@@ -0,0 +1,19 @@
+---
+'@object-ui/core': patch
+'@object-ui/react': patch
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+'@object-ui/components': patch
+'@object-ui/plugin-calendar': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/console': patch
+---
+
+fix(core,react,i18n,components,app-shell,console): a write refused because the object's external datasource does not accept writes says the table is read-only, not "you don't have permission"
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **`@object-ui/core`: `isExternalWriteRefusal(err)`**, re-exported from `@object-ui/react` beside the other write-refusal readers. True when the server refused a write with `EXTERNAL_WRITE_FORBIDDEN`, the ADR-0015 write gate's code for an object bound to an external datasource that does not admit writes (`datasource.external.allowWrites` and `object.external.writable` must both be true). Read from `code`, then `details.code`, like `isPermissionError`. The refusal is a 403, so `isPermissionError` answers true for it too: a caller asks this first.
+- **`@object-ui/i18n`: `form.readOnlyExternalSource`**, in all ten packs: "This table is read-only. Its records come from an external data source that does not accept changes."
+- **Every surface that met this refusal now says the table is read-only:** the console record form page and the record dialog (`@object-ui/components` form), which said "you don't have permission to save this record"; the record page delete, the list row delete and the record page inline edit, which showed the gate's raw diagnostic; and the calendar's drag-to-reschedule and the record path's stage change. A permission line sent an administrator through permission sets for a grant that cannot exist.
@@ -0,0 +1,144 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack-ai/objectstack#30334 — a write the object's external datasource
+ * does not admit says the table is read-only, not that the user lacks
+ * permission.
+ *
+ * The ADR-0015 write gate refuses an insert on an object bound to an external
+ * datasource unless `datasource.external.allowWrites` AND
+ * `object.external.writable` are both true, answering `403
+ * EXTERNAL_WRITE_FORBIDDEN`. Read as any other 403, the banner said "you don't
+ * have permission", which sends an administrator through permission sets for a
+ * grant that cannot exist. The fixture is the envelope the data route answers
+ * for that refusal.
+ */
+
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { toast } from 'sonner';
+import { createI18n } from '@object-ui/i18n';
+import { FormPage } from './FormPage';
+
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
+
+const FIELDS = {
+  name: { type: 'text', label: 'Name' },
+};
+
+/** The gate's refusal of a `POST /data/:object` on a read-only external object. */
+const EXTERNAL_WRITE_FORBIDDEN = {
+  status: 403,
+  body: {
+    error:
+      "Write 'insert' blocked on object 'spare_parts': datasource 'parts_db' is external (schemaMode=external). " +
+      'Requires datasource.external.allowWrites=true (got false) AND object.external.writable=true (got false).',
+    code: 'EXTERNAL_WRITE_FORBIDDEN',
+  },
+};
+
+let posts = 0;
+
+function answer(ok: boolean, status: number, body: unknown): Response {
+  const text = typeof body === 'string' ? body : JSON.stringify(body);
+  return {
+    ok,
+    status,
+    statusText: ok ? 'OK' : 'Refused',
+    json: async () => JSON.parse(text),
+    text: async () => text,
+  } as unknown as Response;
+}
+
+function stubInternal(refusal: { status: number; body: unknown }) {
+  const view = {
+    name: 'spare_parts.form',
+    object: 'spare_parts',
+    viewKind: 'form',
+    label: 'Spare part',
+    config: { type: 'simple', sections: [{ fields: ['name'] }] },
+  };
+  const object = { name: 'spare_parts', label: 'Spare part', fields: FIELDS };
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (url: string, init?: RequestInit) => {
+      if (init?.method === 'POST') {
+        posts += 1;
+        return answer(false, refusal.status, refusal.body);
+      }
+      if (String(url).includes('/meta/view/')) return answer(true, 200, view);
+      if (String(url).includes('/meta/object/')) return answer(true, 200, object);
+      throw new Error(`unstubbed fetch: ${url}`);
+    }),
+  );
+  return render(
+    <MemoryRouter initialEntries={['/forms/spare_parts.form']}>
+      <Routes>
+        <Route path="/forms/:name" element={<FormPage mode="internal" />} />
+      </Routes>
+    </MemoryRouter>,
+  );
+}
+
+async function fillAndSubmit(submitName: RegExp | string = /Submit/) {
+  await userEvent.type(await screen.findByLabelText('Name'), 'Bolt');
+  await userEvent.click(screen.getByRole('button', { name: submitName }));
+}
+
+async function bannerText(): Promise<string> {
+  await waitFor(() => expect(document.querySelector('[id^="form-error:"]')).not.toBeNull());
+  return document.querySelector('[id^="form-error:"]')?.textContent ?? '';
+}
+
+function toastText(): string {
+  expect(vi.mocked(toast.error)).toHaveBeenCalledTimes(1);
+  return String(vi.mocked(toast.error).mock.calls[0][0]);
+}
+
+beforeEach(() => {
+  posts = 0;
+  vi.mocked(toast.error).mockClear();
+  createI18n({ defaultLanguage: 'en', detectBrowserLanguage: false });
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('#30334 — a refused write on a read-only external object', () => {
+  it('says the table is read-only, in the banner and the toast alike', async () => {
+    stubInternal(EXTERNAL_WRITE_FORBIDDEN);
+    await fillAndSubmit();
+
+    const banner = await bannerText();
+    expect(posts).toBe(1);
+    expect(banner).toBe(
+      'This table is read-only. Its records come from an external data source that does not accept changes.',
+    );
+    expect(banner).not.toBe("You don't have permission to save this record.");
+    expect(toastText()).toBe(banner);
+    // The gate's diagnostic (flags, machine names) is not the reader's sentence.
+    expect(banner).not.toContain('allowWrites');
+    expect(banner).not.toContain('spare_parts');
+  });
+
+  it('zh: reads in the reader\'s language, not as the permission line', async () => {
+    createI18n({ defaultLanguage: 'zh', detectBrowserLanguage: false });
+    stubInternal(EXTERNAL_WRITE_FORBIDDEN);
+    await fillAndSubmit('提交');
+
+    const banner = await bannerText();
+    expect(banner).toBe('这张表是只读的：它的记录来自外部数据源，不接受修改。');
+    expect(banner).not.toBe('您没有权限保存这条记录。');
+    expect(toastText()).toBe(banner);
+  });
+
+  it('any other 403 still reads the permission line', async () => {
+    stubInternal({ status: 403, body: { error: 'Denied', code: 'PERMISSION_DENIED' } });
+    await fillAndSubmit();
+
+    expect(await bannerText()).toBe("You don't have permission to save this record.");
+  });
+});
@@ -165,6 +165,7 @@ import {
   SchemaRendererContext,
   declaredUserMessage,
   delegationScopeMessage,
+  isExternalWriteRefusal,
   extractFieldErrors,
   isPermissionError,
   unmarkedRefusalLines,
@@ -2077,13 +2078,16 @@ class WriteRefusal extends Error {
  *
  *  1. the sentence the producer MARKED for the end user (`userMessage`), or a
  *     delegated administrator's scope refusal, which names only their own scope;
- *  2. any other denial (`403`, `PERMISSION_DENIED`, `FORBIDDEN`) as the fixed
+ *  2. a write the object's external datasource does not admit
+ *     (`EXTERNAL_WRITE_FORBIDDEN`) as the localized read-only line: no
+ *     permission can lift it, so the permission line would mislead;
+ *  3. any other denial (`403`, `PERMISSION_DENIED`, `FORBIDDEN`) as the fixed
  *     localized line — the server's text names objects and policies, not
  *     something the submitter can act on (objectstack#3821, #24914 B′);
- *  3. the per-rule lines no row carries (`unmarkedRefusalLines`);
- *  4. the server's sentence of a `4xx` — it answers the request the submitter
+ *  4. the per-rule lines no row carries (`unmarkedRefusalLines`);
+ *  5. the server's sentence of a `4xx` — it answers the request the submitter
  *     made, and they can change it;
- *  5. otherwise — a `5xx`, or a refusal that gave no sentence — the localized
+ *  6. otherwise — a `5xx`, or a refusal that gave no sentence — the localized
  *     generic line: a server fault's text is a diagnostic, not a reason.
  */
 function refusalText(
@@ -2098,6 +2102,7 @@ function refusalText(
   }
   const marked = declaredUserMessage(err) ?? delegationScopeMessage(err);
   if (marked) return marked;
+  if (isExternalWriteRefusal(err)) return t('form.readOnlyExternalSource');
   if (isPermissionError(err)) return t('form.noPermissionToSave');
   if (unmarked && unmarked.length > 1) return unmarked;
   if (unmarked?.[0]) return unmarked[0];
 
