@@ -0,0 +1,26 @@
+---
+"@objectstack/formula": minor
+"@objectstack/lint": minor
+"@objectstack/objectql": patch
+---
+
+fix(formula,lint)!: a formula whose `label()` names a field that declares no options is refused at author time
+
+`label(record.FIELD)` answers on a field whose definition carries an `options` list; on any other field the evaluator faults on every row, so the formula read `null` forever with a WARN line as the only trace. The `expression-invalid` gate refused `label(record.nope)` (unknown field) and `sqrt(4)` (unregistered function) but admitted `label(record.first)` on a text field. It now refuses that too, at `os validate`, `os build`, `os lint` and every door that runs the active authoring gate (the object save door, per-item publish, history restore and a draft's `_diagnostics`; one evaluation, `runRuntimeAuthoringRules`), in the evaluator's own words (the same sentence its WARN line carries), naming the field and the remedy.
+
+Clause-②: no (narrowing) — the object save door and the CLI authoring commands refuse a formula whose `label()` argument names a declared field that declares no options, which they stored before. Nothing is widened.
+
+Metadata-protocol: narrowed (a formula field's `expression` may no longer call `label()` on a field that declares no `options`)
+
+<!-- adr-0087: not-required (no-migration-prescription) No key is added, removed or renamed. The refused value never worked: the evaluator faults on that call on every row, so a stored formula of this shape reads null for every reader today, and no conversion could give it a label to read. The refusal names the field and the remedy (read the field directly, or point label() at a field that declares options). -->
+
+**BREAKING** accept-set narrowing at the authoring gate (`@objectstack/formula`, `@objectstack/lint`), shipped as `minor`.
+
+- **Before.** `PUT /api/v1/meta/object/NAME` with a formula `label(record.first)` (`first` a text field), or `label(record.kind) + label(record.first)`, answered 200; every row then read the formula as `null`.
+- **Now.** The same write answers 422 `expression-invalid` naming `first`, located at the formula field's `expression`; `os validate` / `os build` / `os lint` report the same finding.
+- **Unchanged.** `label()` on a field that declares options is admitted and evaluates as before: inline `options` on any type (`select`, `multiselect`, `radio`, …), or a `picklist` naming a shared list, which the registry resolves onto the served field. The unknown-field and unregistered-function refusals are unchanged and an unknown field gets no second refusal.
+- **Who sees it.** An author whose formula calls `label()` on a field without options, a formula that already reads null on every row.
+
+**The remedy.** Read the field directly (`record.first`), or point `label()` at a field that declares `options` or names a `picklist`.
+
+`validateExpression` gains an opt-in `ExprSchemaHint.optionFields` (the object's option-bearing fields) and the closed refusal-code set gains `label-field-no-options` (`params: { field }`). `@objectstack/formula` exports the two readings of "declares options" side by side: `declaresOptions(def)` on the served form (`@objectstack/objectql` builds `label()`'s map through it) and `declaresOptionsOnceServed(def)` on the authored form (inline `options`, or a `picklist` the registry writes onto the served field), which `@objectstack/lint`'s formula pass hands the validator, so the gate refuses exactly the fields the evaluator faults on.
@@ -298,7 +298,10 @@ then a shared picklist's `picklists.<picklist>.options.<value>`), exactly as
 `Accept-Language`, so the write response the save toast reads, the record
 page title, related lists and lookups all follow it.
 
-- `label()` takes exactly `record.<field>`, a field that declares `options`.
+- `label()` takes exactly `record.<field>`, a field that declares `options`
+  or names a `picklist`. Any other field is refused when the object is saved
+  (`os validate`, `os build`, the object save door), with the field named,
+  because it has no label to read and the formula would read null on every row.
   An empty value reads `''`; a stored value no option declares reads as itself.
   A multi-value select is refused.
 - A read with no locale (a script, a scheduled job) reads the declared labels.
