@@ -0,0 +1,13 @@
+---
+'@objectstack/formula': patch
+'create-objectstack': patch
+---
+
+fix(formula): the bare-reference and unbound-root refusals say the expression faults, not that it evaluates to null
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/formula`.** In a `record`-scoped expression, a bare field name (`amount` where `record.amount` is meant) and a mistyped root (`pge.…` where the surface binds `page`) are unknown variables: the expression faults with `Unknown variable: NAME` and never reads the field. The `bare-reference` and `unbound-root` refusals used to say the name "resolves to nothing and the expression silently evaluates to null", which is true only of a formula field. They now say the expression faults, and `bare-reference` names three outcomes of that fault: a formula field reads null, an `error` validation rule refuses the write, an action's `visible` hides the action. `os validate`, `os build` and the `validate_expression` tool print the new sentences.
+- Codes and params are unchanged (`bare-reference` `{ name }`, `unbound-root` `{ name, roots, suggestion }`). What is refused, warned or passed is unchanged. Only the English `message` changed, so a consumer that matched the old text re-keys to the `code`.
+- **`create-objectstack`.** The scaffolded `AGENTS.md` no longer says a bare field reference "evaluates to `null`". It now says the predicate cannot be evaluated on any record, so an action whose `visible` reads it is hidden everywhere and an `error` validation rule that reads it refuses every write. Projects scaffolded earlier keep their copy until it is edited.
@@ -239,7 +239,7 @@ come at two severities: **errors** fail the build; **warnings** are advisory
 
 | Check | Example | Severity |
 |:---|:---|:---|
-| **Qualify field references** — a formula / validation / predicate binds only the `record` namespace, so a bare `amount` resolves to nothing and evaluates to `null`. Write `record.amount`. | `amount > 100` → `record.amount > 100` | error |
+| **Qualify field references** — a formula / validation / predicate binds only the `record` namespace, so a bare `amount` is an unknown variable and the expression faults instead of reading the field: a formula reads `null`, and a predicate takes its site's fault outcome (an `error` validation rule refuses the write, an action's `visible` hides the action). Write `record.amount`. | `amount > 100` → `record.amount > 100` | error |
 | **Field must exist** — a typo'd `record.<field>` is flagged with a did-you-mean. | `record.amont` → `record.amount` | error |
 | **Unknown function** — a misspelled or nonexistent stdlib call. | `isBlnk(record.x)` | error |
 | **Type soundness** — a text or boolean field used with an arithmetic (`+ - * / %`) or ordering (`< > <= >=`) operator against a number faults at runtime unless the text is numeric. In a formula it evaluates to `null`. Where a fault does something else it is an error, worded for what happens: a validation rule, a field `requiredWhen` / `readonlyWhen`, an option `visibleWhen` or a hook `condition` refuses the write; a record-triggered flow's start, edge or `decision` branch condition fails the run (the write that fired it still lands), whether it reads the field bare or as `record.<field>`, and so does a time-relative flow's that sweeps the same object, where no write fires the run and only the run for that row fails; a bare name that a declared flow variable or a `screen` field holds reads that value, so it is not judged as the field, and a bare name after a node that can bind any name (`script`, `connector_action`, `wait`, `subflow`, `map`, a screen with no fields) gets the warning instead, while its `record.<field>` read is still refused; an advisory (`severity: 'warning'` / `'info'`) validation rule is skipped, so it never gives its advisory. Store it as a number field, compare text with text, or convert explicitly (`size(record.name)` for the length; `double(record.name)`, which itself faults on text that is not a number). | `record.title * 2`; `record.name > 5` in a validation rule → `size(record.name) > 5` | warning in a formula or a display predicate, and in a condition of any other flow, where the warning says the run fails if the condition faults (what such a flow binds under the name depends on how it is started); error at the sites named |
 
@@ -390,8 +390,10 @@ To compare against a field's previous value, reference `previous.<field>`
 (e.g. `record.stage != previous.stage`).
 
