@@ -0,0 +1,12 @@
+---
+'@objectstack/lint': patch
+---
+
+fix(lint): `flow-region-shape-invalid` points at the region container at fault, not only the flow
+
+Clause-②: no
+Metadata-protocol: none
+
+A flow the automation engine refuses for its region shape used to be reported on the whole flow (`flows[1]`, `flow 'lead_time'`). The finding now names the container the engine's refusal names: its `path` runs to that node inside the flow (`flows[1].nodes[1].config.try.nodes[0]`) and its `where` reads `flow 'lead_time' › node 'fan'`. The location is read off the `FlowRegionShapeError` that `validateControlFlow` throws, never parsed from the sentence; the message is unchanged, still the engine's refusal behind the flow's name. The engine stops at a flow's first malformed region, so there is still one finding per flow. Any other error keeps the flow as the anchor, as before.
+
+On the server, the save and publish verdict of an active flow and a draft's diagnostics carry the same move in item-relative spelling: the path was the item root and is now the container, for example `nodes.1`.
@@ -224,7 +224,9 @@ describe('[#28893] validate, build and lint refuse a flow region the engine refu
   // so the finding sits at the union path and names the flow in `where`.
   it('[#29059] an assembled artifact: the refused flow in the second packages[] entry is refused once, and build writes nothing', async () => {
     const { refusal } = CASES.assembled;
-    const expected = { rule: RULE, where: "flow 'rgn_ops_lead_time'", path: 'flows[1]' };
+    // [#29558] Forced edit: the finding is anchored on the container the
+    // engine names (the try_catch at the flow's nodes[1]), not the flow.
+    const expected = { rule: RULE, where: "flow 'rgn_ops_lead_time' › node 'guard'", path: 'flows[1].nodes[1]' };
 
     const validated = await validate('assembled', '--json');
     expect(validated.code, validated.stdout).toBe(1);
@@ -243,7 +245,7 @@ describe('[#28893] validate, build and lint refuse a flow region the engine refu
     const linted = await lint('assembled');
     expect(linted.code, linted.stdout).toBe(1);
     const lintRows = (json(linted, 'lint assembled').issues as Array<Record<string, unknown>>).filter((i) => i.rule === RULE);
-    expect(lintRows.map(({ path }) => path)).toEqual(['flows[1]']);
+    expect(lintRows.map(({ path }) => path)).toEqual(['flows[1].nodes[1]']);
   }, 60_000);
 
   it('CONTROL: the same flow with the join restored validates and builds', async () => {
 
@@ -55,7 +55,7 @@ describe('[#29049] flow-region-shape-invalid', () => {
     const bad = flow('rgn_lead_time', guard(fanOut(false)));
     const findings = validateFlowRegionShape({ flows: [flow('rgn_ok', guard(fanOut(true))), bad] });
     expect(findings.map(({ severity, rule, where, path }) => ({ severity, rule, where, path }))).toEqual([
-      { severity: 'error', rule: FLOW_REGION_SHAPE_INVALID, where: "flow 'rgn_lead_time'", path: 'flows[1]' },
+      { severity: 'error', rule: FLOW_REGION_SHAPE_INVALID, where: "flow 'rgn_lead_time' › node 'guard'", path: 'flows[1].nodes[1]' },
     ]);
     expect(findings[0]!.message).toBe(`Flow 'rgn_lead_time' would be refused at registration: ${engineRefusal(bad)}`);
     expect(findings[0]!.message).toContain("try_catch 'guard' catch: region must be single-exit");
@@ -67,6 +67,40 @@ describe('[#29049] flow-region-shape-invalid', () => {
     expect(finding?.message).toContain("parallel 'fan': a parallel block needs at least 2 branches");
   });
 
