@@ -0,0 +1,11 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+fix(app-shell): a flow bound to an object its package may not use is explained on the Problems list in the Console's language
+
+Clause-②: no
+Metadata-protocol: none
+
+When a package's flow triggers on, scans, or declares a start input of an object outside what the package may use (its own objects, the objects of the packages it declares as dependencies, and system objects), the publish refuses it, and the flow's Problems list showed the server's English sentence in packaging terms to a reader in any language. The Problems list now words that refusal from the served entry's rule id (`flow-trigger-unknown-object`, `flow-input-unknown-object`) and its path: it names the object the flow holds there, says which objects a package can use, and points at the two fixes, picking an object from the list or declaring a dependency on the package that defines it. The copy lives in the Studio string namespace in English and Chinese. Any other server entry, and any of these at a position the Console does not word, still shows the server's sentence as sent. The served shape does not change: the editor pages now keep each served error's `code` on the entries they hand the canvas, where it used to be dropped.
@@ -193,3 +193,19 @@ describe('MetadataResourceEditPage — a pending draft is judged by its own serv
     expect(canvasDiagnostics().map((d) => d.message)).not.toContain(REFUSAL.message);
   });
 });
+
+describe('MetadataResourceEditPage — a served refusal reaches the canvas with its rule id (objectstack#30038)', () => {
+  it('the canvas entry carries the draft verdict\'s `code`, the key the flow Problems list words a refusal by', async () => {
+    server.active.set('page/home', PAGE);
+    server.drafts.set('page/home', { ...PAGE, label: 'broken' });
+    renderEditor();
+
+    await waitFor(
+      () =>
+        expect(canvasDiagnostics()).toContainEqual(
+          expect.objectContaining({ path: REFUSAL.path, code: REFUSAL.code, severity: 'error' }),
+        ),
+      { timeout: 8000 },
+    );
+  });
+});
@@ -905,21 +905,32 @@ function MetadataResourceEditPageImpl({
   // warnings stay server-sourced. Mirrors the read-only banner's source
   // selection, flattened to a path-keyed, severity-tagged list.
   const previewDiagnostics = React.useMemo<
-    Array<{ path?: string; message: string; severity: 'error' | 'warning' }>
+    Array<{ path?: string; message: string; severity: 'error' | 'warning'; code?: string }>
   >(() => {
     // objectstack#26707 — the verdict on the body on screen: the pending
     // draft's (which carries what its publish would refuse) while one is held.
     const diag = serverDiagnostics;
+    // objectstack#30038 — a served error keeps its rule id (`code`), so the
+    // flow Problems list can word a refusal it knows in the Console's language.
     const errs = (hasClientValidator(type, draftMode)
       ? withServerOnlyErrors(displayIssues, diag?.errors)
       : (diag?.errors ?? [])
-    ).map((i) => ({ path: i.path, message: translateSchemaIssue(i, locale) }));
+    ).map((i) => ({
+      path: i.path,
+      message: translateSchemaIssue(i, locale),
+      code: 'code' in i && typeof i.code === 'string' && i.code ? i.code : undefined,
+    }));
     const warns = (diag?.warnings ?? []).map((i) => ({
       path: i.path,
       message: translateValidationMessage(i.message, locale),
     }));
     return [
-      ...errs.map((e) => ({ path: e.path || undefined, message: e.message, severity: 'error' as const })),
+      ...errs.map((e) => ({
+        path: e.path || undefined,
+        message: e.message,
+        severity: 'error' as const,
+        ...(e.code ? { code: e.code } : {}),
+      })),
       ...warns.map((w) => ({ path: w.path || undefined, message: w.message, severity: 'warning' as const })),
     ];
   }, [serverDiagnostics, displayIssues, type, locale, draftMode]);
 
@@ -87,9 +87,16 @@ export function withServerOnlyErrors<T extends { path: string; message: string }
  */
 export function verdictPreviewEntries(
   diagnostics: ServerDiagnostics | undefined,
-): Array<{ path?: string; message: string; severity: 'error' | 'warning' }> {
+): Array<{ path?: string; message: string; severity: 'error' | 'warning'; code?: string }> {
   return [
-    ...(diagnostics?.errors ?? []).map((e) => ({ path: e.path || undefined, message: e.message, severity: 'error' as const })),
+    // objectstack#30038 — an error keeps its rule id, so the Problems list can
+    // word a refusal it knows in the Console's language (`flow-closure-refusal.ts`).
