@@ -0,0 +1,14 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): a failed flow run reads the refusal its write node met the way a record save reads it, instead of the engine's node-prefixed English diagnostic
+
+Clause-②: no
+Metadata-protocol: none
+
+- **What the user sees.** A flow that fails because a write node was refused (a duplicate, a validation rule, a permission denial) used to show the run's `message` in the dialog and toast: `Node 'create_account' failed: create_record(crm_account) failed: …`, in English under every locale. The Console now shows, in order: the flow's authored `errorMessage`; the producer-marked `userMessage`; the inner refusal's own sentence (a permission denial shows the record form's localized "no permission" line instead of server prose); and only then the run's `message`.
+- **Where it applies.** Both failure shapes the flow routes answer: `400 FLOW_FAILED` (`error.userMessage` at the envelope's top level, `error.details.innerRefusal`) and the `200` failed run (`AutomationResult.userMessage`, `AutomationResult.innerRefusal`), for the FlowRunner's resume and both flow-launch hosts.
+- **What does not change.** The wire `message` is untouched, a run that met no refusal still shows its `message`, and nothing parses the run's `message`.
+
+What to do: nothing.
@@ -8,6 +8,9 @@
  */
 
 import { describe, it, expect } from 'vitest';
+import { builtInLocales, registerBuiltInLocales } from '@object-ui/i18n/locales';
+import { ApiErrorSchema, FlowFailureDetailsSchema } from '@objectstack/spec/api';
+import type { AutomationResult } from '@objectstack/spec/contracts';
 import { flowSuccessCopy, interpretFlowResponse, judgeFlowLaunch } from '../flowResponse';
 
 const ok = { ok: true, status: 200 };
@@ -551,3 +554,85 @@ describe("flowSuccessCopy — the action's copy as a template envelope (objectui
         expect(out.successToast).toBeUndefined();
     });
 });
+
+// objectstack#24914 ruling B′ — a refusal a flow's write node met reads like
+// the same refusal on a record save: the authored `errorMessage`, then the
+// producer-marked `userMessage`, then the inner refusal (permission → the
+// form's localized line), then `message`.
+describe('interpretFlowResponse — a refusal met inside the run, by the record-save rule (objectstack#24914)', () => {
+    // Every pack resident, so the `zh` case reads the catalogue a Chinese
+    // console has loaded.
+    registerBuiltInLocales();
+
+    // The door's own constants (objectstack `packages/runtime/src/flow-failed-inner-refusal.test.ts`).
+    const INNER_MESSAGE =
+        "Duplicate record refused on 'crm_account': a unique constraint already holds these values. No record was written.";
+    const RAW_ERROR = `Node 'create_account' failed: create_record(crm_account) failed: ${INNER_MESSAGE}`;
+    const USER_TEXT = '该客户名称已被另一位销售代表占用，请联系主管。';
+    const UNIQUE = { code: 'UNIQUE_VIOLATION', message: INNER_MESSAGE } as const;
+    const DENIED = { code: 'PERMISSION_DENIED', message: 'insufficient privileges to create crm_account' } as const;
+    const RULE = { code: 'VALIDATION_FAILED', message: 'Account name must not contain a URL.' } as const;
+
+    /** The trigger/resume door's `400 FLOW_FAILED`, proven real by the spec's own schemas. */
+    function flowFailed(details: Record<string, unknown>, userMessage?: string) {
+        const error = {
+            code: 'FLOW_FAILED',
+            message: RAW_ERROR,
+            httpStatus: 400,
+            ...(userMessage ? { userMessage } : {}),
+            details,
+        };
+        expect(ApiErrorSchema.safeParse(error).error?.issues).toBeUndefined();
+        expect(FlowFailureDetailsSchema.safeParse(details).error?.issues).toBeUndefined();
+        return { success: false, error };
+    }
+    const failed400 = (json: unknown, copy?: Parameters<typeof interpretFlowResponse>[3]) =>
+        interpretFlowResponse({ ok: false, status: 400 }, json, 'Resume', copy);
+