@@ -15,7 +15,7 @@ import { Empty, EmptyTitle, EmptyDescription, Button, PageHeaderActions, PageHea
 import { useAuth, createAuthenticatedFetch } from '@object-ui/auth';
 import { usePermissions } from '@object-ui/permissions';
 import { useDisplayLocale, useLocalization, pickLocalized } from '@object-ui/i18n';
-import { ActionProvider, useObjectTranslation, useObjectLabel, useActionTextLocalizer, usePageAssignment, isRecordPageOf, useMetadata, RecordContextProvider, SchemaRenderer, DiscussionContextProvider, HighlightFieldsProvider, InlineEditProvider, resolveApprovalLock, useGlobalUndo, useDataInvalidation, notifyDataChanged, subscribeDataChanges, dataChangeMatches, useRowPredicate, classifyLoadError, answeredLoadFailure, extractWriteErrorMessage } from '@object-ui/react';
+import { ActionProvider, useObjectTranslation, useObjectLabel, useActionTextLocalizer, usePageAssignment, isRecordPageOf, useMetadata, RecordContextProvider, SchemaRenderer, DiscussionContextProvider, HighlightFieldsProvider, InlineEditProvider, resolveApprovalLock, useGlobalUndo, useDataInvalidation, notifyDataChanged, subscribeDataChanges, dataChangeMatches, useRowPredicate, classifyLoadError, answeredLoadFailure, extractWriteErrorMessage, isExternalWriteRefusal } from '@object-ui/react';
 import type { AnsweredLoadFailure } from '@object-ui/react';
 import { buildExpandFields, captureUpdateUndoData, recordDelete, resolveAffordance, resolveRecordIdParamSeed, userActionPredicates, withoutDeniedFields, type AffordanceGrantPrincipal, type SchemaLike } from '@object-ui/core';
 import { toast } from 'sonner';
@@ -4641,7 +4641,14 @@ export function RecordDetailView({ dataSource, objects, onEdit, objectNameOverri
             const baseAppUrl = appName ? `/apps/${appName}` : '';
             navigate(`${baseAppUrl}/${objectName}`, { replace: true });
           } catch (err: any) {
-            toast.error(err?.message || 'Delete failed');
+            // A delete the object's external datasource does not admit
+            // (ADR-0015, `EXTERNAL_WRITE_FORBIDDEN`) says the table is
+            // read-only, never the gate's diagnostic.
+            toast.error(
+              isExternalWriteRefusal(err)
+                ? t('form.readOnlyExternalSource')
+                : err?.message || 'Delete failed',
+            );
           }
         },
       } as any);
 
