@@ -0,0 +1,26 @@
+---
+'@objectstack/formula': minor
+'@objectstack/lint': minor
+'@objectstack/mcp': minor
+'@objectstack/spec': minor
+---
+
+fix(lint)!: a text-vs-number comparison in a record-triggered flow condition is refused with what really happens (the run fails, the write lands), and in an advisory validation rule the refusal no longer says the write is refused (#29926)
+
+Clause-②: no (narrowing) — the author-time gate (`os build`, `os validate`, the package publish and the flow publish door) refuses a `type-mismatch` in a record-triggered flow's start or edge condition that it used to pass with a warning; and the fail-closed arm of the verdict is served under its own code `type-mismatch-fail-closed` instead of `type-mismatch` with `params.outcome`. Added beside them: the codes `type-mismatch-run-fails` and `type-mismatch-fail-open`, and the exported type `ExprFaultOutcome`.
+Metadata-protocol: narrowed
+Skills-docs: updated here — `content/docs/data-modeling/formulas.mdx` (the type-soundness row names each outcome) and the MCP skill text in `packages/mcp/src/skill-md.ts` (`flow_condition` now errors too); `skills/**` teaches no text-vs-number comparison in a flow condition or an advisory rule, so no skill or eval moves.
+
+<!-- adr-0087: registered flow-condition-type-mismatch-refused -->
+
+**BREAKING** accept-set narrowing at the author-time expression gate, served by `os build`, `os validate` and `POST /api/v1/packages/:id/publish-drafts`.
+
+- **Record-triggered flow conditions — before.** `name > 5` on a text field, as the start node's `condition` or an edge `condition` of a flow whose start `triggerType` is `record-*`, published with an `expression-invalid` warning saying the expression "silently evaluates to null". It does not: the engine's `evaluateCondition` throws on the fault, so the run fails at that condition, and the record-change trigger isolates the write that fired it, so the write lands and the flow's work is not done.
+- **Now.** The same condition is refused as `expression-invalid` at `severity: error`, code `type-mismatch-run-fails`, with a message saying the run fails at the condition and the triggering write still lands. This is the severity and outcome the nullable-comparison verdict already has on those conditions (#29026). A flow that is not record-triggered, and a node `condition` other than the start node's (inert), keep the warning. The `validate_expression` MCP tool answers the same for `site: 'flow_condition'`.
+- **Advisory validation rules** (`severity: 'warning'` / `'info'`). Still refused at publish, as the nullable twin refuses them, but under `type-mismatch-fail-open` with a message that says what happens: the rule is skipped, the write proceeds, and the rule never gives its advisory. The nullable twin's message on the same rule now says the same instead of "the write is rejected fail-closed". A `severity: 'error'` rule keeps both refusals and their wording.
+- **Refusal codes (`@objectstack/formula`).** A code names one message template, so each outcome has its own: `type-mismatch` (warning, reads null), `type-mismatch-fail-closed`, `type-mismatch-run-fails`, `type-mismatch-fail-open` (all errors). `ExprSchemaHint.faultOutcome` takes `'fail-closed' | 'run-fails' | 'fail-open'` (exported as `ExprFaultOutcome`); the `outcome` param on `type-mismatch` is gone.
+- **`@objectstack/spec`.** Upgrade guide entry `flow-condition-type-mismatch-refused` (semantic: no mechanical rewrite). The `validation-type-mismatch-refused` entry's acceptance criteria now say a create answers 201, the data door's status.
+
+**FROM → TO.** Flow condition `name > 5` on a text field → `size(name) > 5` for its length, `score > 5` on a number field for a value, or `double(name) > 5` only when every value is numeric text. A boolean: `active > 0` → `active == true`. A consumer keyed to the code: `type-mismatch` with `params.outcome === 'fail-closed'` → `type-mismatch-fail-closed`.
