@@ -0,0 +1,15 @@
+---
+'@objectstack/lint': patch
+---
+
+fix(lint): a flow edge condition's `expression-invalid` finding carries the slot's key path (`flows[0].edges[1].condition`) beside its `where` text
+
+Clause-②: no
+Metadata-protocol: none
+
+An `expression-invalid` finding on a top-level flow edge's `condition` used to be located by its `where` prose alone (`flow 'f' · edge 'e2' (decide→end) condition`), which a reader keyed on paths could not address. Its `path` is now the key path in the spelling the other rules' findings use, so a draft's `_diagnostics` reports it item-relative (`edges.1.condition`) and Studio's edge condition field shows the refusal under itself.
+
+- `where`, the message and the verdict are unchanged: nothing is accepted or refused differently.
+- The edge is indexed in the list as authored (a `null` member before it does not renumber it).
+- A nested region's edge, and a flow in a map-form `flows` collection, keep `where` as their `path`, as before.
+- `ExprIssue` gains the optional `path`.
@@ -0,0 +1,134 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#26858 — the permission-set editor hands its RLS clause editors
+ * the served verdict on the set on screen.
+ *
+ * The set's page is its own: it holds the draft read itself and strips the
+ * read decorations off the body, so the verdict the draft read serves (since
+ * objectstack#26707, what its publish will refuse) never reached a field. The
+ * page now keeps that verdict and provides it, and reads it again after each
+ * package-door save, so the field follows the draft it describes.
+ *
+ * The fake door below serves a draft whose `_diagnostics` refuses its USING
+ * clause the way `rls-predicate-unenforceable` does, until the clause changes.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+
+const REFUSED_USING = 'deal_score > 5';
+const REFUSAL =
+  "rowLevelSecurity 'hot_deals' using reads 'deal_score', a formula field the database cannot filter on";
+
+const SET = {
+  name: 'sales_perms',
+  label: 'Sales',
+  objects: { a_account: { allowRead: true } },
+  fields: {},
+};
+
+interface Server {
+  draft: Record<string, unknown> | null;
+  draftReads: number;
+}
+
+/** The door's publish verdict on a stored draft: it refuses the one USING clause. */
+function verdictOf(body: Record<string, unknown>) {
+  const rows = (body.rowLevelSecurity ?? []) as Array<{ using?: string }>;
+  const errors = rows.flatMap((r, i) =>
+    r.using === REFUSED_USING
+      ? [{ path: `rowLevelSecurity.${i}.using`, message: REFUSAL, code: 'rls-predicate-unenforceable' }]
+      : [],
+  );
+  return errors.length ? { valid: false, errors } : { valid: true };
+}
+
+type FakeClient = Record<string, (...args: never[]) => Promise<unknown>>;
+
+function makeClient(server: Server): FakeClient {
+  return {
+    layered: async () => ({ effective: SET, code: null, overlay: null, overlayScope: null }),
+    getDraft: async () => {
+      server.draftReads += 1;
+      return server.draft
+        ? { type: 'permission', name: 'sales_perms', item: { ...server.draft, _draft: true, _diagnostics: verdictOf(server.draft) } }
+        : null;
+    },
+    list: async (type: string) => (type === 'object' ? [{ item: { name: 'a_account' } }] : []),
+    get: async () => null,
+    save: async (_type: string, _name: string, payload: Record<string, unknown>) => {
+      server.draft = JSON.parse(JSON.stringify(payload)) as Record<string, unknown>;
+      return payload;
+    },
+  };
+}
+
+let clientImpl: FakeClient;
+
+vi.mock('./useMetadata', () => ({
+  useMetadataClient: () => clientImpl,
+  useMetadataTypes: () => ({
+    loading: false,
+    error: null,
+    entries: [{ type: 'permission', label: 'Permission', allowEnvironmentOverlay: true }],
+  }),
+}));
+
+vi.mock('./AssignedUsersSection', () => ({ AssignedUsersSection: () => null }));
+
+import { PermissionMatrixEditPage } from './PermissionMatrixEditor';
+
+afterEach(cleanup);
+
+const USING_PLACEHOLDER = 'organization_id == current_user.organization_id';
+
+async function openPackageDoor(server: Server) {
+  clientImpl = makeClient(server);
+  render(
+    <MemoryRouter>
+      <PermissionMatrixEditPage type="permission" name="sales_perms" packageId="app.a" />
+    </MemoryRouter>,
+  );
+  await screen.findByText('a_account');
+  fireEvent.click(screen.getByRole('button', { name: /Row-Level Security/ }));
+}
+
+const policy = (using: string) => ({
+  ...SET,
+  rowLevelSecurity: [{ name: 'hot_deals', object: 'a_account', operation: 'select', using, enabled: true }],
+});
+
+describe('the permission-set editor provides the served verdict to its RLS clauses (objectstack#26858)', () => {
+  it('a pending draft the publish refuses: the USING clause shows the server message, not "Valid CEL"', async () => {
+    const server: Server = { draft: policy(REFUSED_USING), draftReads: 0 };
+    await openPackageDoor(server);
+    expect(await screen.findByText(REFUSAL)).toBeInTheDocument();
+    // The lint itself answered: the clause parses, and only the server refuses it.
