@@ -0,0 +1,10 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): a validation rule guard the publish refuses holds the Studio Data pillar's autosave (#27644)
+
+Clause-②: no
+Metadata-protocol: none
+
+The Data pillar read the object draft and dropped its served `_diagnostics`, so a validation rule guard the publish refuses (an ordering compare on a nullable field, `record.amount > 100`) read clean and autosaved until Publish refused it. The pillar now keeps the draft read's verdict and the body it judged, re-reads both after each save, and hands them to the Validations tab. Each rule's guard carries its own verdict path (`validations.N.condition`, a conditional rule's `.when`), so the error the server located there is shown under the guard and holds the autosave while the guard still shows the judged text, in the raw CEL editor and in the row builder alike. Editing the guard releases the hold: that save goes out and its re-read brings the next verdict. No rule is restated in the console.
@@ -0,0 +1,99 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#27644 — the served error at `verdictPath` counts as blocking in
+ * the ROW builder too.
+ *
+ * The raw editor reports the server's errors through `CelPredicateField`'s
+ * lint report (objectstack#27482), but the row builder mounts no CEL editor,
+ * and a stored guard the publish refuses (`record.amount > 100`, an ordering
+ * compare on a nullable field) round-trips as a row. So the builder reads the
+ * same hold itself: while `value` is the judged text it shows the server's
+ * message and reports it; once the row is edited away it reports none.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import * as React from 'react';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { render, screen, fireEvent, cleanup, waitFor } from '@testing-library/react';
+
+const state = vi.hoisted(() => ({
+  metadataClient: { get: vi.fn(async () => undefined), list: vi.fn(async () => [] as unknown[]), withPreviewDrafts() { return this; } },
+}));
+vi.mock('../useMetadata', () => ({
+  useMetadataClient: () => state.metadataClient,
+}));
+
+import { ConditionBuilder } from './ConditionBuilder';
+import { DraftVerdictBodyContext, DraftVerdictContext } from '../draftVerdict';
+import { __setCelFormulaLoader } from '../celAuthoring';
+
+const REFUSED = 'record.amount > 100';
+const REFUSAL = "validation rule 'amount_cap' applies `>` to `record.amount`, which may be null";
+const PATH = 'validations.0.condition';
+const VERDICT = { valid: false, errors: [{ path: PATH, message: REFUSAL, code: 'expression-invalid' }] };
+const JUDGED = { validations: [{ name: 'amount_cap', condition: REFUSED }] };
+const FIELDS = [{ name: 'amount', label: 'Amount', type: 'number' }];
+
+beforeEach(() => {
+  __setCelFormulaLoader(() =>
+    Promise.resolve({
+      validateExpression: () => ({ ok: true, errors: [], warnings: [] }),
+      introspectScope: () => ({ fields: ['amount'], roots: ['record'], functions: [] }),
+      inferExpressionType: () => 'boolean' as const,
+    }),
+  );
+});
+afterEach(() => {
+  cleanup();
+  __setCelFormulaLoader(undefined);
+});
+
+function Host({ verdictPath, onCount }: { verdictPath?: string; onCount: (n: number) => void }) {
+  const [value, setValue] = React.useState(REFUSED);
+  return (
+    <DraftVerdictContext.Provider value={VERDICT}>
+      <DraftVerdictBodyContext.Provider value={JUDGED}>
+        <ConditionBuilder
+          value={value}
+          onCommit={setValue}
+          fields={FIELDS}
+          scope="record"
+          verdictPath={verdictPath}
+          onBlockingIssuesChange={onCount}
+        />
+      </DraftVerdictBodyContext.Provider>
+    </DraftVerdictContext.Provider>
+  );
+}
+
+describe('ConditionBuilder — the row builder counts the served hold (objectstack#27644)', () => {
+  it('opens the refused guard as a row, shows the server message and reports it as blocking', async () => {
+    const onCount = vi.fn();
+    render(<Host verdictPath={PATH} onCount={onCount} />);
+    // Row mode: the value input, no raw CEL editor.