+  describe('[#29558] the finding is anchored on the container the engine names', () => {
+    it('a top-level container: the path and where name the try_catch at fault, the message is unchanged', () => {
+      const bad = flow('rgn_lead_time', guard(fanOut(false)));
+      const [finding, ...rest] = validateFlowRegionShape({ flows: [flow('rgn_ok', guard(fanOut(true))), bad] });
+      expect(rest).toEqual([]);
+      expect(finding).toMatchObject({ path: 'flows[1].nodes[1]', where: "flow 'rgn_lead_time' › node 'guard'" });
+      expect(finding!.message).toBe(`Flow 'rgn_lead_time' would be refused at registration: ${engineRefusal(bad)}`);
+    });
+
+    it('a nested container: a one-branch parallel inside a try region is anchored where it sits', () => {
+      const bad = flow('rgn_nested', n('guard', 'try_catch', {
+        config: {
+          try: { nodes: [n('fan', 'parallel', { config: { branches: [{ nodes: [n('only')], edges: [] }] } })], edges: [] },
+          catch: { nodes: [n('recover')], edges: [] },
+        },
+      }));
+      const [finding] = validateFlowRegionShape({ flows: [bad] });
+      expect(finding).toMatchObject({ path: 'flows[0].nodes[1].config.try.nodes[0]', where: "flow 'rgn_nested' › node 'fan'" });
+      expect(finding!.message).toBe(`Flow 'rgn_nested' would be refused at registration: ${engineRefusal(bad)}`);
+    });
+
+    it('a container in a parallel branch: the branch index is part of the path', () => {
+      const looped = n('sweep', 'loop', {
+        config: { collection: [1, 2], iteratorVariable: 'row', body: fanOut(false) },
+      });
+      const bad = flow('rgn_branch', n('fan', 'parallel', {
+        config: { branches: [{ nodes: [n('left')], edges: [] }, { nodes: [looped], edges: [] }] },
+      }));
+      const [finding] = validateFlowRegionShape({ flows: [bad] });
+      expect(finding).toMatchObject({ path: 'flows[0].nodes[1].config.branches[1].nodes[0]', where: "flow 'rgn_branch' › node 'sweep'" });
+      expect(finding!.message).toContain("loop 'sweep' body");
+    });
+  });
+
   it('CONTROL: the same flow with the join restored has no finding, nor does a stack with no flows', () => {
     expect(validateFlowRegionShape({ flows: [flow('rgn_lead_time', guard(fanOut(true)))] })).toEqual([]);
     expect(validateFlowRegionShape({})).toEqual([]);
@@ -84,7 +118,7 @@ describe('[#29049] flow-region-shape-invalid', () => {
     it('a non-record entry is no flow and draws nothing; the flow after it keeps its own index', () => {
       const bad = flow('rgn_lead_time', guard(fanOut(false)));
       const findings = validateFlowRegionShape({ flows: [null, 'x', bad] });
-      expect(findings.map(({ path }) => path)).toEqual(['flows[2]']);
+      expect(findings.map(({ path }) => path)).toEqual(['flows[2].nodes[1]']);
     });
 
     it('a body with no string name is named by its path', () => {
 
@@ -17,6 +17,13 @@
  * `[Automation] failed to register flow` and the boot goes on without it, so
  * its trigger never fires.
  *
+ * The finding is anchored on the container the refusal names (#29558): the
+ * engine throws a `FlowRegionShapeError` carrying the container's node id and
+ * its path inside the flow, and the finding's `path` and `where` are read off
+ * it, never off the sentence. The engine throws once, at a flow's first
+ * malformed region, so there is one container per finding and one finding per
+ * flow. Anything else it throws names no container; the flow stays the anchor.
+ *
  * ## ⛔ The verdict is the engine's — nothing here restates the region rules
  *
  * Each flow goes through the same two calls `registerFlow` makes: `FlowSchema`,
@@ -49,7 +56,7 @@
  * exported; region bodies ARE cycle-checked, by `validateControlFlow`.
  */
 
-import { FlowSchema, validateControlFlow } from '@objectstack/spec/automation';
+import { FlowRegionShapeError, FlowSchema, validateControlFlow } from '@objectstack/spec/automation';
 
 type AnyRec = Record<string, unknown>;
 
@@ -63,9 +70,15 @@ export interface FlowRegionShapeFinding {
   severity: 'error';
   /** Diagnostic rule id. */
   rule: string;
-  /** Human-readable location, e.g. `flow 'lead_time'`. */
+  /**
+   * Human-readable location: `flow 'lead_time' › node 'guard'` when the
+   * engine's refusal names the container at fault, else `flow 'lead_time'`.
+   */
   where: string;
-  /** Config path of the flow, e.g. `flows[0]`. */
+  /**
+   * Config path of the container at fault inside the flow, e.g.
+   * `flows[0].nodes[1].config.try.nodes[0]`, else of the flow, `flows[0]`.
+   */
   path: string;
   /** `Flow '<name>' would be refused at registration: ` and the engine's refusal. */
   message: string;
@@ -80,6 +93,20 @@ const HINT =
 const SCHEMA_HINT =
   'Fix the flow so the flow schema accepts it (`os validate` names each issue); its regions are judged then.';
 
+/**
+ * The container the engine's refusal names, read off the refusal itself:
+ * `validateControlFlow` throws `FlowRegionShapeError`, carrying the
+ * container's node id and its path inside the flow. Anything else it throws
+ * names no container, and the flow stays the anchor.
+ */
+function containerAtFault(err: unknown): { nodeId: string; path: readonly (string | number)[] } | undefined {
+  return err instanceof FlowRegionShapeError ? { nodeId: err.nodeId, path: err.path } : undefined;
+}
+
+/** `['nodes', 1, 'config', 'try']` → `.nodes[1].config.try`, the lint path spelling. */
+const spellPath = (segments: readonly (string | number)[]): string =>
+  segments.map((s) => (typeof s === 'number' ? `[${s}]` : `.${s}`)).join('');
+
 /**
  * Every flow of `stack.flows` the automation engine would refuse to register
  * for its region shape, one finding each. Pure.
@@ -112,11 +139,12 @@ export function validateFlowRegionShape(stack: AnyRec): FlowRegionShapeFinding[]
       validateControlFlow(result.data);
     } catch (err) {
       const name = result.data.name;
+      const container = containerAtFault(err);
       findings.push({
         severity: 'error',
         rule: FLOW_REGION_SHAPE_INVALID,
-        where: `flow '${name}'`,
-        path,
+        where: container ? `flow '${name}' › node '${container.nodeId}'` : `flow '${name}'`,
+        path: container ? `${path}${spellPath(container.path)}` : path,
         message: `Flow '${name}' would be refused at registration: ${err instanceof Error ? err.message : String(err)}`,
         hint: HINT,
       });
 
