Clause-②: no (narrowing) — the author-time gate (`os build`, `os validate`, the object save door and the package publish) refuses a `type-mismatch` it used to pass with a warning, at the predicate sites that fail closed. Nothing is widened.
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered validation-type-mismatch-refused -->
+
+**BREAKING** accept-set narrowing at the author-time expression gate, served by `os build`, `os validate`, the object save door and `POST /api/v1/packages/:id/publish-drafts`.
+
+- **Before.** `record.name > 5` on a text field, written as a validation rule's `condition`, published with one `expression-invalid` advisory at `severity: warning` saying the expression "silently evaluates to null". A validation rule fails closed, so from then on every create and update whose `name` was not numeric text was refused: `400 VALIDATION_FAILED` "Validation rule 'name_gt' could not be evaluated (runtime: no such overload: dyn<string> > int) — write rejected".
+- **Now.** The same rule is refused at publish as `expression-invalid` at `severity: error`, at the rule's `condition` path, with a message that says the write would be refused and how to compare like with like. This is the severity the nullable-comparison verdict (`record.qty > 1000` on a nullable number) already had at the same slot.
+- **Which sites.** Those whose runtime refuses the write (or aborts the operation) when the expression faults: a validation rule's `condition` and `when`, nested `then` / `otherwise` rules included; a field's `requiredWhen` and `readonlyWhen`; an option's `visibleWhen` (a write that picks the option); a hook's `condition`. The `validate_expression` MCP tool answers the same for `site: 'validation'`.
+- **Unchanged.** A formula field's `expression` keeps the warning: there the fault reads null, which is what the warning says. So do flow conditions (the run fails, the write that fired it lands), a field's display `visibleWhen` / `settledWhen`, field group and action predicates, and `conditionalFormatting`. Sharing-rule conditions compile to a query filter and are not judged by this verdict.
+- **`@objectstack/spec`.** The upgrade guide entry `validation-type-mismatch-refused` (a semantic migration: no automatic rewrite, because whether the author meant the length, a number stored as text or another field is a judgement about the rule).
+- **`@objectstack/formula`.** `ExprSchemaHint` gains `faultOutcome?: 'fail-closed'`, which the caller sets for a fail-closed site; the `type-mismatch` refusal's `params` carry `outcome: 'fail-closed'` when it is graded an error there.
+
+**FROM → TO.** `condition: 'record.name > 5'` on a text field → `size(record.name) > 5` for its length, `record.score > 5` on a number field for a value, or `double(record.name) > 5` only when every value is numeric text (it faults, and refuses the write, on any other). A boolean: `record.active > 0` → `record.active == true`.
@@ -242,7 +242,7 @@ come at two severities: **errors** fail the build; **warnings** are advisory
 | **Qualify field references** — a formula / validation / predicate binds only the `record` namespace, so a bare `amount` resolves to nothing and evaluates to `null`. Write `record.amount`. | `amount > 100` → `record.amount > 100` | error |
 | **Field must exist** — a typo'd `record.<field>` is flagged with a did-you-mean. | `record.amont` → `record.amount` | error |
 | **Unknown function** — a misspelled or nonexistent stdlib call. | `isBlnk(record.x)` | error |
-| **Type soundness** — a text or boolean field used with an arithmetic (`+ - * / %`) or ordering (`< > <= >=`) operator against a number faults at runtime and evaluates to `null`. Store it as a number field, or drop the arithmetic. | `record.title * 2` | warning |
+| **Type soundness** — a text or boolean field used with an arithmetic (`+ - * / %`) or ordering (`< > <= >=`) operator against a number faults at runtime unless the text is numeric. In a formula it evaluates to `null`. Where a fault refuses the write instead — a validation rule, a field `requiredWhen` / `readonlyWhen`, an option `visibleWhen`, a hook `condition` — it is an error. Store it as a number field, compare text with text, or convert explicitly (`size(record.name)` for the length; `double(record.name)`, which itself faults on text that is not a number). | `record.title * 2`; `record.name > 5` in a validation rule → `size(record.name) > 5` | warning; error where a fault refuses the write |
 | **Date arithmetic** — a `date` / `datetime` field used with `+` / `-` against a number (a `YYYY-MM-DD` value is a string at runtime, so this always faulted to `null`). Use the date helpers instead. | `record.end_date - record.start_date + 1` → `daysBetween(record.start_date, record.end_date) + 1`; `today() + 30` → `daysFromNow(30)`; `record.date + n` → `addDays(record.date, n)` | error (#3306) |
 | **Date subtraction** — the runtime holds a `date` / `datetime` field as its text (`YYYY-MM-DD`, or an ISO-8601 instant), so subtracting two of them faults and the formula reads `null`; a timestamp minus one computes a duration, which a field reads as `{}`. Use `daysBetween`. A condition may still compare a duration (`today() - record.start_date > duration("72h")`). | `record.end_date - record.start_date` → `daysBetween(record.start_date, record.end_date)`; `today() - record.start_date` → `daysBetween(record.start_date, today())` | error |
 