 
@@ -374,6 +374,22 @@ const PINS: { readonly [C in ExpressionRefusalCode]: readonly [Pin<C>, ...Pin<C>
         'time and reject the write. Denormalise the value you need onto `account`\'s object, or read it in a hook instead.',
     },
   ],
+  'label-field-no-options': [
+    {
+      // #28659: the evaluator's own fault sentence, at author time.
+      produce: () =>
+        onlyError('value', 'label(record.first)', {
+          scope: 'record',
+          objectName: 'p4',
+          fields: ['first', 'kind'],
+          optionFields: ['kind'],
+        }),
+      params: { field: 'first' },
+      message:
+        'label(record.first): `first` declares no options, so it has no option label. ' +
+        "label() reads a select field's option label; read any other field directly (record.first).",
+    },
+  ],
   'empty-expression': [
     {
       produce: () => rootsRefusal('   '),
@@ -451,6 +467,7 @@ const SWEEP_SOURCES: readonly string[] = [
   "type == 'grid' && status == 'q'",
   'has(status) && other == 1',
   'daysBetween(record.a, record.b) > 3',
+  "label(record.name) + label(record.status)",
 ];
 
 const SWEEP_INPUTS: readonly ExprInput[] = [
@@ -477,6 +494,7 @@ const SWEEP_SCHEMAS: readonly (ExprSchemaHint | undefined)[] = [
     fields: ['amount', 'close_date', 'name', 'active', 'account', 'status'],
     fieldTypes: { close_date: 'date', name: 'text', active: 'boolean', account: 'lookup' },
     roleCatalog: ['org_admin', 'sales'],
+    optionFields: ['status'],
   },
   { fields: ['status', 'close_date'], objectName: 'deal', fieldTypes: { close_date: 'date' } },
   { fields: ['status'] },
 
@@ -174,6 +174,12 @@ export interface ExpressionRefusalParams {
   'traversal-bare-and-traversed': { readonly root: string; readonly field: string };
   /** A reference field read through more than one relationship hop. */
   'traversal-multi-hop': { readonly root: string; readonly field: string };
+  /**
+   * `label(record.<field>)` naming a declared field that declares no options
+   * (`ExprSchemaHint.optionFields`, #28659). The message is the evaluator's own
+   * fault sentence for that call.
+   */
+  'label-field-no-options': { readonly field: string };
   /** `collectCelRootIdentifiers` was handed no expression. */
   'empty-expression': Readonly<Record<string, never>>;
   /** `collectCelRootIdentifiers` could not parse the source; `detail` is the parser's reason. */
@@ -222,6 +228,7 @@ const CODE_TABLE = {
   'field-near-miss': true,
   'traversal-bare-and-traversed': true,
   'traversal-multi-hop': true,
+  'label-field-no-options': true,
   'empty-expression': true,
   'cel-parse-failed': true,
 } as const satisfies Record<ExpressionRefusalCode, true>;
 
@@ -92,7 +92,7 @@ export {
   MAIL_HTML_SUPPORTED_SHAPES,
 } from './mail-html-hole-placement';
 export type { MailHtmlHole, MailHtmlHolePlacement, MailHtmlHoleJudgeOptions } from './mail-html-hole-placement';
-export { registerStdLib, buildScope, registerPermissionPredicate, registerCapabilityPredicate, isUnparseableDate } from './stdlib';
+export { registerStdLib, buildScope, registerPermissionPredicate, registerCapabilityPredicate, declaresOptions, declaresOptionsOnceServed, isUnparseableDate } from './stdlib';
 export type { PermissionBinding } from './stdlib';
 // objectui#4421 / batch #147 — the permission predicate's data door. `can` reads
 // `EvalContext.permissions` and nothing else, and this is how that map is built
 
@@ -420,14 +420,76 @@ const LABEL_ARGUMENT_REFUSAL =
 /**
  * The field `label()`'s argument names — `kind` for `label(record.kind)` — or
  * `undefined` when the argument is any other shape.