@@ -634,13 +634,13 @@ describe('a draft reads the verdict its publish gives (#26707)', () => {
         expect(published).toMatchObject({ success: true, publishedCount: 3, failedCount: 0 });
     });
 
-    it('[#29233] the region verdict on the draft read is the registry rule\'s: the engine\'s sentence, at the item root', async () => {
+    it('[#29233] the region verdict on the draft read is the registry rule\'s: the engine\'s sentence, at the container it names (#29558)', async () => {
         const { engine } = makeStubEngine();
         const protocol = new ObjectStackProtocolImplementation(engine);
         // A one-branch parallel block nested in a try region. The registry rule
-        // judges the flow as one unit (as the engine does) and anchors the
-        // flow itself, so the item-relative path is the item root; the
-        // sentence names the region.
+        // judges the flow as one unit (as the engine does) and, since #29558,
+        // anchors the container the engine's refusal names, so the
+        // item-relative path is that parallel node inside the try region.
         const flow = regionFlow('nested_region', {
             id: 'guard', type: 'try_catch', label: 'Guard',
             config: {
@@ -656,7 +656,7 @@ describe('a draft reads the verdict its publish gives (#26707)', () => {
         const diagnostics = await draftDiagnostics(protocol, 'flow', flow.name);
         expect(diagnostics.valid).toBe(false);
         expect((diagnostics.errors ?? []).filter((e) => e.code === 'flow-region-shape-invalid')).toEqual([{
-            path: '',
+            path: 'nodes.1.config.try.nodes.0',
             message: "Flow 'nested_region' would be refused at registration: parallel 'fan': a parallel block needs at least 2 branches",
             code: 'flow-region-shape-invalid',
         }]);
 
@@ -82,8 +82,9 @@ describe('[#29233] the publish gate refuses the regions the engine refuses, thro
         expect(issues).toEqual([{
             severity: 'error',
             rule: RULE,
-            where: "flow 'rgnprobe_loop'",
-            path: 'flows[0]',
+            // [#29558] Anchored on the container the engine names, not the flow.
+            where: "flow 'rgnprobe_loop' › node 'lp'",
+            path: 'flows[0].nodes[1]',
             message: refusedAt('rgnprobe_loop', sentence),
             hint: expect.any(String),
         }]);
@@ -92,7 +93,7 @@ describe('[#29233] the publish gate refuses the regions the engine refuses, thro
     it('a parallel block with one branch is refused', () => {
         const flow = flowOf('one_branch', [{ id: 'fan', type: 'parallel', label: 'Fan', config: { branches: [oneStep('only')] } }]);
         expect(regionIssues(flow).issues).toEqual([
-            expect.objectContaining({ path: 'flows[0]', message: refusedAt('one_branch', engineRefusal(flow)) }),
+            expect.objectContaining({ path: 'flows[0].nodes[1]', message: refusedAt('one_branch', engineRefusal(flow)) }),
         ]);
     });
 
@@ -120,7 +121,7 @@ describe('[#29233] the publish gate refuses the regions the engine refuses, thro
         const sentence = engineRefusal(flow)!;
         expect(sentence).toMatch(/^try_catch 'guard' try → loop 'inner' body: /);
         expect(regionIssues(flow).issues).toEqual([
-            expect.objectContaining({ path: 'flows[0]', message: refusedAt('nested', sentence) }),
+            expect.objectContaining({ path: 'flows[0].nodes[1].config.try.nodes[0]', message: refusedAt('nested', sentence) }),
         ]);
     });
 
 
@@ -16,7 +16,7 @@
 // ## What these cases pin
 //
 // The draft still saves (drafts are never gated). Its read answers
-// `valid: false` with the `flow-region-shape-invalid` finding on the flow, in
+// `valid: false` with the `flow-region-shape-invalid` finding on the container, in
 // the engine's own sentence; `publish-drafts`, the per-item publish and a live
 // save each refuse it before any write. Control: a well-formed loop, parallel
 // and try_catch region each read valid, publish, and the engine registers them.
@@ -117,8 +117,8 @@ describe('dogfood: a flow with a malformed region is refused at publish, and its
     const diagnostics = JSON.stringify(read.json);
     expect(diagnostics).toContain('"valid":false');
     expect(diagnostics).toContain('"code":"flow-region-shape-invalid"');
-    // The registry rule anchors the flow itself: the item root, in item-relative spelling.
-    expect(diagnostics).toContain('"path":""');
+    // The registry rule anchors the container the engine names (the loop at nodes[1]), in item-relative spelling.
+    expect(diagnostics).toContain('"path":"nodes.1"');
     expect(diagnostics).toContain(JSON.stringify(`Flow 'rgnprobe_loop' would be refused at registration: ${REGION_SENTENCE}`));
 
     const published = await call('POST', `/packages/${PKG_BAD}/publish-drafts`, {});