diff --git a/‎.changeset/22019-object-save-door-formula-verdict.md‎
Lines changed: 29 additions & 0 deletions b/‎.changeset/22019-object-save-door-formula-verdict.md‎
Lines changed: 29 additions & 0 deletions
diff --git a/‎.changeset/22019-objectql-formula-fault-log.md‎
Lines changed: 11 additions & 0 deletions b/‎.changeset/22019-objectql-formula-fault-log.md‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎packages/lint/src/authoring-rules.ts‎
Lines changed: 32 additions & 4 deletions b/‎packages/lint/src/authoring-rules.ts‎
Lines changed: 32 additions & 4 deletions
diff --git a/‎packages/lint/src/runtime-gate.object-formula-writes.test.ts‎
Lines changed: 164 additions & 0 deletions b/‎packages/lint/src/runtime-gate.object-formula-writes.test.ts‎
Lines changed: 164 additions & 0 deletions
diff --git a/‎packages/lint/src/runtime-gate.object-writes.test.ts‎
Lines changed: 7 additions & 0 deletions b/‎packages/lint/src/runtime-gate.object-writes.test.ts‎
Lines changed: 7 additions & 0 deletions
@@ -0,0 +1,29 @@
+---
+"@objectstack/lint": minor
+"@objectstack/metadata-protocol": minor
+---
+
+fix(lint)!: the object save door refuses a formula field whose expression `os build` refuses (#22019)
+
+Clause-②: no (narrowing)
+
+`formulas.mdx` says the same `validateExpression` validator backs `os build` and metadata registration. At the object save door it did not. A formula field calling an unregistered function, such as `sqrt(record.amount)`, was refused by `os build` as an unknown function, but `PUT /api/v1/meta/object/:name` answered 200, stored it, and the field read `null` on every row.
+
+The runtime publish gate now runs the build's own formula check on an object write. The registry entry for the build's expression rule (`validateStackExpressions`) declared the flow, action and hook writes and never the object write, so the gate never dispatched it there. It now declares `object` as well, for one of its passes: a formula field's `expression`. The door's verdict is the build's finding: the same rule id (`expression-invalid`), location (`object 'NAME' · field 'FIELD' expression`), message and hint.
+
+**BREAKING — what moves for consumers.**
+
+- An object write in publish mode answered 200 for a formula field whose expression the shared validator refuses. It now answers `422 INVALID_METADATA`, with an `expression-invalid` issue located at that field's `expression`. This covers `PUT /api/v1/meta/object/:name` (and `saveMetaItem` in publish mode), the promotion of a draft (`POST /api/v1/meta/object/:name/publish`, `publishMetaItem`), and a package draft publish (`publishPackageDrafts`).
+- The verdict is the one `os build`, `os validate` and `os lint` already gave: an unknown function, a field the object does not declare, a bare field reference (`amount` instead of `record.amount`), and the other errors in the build's formula check. Its warnings now ride the save response as advisories, as they already did for a flow write.
+
+**Remedy.** Fix the expression: the message names the unknown function or field and the position, as `os build` already requires. Use one of the functions `introspectScope` lists, qualify field reads as `record.FIELD`, or compute the value in a stored field and reference it. Saving it as a draft (`mode: 'draft'`) is still allowed, because drafts are never gated; publishing that draft is judged.
+
+**Unchanged.**
+
+- Stored rows are not migrated, and they are not refused on read. An object stored before this change keeps reading, with the formula still `null`, until it is next saved. At that save the gate judges it, because the differential compares the write against the stored universe without its own stored row.
+- The other expressions an object carries are still not judged at this door: validation-rule predicates, the field-rule slots (`requiredWhen`, `readonlyWhen`, `conditionalRequired`, `visibleWhen`), option `visibleWhen`, and the object's own action predicates. `os build` judges them, and the door does not, as before. Each needs its own crossing, measured over the stored corpus first.
+- `OS_ALLOW_UNLINTED_METADATA_WRITES=1` still turns a refusal into a logged write.
+- Measured before crossing: every formula field this repository ships has 0 refusals and 0 advisories at the door. That is 29 fields on 28 objects: examples 7 on 6, and the platform `display_title` formulas 22 on 22.
+- No public export or signature moves. `validateStackExpressions(stack)` keeps its signature. The registry entry reaches the passes through an internal function that is not on the package's entry. The built entry declarations differ only in one doc comment, on `AuthoringRuleContext.runtimeWriteType`.
