@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+---
+
+feat(ui): the Studio permission-set form offers the field permission `when` (row condition on the edit vote)
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+Part of #25866 — the Studio clause of ruling 6408558941 (part ①, item 4), after #25980 landed the key itself.
+
+- **Before.** The permission matrix's field rows carried two checkboxes, `readable` and `editable`: no way to offer or see a `when`. The Read-off cascade could leave `readable: false` beside an authored `when` (the shape the spec refuses at publish), and the Read all / Write all shortcuts dropped the condition.
+- **Now.** Each field row carries **When (edit)**: an authored condition shows as a chip, and the row opens the same CEL editor the row-level-security clauses use, linted the same way; a finding the publish gate would refuse holds the save. Read off clears the condition, Read all / Write all keep it, Clear drops the entry, blank text removes the key. `FieldPerm` gains `when`, carried verbatim by the package-door slice merge.
@@ -64,6 +64,11 @@ fields: {
   RLS predicate (`rls-predicate-*` findings on `permissions[].fields[].when`):
   the fields it names must exist on the entry's object, no cross-object
   reach, no unresolvable `current_user.*` variable.
+- **In Studio.** The permission-set form offers the condition on each field
+  row under **When (edit)**, in the same CEL editor as the row-level security
+  clauses, linted the same way; a condition the publish gate would refuse
+  holds the save. Switching **Read** off clears the condition, and the
+  **Read all** / **Write all** shortcuts keep it.
 
 ## Hidden vs. Read-Only
 
 
@@ -131,7 +131,7 @@ Captured for the record; **out of scope for Phases 1–4 above**. Each is anchor
 - **⑦ Permission-set groups + subtractive *muting*.** Pure union does not scale governance ("permission-set explosion"); Salesforce added permission-set-group *muting* precisely to allow taking access away. Roles→permission-sets already bundle; a subtractive/deny layer (precedence step 4) is the missing piece for large-org administration. Pairs with delegated admin (#9).
 - **⑧ FLS posture: unlisted fields are visible, and field grants union without deny** *(recorded 2026-07 pre-launch architecture assessment)*. Runtime FLS is block-list-shaped: `field-masker.ts` hides a field only when an explicit rule marks it `readable:false`, so an **undeclared** sensitive field is exposed by default, and `getFieldPermissions` merges most-permissively, so one set's `readable:true` permanently out-votes another's `false`. Consequences: protecting a salary/ID-number field relies on discipline (grant it only where needed), not mechanism. The object-level `private` posture (D2/④) mitigates the unlisted-default-visible half for objects that adopt it; the union half is the field-level face of ⑦ — a muting/deny layer must cover **field** grants, not just object grants, when it lands. Until then, treat "sensitive field on a `public` object" as a smell in review.
 
-  > **Note (2026-10-26) — a field permission entry may carry a row condition (#25866, ruling of record 6408558941).** `FieldPermissionSchema.when` is a row predicate in the same canonical CEL as `rowLevelSecurity[].using`, on the **edit** vote only (`when` beside `readable: false` is refused at parse). The condition **narrows where an entry votes**: on a row that matches, the entry votes as declared; on a row that does not, the entry is **absent**, as if the set had not declared the field. It does **not** change the posture recorded here — field grants still **union without deny**: a matched conditioned lock is out-voted by a sibling's unconditioned `editable: true` exactly as before, an entry without `when` votes on every row, and only declaring entries vote. The write gate judges the stored row before an update and the incoming row of an insert, in process (`RLSCompiler.compileRowPredicate` + `storedFormCheckJudge`); a row that cannot be judged (a predicate update, a stored row the caller cannot read, a condition that does not resolve for the request) and every row-blind reader (`/auth/me/permissions`, the field projections, `os explain`) apply the entry as its lock, so no reading is wider than the gate's. The condition is validated like an RLS predicate at authoring (`rls-predicate-*` findings on `permissions[].fields[].when`). The muting/deny layer ⑦ still owes remains the mechanism for taking an edit away that another set grants.
+  > **Note (2026-10-26) — a field permission entry may carry a row condition (#25866, ruling of record 6408558941).** `FieldPermissionSchema.when` is a row predicate in the same canonical CEL as `rowLevelSecurity[].using`, on the **edit** vote only (`when` beside `readable: false` is refused at parse). The condition **narrows where an entry votes**: on a row that matches, the entry votes as declared; on a row that does not, the entry is **absent**, as if the set had not declared the field. It does **not** change the posture recorded here — field grants still **union without deny**: a matched conditioned lock is out-voted by a sibling's unconditioned `editable: true` exactly as before, an entry without `when` votes on every row, and only declaring entries vote. The write gate judges the stored row before an update and the incoming row of an insert, in process (`RLSCompiler.compileRowPredicate` + `storedFormCheckJudge`); a row that cannot be judged (a predicate update, a stored row the caller cannot read, a condition that does not resolve for the request) and every row-blind reader (`/auth/me/permissions`, the field projections, `os explain`) apply the entry as its lock, so no reading is wider than the gate's. The condition is validated like an RLS predicate at authoring (`rls-predicate-*` findings on `permissions[].fields[].when`). Taking an edit away that another set grants remains the job of the muting/deny layer ⑦ still owes.
 - **⑨ Authoring-time validation for capability references** *(recorded 2026-07 pre-launch architecture assessment)*. `systemPermissions` / `requiredPermissions` are free strings today; a typo (`mange_users`) fails closed at runtime — the safe direction — but is undiscoverable: nothing reports that the referenced capability exists nowhere. When D1 lands the `sys_permission` registry, add the authoring/publish-gate lint alongside it: referencing an unregistered capability warns at author time (consistent with ADR-0049 honesty and the contract-first Prime Directive — reject at the producer, don't tolerate at the consumer). **Landed (2026-07):** `validateCapabilityReferences` in `@objectstack/lint` warns (never errors — cross-package capabilities and the fail-closed runtime make a hard gate wrong) when a `requiredPermissions` reference resolves against neither the built-in set (`@objectstack/spec` `PLATFORM_CAPABILITY_NAMES`), nor a capability the stack grants via a permission set's `systemPermissions`, nor a `sys_capability` seed row. Wired into `os validate` and `os lint`. `systemPermissions` (the declaration side) is deliberately not flagged.
 