+ *
+ * Package-internal, not re-exported from the entry: the macro reads its field
+ * through it, and `validateExpression`'s option check (#28659) reads the field
+ * of each `label(` call in a parsed source through it too, so the authoring
+ * gate and the evaluator agree on WHICH field a call names.
  */
-function optionLabelFieldOf(node: CelMacroNode | undefined): string | undefined {
+export function optionLabelFieldOf(node: CelMacroNode | undefined): string | undefined {
   if (!node || node.op !== '.' || !Array.isArray(node.args)) return undefined;
   const [receiver, field] = node.args as [CelMacroNode | undefined, unknown];
   if (!receiver || receiver.op !== 'id' || receiver.args !== 'record') return undefined;
   return typeof field === 'string' && field.length > 0 ? field : undefined;
 }
 
+/**
+ * Does this SERVED field definition declare options — the reading of "has
+ * options" `label()` depends on at evaluation (#28659)?
+ *
+ * A field whose served definition carries an `options` list is a field the
+ * engine builds a label map for (`@objectstack/objectql`'s
+ * `formula-option-labels.ts` reads the served object's fields through this),
+ * so `label(record.<field>)` answers on it. Any other field is absent from
+ * that map, and {@link optionLabelOf} faults on every row.
+ *
+ * It reads the declaration, not the type: a `select` that declares no options
+ * has no labels either (and is refused for that by its own completeness rule),
+ * and any field type that does declare a list is answered.
+ *
+ * An AUTHORED definition is read through {@link declaresOptionsOnceServed}
+ * instead: a field bound to a shared picklist is authored without `options`
+ * and served with them.
+ */
+export function declaresOptions(def: unknown): boolean {
+  return !!def && typeof def === 'object' && Array.isArray((def as { options?: unknown }).options);
+}
+
+/**
+ * Will this AUTHORED field definition declare options once it is served — the
+ * reading an authoring gate judges `label()` by (#28659)?
+ *
+ * The spec gives a `select` / `radio` two option sources, mutually exclusive
+ * (`FieldSchema`): inline `options`, or a `picklist` naming a shared list.
+ * The registry writes a picklist-bound field's resolved options onto the
+ * served object (`@objectstack/objectql`'s `picklist-resolution.ts`), so the
+ * served definition {@link declaresOptions} and `label()` reads the list's
+ * labels; a name no list declares is refused at load. So an authored field
+ * answers when it declares `options` or names a picklist — the R8 reading in
+ * `@objectstack/lint`'s `data-model-rules.ts` — and `@objectstack/lint`'s
+ * formula pass reads the authored body through this, so the authoring gate
+ * refuses exactly the fields the evaluator would fault on.
+ */
+export function declaresOptionsOnceServed(def: unknown): boolean {
+  if (declaresOptions(def)) return true;
+  const picklist = !!def && typeof def === 'object' ? (def as { picklist?: unknown }).picklist : undefined;
+  return typeof picklist === 'string' && picklist !== '';
+}
+
+/**
+ * The sentence for `label(record.<field>)` on a field that declares no options.
+ * Shared by the evaluation fault ({@link optionLabelOf}) and the authoring
+ * refusal (`validateExpression`'s `label-field-no-options`, #28659), so the
+ * author reads the same prescription at the door that the log line carries.
+ */
+export function optionlessLabelSentence(field: string): string {
+  return (
+    `label(record.${field}): \`${field}\` declares no options, so it has no option label. ` +
+    'label() reads a select field\'s option label; read any other field directly ' +
+    `(record.${field}).`
+  );
+}
+
 /**
  * The label a reader reads for `value` of `field`, from the pinned map.
  *
@@ -450,13 +512,7 @@ function optionLabelOf(field: string, value: unknown, labels: EvalOptionLabels |
   // The field's options first, so a field that declares none faults on EVERY
   // row, not only on the rows where it happens to hold a value.
   const options = Object.prototype.hasOwnProperty.call(labels, field) ? labels[field] : undefined;
-  if (options === undefined) {
-    throw new Error(
-      `label(record.${field}): \`${field}\` declares no options, so it has no option label. ` +
-      'label() reads a select field\'s option label; read any other field directly ' +
-      `(record.${field}).`,
-    );
-  }
+  if (options === undefined) throw new Error(optionlessLabelSentence(field));
   if (value === null || value === undefined) return '';
   if (typeof value === 'object') {
     throw new Error(
 
@@ -0,0 +1,152 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `label(record.<field>)` on a declared field that declares no options is
+ * refused at author time (#28659).