@@ -0,0 +1,76 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * objectstack#30334 — the record dialog's refusal of a write the object's
+ * external datasource does not admit (`403 EXTERNAL_WRITE_FORBIDDEN`, the
+ * ADR-0015 write gate) says the table is read-only, not "you don't have
+ * permission": no permission set can lift it.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import React from 'react';
+import { render, screen, fireEvent } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { ComponentRegistry } from '@object-ui/core';
+// Registers the renderers at module scope (object-ui/no-dynamic-import-in-test-hook).
+import '../renderers';
+
+const SCHEMA = {
+  type: 'form',
+  fields: [{ name: 'title', label: 'Title', type: 'text' }],
+  submitText: 'Save',
+} as any;
+
+const GATE_TEXT =
+  "Write 'insert' blocked on object 'spare_parts': datasource 'parts_db' is external (schemaMode=external). " +
+  'Requires datasource.external.allowWrites=true (got false) AND object.external.writable=true (got false).';
+
+function renderForm(onAction: () => Promise<unknown>) {
+  const Form = ComponentRegistry.get('form')!;
+  return render(<Form schema={SCHEMA} onAction={onAction} />);
+}
+
+describe('#30334 — a write the external datasource does not admit', () => {
+  beforeEach(() => {
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  it('reads the read-only line, not the permission line or the gate diagnostic', async () => {
+    const { container } = renderForm(async () => {
+      throw Object.assign(new Error(GATE_TEXT), { code: 'EXTERNAL_WRITE_FORBIDDEN', httpStatus: 403 });
+    });
+    fireEvent.click(screen.getByRole('button', { name: /submit/i }));
+
+    expect(await screen.findByText(/this table is read-only/i)).toBeInTheDocument();
+    expect(screen.queryByText(/permission to save/i)).not.toBeInTheDocument();
+    expect(container.textContent).not.toMatch(/allowWrites/);
+    expect(container.textContent).not.toMatch(/spare_parts/);
+  });
+
+  it('reads the code from `details` as well', async () => {
+    renderForm(async () => {
+      throw Object.assign(new Error(GATE_TEXT), {
+        httpStatus: 403,
+        details: { error: GATE_TEXT, code: 'EXTERNAL_WRITE_FORBIDDEN' },
+      });
+    });
+    fireEvent.click(screen.getByRole('button', { name: /submit/i }));
+
+    expect(await screen.findByText(/this table is read-only/i)).toBeInTheDocument();
+  });
+
+  it('CONTROL: any other 403 keeps the permission line', async () => {
+    renderForm(async () => {
+      throw Object.assign(new Error('FORBIDDEN: insufficient privileges'), { code: 'FORBIDDEN', status: 403 });
+    });
+    fireEvent.click(screen.getByRole('button', { name: /submit/i }));
+
+    expect(await screen.findByText(/permission to save/i)).toBeInTheDocument();
+    expect(screen.queryByText(/this table is read-only/i)).not.toBeInTheDocument();
+  });
+});
@@ -42,7 +42,7 @@ import { FullscreenEditor } from '../../custom/fullscreen-editor';
 import { CharacterCount } from '../../custom/character-count';
 import { cn } from '../../lib/utils';
 import React from 'react';
-import { SchemaRendererContext, usePredicateScope, useCapabilityGate, isPermissionError, extractWriteErrorMessage, extractFieldErrors, declaredUserMessage, delegationScopeMessage, unmarkedRefusalLines } from '@object-ui/react';
+import { SchemaRendererContext, usePredicateScope, useCapabilityGate, isPermissionError, extractWriteErrorMessage, extractFieldErrors, declaredUserMessage, delegationScopeMessage, isExternalWriteRefusal, unmarkedRefusalLines } from '@object-ui/react';
 import { createSafeTranslation } from '@object-ui/i18n';
 import type { RendererHostProps } from '../../lib/renderer-host-props';
 import { currencyCodeFieldNames, useUsedCurrencyCodes, withUsedCurrencyCodes } from './usedCurrencyCodes';
@@ -500,6 +500,8 @@ const useSafeFormTranslation = createSafeTranslation(
     'validation.formInvalidJoiner': ', ',
     'errors.forbidden': 'Access denied.',
     'form.noPermissionToSave': "You don't have permission to save this record.",
+    // objectstack#30334 — a write the external datasource does not admit. Byte-identical to the `en` pack.
+    'form.readOnlyExternalSource': 'This table is read-only. Its records come from an external data source that does not accept changes.',
     'form.submitFailed': 'Could not save. Please try again.',
     'form.clearedOnHide': 'Cleared — no longer applicable given the current values: {{fields}}',
     // objectui#8069 — the submit refusal for a field `visibleWhen` that could
@@ -3218,14 +3220,19 @@ ComponentRegistry.register('form',
         // boundary to fix (objectstack#26059, Q3). It is read before
         // `isPermissionError`, which answers true for any 403; every other
         // denial keeps the fixed line (objectstack#24914 B′).
+        // A write the object's external datasource does not admit (`403
+        // EXTERNAL_WRITE_FORBIDDEN`, ADR-0015) says the table is read-only:
+        // no permission lifts it, so the permission line would mislead.
         // A refusal listing one entry per failed rule is said one line per
         // entry left unmarked above, not as the envelope's `; `-joined
         // summary, which would also repeat the reasons already under inputs.
         const unmarked = unmarkedRefusalLines(error, (field) => shownInline.has(field));
         const errorMessage: string | string[] =
           declaredUserMessage(error) ??
           delegationScopeMessage(error) ??
-          (isPermissionError(error)
+          (isExternalWriteRefusal(error)
+            ? t('form.readOnlyExternalSource')
+            : isPermissionError(error)
             ? t('form.noPermissionToSave')
             : unmarked && unmarked.length > 1
               ? unmarked
 