+    ...(diagnostics?.errors ?? []).map((e) => ({
+      path: e.path || undefined,
+      message: e.message,
+      severity: 'error' as const,
+      ...(e.code ? { code: e.code } : {}),
+    })),
     ...(diagnostics?.warnings ?? []).map((w) => ({ path: w.path || undefined, message: w.message, severity: 'warning' as const })),
   ];
 }
@@ -188,7 +195,7 @@ export function verdictEntriesStillShown(
   diagnostics: ServerDiagnostics | undefined,
   judged: unknown,
   shown: unknown,
-): Array<{ path?: string; message: string; severity: 'error' | 'warning' }> {
+): Array<{ path?: string; message: string; severity: 'error' | 'warning'; code?: string }> {
   return verdictPreviewEntries(diagnostics).filter(
     (entry) =>
       !entry.path ||
 
@@ -0,0 +1,112 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * flow-closure-refusal — the Studio sentence for one publish refusal: a flow
+ * that binds an object its package may not use (objectstack#30038, ruling A).
+ *
+ * Under a package closure the publish gate refuses a flow whose trigger object,
+ * time-relative scan object or start-input object is outside that closure, and
+ * the draft's `_diagnostics.errors[]` carry the refusal as the gate wrote it: an
+ * English sentence in packaging terms, with the rule id as the entry's `code`
+ * and the item-relative `path` of the offending key. The Problems panel used to
+ * show that English text as sent, to a reader in any language.
+ *
+ * This module renders the sentence in the Console's language from what the
+ * wire already carries, and nothing else: the entry's `code` (the rule id the
+ * spec calls "the key a renderer groups or suppresses by") picks the copy, the
+ * entry's `path` picks the position, and the object name is read from the flow
+ * on screen at that path. The wire shape does not move.
+ *
+ * - Two rule ids at three positions, and only this refusal:
+ *   `flow-trigger-unknown-object` at `nodes.N.config.objectName` (the start
+ *   node's object) and at `nodes.N.config.timeRelative.object` (a time-relative
+ *   scan's object); `flow-input-unknown-object` at `variables.N.objectName` (a
+ *   start input's declaration). Both ids also raise a no-closure advisory with
+ *   other words; that one is a warning and never reaches `errors[]`, so an
+ *   error entry with one of these ids is this refusal.
+ * - The sentence names the object and says "this package": the package is the
+ *   one Studio is editing, which the page already shows. "Did you mean" is not
+ *   recomputed here; the sentence points at the object list and at the
+ *   dependency declaration instead.
+ * - Anything else — another code, another position, a value no longer a name
+ *   at that path — answers `undefined`, and the caller shows the server's own
+ *   sentence as before.
+ *
+ * ⛔ No verdict is computed here: the refusal is the server's, and this only
+ * words it.