+
+**The renamed code shipped in 18.3.0.** `@objectstack/formula@18.3.0` and `@objectstack/mcp@18.3.0` already serve #29904's fail-closed refusal as `type-mismatch` with `params.outcome: 'fail-closed'` (the `outcome` param is in the 18.3.0 `ExpressionRefusalParams` type), although 18.3.0's changelog has no line for it: its changeset (`29904-type-mismatch-fail-closed.md`) was not consumed by that release. This release renames that arm `type-mismatch-fail-closed` and removes the `outcome` param, so a consumer keyed to 18.3.0's `type-mismatch` + `outcome` moves to the new code (FROM → TO above). The same changeset also says flow conditions keep the warning; a record-triggered flow's start and edge conditions are now refused, as above.
@@ -242,7 +242,7 @@ come at two severities: **errors** fail the build; **warnings** are advisory
 | **Qualify field references** — a formula / validation / predicate binds only the `record` namespace, so a bare `amount` resolves to nothing and evaluates to `null`. Write `record.amount`. | `amount > 100` → `record.amount > 100` | error |
 | **Field must exist** — a typo'd `record.<field>` is flagged with a did-you-mean. | `record.amont` → `record.amount` | error |
 | **Unknown function** — a misspelled or nonexistent stdlib call. | `isBlnk(record.x)` | error |
-| **Type soundness** — a text or boolean field used with an arithmetic (`+ - * / %`) or ordering (`< > <= >=`) operator against a number faults at runtime unless the text is numeric. In a formula it evaluates to `null`. Where a fault refuses the write instead — a validation rule, a field `requiredWhen` / `readonlyWhen`, an option `visibleWhen`, a hook `condition` — it is an error. Store it as a number field, compare text with text, or convert explicitly (`size(record.name)` for the length; `double(record.name)`, which itself faults on text that is not a number). | `record.title * 2`; `record.name > 5` in a validation rule → `size(record.name) > 5` | warning; error where a fault refuses the write |
+| **Type soundness** — a text or boolean field used with an arithmetic (`+ - * / %`) or ordering (`< > <= >=`) operator against a number faults at runtime unless the text is numeric. In a formula it evaluates to `null`. Where a fault does something else it is an error, worded for what happens: a validation rule, a field `requiredWhen` / `readonlyWhen`, an option `visibleWhen` or a hook `condition` refuses the write; a record-triggered flow's start or edge condition fails the run (the write that fired it still lands); an advisory (`severity: 'warning'` / `'info'`) validation rule is skipped, so it never gives its advisory. Store it as a number field, compare text with text, or convert explicitly (`size(record.name)` for the length; `double(record.name)`, which itself faults on text that is not a number). | `record.title * 2`; `record.name > 5` in a validation rule → `size(record.name) > 5` | warning in a formula or a display predicate; error at the sites named |
 | **Date arithmetic** — a `date` / `datetime` field used with `+` / `-` against a number (a `YYYY-MM-DD` value is a string at runtime, so this always faulted to `null`). Use the date helpers instead. | `record.end_date - record.start_date + 1` → `daysBetween(record.start_date, record.end_date) + 1`; `today() + 30` → `daysFromNow(30)`; `record.date + n` → `addDays(record.date, n)` | error (#3306) |
 | **Date subtraction** — the runtime holds a `date` / `datetime` field as its text (`YYYY-MM-DD`, or an ISO-8601 instant), so subtracting two of them faults and the formula reads `null`; a timestamp minus one computes a duration, which a field reads as `{}`. Use `daysBetween`. A condition may still compare a duration (`today() - record.start_date > duration("72h")`). | `record.end_date - record.start_date` → `daysBetween(record.start_date, record.end_date)`; `today() - record.start_date` → `daysBetween(record.start_date, today())` | error |
 
 
@@ -371,6 +371,62 @@ const PINS: { readonly [C in ExpressionRefusalCode]: readonly [Pin<C>, ...Pin<C>
         'field, or drop the arithmetic/comparison.',
     },
   ],
+  // [#29926] One code per fault outcome the caller declares (`faultOutcome`):
+  // the three sentences differ in what the runtime does, so they are three
+  // codes. `type-mismatch-fail-closed` is the sentence #29904 served as
+  // `type-mismatch` with `outcome: 'fail-closed'`, byte for byte.