+    expect(screen.getByDisplayValue('100')).toBeInTheDocument();
+    expect(screen.queryAllByRole('combobox').some((el) => el.tagName === 'TEXTAREA')).toBe(false);
+    expect(screen.getByTestId('cel-server-error')).toHaveTextContent(REFUSAL);
+    await waitFor(() => expect(onCount).toHaveBeenLastCalledWith(1));
+  });
+
+  it('editing the row away releases: no message, 0 reported', async () => {
+    const onCount = vi.fn();
+    render(<Host verdictPath={PATH} onCount={onCount} />);
+    await waitFor(() => expect(onCount).toHaveBeenLastCalledWith(1));
+
+    fireEvent.change(screen.getByDisplayValue('100'), { target: { value: '50' } });
+
+    await waitFor(() => expect(onCount).toHaveBeenLastCalledWith(0));
+    expect(screen.queryByTestId('cel-server-error')).toBeNull();
+  });
+
+  it('control: without a verdictPath the builder reads no verdict', async () => {
+    const onCount = vi.fn();
+    render(<Host onCount={onCount} />);
+    await waitFor(() => expect(onCount).toHaveBeenCalled());
+    expect(onCount).toHaveBeenLastCalledWith(0);
+    expect(screen.queryByTestId('cel-server-error')).toBeNull();
+  });
+});
@@ -26,11 +26,12 @@ import {
   Button, Input, Label,
   Select, SelectTrigger, SelectContent, SelectItem, SelectValue,
 } from '@object-ui/components';
-import { Plus, X, Code2, ListFilter } from 'lucide-react';
+import { AlertCircle, Plus, X, Code2, ListFilter } from 'lucide-react';
 import { BOOLEAN_VALUE_TYPES, expandEmptyOperator, type EmptyOperatorArm } from '@objectstack/spec/data';
 import { useObjectFields } from '../previews/useObjectFields.js';
 import { CelPredicateField } from '../CelPredicateField.js';
 import type { CelLintIssue } from '../celAuthoring.js';
+import { useServerHoldAt } from '../draftVerdict.js';
 import { t, tFormat, useMetadataLocale } from '../i18n.js';
 
 type Op = '==' | '!=' | '>' | '<' | '>=' | '<=' | 'truthy' | 'falsy';
@@ -820,7 +821,7 @@ function initFrom(value: string, valueOf: SubjectValueOf): { rows: Row[]; join:
   return { rows: [], join: '&&', raw: !!value };
 }
 
-export function ConditionBuilder({ label, value, onCommit, objectName, fields: fieldsProp, disabled, onBlockingIssuesChange, subjects, scope, roots, scopeIssue, labelSubjects = false }: {
+export function ConditionBuilder({ label, value, onCommit, objectName, fields: fieldsProp, disabled, onBlockingIssuesChange, subjects, scope, roots, scopeIssue, labelSubjects = false, verdictPath }: {
   label?: string;
   value: string;
   onCommit: (cel: string) => void;
@@ -911,6 +912,15 @@ export function ConditionBuilder({ label, value, onCommit, objectName, fields: f
    * beside it. Off by default, so a mount that lists spellings keeps them.
    */
   labelSubjects?: boolean;
+  /**
+   * objectstack#27644 — the item-relative path `value` is stored at in the body
+   * the page's served verdict judged (`validations.1.condition`), forwarded to
+   * `CelPredicateField`. The server's errors there count as blocking while
+   * `value` is the text they judged, in either mode: the raw editor reports
+   * them with its lint, and the row builder, which mounts no CEL editor, shows
+   * and counts them itself. Omitted: no server verdict is read.
+   */
+  verdictPath?: string;
 }) {
   const { fields: hookFields } = useObjectFields(objectName);
   const fields = fieldsProp ?? hookFields;
@@ -1063,7 +1073,11 @@ export function ConditionBuilder({ label, value, onCommit, objectName, fields: f
     const errs = issues.filter((i) => i.severity === 'error').length;
     setCelErrors((prev) => (prev === errs ? prev : errs));
   }, []);
-  const blockingIssues = raw ? celErrors : 0;
+  // objectstack#27644 — the row builder has no editor to report the server's
+  // errors at this path, so it counts them here; the raw editor's report
+  // already carries them.
+  const held = useServerHoldAt(verdictPath, value || '');
+  const blockingIssues = raw ? celErrors : held.length;
   // Held in a ref so an unmemoized parent callback cannot re-fire the effect.
   const onBlockingIssuesChangeRef = React.useRef(onBlockingIssuesChange);
   React.useEffect(() => {
@@ -1114,6 +1128,7 @@ export function ConditionBuilder({ label, value, onCommit, objectName, fields: f
              roots are the engine's own, unchanged. */
           roots={offeredRoots}
           scopeIssue={scopeIssue}
+          verdictPath={verdictPath}
           t={tLocal}
         />
         {value && !parse(value, valueOf) && (
@@ -1205,6 +1220,18 @@ export function ConditionBuilder({ label, value, onCommit, objectName, fields: f
       {compiled && (
         <div className="rounded bg-muted/40 px-2 py-1 text-[10px] font-mono text-muted-foreground break-all">{compiled}</div>
       )}
+
+      {/* objectstack#27644 — what the publish refuses in this condition, as served. */}
+      {held.length > 0 && (
+        <ul className="space-y-1" aria-live="polite">
+          {held.map((e, i) => (
+            <li key={i} className="flex items-start gap-1.5 text-[11px] text-destructive" data-testid="cel-server-error">
+              <AlertCircle className="mt-[1px] h-3 w-3 shrink-0" />
+              <span>{e.message}</span>
+            </li>
+          ))}
+        </ul>
+      )}
     </div>
   );
 }