+ */
+
+import { tFormat } from '../i18n.js';
+
+/** The rule id of the trigger / time-relative scan refusal (`@objectstack/lint`). */
+export const FLOW_TRIGGER_UNKNOWN_OBJECT = 'flow-trigger-unknown-object';
+/** The rule id of the start-input declaration refusal (`@objectstack/lint`). */
+export const FLOW_INPUT_UNKNOWN_OBJECT = 'flow-input-unknown-object';
+
+/** The flow on screen, as far as this sentence reads it. */
+export interface ClosureRefusalFlow {
+  nodes?: readonly unknown[];
+  variables?: readonly unknown[];
+}
+
+/** The served entry, as far as this sentence reads it. */
+export interface ClosureRefusalEntry {
+  code?: string;
+  path?: string | ReadonlyArray<string | number>;
+}
+
+const TRIGGER_OBJECT = /^nodes\.(\d+)\.config\.objectName$/;
+const SCAN_OBJECT = /^nodes\.(\d+)\.config\.timeRelative\.object$/;
+const INPUT_OBJECT = /^variables\.(\d+)\.objectName$/;
+
+function dottedPath(path: ClosureRefusalEntry['path']): string {
+  if (Array.isArray(path)) return path.join('.');
+  return typeof path === 'string' ? path : '';
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined;
+}
+
+function name(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value : undefined;
+}
+
+/**
+ * The localized sentence for a served closure refusal, or `undefined` when the
+ * entry is not one of the three positions this module words (the caller then
+ * shows the server's message unchanged).
+ */
+export function closureRefusalMessage(
+  entry: ClosureRefusalEntry,
+  flow: ClosureRefusalFlow,
+  locale?: string,
+): string | undefined {
+  const path = dottedPath(entry.path);
+  if (entry.code === FLOW_TRIGGER_UNKNOWN_OBJECT) {
+    const trigger = TRIGGER_OBJECT.exec(path);
+    if (trigger) {
+      const object = name(record(record(flow.nodes?.[Number(trigger[1])])?.config)?.objectName);
+      return object ? tFormat('engine.flowProblems.closureRefusal.triggerObject', locale, { object }) : undefined;
+    }
+    const scan = SCAN_OBJECT.exec(path);
+    if (scan) {
+      const config = record(record(flow.nodes?.[Number(scan[1])])?.config);
+      const object = name(record(config?.timeRelative)?.object);
+      return object ? tFormat('engine.flowProblems.closureRefusal.scanObject', locale, { object }) : undefined;
+    }
+    return undefined;
+  }
+  if (entry.code === FLOW_INPUT_UNKNOWN_OBJECT) {
+    const input = INPUT_OBJECT.exec(path);
+    if (!input) return undefined;
+    const variable = record(flow.variables?.[Number(input[1])]);
+    const object = name(variable?.objectName);
+    if (!object) return undefined;
+    return tFormat('engine.flowProblems.closureRefusal.inputObject', locale, {
+      object,
+      input: name(variable?.name) ?? `#${input[1]}`,
+    });
+  }
+  return undefined;
+}
@@ -0,0 +1,115 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#30038 (ruling A) — the publish refusal of a flow bound to an
+ * object outside its package's closure reads, on the Problems list, in the
+ * Console's language. The sentence is chosen by the served entry's rule id
+ * (`code`) and its item-relative `path`, and names the object the flow on
+ * screen holds at that path; the wire shape does not move.
+ *
+ * Pinned: the three positions of the two rule ids render the studio copy
+ * (zh-CN in Chinese, en in English); an unmatched code, an unmatched position,
+ * a missing value and a warning keep the server's sentence as sent; and the
+ * served verdict's `code` survives `verdictPreviewEntries`, the step that
+ * flattens a draft's `_diagnostics` for the canvas.