+    await waitFor(() => expect(screen.getByPlaceholderText(USING_PLACEHOLDER)).toHaveValue(REFUSED_USING));
+    await new Promise((r) => setTimeout(r, 600));
+    expect(screen.queryByText('Valid CEL')).toBeNull();
+  });
+
+  it('the verdict follows the draft: after an autosave of a changed clause the refusal goes', async () => {
+    const server: Server = { draft: policy(REFUSED_USING), draftReads: 0 };
+    await openPackageDoor(server);
+    await screen.findByText(REFUSAL);
+    const readsBefore = server.draftReads;
+
+    fireEvent.change(screen.getByPlaceholderText(USING_PLACEHOLDER), { target: { value: 'owner_id == current_user.id' } });
+
+    await waitFor(() => expect(server.draftReads).toBeGreaterThan(readsBefore), { timeout: 5000 });
+    await waitFor(() => expect(screen.queryByText(REFUSAL)).toBeNull(), { timeout: 5000 });
+    expect(await screen.findByText('Valid CEL', {}, { timeout: 3000 })).toBeInTheDocument();
+  });
+
+  it('control: a draft the publish accepts reads "Valid CEL"', async () => {
+    const server: Server = { draft: policy('owner_id == current_user.id'), draftReads: 0 };
+    await openPackageDoor(server);
+    expect(await screen.findByText('Valid CEL', {}, { timeout: 3000 })).toBeInTheDocument();
+    expect(screen.queryByText(REFUSAL)).toBeNull();
+  });
+});
@@ -0,0 +1,107 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#26858 — the edit page provides the served verdict on the body
+ * on screen (`DraftVerdictContext`), so a field inside it — the flow edge
+ * condition, the CEL editors — can read the errors at its own path.
+ *
+ * The canvas stand-in below reads the context exactly as a field does
+ * (`useServerErrorsAt`) at one path and at a sibling. The server double serves
+ * a pending draft whose verdict refuses that path, the way the draft read does
+ * since objectstack#26707.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, cleanup, waitFor } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+
+const REFUSAL = 'region "main" names a component this deployment does not have';
+
+const server = vi.hoisted(() => ({ draft: null as Record<string, unknown> | null }));
+
+const mockClient = vi.hoisted(() => ({
+  list: vi.fn(async () => []),
+  listDrafts: vi.fn(async () => []),
+  get: vi.fn(async () => null),
+  references: vi.fn(async () => []),
+  layered: vi.fn(async () => ({
+    code: null,
+    overlay: server.draft,
+    overlayScope: 'env',
+    effective: server.draft,
+    _diagnostics: { valid: true },
+    editable: true,
+    deletable: true,
+    resettable: false,
+    lock: 'none',
+  })),
+  getDraft: vi.fn(async (type: string, name: string) => {
+    if (!server.draft) throw Object.assign(new Error('No pending draft'), { code: 'NO_DRAFT', status: 404 });
+    return {
+      type,
+      name,
+      item: {
+        ...server.draft,
+        _draft: true,
+        _diagnostics: { valid: false, errors: [{ path: 'regions.0', message: REFUSAL, code: 'page-component-unknown' }] },
+      },
+    };
+  }),
+  save: vi.fn(async (type: string, name: string, item: unknown) => ({ type, name, item })),
+  publish: vi.fn(async () => ({ success: true })),
+  reset: vi.fn(async () => ({})),
+}));
+
+vi.mock('./useMetadata', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('./useMetadata')>();
+  return {
+    ...mod,
+    useMetadataClient: () => mockClient,
+    useMetadataTypes: () => ({
+      entries: [{ type: 'page', name: 'page', label: 'Page', allowEnvironmentOverlay: true, schema: { required: [] } }],
+    }),
+  };
+});
+
+import { MetadataResourceEditPage } from './ResourceEditPage';
+import { registerMetadataPreview, getMetadataPreview } from './preview-registry';
+import { useServerErrorsAt } from './draftVerdict';
+
+/** Reads the page's verdict the way an expression field does. */
+function VerdictProbe() {
+  const here = useServerErrorsAt('regions.0');
+  const sibling = useServerErrorsAt('regions.1');
+  return (
+    <>
+      <pre data-testid="at-path">{here.map((e) => e.message).join('|')}</pre>
+      <pre data-testid="at-sibling">{sibling.map((e) => e.message).join('|')}</pre>
+    </>
+  );
+}
+
+const realPage = getMetadataPreview('page');
+
+beforeEach(() => {
+  server.draft = { name: 'home', label: 'Home', type: 'home', template: 'default', regions: [{ name: 'main', components: [] }] };
+  registerMetadataPreview('page', VerdictProbe as never);
+});
+
+afterEach(() => {
+  cleanup();
+  if (realPage) registerMetadataPreview('page', realPage);
+  window.history.replaceState(null, '', '/');
+});
+
+describe('MetadataResourceEditPage provides the served verdict to the fields inside it (objectstack#26858)', () => {
+  it('a field at the refused path reads the refusal; a sibling path reads nothing', async () => {
+    window.history.replaceState(null, '', '/metadata/page/home');
+    render(
+      <MemoryRouter initialEntries={['/metadata/page/home']}>
+        <MetadataResourceEditPage type="page" name="home" />
+      </MemoryRouter>,
+    );
+    await waitFor(() => expect(screen.getByTestId('at-path')).toHaveTextContent(REFUSAL), { timeout: 8000 });
+    expect(screen.getByTestId('at-sibling')).toHaveTextContent('');
+  });
+});