@@ -0,0 +1,17 @@
+---
+'@objectstack/formula': patch
+'@objectstack/objectql': patch
+---
+
+fix(objectql,formula): a formula field whose `date()` / `datetime()` is handed text it cannot parse is a reported evaluation fault, not a silent null
+
+Clause-②: no
+Metadata-protocol: none
+
+A formula field such as `date(record.first)` on a row whose `first` holds text that is not a date (`"grace"`) read `null`, the same bytes an empty `first` gives, and nothing was logged. `date()` / `datetime()` answer an invalid Date for such text, the evaluator reports that as a success, and the invalid Date serializes to `null`, so the once-per-field formula fault line never fired.
+
+- **The field now reports it.** The read path (`find`, `findOne` and a write's response) treats that invalid Date as an evaluation fault: the field reads `null` exactly as before, and the engine's logger gets the one `warn` line per object and field per engine instance that every other formula fault gets. The line says that `date()` / `datetime()` take ISO text, a timestamp or epoch milliseconds. The record's text is not quoted in the log. A date function over the bad value (`addDays(date(record.first), 1)`) reports the same way.
+- **An empty source is not a fault.** `null`, empty or blank text still reads `null` with no line.
+- **Predicates are unchanged.** `date()` still answers the same invalid Date, so `date(record.d) == today()` over non-date text is still `false`, and `visibleWhen`, validation rules and filters answer as before. `isoDate()` and `daysBetween()` over it still refuse at evaluation.
+- **`@objectstack/formula` gains `isUnparseableDate(value)`**: `true` for the invalid Date `date()` / `datetime()` (or `addDays` / `addMonths` over it) answered for non-empty text they could not parse, `false` for everything else, including an invalid Date from an empty source. It reads a weakly held mark and never changes what any function returns.
+- **What a read returns over the wire does not move.** In process, `ObjectQL#find` now hands back `null` for such a field where it handed back an invalid `Date`; serialized, both are `null`.
@@ -0,0 +1,75 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `isUnparseableDate` — the mark `date()` / `datetime()` put on the invalid
+ * Date they answer for non-empty text they cannot parse.
+ *
+ * The VALUE is unchanged: still an invalid Date, still `ok: true`, so every
+ * predicate answers exactly as before. What is added is a way for a
+ * formula-field reader to tell "the text was not a date" from "there was no
+ * text", which both serialize to `null`. The objectql read path reports the
+ * first as a fault (`engine-formula-fault-log.test.ts`).
+ */
+
+import { describe, it, expect } from 'vitest';
+
+import { celEngine } from './cel-engine';
+import { isUnparseableDate } from './stdlib';
+
+const ev = (source: string, record: Record<string, unknown>) =>
+  celEngine.evaluate({ dialect: 'cel', source }, { record });
+
+describe('isUnparseableDate', () => {
+  it('marks date() / datetime() over text they cannot parse, and the value stays an ok invalid Date', () => {
+    for (const fn of ['date', 'datetime']) {
+      const r = ev(`${fn}(record.first)`, { first: 'grace' });
+      expect(r.ok).toBe(true);
+      const v = (r as { value: unknown }).value;
+      expect(v).toBeInstanceOf(Date);
+      expect(Number.isNaN((v as Date).getTime())).toBe(true);
+      expect(isUnparseableDate(v)).toBe(true);
+    }
+  });
+
+  it('the mark survives addDays / addMonths over it', () => {
+    for (const source of ['addDays(date(record.first), 1)', 'addMonths(date(record.first), 2)']) {
+      const r = ev(source, { first: 'grace' });
+      expect(r.ok).toBe(true);
+      expect(isUnparseableDate((r as { value: unknown }).value)).toBe(true);
+    }
+  });
+
+  it('control: an EMPTY source is not marked (null, empty and blank text)', () => {
+    for (const first of [null, '', '   ']) {
+      const r = ev('date(record.first)', { first });
+      expect(r.ok).toBe(true);
+      const v = (r as { value: unknown }).value as Date;
+      expect(Number.isNaN(v.getTime())).toBe(true);
+      expect(isUnparseableDate(v)).toBe(false);
+    }
+  });
+
+  it('control: ISO text, epoch numbers and non-Dates are not marked', () => {
+    const iso = ev('date(record.first)', { first: '2026-03-04' });
+    expect(iso.ok && (iso.value as Date).toISOString()).toBe('2026-03-04T00:00:00.000Z');
+    expect(isUnparseableDate((iso as { value: unknown }).value)).toBe(false);
+    const epoch = ev('date(record.n)', { n: 5 });
+    expect(isUnparseableDate((epoch as { value: unknown }).value)).toBe(false);
+    for (const v of [null, undefined, 'grace', new Date(Number.NaN), 0]) {
+      expect(isUnparseableDate(v)).toBe(false);
+    }
+  });
+
+  it('control: a predicate over date() on bad text answers as before — false, ok', () => {
+    expect(ev('date(record.first) == today()', { first: 'grace' })).toEqual({ ok: true, value: false });
+    expect(ev('date(record.first) != today()', { first: 'grace' })).toEqual({ ok: true, value: true });
+  });
+
+  it('control: isoDate / daysBetween over it still refuse at evaluate', () => {
+    const iso = ev('isoDate(date(record.first))', { first: 'grace' });
+    expect(iso.ok).toBe(false);
+    expect(!iso.ok && iso.error.message).toContain('not a renderable timestamp');
+    const days = ev('daysBetween(date(record.first), today())', { first: 'grace' });
+    expect(days.ok).toBe(false);
+  });
+});
@@ -92,7 +92,7 @@ export {
   MAIL_HTML_SUPPORTED_SHAPES,
 } from './mail-html-hole-placement';
 export type { MailHtmlHole, MailHtmlHolePlacement, MailHtmlHoleJudgeOptions } from './mail-html-hole-placement';
-export { registerStdLib, buildScope, registerPermissionPredicate, registerCapabilityPredicate } from './stdlib';
+export { registerStdLib, buildScope, registerPermissionPredicate, registerCapabilityPredicate, isUnparseableDate } from './stdlib';
 export type { PermissionBinding } from './stdlib';
 // objectui#4421 / batch #147 — the permission predicate's data door. `can` reads
 // `EvalContext.permissions` and nothing else, and this is how that map is built
 