+ */
+
+import { describe, it, expect, beforeAll } from 'vitest';
+import { loadStudioCatalogue } from '@object-ui/i18n/namespaces/studio';
+import { buildFlowProblems, type ServerDiagnostic } from './flow-problems';
+import { verdictPreviewEntries } from '../draftVerdict';
+import type { FlowDesignerNode } from './flow-canvas-layout';
+
+beforeAll(async () => {
+  await loadStudioCatalogue('zh');
+});
+
+/** The sentence the publish gate writes (`@objectstack/lint` validate-flow-trigger-readiness). */
+const SERVED =
+  "triggers on object 'crm_custom_eval_1104', which is outside the closure of package 'com.example.crm.custom' " +
+  "(its own objects, the objects of the packages its manifest declares in `dependencies`, and platform objects), " +
+  'so the package may not bind a flow to it.';
+
+const nodes = [
+  {
+    id: 'start',
+    type: 'start',
+    label: 'Start',
+    config: {
+      triggerType: 'record-after-update',
+      objectName: 'crm_custom_eval_1104',
+      timeRelative: { object: 'crm_scan_target' },
+    },
+  },
+  { id: 'end', type: 'end', label: 'End' },
+] as unknown as FlowDesignerNode[];
+const edges = [{ id: 'e1', source: 'start', target: 'end' }];
+const variables = [{ name: 'deal_id', type: 'text', isInput: true, objectName: 'crm_deal_x' }];
+
+function serverMessages(serverDiagnostics: ServerDiagnostic[], locale: string): string[] {
+  return buildFlowProblems({ nodes, edges, serverDiagnostics, variables, locale })
+    .filter((p) => p.source === 'server')
+    .map((p) => p.message);
+}
+
+const trigger: ServerDiagnostic = {
+  path: 'nodes.0.config.objectName',
+  message: SERVED,
+  code: 'flow-trigger-unknown-object',
+};
+
+describe('flow Problems — the closure refusal in the Console\'s language (objectstack#30038)', () => {
+  it('zh-CN: the trigger object refusal renders in Chinese and names the object on screen', () => {
+    const [message] = serverMessages([trigger], 'zh-CN');
+    expect(message).toMatch(/[一-鿿]/);
+    expect(message).toContain('“crm_custom_eval_1104”');
+    expect(message).not.toContain('closure');
+  });
+
+  it('en: the same entry renders the studio English sentence, not the packaging one', () => {
+    const [message] = serverMessages([trigger], 'en');
+    expect(message).toContain('"crm_custom_eval_1104"');
+    expect(message).not.toBe(SERVED);
+    expect(message).not.toContain('closure');
+  });
+
+  it('the time-relative scan object and the start input are the rule ids\' other two positions', () => {
+    const [scan, input] = serverMessages(
+      [
+        { path: 'nodes.0.config.timeRelative.object', message: SERVED, code: 'flow-trigger-unknown-object' },
+        { path: 'variables.0.objectName', message: SERVED, code: 'flow-input-unknown-object' },
+      ],
+      'zh-CN',
+    );
+    expect(scan).toContain('“crm_scan_target”');
+    expect(scan).toMatch(/[一-鿿]/);
+    expect(input).toContain('“crm_deal_x”');
+    expect(input).toContain('“deal_id”');
+    expect(input).toMatch(/[一-鿿]/);
+  });
+
+  it('an unknown code passes the server\'s sentence through', () => {
+    expect(serverMessages([{ ...trigger, code: 'some-other-rule' }], 'zh-CN')).toEqual([SERVED]);
+    expect(serverMessages([{ path: trigger.path, message: SERVED }], 'zh-CN')).toEqual([SERVED]);
+  });
+
+  it('a known code at a position it does not word, or with no name at the path, passes through', () => {
+    expect(serverMessages([{ ...trigger, path: 'nodes.0.config.condition' }], 'zh-CN')).toEqual([SERVED]);
+    expect(serverMessages([{ ...trigger, path: 'nodes.1.config.objectName' }], 'zh-CN')).toEqual([SERVED]);
+    expect(serverMessages([{ ...trigger, code: 'flow-input-unknown-object' }], 'zh-CN')).toEqual([SERVED]);
+  });
+
+  it('a warning under the same rule id (the no-closure advisory) is not reworded', () => {
+    expect(serverMessages([{ ...trigger, severity: 'warning' }], 'zh-CN')).toEqual([SERVED]);
+  });
+
+  it('the draft verdict\'s `code` survives the flattening the canvas reads', () => {