+    it('a unique refusal shows the inner sentence, without the node and operation wrapper', () => {
+        expect(failed400(flowFailed({ innerRefusal: UNIQUE }))).toEqual({
+            kind: 'failed', error: INNER_MESSAGE, retryable: false,
+        });
+    });
+
+    it("a validation refusal shows the author's rule text", () => {
+        expect(failed400(flowFailed({ innerRefusal: RULE }))).toMatchObject({ error: RULE.message });
+    });
+
+    it("a permission refusal shows the record form's localized line, never the server prose", () => {
+        const en = failed400(flowFailed({ innerRefusal: DENIED }));
+        expect(en).toMatchObject({ error: builtInLocales.en.form.noPermissionToSave });
+
+        const zh = failed400(flowFailed({ innerRefusal: DENIED }), { flowName: 'convert', bundle: undefined, locale: 'zh-CN' });
+        expect(zh).toMatchObject({ error: builtInLocales.zh.form.noPermissionToSave });
+        expect((zh as { error: string }).error).not.toContain('crm_account');
+    });
+
+    it('a producer-marked userMessage wins over the inner refusal, verbatim', () => {
+        expect(failed400(flowFailed({ innerRefusal: UNIQUE }, USER_TEXT))).toMatchObject({ error: USER_TEXT });
+        expect(failed400(flowFailed({ innerRefusal: DENIED }, USER_TEXT))).toMatchObject({ error: USER_TEXT });
+    });
+
+    it("the flow's authored errorMessage still wins over both", () => {
+        const json = flowFailed({ errorMessage: 'Conversion failed.', innerRefusal: UNIQUE }, USER_TEXT);
+        expect(failed400(json)).toMatchObject({ error: 'Conversion failed.' });
+    });
+
+    it('an envelope without the members falls back to message, never to silence', () => {
+        expect(failed400(flowFailed({}))).toMatchObject({ error: RAW_ERROR });
+    });
+
+    it('the 200 failed arm reads the same members off the run, in the same order', () => {
+        const run = (extra: Partial<AutomationResult>): AutomationResult => ({
+            success: false, status: 'failed', error: RAW_ERROR, ...extra,
+        });
+        const on200 = (data: AutomationResult) => interpretFlowResponse(ok, { success: true, data }, 'Flow "convert"');
+
+        expect(on200(run({ innerRefusal: UNIQUE }))).toMatchObject({ kind: 'failed', error: INNER_MESSAGE, retryable: false });
+        expect(on200(run({ innerRefusal: DENIED }))).toMatchObject({ error: builtInLocales.en.form.noPermissionToSave });
+        expect(on200(run({ innerRefusal: UNIQUE, userMessage: USER_TEXT }))).toMatchObject({ error: USER_TEXT });
+        expect(on200(run({ innerRefusal: UNIQUE, userMessage: USER_TEXT, errorMessage: 'Conversion failed.' })))
+            .toMatchObject({ error: 'Conversion failed.' });
+        expect(on200(run({}))).toMatchObject({ error: RAW_ERROR });
+    });
+});
@@ -112,6 +112,19 @@
  * beats N dialects). If it is absent the message degrades to the envelope's own
  * `error.message`, never to silence.
  *
+ * ## A refusal met inside the run reads like the same refusal on a save (objectstack#24914)
+ *
+ * `message` names node ids and object API names, in English: a duplicate met
+ * by a `create_record` node read `Node 'create_account' failed:
+ * create_record(crm_account) failed: …`. Ruling B′ gave the run the record
+ * save's two carriers — the producer-marked `userMessage` (the envelope's top
+ * level on a 400, `AutomationResult.userMessage` on a 200) and `innerRefusal`
+ * (`error.details` on a 400, the run's own member on a 200: the node's refusal
+ * in its wire `code`, `message` already without the prefixes). Both failure
+ * arms read them through {@link flowFailureMessage}, between the authored
+ * `errorMessage` and `message`, and render the inner refusal by the record
+ * form's rule. `message` itself is untouched on the wire.
+ *
  * ## A LAUNCH is judged here too, not just interpreted (objectui#9973)
  *
  * Classifying the response was never the whole rule. The two launch handlers
@@ -188,6 +201,8 @@
 