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal at the object save door of a formula expression the published validator already refuses at `os build`: no authorable key, spelling, export or stored shape moves, and no stored row is read, rewritten or converted. A stored object whose formula the validator refuses keeps reading until it is next saved, and the repair is the author's edit of the expression, which no ledger entry can derive. The other categories are closed on facts: the packages publish (not unpublished); no ADR-0087 id covers this door (not already-registered); and the change is a door verdict, not a declaration (not runtime-interface-only or type-surface-only). -->
@@ -0,0 +1,11 @@
+---
+"@objectstack/objectql": patch
+---
+
+fix(objectql): a formula field that does not evaluate is logged once per object and field, instead of reading `null` in silence (#22019)
+
+A formula the engine cannot evaluate reads `null`, on `find`, on `findOne` and on the write response. Before this change nothing said why. A formula calling an unregistered function (`sqrt(record.amount)`) read `null` on every row with no log line anywhere. ADR-0032 says a call site must not silently swallow an expression fault.
+
+The engine now reports the fault through its logger at `warn`, once per (object, field) per engine instance, however many rows and reads hit it. The line names the object, the field and the evaluator's error (kind and first line; the full message is in the log metadata). It also says where the repair is: `os validate` or a re-save of the object refuses an expression-level fault with a located message, and a fault that depends on a record's values needs a guard on the operands it reads.
+
+Unchanged: the field still reads `null`, because what a read returns is protocol. `evaluateFormulaField`, the hook-side helper with no engine, still returns `null` without a log line. The built entry declarations gain three `private` member names on `ObjectQL`.
@@ -97,7 +97,7 @@
 // Imported per-module, never through `./index.js`: the barrel would make this
 // file a cycle partner of its own package entry, and the runtime surface
 // (`./runtime.js`) needs a graph it can reason about rule by rule.
-import { validateStackExpressions } from './validate-expressions.js';
+import { runStackExpressionPasses } from './validate-expressions.js';
 import { validateListViewMode } from './validate-list-view-mode.js';
 import { validateFunctionalCompleteness } from './validate-functional-completeness.js';
 import { validateManagedApiMethods } from './validate-managed-api-methods.js';
@@ -306,6 +306,12 @@ export interface AuthoringRuleContext {
    * members can judge a partial per-write snapshot without inventing
    * findings. No other rule reads it, and none should without the same
    * argument.
+   *
+   * [#22019] One other rule reads it, on that argument: `validateStackExpressions`
+   * is one entry over several PASSES, and an `object` write is admitted for its
+   * field-formula pass alone (`runStackExpressionPasses`, `StackExpressionOptions`). The
+   * entry-level `runtimeTypes` can say that an object write reaches the rule; it
+   * cannot say which of the rule's passes judge that write.
    */
   runtimeWriteType?: string;
   /**
@@ -570,10 +576,32 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     // crossing: 79 actions and 6 hooks (showcase 70/4, todo 8/1, crm 1/1) →
     // 0 differential findings, with lit synthetic probes refused per type in
     // `runtime-gate.inert-type-writes.test.ts`.
+    //
+    // [#22019] `object` joins, for ONE pass: a formula field's `expression`.
+    // `formulas.mdx` says the same `validateExpression` validator backs
+    // `os build` and metadata registration; at the object save door it did
+    // not, so `sqrt(record.amount)` — refused by `os build` as an unknown
+    // function — saved with a 200 and read `null` on every row, logged
+    // nowhere. The door now gives the build's verdict, from this entry, in the
+    // build's words (rule, location, message and hint are the same finding).
+    //
+    // NARROW by construction, not by snapshot shape: `ctx.runtimeWriteType`
+    // reaches `runStackExpressionPasses` — the body `validateStackExpressions`
+    // runs, whose public signature is unchanged — which on an object write runs
+    // the field-formula pass and fences every other object-borne expression
+    // pass off by name (`StackExpressionOptions.runtimeWriteType`) — each of
+    // those is a crossing of its own, not a rider on this one.
+    //
+    // MEASURED over the stored corpus at the door's own snapshot shape before
+    // crossing: every formula field the repository ships — 29 fields on 28
+    // objects (examples: app-crm 4 on 3, app-showcase 2 on 2, app-todo 1 on 1,
+    // app-multi-package none; platform `display_title` formulas: 22 on 22) →
+    // 0 differential errors and 0 advisories, against 1 refusal for the card's
+    // own `sqrt(record.amount)` body under the same harness.
     surfaces: CLI_AND_RUNTIME,
-    runtimeTypes: ['flow', 'action', 'hook'],
-    run: (stack) =>
-      validateStackExpressions(stack).map((i) => ({
+    runtimeTypes: ['flow', 'action', 'hook', 'object'],
+    run: (stack, ctx) =>
+      runStackExpressionPasses(stack, { runtimeWriteType: ctx.runtimeWriteType }).map((i) => ({
         severity: i.severity ?? 'error',
         rule: EXPRESSION_INVALID,
         where: i.where,
 
@@ -0,0 +1,164 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #22019 — the OBJECT write door runs the build's field-formula pass, and only
+ * that pass.