 > **Note (2026-10-14) — ⑨'s seed-row source is gone.** With `sys_capability` retired by #15204
 
@@ -0,0 +1,195 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#25866 — a field permission entry may carry a row condition on
+ * its EDIT vote (`when`, the CEL of `rowLevelSecurity[].using`). The matrix
+ * offers the key beside the Read / Edit boxes and shows an authored one, and
+ * it never authors the shape the spec refuses (`when` beside
+ * `readable: false`): Read off clears the condition, the bulk shortcuts keep
+ * it, blank text removes the key, and a condition the publish gate would
+ * refuse holds the save the way an RLS clause does.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { MemoryRouter } from 'react-router-dom';
+
+interface FieldEntry {
+  readable?: boolean;
+  editable?: boolean;
+  when?: string;
+}
+interface SavedSet {
+  fields?: Record<string, FieldEntry>;
+}
+
+/** The slice of the metadata client the editor calls here. */
+type FakeClient = Record<string, (...args: never[]) => Promise<unknown>>;
+
+let clientImpl: FakeClient;
+let saved: SavedSet[] = [];
+
+vi.mock('./useMetadata', () => ({
+  useMetadataClient: () => clientImpl,
+  useMetadataTypes: () => ({
+    loading: false,
+    error: null,
+    entries: [{ type: 'permission', label: 'Permission', allowEnvironmentOverlay: true }],
+  }),
+}));
+
+vi.mock('./AssignedUsersSection', () => ({ AssignedUsersSection: () => null }));
+
+import { PermissionMatrixEditPage } from './PermissionMatrixEditor';
+
+afterEach(() => {
+  cleanup();
+  saved = [];
+});
+
+// Eight fields: the same wide object the bulk cases use.
+const FIELDS = ['amount', 'email', 'name', 'owner', 'phone', 'region', 'revenue', 'status'];
+
+function makeClient(storedFields: Record<string, FieldEntry>): FakeClient {
+  return {
+    layered: async () => ({
+      effective: {
+        name: 'sales_perms',
+        label: 'Sales',
+        objects: { a_account: { allowRead: true } },
+        fields: storedFields,
+      },
+      code: null,
+      overlay: null,
+      overlayScope: null,
+    }),
+    getDraft: async () => null,
+    list: async (type: string) => (type === 'object' ? [{ item: { name: 'a_account' } }] : []),
+    get: async (type: string) => (type === 'object' ? { fields: FIELDS.map((name) => ({ name })) } : null),
+    save: async (_type: string, _name: string, payload: Record<string, unknown>) => {
+      saved.push(JSON.parse(JSON.stringify(payload)) as SavedSet);
+      return payload;
+    },
+  };
+}
+
+/** The package door autosaves 1.5s after the last edit (objectui#11787). */
+const AUTOSAVE = { timeout: 4000 };
+const WHEN_LABEL = 'WHEN (edit vote — row condition)';
+
+async function renderExpanded(storedFields: Record<string, FieldEntry> = {}) {
+  clientImpl = makeClient(storedFields);
+  render(
+    <MemoryRouter>
+      <PermissionMatrixEditPage type="permission" name="sales_perms" packageId="app.a" />
+    </MemoryRouter>,
+  );
+  fireEvent.click(await screen.findByRole('button', { name: /a_account/ }));
+  await screen.findByLabelText('a_account.amount readable');
+}
+
+const whenButton = (field: string) => screen.getByRole('button', { name: `a_account.${field} when` });
+
+async function authorWhen(field: string, expression: string) {
+  fireEvent.click(whenButton(field));
+  const editor = await screen.findByLabelText(WHEN_LABEL);
+  fireEvent.change(editor, { target: { value: expression } });
+  return editor;
+}
+
+/** The next autosave to land after `n` already have. */
+async function saveAfter(n: number): Promise<SavedSet> {
+  await waitFor(() => expect(saved.length).toBeGreaterThan(n), AUTOSAVE);
+  return saved[saved.length - 1];
+}
+
+describe('a field row offers a row condition on its edit vote (objectstack#25866)', () => {
+  it('offers the key, shows the authored condition, and the saved entry carries it', async () => {
+    await renderExpanded();
+    expect(whenButton('amount')).toHaveTextContent('Add condition');
+
+    await authorWhen('amount', "status == 'draft'");
+    // The chip beside the boxes shows the condition as authored.
+    expect(whenButton('amount')).toHaveTextContent("status == 'draft'");
+
+    const set = await saveAfter(0);