 
@@ -169,14 +169,17 @@ export interface ExpressionRefusalParams {
    */
   'date-duration-value': { readonly reference?: string };
   /**
-   * WARNING, never an error: a text or boolean field used with an arithmetic
-   * or ordering `operator` against a number.
+   * A text or boolean field used with an arithmetic or ordering `operator`
+   * against a number. A WARNING (the expression reads null) unless `outcome`
+   * is `'fail-closed'`: the site refuses the write it guards when the
+   * expression faults, and the verdict is an ERROR (#29904).
    */
   'type-mismatch': {
     readonly operands: string;
     readonly operator: string;
     readonly held: 'text' | 'boolean';
     readonly reference?: string;
+    readonly outcome?: 'fail-closed';
   };
   /**
    * WARNING, never an error: a bare identifier in a flattened condition that
 
@@ -764,6 +764,27 @@ describe('validateExpression (ADR-0032)', () => {
       expect(r.warnings[0].message).toMatch(/evaluates to null/);
     });
 
+    // [#29904] The caller declares a fail-closed site; there the fault is a
+    // refused write, not a null, and the verdict is an error saying so.
+    it('errors on the same comparison where the caller declares the site fail-closed (#29904)', () => {
+      const r = validateExpression('predicate', 'record.name > 5', { ...schema, faultOutcome: 'fail-closed' });
+      expect(r.ok).toBe(false);
+      expect(r.warnings).toHaveLength(0);
+      expect(r.errors).toHaveLength(1);
+      expect(r.errors[0]).toMatchObject({
+        code: 'type-mismatch',
+        params: { operands: 'string > int', operator: '>', held: 'text', reference: 'record.name', outcome: 'fail-closed' },
+      });
+      expect(r.errors[0].message).not.toMatch(/evaluates to null/);
+      const bool = validateExpression('predicate', 'record.is_active > 0', { ...schema, faultOutcome: 'fail-closed' });
+      expect(bool.errors.map((e) => e.code)).toEqual(['type-mismatch']);
+      // The conversions the message names validate clean in this dialect.
+      for (const fixed of ['size(record.name) > 5', 'double(record.name) > 5']) {
+        const ok = validateExpression('predicate', fixed, { ...schema, faultOutcome: 'fail-closed' });
+        expect([ok.errors, ok.warnings], fixed).toEqual([[], []]);
+      }
+    });
+
     it('warns on a text field ordered against a number', () => {
       const r = validateExpression('predicate', 'record.title >= 5', schema);
       expect(r.ok).toBe(true);
 
@@ -222,6 +222,23 @@ export interface ExprSchemaHint {
    * {@link fields}; without it nothing is judged.
    */
   optionFields?: readonly string[];
+  /**
+   * [#29904] What the site's runtime does when this expression FAULTS, as
+   * declared by the caller that knows the site — the validator cannot tell a
+   * validation rule's `predicate` from a flow condition's.
+   *
+   * `'fail-closed'`: an expression that cannot be evaluated refuses the write
+   * (or aborts the operation) it guards instead of being skipped — an object
+   * validation rule, a field `requiredWhen` / `readonlyWhen`, an option
+   * `visibleWhen` on the write path, a hook `condition`. There a
+   * `type-mismatch` (text or a boolean ordered / arithmetic'd against a
+   * number) is an ERROR worded for that outcome, the severity the
+   * nullable-comparison verdict already has at the same sites.
+   *
+   * Absent: a fault reads as null (a formula field), and `type-mismatch` stays
+   * the advisory warning whose "evaluates to null" text is true there.
+   */
+  faultOutcome?: 'fail-closed';
 }
 