+ *
+ * ## The state this closes
+ *
+ * `validateStackExpressions` is the build's expression rule. Its field-formula
+ * pass calls `validateExpression('value', …)` on every `fields[].expression` —
+ * the verdict `formulas.mdx` says backs both `os build` and metadata
+ * registration. The entry declared `runtimeTypes: ['flow', 'action', 'hook']`,
+ * so on an `object` write the gate never dispatched it: a formula calling an
+ * unregistered function (`sqrt(record.amount)`) published clean and read
+ * `null` on every row.
+ *
+ * ## The crossing, and its fence
+ *
+ * `object` joins `runtimeTypes`, and the gate's `runtimeWriteType` reaches the
+ * rule (`runStackExpressionPasses`), which on an object write runs the
+ * field-formula pass alone. Every other object-borne pass the build runs —
+ * validation-rule predicates, the field-rule slots, option `visibleWhen`, the
+ * object's own action predicates — is FENCED off this door by name, and the
+ * fence is pinned below with the build still flagging the same body, so a
+ * later widening moves that line consciously rather than by drift.
+ *
+ * The protocol-level half — the same verdict through the real `saveMetaItem`
+ * and `publishMetaItem`, and the door/build equality of the finding — is
+ * the #22019 block of `packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts`.
+ */
+import { describe, expect, it } from 'vitest';
+import { EXPRESSION_INVALID, runAuthoringRules } from './authoring-rules.js';
+import { runRuntimeAuthoringRules, runtimeAuthoringRulesFor } from './runtime-gate.js';
+import { runStackExpressionPasses, validateStackExpressions } from './validate-expressions.js';
+
+/** The card's object, with the formula under test. `sharingModel` keeps `security-owd-unset` quiet. */
+const fxSqrt = (expression: string, over: Record<string, unknown> = {}) => ({
+  name: 'fx_sqrt',
+  label: 'Formula Probe',
+  sharingModel: 'private',
+  fields: {
+    name: { type: 'text', label: 'Name' },
+    amount: { type: 'number', label: 'Amount' },
+    score: { type: 'formula', label: 'Score', expression },
+  },
+  ...over,
+});
+
+const WHERE = "object 'fx_sqrt' · field 'score' expression";
+
+const gateObject = (item: unknown) =>
+  runRuntimeAuthoringRules({ type: 'object', item, context: { objects: [] } });
+
+const expressionFindings = <T extends { rule: string }>(fs: readonly T[]): T[] =>
+  fs.filter((f) => f.rule === EXPRESSION_INVALID);
+
+const dump = (r: unknown) => JSON.stringify(r, null, 2);
+
+describe('#22019 — the object door dispatches the build\'s expression rule', () => {
+  it('`validateStackExpressions` is on the object door', () => {
+    expect(runtimeAuthoringRulesFor('object').map((r) => r.name)).toContain('validateStackExpressions');
+  });
+
+  it('⭐ LIT — a formula calling an unregistered function (`sqrt`) is REFUSED, located at the key the author edits', () => {
+    const result = gateObject(fxSqrt('sqrt(record.amount)'));
+
+    expect(result.rulesRun).toContain('validateStackExpressions');
+    const errs = expressionFindings(result.errors);
+    expect(errs, dump(result)).toHaveLength(1);
+    expect(errs[0]).toMatchObject({ severity: 'error', where: WHERE, path: WHERE });
+    expect(errs[0]!.message).toContain('`sqrt` is not a callable name here');
+  });
+
+  it('⭐ LIT — a formula reading a field the object has not got is REFUSED (the same pass, its field-existence half)', () => {
+    const result = gateObject(fxSqrt('floor(record.amont)'));
+
+    const errs = expressionFindings(result.errors);
+    expect(errs, dump(result)).toHaveLength(1);
+    expect(errs[0]).toMatchObject({ where: WHERE });
+    expect(errs[0]!.message).toContain('amont');
+  });
+
+  it('⭐ CONTROL — a registered call (`floor(record.amount)`) publishes clean', () => {
+    const result = gateObject(fxSqrt('floor(record.amount)'));
+
+    expect(result.rulesRun).toContain('validateStackExpressions');
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+    expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+  });
+
+  it('⭐ PARITY — the door finding IS the build finding for the same body', () => {
+    const body = fxSqrt('sqrt(record.amount)');
+    const atDoor = expressionFindings(gateObject(body).errors);
+    const stack = { objects: [body] };
+    const atBuild = expressionFindings(runAuthoringRules('build', { normalized: stack, parsed: stack }));
+
+    expect(atBuild).toHaveLength(1);
+    expect(atDoor).toEqual(atBuild);
+  });
+
+  it('a stored sibling\'s broken formula is not this write\'s to answer for (the differential)', () => {
+    const sibling = { ...fxSqrt('sqrt(record.amount)'), name: 'fx_sibling' };
+    const result = runRuntimeAuthoringRules({
+      type: 'object',
+      item: fxSqrt('floor(record.amount)'),
+      context: { objects: [sibling] },
+    });
+
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+  });
+});
+
+describe('#22019 — the fence: every other object-borne expression pass stays off this door', () => {
+  /**
+   * One body carrying a fault in each fenced pass, and a CLEAN formula. The
+   * build flags every one of them; the object door flags none. Each fault is
+   * one the build refuses at `error`, so "the door is silent" cannot be read
+   * as "there was nothing to say".