+    const entries = verdictPreviewEntries({ valid: false, errors: [{ ...trigger, path: 'nodes.0.config.objectName' }] });
+    expect(entries).toEqual([
+      { path: 'nodes.0.config.objectName', message: SERVED, severity: 'error', code: 'flow-trigger-unknown-object' },
+    ]);
+    const [message] = serverMessages(entries, 'zh-CN');
+    expect(message).toContain('“crm_custom_eval_1104”');
+    expect(message).toMatch(/[一-鿿]/);
+  });
+});
@@ -33,6 +33,7 @@ import { flowNodeDisplayName } from './flow-canvas-parts.js';
 import { t, tFormat } from '../i18n.js';
 import { uniqueId } from '../inspectors/unique-id.js';
 import { isBlankExpressionRefusal } from '../inspectors/flow-value-envelope.js';
+import { closureRefusalMessage } from './flow-closure-refusal.js';
 
 /** What a problem points at on the canvas — drives badge placement + reveal. */
 export type FlowProblemTarget =
@@ -73,6 +74,13 @@ export interface ServerDiagnostic {
   message: string;
   /** Defaults to `'error'`. */
   severity?: DiagnosticLevel;
+  /**
+   * The rule id the server raised the entry under (`_diagnostics.errors[].code`),
+   * when it sent one. objectstack#30038 — the one key a renderer may word a
+   * served refusal by (`flow-closure-refusal.ts`); without it the entry's
+   * `message` is shown as sent.
+   */
+  code?: string;
 }
 
 /** Stable `source->target` key matching an edge problem to a rendered edge. */
@@ -282,10 +290,11 @@ export function buildFlowProblems({ nodes, edges, serverDiagnostics, variables,
     problems.push({
       id: `server:${i}:${targetKey(target)}`,
       level,
-      // The words the node's value cell uses for the same refusal.
+      // The words the node's value cell uses for the same refusal; the closure
+      // refusal in the Console's language (objectstack#30038); else as sent.
       message: isBlankExpressionRefusal(diag.message)
         ? t('engine.inspector.flowNode.kv.expressionNeeded', locale)
-        : diag.message,
+        : (level === 'error' ? closureRefusalMessage(diag, { nodes, variables }, locale) : undefined) ?? diag.message,
       target,
       source: 'server',
       ...(location ? { location } : {}),
 
@@ -4271,6 +4271,11 @@ const STUDIO_EN: Record<string, string> = {
   'engine.flowProblems.connectRefused.missingTarget': 'Cannot connect: this flow has no node "{target}".',
   'engine.flowProblems.connectRefused.self': 'Cannot connect "{source}" to itself.',
   'engine.flowProblems.connectRefused.repeat': '"{source}" already connects to "{target}". Select that connection to change it.',
+  // objectstack#30038 — the publish refusal of a flow bound to an object outside its package's closure,
+  // worded from the served entry's rule id and path (`previews/flow-closure-refusal.ts`).
+  'engine.flowProblems.closureRefusal.triggerObject': 'This flow starts on records of "{object}", an object this package cannot use. A package can use only its own objects, the objects of the packages it declares as dependencies, and system objects. Pick an object from the list, or declare a dependency on the package that defines "{object}".',
+  'engine.flowProblems.closureRefusal.scanObject': 'This flow\u2019s scheduled scan reads records of "{object}", an object this package cannot use. A package can use only its own objects, the objects of the packages it declares as dependencies, and system objects. Pick an object from the list, or declare a dependency on the package that defines "{object}".',
+  'engine.flowProblems.closureRefusal.inputObject': 'Input "{input}" takes a record of "{object}", an object this package cannot use. A package can use only its own objects, the objects of the packages it declares as dependencies, and system objects. Pick an object from the list for this input, or declare a dependency on the package that defines "{object}".',
   'engine.repeater.empty': 'No items. Click + to add.',
   'engine.cancel': 'Cancel',
   'engine.close': 'Close',