@@ -73,11 +73,48 @@ function startOfDayUtc(d: Date): Date {
   return out;
 }
 
-/** Coerce a CEL value (Date | ISO string | epoch number) to a Date. */
+/**
+ * The invalid Dates {@link toDate} minted from TEXT it could not parse — not
+ * from an empty source. Read through {@link isUnparseableDate}.
+ *
+ * `date()` / `datetime()` answer an invalid Date for both, and that answer is
+ * deliberate: a predicate compares it and stays `false` (`date(record.d) ==
+ * today()` on a non-date string is simply not today), which is what the
+ * temporal-equality rewrite in `cel-engine.ts` relies on. So the VALUE never
+ * changes here. A formula FIELD, though, serializes an invalid Date to `null`,
+ * the same bytes an empty source gives, and its reader must be able to tell
+ * "the text was not a date" (a fault worth one warn line) from "there was no
+ * text" (no fault). This side table is that distinction, held off the value.
+ *
+ * Weakly held, so it keeps nothing alive; it records a fact about an argument
+ * and never changes what any function returns.
+ */
+const unparseableDates = new WeakSet<Date>();
+
+/**
+ * Coerce a CEL value (Date | ISO string | epoch number) to a Date.
+ *
+ * Non-empty text that does not parse yields an invalid Date marked in
+ * {@link unparseableDates}; an empty source (`null`, `undefined`, blank text)
+ * yields an unmarked invalid Date.
+ */
 function toDate(v: unknown): Date {
   if (v instanceof Date) return v;
   if (typeof v === 'number' || typeof v === 'bigint') return new Date(Number(v));
-  return new Date(String(v));
+  const out = new Date(String(v));
+  if (typeof v === 'string' && v.trim() !== '' && Number.isNaN(out.getTime())) unparseableDates.add(out);
+  return out;
+}
+
+/**
+ * True when `value` is the invalid Date `date()` / `datetime()` (or a stdlib
+ * date function over one) answered for non-empty text it could not parse.
+ * False for an invalid Date from an empty source, for every valid Date and for
+ * anything that is not a Date. A formula-field reader reports a `true` as an
+ * evaluation fault; a predicate never asks.
+ */
+export function isUnparseableDate(value: unknown): boolean {
+  return value instanceof Date && unparseableDates.has(value);
 }
 
 /** One UTC day in milliseconds. */
@@ -113,6 +150,8 @@ function isoTimestampText(fn: string, d: Date): string {
 