+  'type-mismatch-fail-closed': [
+    {
+      produce: () =>
+        onlyError('predicate', 'record.name > 5', { scope: 'record', fieldTypes: { name: 'text' }, faultOutcome: 'fail-closed' }),
+      params: { operands: 'string > int', operator: '>', held: 'text', reference: 'record.name' },
+      message:
+        'type mismatch `string > int` — `record.name` holds text but is used with `>` against a number. CEL has no such operation, so ' +
+        'wherever the value is not numeric text (an empty value included) the expression faults, and here ' +
+        'an expression that cannot be evaluated fails closed: the write (or the operation a hook guards) is refused, not ' +
+        'skipped. ' +
+        'Compare like with like: use a number field, compare text with text, or convert explicitly — `size(record.name)` for its ' +
+        'length, `double(record.name)` for its value (which itself faults on text that is not a number).',
+    },
+    {
+      produce: () =>
+        onlyError('predicate', 'record.active > 0', { scope: 'record', fieldTypes: { active: 'boolean' }, faultOutcome: 'fail-closed' }),
+      params: { operands: 'bool > int', operator: '>', held: 'boolean', reference: 'record.active' },
+      message:
+        'type mismatch `bool > int` — `record.active` holds a boolean but is used with `>` against a number. CEL has no such operation, so ' +
+        'wherever the value is not numeric text (an empty value included) the expression faults, and here ' +
+        'an expression that cannot be evaluated fails closed: the write (or the operation a hook guards) is refused, not ' +
+        'skipped. Compare a boolean with `true` / `false`, or use a number field.',
+    },
+  ],
+  'type-mismatch-run-fails': [
+    {
+      produce: () =>
+        onlyError('predicate', 'name > 5', { scope: 'flattened', fields: ['name'], fieldTypes: { name: 'text' }, faultOutcome: 'run-fails' }),
+      params: { operands: 'string > int', operator: '>', held: 'text', reference: 'name' },
+      message:
+        'type mismatch `string > int` — `name` holds text but is used with `>` against a number. CEL has no such operation, so ' +
+        'wherever the value is not numeric text (an empty value included) the expression faults, and here ' +
+        'a flow condition that cannot be evaluated fails the run: the flow stops at this condition, the write that fired ' +
+        'it still lands, and the work the flow exists to do is not done. ' +
+        'Compare like with like: use a number field, compare text with text, or convert explicitly — `size(name)` for its ' +
+        'length, `double(name)` for its value (which itself faults on text that is not a number).',
+    },
+  ],
+  'type-mismatch-fail-open': [
+    {
+      produce: () =>
+        onlyError('predicate', 'record.name > 5', { scope: 'record', fieldTypes: { name: 'text' }, faultOutcome: 'fail-open' }),
+      params: { operands: 'string > int', operator: '>', held: 'text', reference: 'record.name' },
+      message:
+        'type mismatch `string > int` — `record.name` holds text but is used with `>` against a number. CEL has no such operation, so ' +
+        'wherever the value is not numeric text (an empty value included) the expression faults, and here ' +
+        'the rule is advisory, so a rule that cannot be evaluated is skipped, not refused: the write proceeds, the rule is ' +
+        'never applied (its advisory never fires), and the only trace is a log line saying it could not be evaluated. ' +
+        'Compare like with like: use a number field, compare text with text, or convert explicitly — `size(record.name)` for its ' +
+        'length, `double(record.name)` for its value (which itself faults on text that is not a number).',
+    },
+  ],
   'field-near-miss': [
     {
       produce: () => onlyWarning('predicate', "stauts == 'x'", { fields: ['status'], objectName: 'deal' }),
@@ -546,6 +602,15 @@ const SWEEP_SCHEMAS: readonly (ExprSchemaHint | undefined)[] = [
     optionFields: ['status'],
   },
   { fields: ['status', 'close_date'], objectName: 'deal', fieldTypes: { close_date: 'date' } },
+  // [#29926] The deal schema once per declared fault outcome, so the sweep
+  // reaches each `type-mismatch-*` code and holds its params to its message.