 > **Qualify your references.** A validation predicate binds only the `record`
-> namespace, so a bare `status == "won"` resolves to nothing and the rule
-> silently never fires — write `record.status == "won"`. `objectstack build`
+> namespace, so a bare `status == "won"` is an unknown variable and the rule
+> cannot be evaluated: an `error` rule then refuses every write it judges, and a
+> `warning` / `info` rule is skipped with a log line and never applied — write
+> `record.status == "won"`. `objectstack build`
 > flags bare references, unknown fields, and text/boolean fields misused in
 > arithmetic — see [Build-time validation](/docs/data-modeling/formulas#build-time-validation).
 
 
@@ -28,7 +28,9 @@ they reference record fields through the `record.` scope:
 
 ```ts
 // ✗ Wrong — `done` is a bare reference. It type-checks (it's just a string),
-//   but at runtime it resolves to null → the action is hidden on EVERY record.
+//   but at runtime it is an unknown variable, so the predicate faults on every
+//   record — and the Console hides an action whose `visible` faults: hidden on
+//   EVERY record.
 { name: 'mark_done', visible: '!done' }
 
 // ✓ Right
@@ -896,16 +898,19 @@ What the failure does depends on what the predicate guards:
 
 | Predicate | On failure |
 | :--- | :--- |
-| A field's `visibleWhen`, `readonlyWhen`, `requiredWhen`; a view's `visibleOn`; an option's `visibleWhen`; list conditional formatting | **Fail open**: the rule's safe default applies, so a broken rule never hides a field. A rule that never fires while its field stays visible is the symptom, usually a bare field name where `record.<field>` was meant |
+| A field's `visibleWhen`, `readonlyWhen`, `requiredWhen`; a view's `visibleOn`; an option's `visibleWhen`; list conditional formatting | **Fail open in the Console's rendering**: the rule's safe default applies, so a broken rule never hides a field. A rule that never fires while its field stays visible is the symptom, usually a bare field name where `record.<field>` was meant. This row is the Console's display only; the server judges `requiredWhen`, `readonlyWhen` and an option's `visibleWhen` again on the write (see below) |
 | An object field group's `visibleWhen` | **Fail closed**: the whole group is hidden on the form and the record page |
 | A page node's `visibleWhen` / `visible` / `hidden`, and a `page:tabs` item's `visibleWhen` | **Fail closed**: the node or tab is withheld; a withheld related list is not counted in its tab badge |
 | A navigation item's or area's `visible` | **Fail open**: the item renders for everyone, reported under `app-shell:visible` |
 
 At **submit** a broken field rule is refused, not passed. A field `visibleWhen` that
 cannot be evaluated refuses the submit on the client, with a message naming the field
-and the rule, because no server evaluates `visibleWhen`. A broken `requiredWhen` or
-`readonlyWhen` is refused by the server, and the form shows that refusal beside the
-input. A `visibleWhen` that reads `previous` cannot be evaluated on a create form, so
+and the rule, because no server evaluates a field's `visibleWhen`. A broken
+`requiredWhen` or `readonlyWhen`, or an option's `visibleWhen`, is refused by the
+server, and the form shows that refusal beside the input. One exception: a
+`readonlyWhen` that reads a name the write does not bind (a bare field name, or
+`parent` where no master-detail header was resolved) holds the lock instead: the
+server drops the incoming change to that field and the rest of the write lands. A `visibleWhen` that reads `previous` cannot be evaluated on a create form, so
 such a form is always refused.
 
 A **blank** rule (`''`, whitespace, or an envelope whose `source` is blank) is not "no
 
@@ -300,7 +300,8 @@ reference** — `status` instead of `record.status`:
 {/* os:check */}
 ```typescript
 // ✗ Wrong — bare `status`. Type-checks (it's just a string), but at runtime
-//   it resolves to null, so the action is hidden on EVERY ticket.
+//   it is an unknown variable, so the predicate faults on every ticket — and
+//   the Console hides an action whose `visible` faults: hidden on EVERY ticket.
 visible: 'status != "resolved"'
 ```
 
@@ -315,8 +316,11 @@ visible: 'status != "resolved"'
   ✗ Author-time rules failed (1 issue)
   • stack · action 'resolve_ticket' visible: bare reference `status` — a
     formula/validation expression binds the record as the `record` namespace,
-    not at top level, so `status` resolves to nothing and the expression
-    silently evaluates to null. Write `record.status`.
+    not at top level, so `status` is an unknown variable and the expression
+    faults with `Unknown variable: status` instead of reading the field. The
+    site's fault rule decides the outcome (a formula field reads null, an
+    `error` validation rule refuses the write, an action's `visible` hides the
+    action). Write `record.status`.
     — source: `status != "resolved"`
       rule: expression-invalid  at stack · action 'resolve_ticket' visible
 ```
 