@@ -77,6 +77,11 @@
 
 import type { ActionResult } from './ActionRunner.js';
 import { getRecordDisplayName } from '../utils/record-title.js';
+import { isExternalWriteRefusal } from '../utils/external-write-refusal.js';
+
+/** The `en` pack's `form.readOnlyExternalSource`, for a host with no translation. */
+const READ_ONLY_EXTERNAL_SOURCE_EN =
+  'This table is read-only. Its records come from an external data source that does not accept changes.';
 
 type Row = Record<string, unknown>;
 
@@ -272,8 +277,13 @@ export const recordDelete = Object.freeze({
       toast.success(recordDelete.successText(deps, record));
       return { success: true, reload: true, silent: true };
     } catch (err) {
+      // A delete the object's external datasource does not admit (ADR-0015,
+      // `EXTERNAL_WRITE_FORBIDDEN`) says the table is read-only, not the
+      // gate's diagnostic, which names datasource flags and machine names.
       toast.error(t('objectActions.deleteFailed', { label }), {
-        description: (err as Error).message,
+        description: isExternalWriteRefusal(err)
+          ? t('form.readOnlyExternalSource', { defaultValue: READ_ONLY_EXTERNAL_SOURCE_EN })
+          : (err as Error).message,
       });
       // The toast above (label + error message) is the feedback; returning
       // WITHOUT `error` keeps the runner from toasting the raw message again.
 
@@ -43,6 +43,7 @@ export * from './utils/expand-fields.js';
 // The `enable`-block API denial predicate, read by `@object-ui/react` and
 // re-exported by `@object-ui/data-objectstack` (objectstack#25917).
 export * from './utils/api-access-denied.js';
+export * from './utils/external-write-refusal.js';
 // The RETIREMENT gate (objectui#4914, maintainer ruling B). Homed here rather
 // than in `@object-ui/fields` because `@object-ui/components` is one of its six
 // consumers and `fields` depends on `components` — see the module's docblock