+   */
+  const fenced = () => fxSqrt('floor(record.amount)', {
+    validations: [
+      { name: 'amount_root', type: 'script', condition: 'sqrt(record.amount) > 1', message: 'x', severity: 'error' },
+    ],
+    actions: [
+      { name: 'fx_close', label: 'Close', type: 'script', target: 'close', visible: 'record.status ==' },
+    ],
+  });
+  const withFieldRule = () => {
+    const body = fenced();
+    (body.fields as Record<string, unknown>).name = {
+      type: 'text', label: 'Name', requiredWhen: 'amount > 1',
+    };
+    return body;
+  };
+
+  it('the build (no `runtimeWriteType`) still flags each fenced site', () => {
+    const wheres = validateStackExpressions({ objects: [withFieldRule()] })
+      .filter((i) => (i.severity ?? 'error') === 'error')
+      .map((i) => i.where);
+
+    expect(wheres.some((w) => w.includes("validation 'amount_root'")), dump(wheres)).toBe(true);
+    expect(wheres.some((w) => w.includes("field 'name' requiredWhen")), dump(wheres)).toBe(true);
+    expect(wheres.some((w) => w.includes("action 'fx_close'")), dump(wheres)).toBe(true);
+    expect(wheres.some((w) => w === WHERE), 'the clean formula must not be flagged').toBe(false);
+  });
+
+  it('the object door flags none of them — only a formula field\'s `expression` is judged there', () => {
+    const result = gateObject(withFieldRule());
+
+    expect(result.rulesRun).toContain('validateStackExpressions');
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+    expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+  });
+
+  it('the narrowing is the rule\'s, keyed on the write type — a flow write still runs every pass it ran', () => {
+    // `runtimeWriteType: 'flow'` is what the gate passes on a flow write; the
+    // option narrows ONLY on `object`, so nothing about the three existing
+    // doors moves.
+    const stack = { objects: [withFieldRule()] };
+    expect(runStackExpressionPasses(stack, { runtimeWriteType: 'flow' })).toEqual(validateStackExpressions(stack));
+    // And the object pass set is a strict subset of what the build reports.
+    expect(runStackExpressionPasses(stack, { runtimeWriteType: 'object' })).toEqual([]);
+  });
+});
@@ -111,6 +111,12 @@ describe('the object write door dispatches at the adjudicated scope (#4716)', ()
     // distinguishable, and a rule silently joining or leaving this door is
     // precisely the drift this pin exists to catch.
     expect(runtimeAuthoringRulesFor('object').map((r) => r.name)).toEqual([
+      // [#22019] The build's expression rule joins, for ONE of its passes: a
+      // formula field's `expression` — the `validateExpression` verdict the
+      // docs say backs metadata registration. Its other object-borne passes are
+      // fenced off this door inside the rule (`StackExpressionOptions`), and
+      // that fence is pinned in `runtime-gate.object-formula-writes.test.ts`.
+      'validateStackExpressions',
       'validateFunctionalCompleteness',
       'validateManagedApiMethods',
       'validatePresetComparands', // #8793 — at this door before #4716
@@ -391,6 +397,7 @@ describe('the object write door dispatches at the adjudicated scope (#4716)', ()
     expect(result.advisories, JSON.stringify(result.advisories)).toEqual([]);
     // "clean" and "nothing ran" must stay distinguishable.
     expect(result.rulesRun).toEqual([
+      'validateStackExpressions', // [#22019] — see the roster pin above
       'validateFunctionalCompleteness',
       'validateManagedApiMethods',
       'validatePresetComparands',