 /** Add `n` days to a Date in UTC; returns a new Date. */
 function addDaysUtc(d: Date, n: number): Date {
+  // Unparseable text stays the same invalid Date, so its mark survives.
+  if (unparseableDates.has(d)) return d;
   const out = new Date(d.getTime());
   out.setUTCDate(out.getUTCDate() + n);
   return out;
@@ -125,6 +164,7 @@ function addDaysUtc(d: Date, n: number): Date {
  * "next service date = last + N months" rule to behave.
  */
 function addMonthsUtc(d: Date, n: number): Date {
+  if (unparseableDates.has(d)) return d;
   const out = new Date(d.getTime());
   const day = out.getUTCDate();
   out.setUTCDate(1); // avoid roll-over while shifting the month
 
@@ -30,6 +30,7 @@
  * (its #22019 block).
  */
 import { beforeEach, describe, expect, it } from 'vitest';
+import { ExpressionEngine } from '@objectstack/formula';
 import { ObjectQL } from './engine.js';
 
 type Rec = Record<string, unknown>;
@@ -204,3 +205,103 @@ describe('#22019 — a formula fault on the read path is said once per (object,
     expect(other.faultLines('score')).toHaveLength(1);
   });
 });
+
+/**
+ * An unparseable `date()` input is a fault, not a silent null.
+ *
+ * `date()` / `datetime()` coerce their argument with the stdlib's `toDate`,
+ * which answers an INVALID Date for text it cannot parse, and the evaluator
+ * reports that as `ok: true`. Predicates rely on that on purpose: a comparison
+ * over an invalid Date stays `false`. A formula FIELD has no such use for it:
+ * the invalid Date serializes to `null`, the same bytes an empty source gives,
+ * and nothing was said. Pinned here:
+ *
+ *  - the answer is still `null` — the bytes a read returns do not move;
+ *  - the field gets the one line per (object, field) any other fault gets, and
+ *    the line names `date()` and how to guard the operand;
+ *  - controls: ISO text still reads its instant with no line, an EMPTY source
+ *    logs nothing (a null operand is not a fault), and the same expression as a
+ *    predicate answers exactly as before.
+ */
+const FX_DATE = {
+  name: 'fx_date',
+  label: 'Date Formula Probe',
+  fields: {
+    id: { name: 'id', label: 'ID', type: 'text' as const, primaryKey: true },
+    first: { name: 'first', label: 'First', type: 'text' as const },
+    f_date: { name: 'f_date', label: 'F Date', type: 'formula' as const, expression: { dialect: 'cel', source: 'date(record.first)' } },
+    f_next: { name: 'f_next', label: 'F Next', type: 'formula' as const, expression: { dialect: 'cel', source: 'addDays(date(record.first), 1)' } },
+  },
+};
+
+async function makeDateRig(rows: Rec[]) {
+  const { logger, warns } = makeRecordingLogger();
+  const engine = new ObjectQL({ logger });
+  const { driver, storeFor } = makeStubDriver();
+  engine.registerDriver(driver as never, true);
+  await engine.init();
+  engine.registry.registerObject(FX_DATE as never, 'test');
+  for (const row of rows) storeFor('fx_date').set(String(row.id), row);
+  const faultLines = (field?: string) =>
+    warns.filter((w) => w.meta?.object === 'fx_date' && (field === undefined || w.meta?.field === field));
+  return { engine, warns, faultLines };
+}
+
+describe('an unparseable date() input in a formula field is a reported fault, and the answer stays null', () => {
+  it('text date() cannot parse: the field reads null, and the fault is said once per field', async () => {
+    const rig = await makeDateRig([{ id: 'r_g', first: 'grace' }, { id: 'r_h', first: 'hopper' }]);
+    const rows = await rig.engine.find('fx_date', {} as never) as Rec[];
+    await rig.engine.findOne('fx_date', { where: { id: 'r_g' } } as never);
+
+    const lines = rig.faultLines('f_date');
+    expect(lines, JSON.stringify(rig.warns)).toHaveLength(1);
+    // The served bytes are the ones the invalid Date serialized to before; the
+    // in-process value is the `null` every other fault reads.
+    expect(JSON.stringify(rows[0])).toContain('"f_date":null');
+    expect(rows.map((r) => r.f_date)).toEqual([null, null]);
+    expect(lines[0]!.message).toContain("formula field 'f_date' on 'fx_date'");
+    expect(lines[0]!.meta).toMatchObject({ object: 'fx_date', field: 'f_date', kind: 'runtime' });
+    expect(String(lines[0]!.meta?.error)).toContain('date()');
+    // A date function over the invalid Date is the same fault, on its own field.
+    expect(rows.map((r) => r.f_next)).toEqual([null, null]);
+    expect(rig.faultLines('f_next')).toHaveLength(1);
+    expect(rig.faultLines()).toHaveLength(2);
+  });
+
+  it('the write response reads null for it and says it there', async () => {
+    const rig = await makeDateRig([]);
+    const created = await rig.engine.insert('fx_date', { first: 'grace' }) as Rec;
+
+    expect(rig.faultLines('f_date')).toHaveLength(1);
+    expect(created.f_date).toBeNull();
+  });
+
+  it('control: ISO text still reads its instant, with no line', async () => {
+    const rig = await makeDateRig([{ id: 'r_iso', first: '2026-03-04' }]);
+    const [row] = await rig.engine.find('fx_date', {} as never) as Rec[];
+
+    expect(row!.f_date).toBeInstanceOf(Date);
+    expect((row!.f_date as Date).toISOString()).toBe('2026-03-04T00:00:00.000Z');
+    expect((row!.f_next as Date).toISOString()).toBe('2026-03-05T00:00:00.000Z');
+    expect(rig.faultLines()).toEqual([]);
+  });
+
+  it('control: an EMPTY source is not a fault — nothing is logged for it', async () => {
+    const rig = await makeDateRig([{ id: 'r_null', first: null }, { id: 'r_blank', first: '' }]);
+    const rows = await rig.engine.find('fx_date', {} as never) as Rec[];
+
+    expect(rows).toHaveLength(2);
+    // Read in-process as an invalid Date, served as `null`: the bytes this
+    // card does not move for an empty source either.
+    expect(JSON.parse(JSON.stringify(rows)).map((r: Rec) => r.f_date)).toEqual([null, null]);
+    expect(rig.faultLines()).toEqual([]);
+  });
+
+  it('control: the same date() as a predicate answers as before — false, no fault', () => {
+    const r = ExpressionEngine.evaluate(
+      { dialect: 'cel', source: 'date(record.first) == today()' },
+      { record: { first: 'grace' } },
+    );
+    expect(r).toEqual({ ok: true, value: false });
+  });
+});
@@ -334,7 +334,7 @@ import { applyProtection, pluralToSingular, ExternalWriteForbiddenError } from '
 import { SchemaRegistry, type ArtifactInstallScope } from './registry.js';
 import { expandSearchToFilter, normalizeSearch, SEARCHABLE_ENUM_TYPES, SEARCHABLE_TEXTUAL_TYPES } from './search-filter.js';
 import { stripSearchCompanion } from './search-companion.js';
-import { ExpressionEngine, analyzeRelationshipTraversals, type EvalError, type EvalOptionLabels, type EvalPermissions } from '@objectstack/formula';
+import { ExpressionEngine, analyzeRelationshipTraversals, isUnparseableDate, type EvalError, type EvalOptionLabels, type EvalPermissions } from '@objectstack/formula';
 import { declaredOptionLabels, readerOptionLabels } from './formula-option-labels.js';
 import type { Expression } from '@objectstack/spec';
 import {
@@ -3084,6 +3084,18 @@ function formulaHopRefusal(field: string, b: RelatedFieldBinding, named: Readonl
   }
 }
 