+    expect(set.fields?.['a_account.amount']).toEqual({ readable: true, editable: false, when: "status == 'draft'" });
+  });
+
+  it('shows a stored condition on load; the other rows still offer the key', async () => {
+    await renderExpanded({ 'a_account.amount': { readable: true, editable: false, when: "status == 'approved'" } });
+    expect(whenButton('amount')).toHaveTextContent("status == 'approved'");
+    expect(whenButton('email')).toHaveTextContent('Add condition');
+  });
+
+  it('Read off clears the condition: the spec refuses `when` beside readable:false', async () => {
+    await renderExpanded({ 'a_account.amount': { readable: true, editable: true, when: 'owner == current_user.id' } });
+
+    fireEvent.click(screen.getByLabelText('a_account.amount readable'));
+    expect(screen.getByLabelText('a_account.amount readable')).not.toBeChecked();
+    expect(screen.getByLabelText('a_account.amount editable')).not.toBeChecked();
+    // No affordance on a row that cannot carry a condition.
+    expect(screen.queryByRole('button', { name: 'a_account.amount when' })).toBeNull();
+
+    const set = await saveAfter(0);
+    expect(set.fields?.['a_account.amount']).toEqual({ readable: false, editable: false });
+  });
+
+  it('the Edit toggle and the bulk Read all / Write all keep the condition; Clear drops it', async () => {
+    await renderExpanded({ 'a_account.amount': { readable: true, editable: false, when: "status == 'draft'" } });
+
+    fireEvent.click(screen.getByLabelText('a_account.amount editable'));
+    expect(whenButton('amount')).toHaveTextContent("status == 'draft'");
+
+    fireEvent.click(screen.getByRole('button', { name: 'Write all' }));
+    expect(screen.getByLabelText('a_account.amount editable')).toBeChecked();
+    expect(whenButton('amount')).toHaveTextContent("status == 'draft'");
+
+    fireEvent.click(screen.getByRole('button', { name: 'Read all' }));
+    expect(screen.getByLabelText('a_account.amount editable')).not.toBeChecked();
+    expect(whenButton('amount')).toHaveTextContent("status == 'draft'");
+
+    const first = await saveAfter(0);
+    expect(first.fields?.['a_account.amount']).toEqual({ readable: true, editable: false, when: "status == 'draft'" });
+    expect(first.fields?.['a_account.email']).toEqual({ readable: true, editable: false });
+
+    fireEvent.click(screen.getByRole('button', { name: 'Clear' }));
+    expect(whenButton('amount')).toHaveTextContent('Add condition');
+    const second = await saveAfter(1);
+    expect(second.fields?.['a_account.amount']).toBeUndefined();
+  });
+
+  it('blank text removes the key rather than saving a blank condition', async () => {
+    await renderExpanded({ 'a_account.amount': { readable: true, editable: false, when: "status == 'draft'" } });
+
+    const editor = await authorWhen('amount', '   ');
+    expect(editor).toHaveValue('');
+    expect(whenButton('amount')).toHaveTextContent('Add condition');
+
+    const set = await saveAfter(0);
+    expect(set.fields?.['a_account.amount']).toEqual({ readable: true, editable: false });
+  });
+
+  it('a condition the publish gate would refuse holds the save; a fixed one releases it', async () => {
+    await renderExpanded();
+
+    // A valid condition first: it lands, and warms the lint engine, so the
+    // fault below is judged well inside the autosave pause.
+    await authorWhen('amount', "status == 'draft'");
+    await screen.findByText('Valid CEL', {}, { timeout: 3000 });
+    await saveAfter(0);
+
+    fireEvent.change(screen.getByLabelText(WHEN_LABEL), { target: { value: 'status ==' } });
+    const held = await screen.findByTestId('perm-autosave-held', {}, { timeout: 3000 });
+    expect(held).toHaveTextContent('Fix the CEL syntax errors before saving.');
+    // Longer than the autosave's pause: the held edit does not land.
+    await new Promise((r) => setTimeout(r, 2000));
+    expect(saved).toHaveLength(1);
+
+    fireEvent.change(screen.getByLabelText(WHEN_LABEL), { target: { value: "status == 'approved'" } });
+    await waitFor(() => expect(screen.queryByTestId('perm-autosave-held')).toBeNull(), { timeout: 3000 });
+    const set = await saveAfter(1);
+    expect(set.fields?.['a_account.amount']).toEqual({ readable: true, editable: false, when: "status == 'approved'" });
+  });
+});