@@ -54,6 +54,7 @@ import {
   type CelSuggestionKind,
   type CelValueType,
 } from './celAuthoring.js';
+import { useServerErrorsAt } from './draftVerdict.js';
 
 const LINT_DEBOUNCE_MS = 250;
 
@@ -118,6 +119,15 @@ export interface CelPredicateFieldProps {
    * has no such second verdict (the permission matrix included).
    */
   scopeIssue?: boolean;
+  /**
+   * objectstack#26858 — the item-relative path this editor writes in the body
+   * the page holds (`rowLevelSecurity.0.using`). When the page's served verdict
+   * (`DraftVerdictContext`) has an error at exactly that path — what publish
+   * will refuse — the editor shows the server's message and withholds "Valid
+   * CEL". The lint, its findings and `onLintChange` are unaffected, as with
+   * `scopeIssue`. Omitted: no server verdict is read.
+   */
+  verdictPath?: string;
   /** Reports the current lint issues up so the editor can gate Save on errors. */
   onLintChange?: (issues: CelLintIssue[]) => void;
   /**
@@ -158,6 +168,7 @@ export function CelPredicateField({
   slot,
   role,
   scopeIssue,
+  verdictPath,
   onLintChange,
   onInferredTypeChange,
   t,
@@ -354,9 +365,13 @@ export function CelPredicateField({
 
   const errors = issues.filter((i) => i.severity === 'error');
   const warnings = issues.filter((i) => i.severity === 'warning');
-  // "Valid CEL" only when nothing — the lint, or the host's scope verdict —
-  // says otherwise (objectui#11789).
-  const clean = linted && !!value.trim() && issues.length === 0 && !scopeIssue;
+  // objectstack#26858 — the server's errors at this editor's path, each one
+  // the lint does not already say in the same words.
+  const atPath = useServerErrorsAt(verdictPath);
+  const serverErrors = atPath.filter((e) => !issues.some((iss) => issueText(iss, t) === e.message));
+  // "Valid CEL" only when nothing — the lint, the host's scope verdict
+  // (objectui#11789) or the server's verdict at this path — says otherwise.
+  const clean = linted && !!value.trim() && issues.length === 0 && !scopeIssue && atPath.length === 0;
   // Result-type affordance (role="value"): shown once the expression parses,
   // even alongside warnings — the type is what dataset measure eligibility
   // keys off, so the author should see it whenever it is known.
@@ -384,7 +399,7 @@ export function CelPredicateField({
           aria-expanded={open}
           aria-autocomplete="list"
           aria-controls={open ? listId : undefined}
-          aria-invalid={errors.length > 0 || undefined}
+          aria-invalid={errors.length > 0 || atPath.length > 0 || undefined}
           onChange={(e) => {
             onChange(e.target.value);
             refreshAc();
@@ -397,7 +412,7 @@ export function CelPredicateField({
           }}
           className={cn(
             'font-mono text-xs',
-            errors.length > 0 && 'border-destructive focus-visible:ring-destructive/40',
+            (errors.length > 0 || atPath.length > 0) && 'border-destructive focus-visible:ring-destructive/40',
           )}
         />
         {open && suggestions.length > 0 && (
@@ -431,15 +446,21 @@ export function CelPredicateField({
         )}
       </div>
 
-      {/* Inline lint findings. */}
-      {(errors.length > 0 || warnings.length > 0) && (
+      {/* Inline lint findings, then the server's at this path (as written). */}
+      {(errors.length > 0 || warnings.length > 0 || serverErrors.length > 0) && (
         <ul className="mt-1 space-y-1" aria-live="polite">
           {errors.map((iss, i) => (
             <li key={`e${i}`} className="flex items-start gap-1.5 text-[11px] text-destructive">
               <AlertCircle className="mt-[1px] h-3 w-3 shrink-0" />
               <span>{issueText(iss, t)}</span>
             </li>
           ))}
+          {serverErrors.map((e, i) => (
+            <li key={`s${i}`} className="flex items-start gap-1.5 text-[11px] text-destructive" data-testid="cel-server-error">
+              <AlertCircle className="mt-[1px] h-3 w-3 shrink-0" />
+              <span>{e.message}</span>
+            </li>
+          ))}
           {warnings.map((iss, i) => (
             <li key={`w${i}`} className="flex items-start gap-1.5 text-[11px] text-amber-600 dark:text-amber-500">
               <AlertTriangle className="mt-[1px] h-3 w-3 shrink-0" />
 