 /**
@@ -308,7 +325,9 @@ function toCelFieldTypes(fieldTypes: Readonly<Record<string, string>>): Record<s
  *    recovers, so it blocks the build.
  *  - `type-mismatch` (**warning**): a text/boolean field used with an
  *    arithmetic/ordering operator against a number — nulls unless the text value
- *    happens to be numeric, so it stays advisory.
+ *    happens to be numeric, so it stays advisory. An **error** where the caller
+ *    declares the site fail-closed (`faultOutcome`, #29904): there the fault is
+ *    not a null, it is a refused write on every value that is not numeric text.
  *  - `date-text-arithmetic` / `date-duration-value` (**error**, #28944): what
  *    the Timestamp typing passes, re-checked with a date field declared as the
  *    text the runtime holds — see {@link dateTextIssue}.
@@ -319,6 +338,7 @@ function typeSoundnessIssue(
   fieldTypes: Readonly<Record<string, string>>,
   scope: 'record' | 'flattened',
   role: 'predicate' | 'value',
+  faultOutcome: ExprSchemaHint['faultOutcome'],
 ): { issue: ExprValidationError; severity: 'error' | 'warning' } | null {
   const celFieldTypes = toCelFieldTypes(fieldTypes);
   const mismatch = firstTypeMismatch(source, celFieldTypes, scope);
@@ -345,6 +365,37 @@ function typeSoundnessIssue(
   const heldKind = mismatch.celType === 'bool' ? 'boolean' : 'text';
   const held = heldKind === 'boolean' ? 'a boolean' : 'text';
   const subject = ref ? `${ref} holds ${held}` : `${held === 'a boolean' ? 'a boolean' : 'a text'} field`;
+  if (faultOutcome === 'fail-closed') {
+    // [#29904] Measured on the evaluator: `record.name > 5` faults on `"abc"`
+    // and on null, and the ADR-0032 §1c rescue answers only numeric text
+    // (`"7"`). `size()` answers text; `double()` / `int()` validate clean but
+    // fault on text that is not a number — so the hint says so.
+    const operand = reference ?? (heldKind === 'boolean' ? 'the field' : 'the text');
+    const convert = heldKind === 'boolean'
+      ? 'Compare a boolean with `true` / `false`, or use a number field.'
+      : `Compare like with like: use a number field, compare text with text, or convert ` +
+        `explicitly — \`size(${operand})\` for its length, \`double(${operand})\` for its value ` +
+        `(which itself faults on text that is not a number).`;
+    return {
+      severity: 'error',
+      issue: refusal(
+        'type-mismatch',
+        {
+          operands: mismatch.operands,
+          operator: mismatch.operator,
+          held: heldKind,
+          ...(reference !== undefined ? { reference } : {}),
+          outcome: 'fail-closed',
+        },
+        source,
+        `type mismatch \`${mismatch.operands}\` — ${subject} but is used with \`${mismatch.operator}\` ` +
+          `against a number. CEL has no such operation, so wherever the value is not numeric text ` +
+          `(an empty value included) the expression faults, and here an expression that cannot be ` +
+          `evaluated fails closed: the write (or the operation a hook guards) is refused, not skipped. ` +
+          convert,
+      ),
+    };
+  }
   return {
     severity: 'warning',
     issue: refusal(
@@ -1208,10 +1259,11 @@ export function validateExpression(
         // #1928 / #3306 — with per-field types in hand, flag a type-unsound
         // operator use that faults at runtime and silently nulls: a text/boolean
         // field arithmetic'd/ordered against a number (advisory warning — a
-        // numeric text value can succeed), or date-field arithmetic (hard error —
+        // numeric text value can succeed — or an error where the site fails
+        // closed, #29904), or date-field arithmetic (hard error —
         // always nulls). Only runs when there is no bare-ref error (the typed
         // check needs the canonical `record.<field>` form).
-        const r = typeSoundnessIssue(source, schema.fieldTypes, 'record', role);
+        const r = typeSoundnessIssue(source, schema.fieldTypes, 'record', role, schema.faultOutcome);
         if (r) (r.severity === 'error' ? errors : warnings).push(r.issue);
       }
     } else if (schema?.fields && schema.fields.length > 0) {
@@ -1246,7 +1298,7 @@ export function validateExpression(
       // date-field arithmetic (error). Flow variables stay `dyn` (never flagged);
       // equality/ordering of a date is runtime-safe (never flagged).
       if (schema.fieldTypes) {
-        const r = typeSoundnessIssue(source, schema.fieldTypes, 'flattened', role);
+        const r = typeSoundnessIssue(source, schema.fieldTypes, 'flattened', role, schema.faultOutcome);
         if (r) (r.severity === 'error' ? errors : warnings).push(r.issue);
       }
     }
 
@@ -872,17 +872,108 @@ describe('validateStackExpressions (ADR-0032 build-time)', () => {
       expect(issues).toHaveLength(0);
     });
 