@@ -96,7 +96,8 @@ const CASES: ReadonlyArray<{ rule: string; blindTo: readonly AuthoringCommand[];
     blindTo: ['lint'],
     stack: withBaseline({
       // The planted defect is the BARE `lead_score` (a record-scoped predicate
-      // binds fields under `record`, so this silently evaluates to null) — not
+      // binds fields under `record`, so `lead_score` is an unknown variable and
+      // the rule, `error` by default, refuses every write it judges) — not
       // the key it is written under. Spelled `condition`, which is the only key
       // `validation.zod.ts` declares: `expression` is one of the four names it
       // rejects outright, so a fixture using it planted TWO defects and let the
 
@@ -15,9 +15,11 @@ that defines business objects, views, automations, and AI agents in TypeScript.
 ## Verify your work (do this after every metadata change)
 
 Metadata mistakes fail **silently at runtime**, not at edit time — a bare field
-reference in a predicate (`done` instead of `record.done`) evaluates to `null`
-and silently hides an action on every record; a dangling widget binding renders
-an empty chart. Catch them before you ship:
+reference in a predicate (`done` instead of `record.done`) is an unknown
+variable, so the predicate cannot be evaluated on any record: an action whose
+`visible` reads it is hidden on every record, and an `error` validation rule
+that reads it refuses every write; a dangling widget binding renders an empty chart. Catch
+them before you ship:
 
 ```bash
 {{PM}} run validate      # schema + CEL predicates + widget bindings (no artifact)
 
@@ -351,8 +351,10 @@ let recordScopeEnv: Environment | undefined;
  * In a `record`-scoped CEL site — a `Field.formula` or an object validation
  * predicate — the evaluation scope binds only the `record`/`previous`/… *namespaces*
  * (no field flattening). A bare top-level identifier like `amount` or `status`
- * therefore resolves to nothing and the expression silently evaluates to `null`
- * / never fires (#1928, the class behind #1927's broken formulas). Returns the
+ * is therefore an unknown variable: the expression faults with `Unknown
+ * variable: <name>` instead of reading the field, and the site's fault rule
+ * decides the outcome — a formula reads null, a predicate is refused, locked,
+ * hidden or skipped (#1928, the class behind #1927's broken formulas). Returns the
  * first such bare reference, or `null`.
  *
  * Acts ONLY on cel-js's `Unknown variable: X` fault, so it cannot false-positive
 
@@ -274,8 +274,9 @@ const PINS: { readonly [C in ExpressionRefusalCode]: readonly [Pin<C>, ...Pin<C>
       produce: () => onlyError('predicate', "pge.selectedProjectId != ''", { scope: 'record', roots: ['page'] }),
       params: { name: 'pge', roots: ['page'], suggestion: 'page' },
       message:
-        'unbound root `pge` — beyond the record this authoring surface binds `page`, and `pge` is none of them, ' +
-        'so `pge.…` resolves to nothing and the expression silently evaluates to null. Did you mean `page`?',
+        'unbound root `pge` — beyond the record this authoring surface binds `page`, and `pge` is none of them: ' +
+        '`pge.…` is an unknown variable, so the expression faults with `Unknown variable: pge` instead of reading it. ' +
+        'Did you mean `page`?',
     },
   ],
   'bare-reference': [
@@ -284,7 +285,9 @@ const PINS: { readonly [C in ExpressionRefusalCode]: readonly [Pin<C>, ...Pin<C>
       params: { name: 'amount' },
       message:
         'bare reference `amount` — a formula/validation expression binds the record as the `record` namespace, ' +
-        'not at top level, so `amount` resolves to nothing and the expression silently evaluates to null. Write `record.amount`.',
+        'not at top level, so `amount` is an unknown variable and the expression faults with `Unknown variable: amount` ' +