@@ -677,6 +677,7 @@ export function PermissionAdvancedFacets({
                   objectName={pol.object}
                   fieldNames={fieldsFor(pol.object)}
                   clause="using"
+                  verdictPath={`rowLevelSecurity.${i}.using`}
                   onLintChange={(issues) => reportClause(`${i}:using`, issues)}
                   onChange={(v) => {
                     const next = [...policies];
@@ -693,6 +694,7 @@ export function PermissionAdvancedFacets({
                   objectName={pol.object}
                   fieldNames={fieldsFor(pol.object)}
                   clause="check"
+                  verdictPath={`rowLevelSecurity.${i}.check`}
                   onLintChange={(issues) => reportClause(`${i}:check`, issues)}
                   onChange={(v) => {
                     const next = [...policies];
 
@@ -93,6 +93,13 @@ import { HistoryPanel } from './ResourceHistoryPage.js';
 import { useMetadataClient, useMetadataTypes, type RichMetadataTypeEntry } from './useMetadata.js';
 // objectui#11773 — the package door's draft save sends the version it was built on.
 import { readDraftForSave, useDraftSaveGuard } from './DraftConflictDialog.js';
+// objectstack#26858 — the served verdict the RLS clause editors read at their paths.
+import {
+  DraftVerdictContext,
+  draftEnvelopeDiagnostics,
+  editedItemDiagnostics,
+  type ServerDiagnostics,
+} from './draftVerdict.js';
 // objectui#11787 — the package door autosaves through the pillars' own autosave.
 import { useDraftAutoSave, type DraftSend } from '../studio-design/useDraftAutoSave.js';
 // objectui#12456 — the Studio Access pillar's presentation draws the shared item header.
@@ -727,6 +734,11 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
   const [fieldsByObject, setFieldsByObject] = React.useState<Record<string, FieldSummary[]>>({});
   const [expanded, setExpanded] = React.useState<Set<string>>(new Set());
   const [loading, setLoading] = React.useState(true);
+  // objectstack#26858 — the server's verdict on the set on screen: the pending
+  // draft's while the package door holds one (what its publish will refuse),
+  // else the layered read's. Taken off each read, never computed here.
+  const [servedVerdict, setServedVerdict] = React.useState<ServerDiagnostics | undefined>(undefined);
+  const verdictReadSeq = React.useRef(0);
   const [saving, setSaving] = React.useState(false);
   // objectui#11787 — when the package door's last draft save landed, for the
   // status line that replaces its Save button ("Saved 10:42").
@@ -849,6 +861,14 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
         ]);
         if (cancelled) return;
         const pendingDraft = pendingRead?.answer ?? null;
+        verdictReadSeq.current += 1;
+        setServedVerdict(
+          editedItemDiagnostics({
+            hasDraft: !!pendingDraft,
+            draftDiagnostics: draftEnvelopeDiagnostics(pendingDraft),
+            layered: lay,
+          }),
+        );
         // ARTIFACT tier input (objectui#4518) — the `code` layer, and its
         // `provenance` (objectui#4526), of the SAME envelope the display
         // baseline comes from, so the writability verdict and the body on
@@ -1326,6 +1346,13 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
           // baseline hasn't moved. Show what we just staged.
           resetDraftBaseline(toDisplayDraft(toSave));
         }
+        // objectstack#26858 — the draft this save stored carries its own publish
+        // verdict on its next read; the one held described the body before it.
+        // Read off the save's path, so a later read (or a load) wins.
+        const seq = ++verdictReadSeq.current;
+        void readDraftForSave(client, type, payload.name, packageId).then((read) => {
+          if (seq === verdictReadSeq.current) setServedVerdict(draftEnvelopeDiagnostics(read.answer));
+        });
         // Let the surface count it.
         onDraftSaved?.();
       } else {
@@ -1356,6 +1383,8 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