+ *
+ * `label()` (#26608) answers on a field whose definition carries an `options`
+ * list: the engine builds its label map from exactly those fields, read
+ * through `declaresOptions`. On any other field the evaluator faults on every
+ * row and the formula reads null forever. `validateExpression` now gives that
+ * verdict before the formula is stored, when the caller hands it the object's
+ * option-bearing fields (`ExprSchemaHint.optionFields`), in the evaluator's
+ * own words.
+ *
+ * Each refusal asserts the code and the named field, not the prose around it;
+ * the message pin lives with the other code pins in
+ * `expression-refusal-codes.test.ts`.
+ */
+import { describe, expect, it } from 'vitest';
+import { celEngine } from './cel-engine';
+import { declaresOptions, declaresOptionsOnceServed } from './stdlib';
+import { validateExpression, type ExprSchemaHint } from './validate';
+
+/** The card's object: `first` is text, `kind` a select with options, `stage` a radio with options. */
+const P4: ExprSchemaHint = {
+  scope: 'record',
+  objectName: 'qaformula_p4',
+  fields: ['first', 'kind', 'stage', 'pf'],
+  fieldTypes: { first: 'text', kind: 'select', stage: 'radio', pf: 'formula' },
+  traversalHydration: true,
+  optionFields: ['kind', 'stage'],
+};
+
+const codes = (source: string, schema: ExprSchemaHint = P4) => {
+  const r = validateExpression('value', source, schema);
+  return r.errors.map((e) => ({ code: e.code, params: e.params }));
+};
+
+describe('label(record.FIELD) on a field that declares no options is refused (#28659)', () => {
+  it('⭐ LIT — the card\'s `label(record.first)` (text) is refused, naming `first`', () => {
+    const r = validateExpression('value', 'label(record.first)', P4);
+    expect(r.ok).toBe(false);
+    expect(r.errors.map((e) => ({ code: e.code, params: e.params }))).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+    ]);
+    expect(r.errors[0]!.message).toContain('`first` declares no options');
+    expect(r.warnings).toEqual([]);
+  });
+
+  it('⭐ LIT — the compound `label(record.kind) + label(record.first)` is refused for `first` alone', () => {
+    expect(codes('label(record.kind) + label(record.first)')).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+    ]);
+  });
+
+  it('one refusal per field, however many calls name it', () => {
+    expect(codes("label(record.first) + ' / ' + label(record.first)")).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+    ]);
+    expect(codes("label(record.first) + label(record.pf)")).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+      { code: 'label-field-no-options', params: { field: 'pf' } },
+    ]);
+  });
+
+  it('a call nested anywhere in the expression is judged', () => {
+    expect(codes("record.kind == 'clean' ? label(record.first) : 'x'")).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+    ]);
+    expect(codes('size(label(record.first)) > 0 ? 1 : 0')).toEqual([
+      { code: 'label-field-no-options', params: { field: 'first' } },
+    ]);
+  });
+
+  it('CONTROL — label() on fields that declare options is admitted, whatever their type', () => {
+    expect(validateExpression('value', 'label(record.kind)', P4)).toEqual({ ok: true, errors: [], warnings: [] });
+    expect(validateExpression('value', "label(record.kind) + ' · ' + label(record.stage)", P4)).toEqual({
+      ok: true,
+      errors: [],
+      warnings: [],
+    });
+  });
+
+  it('CONTROL — an undeclared field keeps its `unknown-field` refusal and gets no second one', () => {
+    expect(codes('label(record.nope)')).toEqual([