+        'instead of reading the field. The site\'s fault rule decides the outcome (a formula field reads null, an ' +
+        '`error` validation rule refuses the write, an action\'s `visible` hides the action). Write `record.amount`.',
     },
   ],
   'date-arithmetic': [
 
@@ -94,8 +94,9 @@ export interface ExprSchemaHint {
    * #1928 tier 4 — field name → spec field type (`'text'`, `'currency'`,
    * `'boolean'`, `'date'`, …). Enables the advisory type-soundness check: a
    * text or boolean field used with an arithmetic/ordering operator against a
-   * number faults at runtime and the expression silently evaluates to `null`,
-   * so it is surfaced as a NON-blocking warning. Absent ⇒ the check is skipped.
+   * number faults at runtime — a formula field reads that fault as `null` —
+   * so it is surfaced as a NON-blocking warning, or as an error where the site
+   * declares its {@link faultOutcome}. Absent ⇒ the check is skipped.
    * Consulted at both scopes: `record.<field>` at a `'record'` site, the bare
    * `<field>` and its `record.<field>` / `previous.<field>` read at a
    * `'flattened'` one (#29959).
@@ -106,9 +107,12 @@ export interface ExprSchemaHint {
    * identifier is legal (#1928):
    *  - `'record'`    → the record is bound only as the `record` namespace, with
    *                    no field flattening (`Field.formula`, object validation
-   *                    predicates). A bare `amount` resolves to nothing and the
-   *                    expression silently evaluates to `null` / never fires, so
-   *                    it MUST be written `record.amount`. We flag bare refs.
+   *                    predicates). A bare `amount` is an unknown variable: the
+   *                    expression faults (`Unknown variable: amount`) instead of
+   *                    reading the field, and the site's fault rule decides the
+   *                    outcome (a formula reads null, a predicate is refused,
+   *                    locked, hidden or skipped), so it MUST be written
+   *                    `record.amount`. We flag bare refs.
    *  - `'flattened'` → the record's own fields are spread to top-level alongside
    *                    flow variables (flow / automation conditions), so bare
    *                    `status` is correct and is NOT an error. Flow variables
@@ -1247,9 +1251,9 @@ function mistypedRootRefusal(
     { name: bare, roots: [...surfaceRoots], suggestion },
     source,
     `unbound root \`${bare}\` — beyond the record this authoring surface binds ` +
-      `\`${surfaceRoots.join('`, `')}\`, and \`${bare}\` is none of them, so \`${bare}.…\` ` +
-      `resolves to nothing and the expression silently evaluates to null. ` +
-      `Did you mean \`${suggestion}\`?`,
+      `\`${surfaceRoots.join('`, `')}\`, and \`${bare}\` is none of them: \`${bare}.…\` ` +
+      `is an unknown variable, so the expression faults with \`Unknown variable: ${bare}\` ` +
+      `instead of reading it. Did you mean \`${suggestion}\`?`,
   );
 }
 
@@ -1492,8 +1496,11 @@ export function validateExpression(
               { name: bare },
               source,
               `bare reference \`${bare}\` — a formula/validation expression binds the record as the ` +
-                `\`record\` namespace, not at top level, so \`${bare}\` resolves to nothing and the ` +
-                `expression silently evaluates to null. Write \`record.${bare}\`.`,
+                `\`record\` namespace, not at top level, so \`${bare}\` is an unknown variable and the ` +
+                `expression faults with \`Unknown variable: ${bare}\` instead of reading the field. The ` +
+                `site's fault rule decides the outcome (a formula field reads null, an \`error\` ` +
+                `validation rule refuses the write, an action's \`visible\` hides the action). ` +
+                `Write \`record.${bare}\`.`,
             ),
         );
       } else if (schema.fieldTypes) {