         // fallback this line already spelled for the resolved-but-empty
         // (404-shaped) envelope.
         resetDraftBaseline(toDisplayDraft((lay?.effective ?? toSave) as PermissionSetDraft));
+        verdictReadSeq.current += 1;
+        setServedVerdict(editedItemDiagnostics({ hasDraft: false, draftDiagnostics: undefined, layered: lay }));
         setPostSaveRereadFailed(rereadFailed);
         // The write landed, so the server holds the set now whatever the
         // confirming read said (objectui#7611: its holders can be listed). Only
@@ -2050,17 +2079,19 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
               {capabilitiesEl}
             </div>
             <div hidden={facetTab === null} data-testid="perm-tabpanel-facets" className="min-h-0 flex-1 overflow-auto">
-              <PermissionAdvancedFacets
-                draft={draft}
-                setDraft={setDraft}
-                writable={writable}
-                allSetNames={allSetNames}
-                loadObjectFields={loadObjectFields}
-                onCelErrorsChange={setCelErrorCount}
-                t={t}
-                only={facetTab}
-                packageBound={!!packageId}
-              />
+              <DraftVerdictContext.Provider value={servedVerdict}>
+                <PermissionAdvancedFacets
+                  draft={draft}
+                  setDraft={setDraft}
+                  writable={writable}
+                  allSetNames={allSetNames}
+                  loadObjectFields={loadObjectFields}
+                  onCelErrorsChange={setCelErrorCount}
+                  t={t}
+                  only={facetTab}
+                  packageBound={!!packageId}
+                />
+              </DraftVerdictContext.Provider>
             </div>
           </div>
         )}
@@ -2222,16 +2253,18 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
           {/* Advanced facets (ADR-0056 P3) — RLS / tab visibility / delegated
               admin scope, structured editors instead of raw JSON. Collapsed by
               default so they don't crowd the object matrix. */}
-          <PermissionAdvancedFacets
-            draft={draft}
-            setDraft={setDraft}
-            writable={writable}
-            allSetNames={allSetNames}
-            loadObjectFields={loadObjectFields}
-            onCelErrorsChange={setCelErrorCount}
-            t={t}
-            packageBound={!!packageId}
-          />
+          <DraftVerdictContext.Provider value={servedVerdict}>
+            <PermissionAdvancedFacets
+              draft={draft}
+              setDraft={setDraft}
+              writable={writable}
+              allSetNames={allSetNames}
+              loadObjectFields={loadObjectFields}
+              onCelErrorsChange={setCelErrorCount}
+              t={t}
+              packageBound={!!packageId}
+            />
+          </DraftVerdictContext.Provider>
         </div>
         {/* ADR-0056 P4 — assigning users is a Setup act, so the DESIGN surface
             (Studio, embedded) never shows it. objectui#7611 — the Setup catalog
 
@@ -147,6 +147,7 @@ import { useMetadataLocale, t, tFormat, translateMetadataType, translateValidati
 import { JsonSourceEditor } from './JsonSourceEditor.js';
 import { validateMetadataDraft, hasClientValidator, type DraftMode } from './clientValidation.js';
 import {
+  DraftVerdictContext,
   draftEnvelopeDiagnostics,
   editedItemDiagnostics,
   withServerOnlyErrors,
@@ -2643,7 +2644,7 @@ function MetadataResourceEditPageImpl({
     </>
   );
 
-  return (
+  const page = (
     <PageShell
       entry={entry ?? { type, label: type }}
       itemName={createMode ? '(new)' : name}
@@ -3536,6 +3537,9 @@ function MetadataResourceEditPageImpl({
       </AlertDialog>
     </PageShell>
   );
+  // objectstack#26858 — the verdict on the body on screen, for an expression
+  // field to read at its own path (`useServerErrorsAt`).
+  return <DraftVerdictContext.Provider value={serverDiagnostics}>{page}</DraftVerdictContext.Provider>;
 }
 