+      { code: 'unknown-field', params: { field: 'nope', objectName: 'qaformula_p4' } },
+    ]);
+  });
+
+  it('CONTROL — an unregistered function keeps its refusal', () => {
+    expect(codes('sqrt(4)').map((c) => c.code)).toEqual(['cel-unknown-function']);
+  });
+
+  it('CONTROL — reading the optionless field directly is admitted', () => {
+    expect(validateExpression('value', "record.first + ' · ' + label(record.kind)", P4).ok).toBe(true);
+  });
+
+  it('opt-in: without `optionFields` (or without `fields`) nothing is judged, as before', () => {
+    const { optionFields: _omit, ...noOptions } = P4;
+    expect(validateExpression('value', 'label(record.first)', noOptions).ok).toBe(true);
+    const { fields: _f, ...noFields } = P4;
+    expect(validateExpression('value', 'label(record.first)', noFields).ok).toBe(true);
+    expect(validateExpression('value', 'label(record.first)').ok).toBe(true);
+  });
+
+  it('the refusal is the evaluator\'s own fault sentence for the same call', () => {
+    const run = celEngine.evaluate({ dialect: 'cel', source: 'label(record.first)' }, {
+      record: { first: 'hello', kind: 'clean' },
+      optionLabels: { kind: { clean: 'Clean' } },
+    });
+    expect(run.ok).toBe(false);
+    const refused = validateExpression('value', 'label(record.first)', P4).errors[0]!;
+    if (!run.ok) expect(run.error.message).toBe(refused.message);
+  });
+});
+
+describe('declaresOptions — the one reading of "has options" (#28659)', () => {
+  it('is true exactly when the definition carries an options list', () => {
+    expect(declaresOptions({ type: 'select', options: [{ value: 'a', label: 'A' }] })).toBe(true);
+    expect(declaresOptions({ type: 'multiselect', options: [] })).toBe(true);
+    expect(declaresOptions({ type: 'text' })).toBe(false);
+    expect(declaresOptions({ type: 'select' })).toBe(false);
+    expect(declaresOptions({ type: 'select', options: 'a,b' })).toBe(false);
+    expect(declaresOptions(null)).toBe(false);
+    expect(declaresOptions(undefined)).toBe(false);
+  });
+});
+
+describe('declaresOptionsOnceServed — the authored-form reading (#28659)', () => {
+  it('admits inline options and a named picklist, the two option sources the spec declares', () => {
+    expect(declaresOptionsOnceServed({ type: 'select', options: [{ value: 'a', label: 'A' }] })).toBe(true);
+    expect(declaresOptionsOnceServed({ type: 'select', picklist: 'kinds' })).toBe(true);
+    expect(declaresOptionsOnceServed({ type: 'radio', picklist: 'kinds' })).toBe(true);
+    expect(declaresOptionsOnceServed({ type: 'select', picklist: '' })).toBe(false);
+    expect(declaresOptionsOnceServed({ type: 'text' })).toBe(false);
+    expect(declaresOptionsOnceServed({ type: 'select' })).toBe(false);
+    expect(declaresOptionsOnceServed(null)).toBe(false);
+  });
+
+  it('a picklist-bound field: refused by the served-form reading as authored, admitted once its list is written on', () => {
+    const authored = { type: 'select', picklist: 'kinds' };
+    const served = { ...authored, options: [{ value: 'clean', label: 'Clean' }] };
+    expect(declaresOptions(authored)).toBe(false);
+    expect(declaresOptions(served)).toBe(true);
+    expect(declaresOptionsOnceServed(authored)).toBe(declaresOptions(served));
+  });
+
+  it('CONTROL — a picklist-bound field named in optionFields is admitted by the validator', () => {
+    const schema: ExprSchemaHint = { ...P4, fields: [...P4.fields!, 'tier'], optionFields: [...P4.optionFields!, 'tier'] };
+    expect(validateExpression('value', 'label(record.tier)', schema)).toEqual({ ok: true, errors: [], warnings: [] });
+  });
+});