+  ...(['fail-closed', 'run-fails', 'fail-open'] as const).map((faultOutcome): ExprSchemaHint => ({
+    scope: 'record',
+    objectName: 'deal',
+    fields: ['amount', 'name', 'active'],
+    fieldTypes: { name: 'text', active: 'boolean' },
+    faultOutcome,
+  })),
   { fields: ['status'] },
   { fieldTypes: { account: 'lookup' }, traversalHydration: true },
 ];
 
@@ -57,6 +57,18 @@ export type CelFieldRole = Exclude<FieldRole, 'template'>;
  */
 export type ExpressionSourceKind = 'array' | 'object' | 'number' | 'boolean' | 'bigint' | 'symbol' | 'function';
 
+/**
+ * The params every `type-mismatch*` code interpolates: the CEL operand types,
+ * the `operator`, what the field holds, and the field as written when known.
+ * The four codes differ in the outcome their sentence states, never in params.
+ */
+interface TypeMismatchParams {
+  readonly operands: string;
+  readonly operator: string;
+  readonly held: 'text' | 'boolean';
+  readonly reference?: string;
+}
+
 /** Code → the params its message interpolates. The keys ARE the closed set. */
 export interface ExpressionRefusalParams {
   /** An envelope whose `source` is present but is not text. */
@@ -169,18 +181,30 @@ export interface ExpressionRefusalParams {
    */
   'date-duration-value': { readonly reference?: string };
   /**
-   * A text or boolean field used with an arithmetic or ordering `operator`
-   * against a number. A WARNING (the expression reads null) unless `outcome`
-   * is `'fail-closed'`: the site refuses the write it guards when the
-   * expression faults, and the verdict is an ERROR (#29904).
+   * WARNING, never an error: a text or boolean field used with an arithmetic
+   * or ordering `operator` against a number, at a site where a fault reads
+   * null (a formula field) or whose fault outcome the caller did not declare.
    */
-  'type-mismatch': {
-    readonly operands: string;
-    readonly operator: string;
-    readonly held: 'text' | 'boolean';
-    readonly reference?: string;
-    readonly outcome?: 'fail-closed';
-  };
+  'type-mismatch': TypeMismatchParams;
+  /**
+   * [#29926] ERROR: the same mismatch at a site that FAILS CLOSED — the
+   * expression faulting refuses the write (or aborts the operation a hook
+   * guards). Served as `type-mismatch` with `outcome: 'fail-closed'` by #29904
+   * until this code gave the sentence its own name.
+   */
+  'type-mismatch-fail-closed': TypeMismatchParams;
+  /**
+   * [#29926] ERROR: the same mismatch in a record-triggered flow's start or
+   * edge condition — the run fails at the condition, the write that fired it
+   * lands.
+   */
+  'type-mismatch-run-fails': TypeMismatchParams;
+  /**
+   * [#29926] ERROR: the same mismatch in an advisory (`warning` / `info`)
+   * validation rule — the rule is skipped, the write proceeds, and the
+   * advisory never fires.
+   */
+  'type-mismatch-fail-open': TypeMismatchParams;
   /**
    * WARNING, never an error: a bare identifier in a flattened condition that
    * is one typo away from a field. Absent `objectName` reads "the trigger object".
@@ -243,6 +267,9 @@ const CODE_TABLE = {
   'date-text-arithmetic': true,
   'date-duration-value': true,
   'type-mismatch': true,
+  'type-mismatch-fail-closed': true,
+  'type-mismatch-run-fails': true,
+  'type-mismatch-fail-open': true,
   'field-near-miss': true,
   'traversal-bare-and-traversed': true,
   'traversal-multi-hop': true,
 
@@ -165,7 +165,7 @@ export type { UnknownFunctionCall } from './unknown-function';
 // ADR-0032 — shared validator + introspection (one validator for build,
 // registration, and the agent-callable validate_expression tool).