-    it('warns on a validation predicate ordering a text field against a number', () => {
+    // [#29904] A validation rule fails closed: a predicate that cannot be
+    // evaluated refuses the write. So a text field ordered against a number
+    // there is an ERROR — every write whose value is not numeric text would be
+    // refused — where a formula's fault reads null and keeps the warning. The
+    // field is `required` so the nullable-comparison verdict stays out of it.
+    const typeMismatches = (issues: ReturnType<typeof validateStackExpressions>) =>
+      issues.filter(i => /^type mismatch/.test(i.message));
+
+    it('refuses a validation predicate ordering a required text field against a number (#29904)', () => {
       const issues = validateStackExpressions({
         objects: [{
           name: 'crm_lead',
-          fields: { title: { type: 'text' } },
+          fields: { title: { type: 'text', required: true } },
           validations: [{ name: 'r', condition: 'record.title > 5' }],
         }],
       });
-      const w = issues.filter(i => i.severity === 'warning');
-      expect(w).toHaveLength(1);
-      expect(w[0].message).toMatch(/record\.title/);
+      expect(issues).toHaveLength(1);
+      expect(issues[0]).toMatchObject({ severity: 'error', path: 'objects[0].validations[0].condition' });
+      expect(issues[0].message).toMatch(/^type mismatch `string > int` — `record\.title` holds text/);
+      expect(issues[0].message).toMatch(/the write \(or the operation a hook guards\) is refused/);
+      expect(issues[0].message).toMatch(/`size\(record\.title\)`/);
+      expect(issues[0].message).not.toMatch(/evaluates to null/);
+    });
+
+    it('keeps the warning for the same comparison in a formula field, where the fault reads null (#29904)', () => {
+      const issues = validateStackExpressions({
+        objects: [{
+          name: 'crm_lead',
+          fields: {
+            title: { type: 'text', required: true },
+            big: { type: 'formula', expression: 'record.title > 5' },
+          },
+        }],
+      });
+      expect(issues).toHaveLength(1);
+      expect(issues[0].severity).toBe('warning');
+      expect(issues[0].message).toMatch(/silently evaluates to null/);
+    });
+
+    it('refuses the type mismatch at every other fail-closed site (#29904)', () => {
+      const issues = validateStackExpressions({
+        objects: [{
+          name: 'crm_lead',
+          fields: {
+            title: { type: 'text', required: true },
+            active: { type: 'boolean', required: true },
+            due: { type: 'text', requiredWhen: 'record.title > 5', readonlyWhen: 'record.active > 0' },
+            tier: {
+              type: 'select',
+              options: [{ value: 'gold', label: 'Gold', visibleWhen: 'record.title >= 10' }],
+            },
+          },
+          validations: [
+            { name: 'w', type: 'script', condition: 'record.title == "x"', when: 'record.title < 3', message: 'm' },
+            {
+              name: 'c',
+              type: 'conditional',
+              when: 'record.title == "y"',
+              then: { name: 'c_then', type: 'script', condition: 'record.title * 2 > 1', message: 'm' },
+              message: 'm',
+            },
+          ],
+        }],
+        hooks: [{ name: 'h', object: 'crm_lead', events: ['beforeInsert'], condition: 'record.title > 1' }],
+      });
+      const found = typeMismatches(issues);
+      expect(found.map(i => [i.where, i.severity])).toEqual([
+        ["object 'crm_lead' · validation 'w' when", 'error'],
+        ["object 'crm_lead' · validation rule 'c' then → 'c_then'", 'error'],
+        ["object 'crm_lead' · field 'due' requiredWhen", 'error'],
+        ["object 'crm_lead' · field 'due' readonlyWhen", 'error'],
+        ["object 'crm_lead' · field 'tier' option 'gold' visibleWhen", 'error'],
+        ["hook 'h' (crm_lead) condition", 'error'],
+      ]);
+      expect(found.find(i => /readonlyWhen/.test(i.where))!.message).toMatch(/holds a boolean/);
+    });
+
+    it('keeps the warning where a fault does not refuse a write: field visibleWhen, action visible (#29904)', () => {
+      const issues = validateStackExpressions({
+        objects: [{
+          name: 'crm_lead',
+          fields: { title: { type: 'text', required: true, visibleWhen: 'record.title > 5' } },
+          actions: [{ name: 'a', label: 'A', type: 'script', target: 'noop', visible: 'record.title > 5' }],
+        }],
+      });
+      const found = typeMismatches(issues);
+      expect(found.length).toBeGreaterThan(0);
+      for (const i of found) expect(i.severity).toBe('warning');
+    });
+
+    it('leaves the nullable-comparison verdict as it was beside the type mismatch (#29904)', () => {
+      const issues = validateStackExpressions({
+        objects: [{
+          name: 'crm_lead',
+          fields: { qty: { type: 'number' } },
+          validations: [{ name: 'big', condition: 'record.qty > 1000' }],
+        }],
+      });
+      expect(issues).toHaveLength(1);
+      expect(issues[0].severity).toBe('error');
+      expect(issues[0].message).toMatch(/declares as nullable/);
+      expect(typeMismatches(issues)).toEqual([]);
     });
 
     it('warns on a flattened flow condition doing arithmetic on a bare text field', () => {