+/**
+ * What a formula field reports when it evaluated to the invalid Date that
+ * `date()` / `datetime()` answer for text they cannot parse
+ * ({@link isUnparseableDate}). An EMPTY source is not this fault: it reads
+ * `null` and says nothing. The record's text is not quoted — a log line is no
+ * place for row data.
+ */
+const UNPARSEABLE_DATE_FAULT =
+  'date() / datetime() was handed text it cannot parse as a date, so the formula has no value on this record; '
+  + 'they take ISO text (`2026-03-04`, `2026-03-04T09:30:00Z`), a timestamp or epoch milliseconds, and an empty '
+  + 'source reads null without a report.';
+
 function applyFormulaPlan(
   plan: FormulaPlanEntry[],
   records: any[],
@@ -3126,7 +3138,13 @@ function applyFormulaPlan(
         scope = hop.record;
         empty = hop.empty;
       }
-      const r = ExpressionEngine.evaluate(fp.expression, { now, timezone, user, org, permissions, optionLabels, record: scope });
+      const evaluated = ExpressionEngine.evaluate(fp.expression, { now, timezone, user, org, permissions, optionLabels, record: scope });
+      // An invalid Date minted from text `date()` could not parse evaluates
+      // `ok` (a predicate relies on that) but serializes to the `null` an empty
+      // source gives: for a field it is a fault, said like any other.
+      const r = evaluated.ok && isUnparseableDate(evaluated.value)
+        ? { ok: false as const, error: { kind: 'runtime' as const, message: UNPARSEABLE_DATE_FAULT } }
+        : evaluated;
       if (r.ok) {
         rec[fp.name] = roundFormulaValue(r.value, fp.scale);
         continue;