 export { validateExpression, introspectScope, expectedDialect, inferExpressionType, nearestName, CEL_STDLIB_FUNCTIONS } from './validate';
-export type { FieldRole, ExprInput, ExprSchemaHint, ExprValidationError, ExprValidationResult, InferredValueType } from './validate';
+export type { FieldRole, ExprInput, ExprSchemaHint, ExprFaultOutcome, ExprValidationError, ExprValidationResult, InferredValueType } from './validate';
 // #22727 — the declaration authoring stamps onto a formula field: its
 // `returnType`, and for a provably-money result its currency, copied from the
 // source field's own `currencyConfig`. The producer behind `returnType: 'currency'`.
 
@@ -771,20 +771,50 @@ describe('validateExpression (ADR-0032)', () => {
       expect(r.ok).toBe(false);
       expect(r.warnings).toHaveLength(0);
       expect(r.errors).toHaveLength(1);
-      expect(r.errors[0]).toMatchObject({
-        code: 'type-mismatch',
-        params: { operands: 'string > int', operator: '>', held: 'text', reference: 'record.name', outcome: 'fail-closed' },
+      // [#29926] Its own code: the fail-closed sentence is not the warning's.
+      expect(r.errors[0]).toEqual({
+        source: 'record.name > 5',
+        message: expect.any(String),
+        code: 'type-mismatch-fail-closed',
+        params: { operands: 'string > int', operator: '>', held: 'text', reference: 'record.name' },
       });
       expect(r.errors[0].message).not.toMatch(/evaluates to null/);
       const bool = validateExpression('predicate', 'record.is_active > 0', { ...schema, faultOutcome: 'fail-closed' });
-      expect(bool.errors.map((e) => e.code)).toEqual(['type-mismatch']);
+      expect(bool.errors.map((e) => e.code)).toEqual(['type-mismatch-fail-closed']);
       // The conversions the message names validate clean in this dialect.
       for (const fixed of ['size(record.name) > 5', 'double(record.name) > 5']) {
         const ok = validateExpression('predicate', fixed, { ...schema, faultOutcome: 'fail-closed' });
         expect([ok.errors, ok.warnings], fixed).toEqual([[], []]);
       }
     });
 
+    // [#29926] The two other outcomes a caller can declare, each an error
+    // under its own code, worded for what that runtime does.
+    it('errors with the run-fails wording where the caller declares a flow condition (#29926)', () => {
+      const flat = { ...schema, scope: 'flattened' as const, faultOutcome: 'run-fails' as const };
+      const r = validateExpression('predicate', 'name > 5', flat);
+      expect(r.warnings).toHaveLength(0);
+      expect(r.errors.map((e) => [e.code, e.params])).toEqual([
+        ['type-mismatch-run-fails', { operands: 'string > int', operator: '>', held: 'text', reference: 'name' }],
+      ]);
+      expect(r.errors[0].message).toContain('fails the run');
+      expect(r.errors[0].message).toContain('the write that fired it still lands');
+      expect(r.errors[0].message).not.toMatch(/evaluates to null|is refused/);
+      for (const fixed of ['size(name) > 5', 'double(name) > 5']) {
+        const ok = validateExpression('predicate', fixed, flat);
+        expect([ok.errors, ok.warnings], fixed).toEqual([[], []]);
+      }
+    });
+
+    it('errors with the skipped-advisory wording where the caller declares fail-open (#29926)', () => {
+      const r = validateExpression('predicate', 'record.name > 5', { ...schema, faultOutcome: 'fail-open' });
+      expect(r.warnings).toHaveLength(0);
+      expect(r.errors.map((e) => e.code)).toEqual(['type-mismatch-fail-open']);
+      expect(r.errors[0].message).toContain('the write proceeds');
+      expect(r.errors[0].message).toContain('its advisory never fires');
+      expect(r.errors[0].message).not.toMatch(/evaluates to null|is refused/);
+    });
+
     it('warns on a text field ordered against a number', () => {
       const r = validateExpression('predicate', 'record.title >= 5', schema);
       expect(r.ok).toBe(true);