 /**
 
@@ -19,6 +19,8 @@
  * the live client parse.
  */
 
+import * as React from 'react';
+
 /** One `_diagnostics` entry, as served (`MetadataValidationResult`). */
 export interface ServerDiagnosticEntry {
   path: string;
@@ -75,3 +77,35 @@ export function withServerOnlyErrors<T extends { path: string; message: string }
   const extra = (serverErrors ?? []).filter((e) => !seen.has(`${e.path}\n${e.message}`));
   return [...clientErrors, ...extra];
 }
+
+/**
+ * objectstack#26858 — the served verdict on the body on screen, for a field
+ * that edits one path of it. The page holding the draft read provides it
+ * (`ResourceEditPage`, the permission-set editor); a field asks for the errors
+ * at its own item-relative path with {@link useServerErrorsAt}. Absent outside
+ * such a page, so a field mounted anywhere else reads none.
+ */
+export const DraftVerdictContext = React.createContext<ServerDiagnostics | undefined>(undefined);
+
+const NO_ERRORS: readonly ServerDiagnosticEntry[] = [];
+
+/**
+ * The served errors located exactly at `path` — the dotted, item-relative
+ * spelling `_diagnostics` uses (`rowLevelSecurity.0.using`, `edges.1.condition`).
+ * Equality, never a prefix: a sibling's error (`edges.10.condition`, the same
+ * policy's `check`) is not this field's. ⛔ Reads the path the server wrote;
+ * no rule is restated here.
+ */
+export function serverErrorsAt(
+  diagnostics: ServerDiagnostics | undefined,
+  path: string | undefined,
+): readonly ServerDiagnosticEntry[] {
+  if (!path || !diagnostics?.errors?.length) return NO_ERRORS;
+  const hits = diagnostics.errors.filter((e) => e.path === path);
+  return hits.length ? hits : NO_ERRORS;
+}
+
+/** {@link serverErrorsAt} against the verdict the enclosing page provides. */
+export function useServerErrorsAt(path: string | undefined): readonly ServerDiagnosticEntry[] {
+  return serverErrorsAt(React.useContext(DraftVerdictContext), path);
+}
@@ -48,6 +48,7 @@ import { useConnectorRegistry } from './connector-input-fields.js';
 import { VariableTextInput } from './VariableTextInput.js';
 import { findUnknownRefs, scopeRoots, describeUnknownRefs } from './flow-ref-check.js';
 import { writeExpressionSource } from './expression-envelope.js';
+import { useServerErrorsAt } from '../draftVerdict.js';
 import { describeEdgeConnectionRefusal, edgeConnectionRefusal } from '../previews/flow-problems.js';
 import { flowEdgeDisplayName } from '../previews/flow-canvas-parts.js';
 // objectui#7265 — the selected edge as this panel reads it out of the draft.
@@ -89,6 +90,9 @@ export function FlowEdgeInspector({
   // time it evaluates this guard (objectui#11085). Called unconditionally — a
   // missing edge resolves the flow variables alone.
   const { groups: scopeGroups } = useEdgeScope(draft as Record<string, unknown>, edge, connectors);
+  // objectstack#26858 — what the page's served verdict says at this edge's
+  // `condition` (an `expression-invalid` its publish would refuse), as written.
+  const conditionVerdict = useServerErrorsAt(index >= 0 ? `edges.${index}.condition` : undefined);
 
   if (!edge) {
     return (
@@ -330,6 +334,11 @@ export function FlowEdgeInspector({
           </p>
         ) : null;
       })()}
+      {conditionVerdict.map((e, i) => (
+        <p key={i} className="text-[11px] leading-snug text-destructive" role="alert" data-testid="flow-edge-server-error">
+          {e.message}
+        </p>
+      ))}
       <InspectorCheckboxField
         label={t('engine.inspector.flowEdge.isDefault', locale)}
         value={isDefault}