 import { actionCopySource, actionErrorDetail } from '@object-ui/core';
 import type { ActionResult } from '@object-ui/core';
+import { getLoadedBuiltInLocales } from '@object-ui/i18n';
+import { declaredUserMessage, isPermissionError } from '@object-ui/react';
 import { errorCodeIs } from '@object-ui/types';
 import type { AutomationResult } from '@objectstack/spec/contracts';
 import { translateFlow, type TranslationBundle } from '@objectstack/spec/system';
@@ -289,14 +304,72 @@ export type FlowResponseOutcome<S = unknown> =
     | ({ kind: 'done'; data: FlowRunResult | undefined; successMessage?: string } & Pick<AutomationResult, 'flowLabel'>);
 
 /**
- * A flow declares a friendly `errorMessage`; prefer it — translated, when the
- * bundle carries `flows.FLOW.errorMessage` (objectui#12075) — over the raw
- * `error`, then fall back to the label. `actionErrorDetail` guarantees a string.
+ * What a failed run's message is read from. On a 200 every member is the run's
+ * own (`AutomationResult`); on a 400 `FLOW_FAILED` `errorMessage` and
+ * `innerRefusal` are `error.details`' (`FlowFailureDetailsSchema`) and
+ * `userMessage` is the envelope's top level (`ApiErrorSchema.userMessage`).
+ */
+interface FlowFailureCarriers {
+    errorMessage?: unknown;
+    /** Already read by `declaredUserMessage`, so non-empty or `null`. */
+    userMessage: string | null;
+    innerRefusal?: unknown;
+}
+
+/** The one subtree of a resident catalogue {@link permissionDeniedLine} reads. */
+type PermissionLinePack = { form?: { noPermissionToSave?: unknown } } | undefined;
+
+/**
+ * The record form's permission line (`form.noPermissionToSave`) in `locale`,
+ * read from the RESIDENT built-in catalogue — exact tag first, then its base
+ * language, the registry's own order (the same read `LoadingScreen` makes).
+ * The active language's catalogue is resident whenever the console runs in
+ * it; anything else answers the resident `en` catalogue, which always is.
+ * The literal is the last resort only for a registry that answers neither.
+ *
+ * Each read is one chain off `getLoadedBuiltInLocales()`, never a local
+ * binding of its result, so `scripts/check-i18n-dead-keys.mjs` derives the
+ * `en` read as a read of `form.noPermissionToSave` and the active-language
+ * reads as runtime-indexed; its header bullet for this file says which leg
+ * sees what.
+ */
+function permissionDeniedLine(locale: string | undefined): string {
+    const usable = (line: unknown): string | undefined =>
+        typeof line === 'string' && line.trim() ? line : undefined;
+    const base = locale ? locale.toLowerCase().split('-')[0] : undefined;
+    return (
+        (locale ? usable((getLoadedBuiltInLocales()[locale] as PermissionLinePack)?.form?.noPermissionToSave) : undefined)
+        ?? (base ? usable((getLoadedBuiltInLocales()[base] as PermissionLinePack)?.form?.noPermissionToSave) : undefined)
+        ?? usable((getLoadedBuiltInLocales().en as PermissionLinePack)?.form?.noPermissionToSave)
+        ?? "You don't have permission to save this record."
+    );
+}
+
+/**
+ * A failed run's message, by the record-save rule (objectstack#24914 ruling
+ * B′): the flow's authored `errorMessage` — translated when the bundle carries
+ * `flows.FLOW.errorMessage` (objectui#12075) — then the producer-marked
+ * `userMessage`, then the refusal the run's write node met (`innerRefusal`,
+ * whose `message` the spec serves without the node and operation prefixes),
+ * then the run's own `message`.
+ *
+ * The inner refusal is rendered exactly as the record form renders the same
+ * refusal on a save: a permission denial (`isPermissionError`) becomes the
+ * form's localized permission line instead of server prose (objectstack#3821),
+ * anything else reads its own sentence. `message` stays the last rung, so a
+ * run that met no refusal still says something, never nothing.
  */
-function flowFailureMessage(data: FlowRunResult, fallback: string, copy: FlowCopyLocale | undefined): string {
-    const friendly = data.errorMessage;
+function flowFailureMessage(failure: FlowFailureCarriers, message: string, copy: FlowCopyLocale | undefined): string {
+    const friendly = failure.errorMessage;
     if (typeof friendly === 'string' && friendly.length > 0) return translatedFlowMessage('errorMessage', friendly, copy);
-    return actionErrorDetail(data, fallback);
+    if (failure.userMessage) return failure.userMessage;
+    const inner = failure.innerRefusal as { code?: unknown; message?: unknown } | null | undefined;
+    if (inner && typeof inner === 'object' && typeof inner.code === 'string') {
+        const refusal = { code: inner.code, message: typeof inner.message === 'string' ? inner.message : '' };
+        if (isPermissionError(refusal)) return permissionDeniedLine(copy?.locale);
+        if (refusal.message.trim()) return refusal.message;
+    }
+    return message;
 }
 
 /**
@@ -343,10 +416,15 @@ export function interpretFlowResponse<S = unknown>(
         // authorable `errorMessage` stays preferred for it; the envelope's own
         // `message` is the fallback. See the header note.
         if (res.status === 400 && errorCodeIs(json?.error, 'FLOW_FAILED')) {
+            const details = errorEnvelopeDetails(json);
             return {
                 kind: 'failed',
                 error: flowFailureMessage(
-                    errorEnvelopeDetails(json),
+                    {
+                        errorMessage: details.errorMessage,
+                        userMessage: declaredUserMessage(json?.error),
+                        innerRefusal: details.innerRefusal,
+                    },
                     actionErrorDetail(json, `${label} failed`),
                     copy,
                 ),
@@ -390,7 +468,15 @@ export function interpretFlowResponse<S = unknown>(
     if (data.success === false || data.status === 'failed') {
         return {
             kind: 'failed',
-            error: flowFailureMessage(data, `${label} failed`, copy),
+            error: flowFailureMessage(
+                {
+                    errorMessage: data.errorMessage,
+                    userMessage: declaredUserMessage(data),
+                    innerRefusal: data.innerRefusal,
+                },
+                actionErrorDetail(data, `${label} failed`),
+                copy,
+            ),
             retryable: false,
         };
     }
 
@@ -211,7 +211,7 @@
  * produce it. Derived and read are pinned TO EACH OTHER instead:
  * `ANALYSED_PACK_OBJECT_IMPORTERS` below lists exactly the paths these bullets
  * analyse, and `scripts/__tests__/check-i18n-dead-keys.test.ts` fails when the
- * derived non-test set and that list disagree in either direction. A sixth
+ * derived non-test set and that list disagree in either direction. An unlisted
  * importer therefore turns a test red instead of joining the silence, which is
  * the failure this section had: not a wrong number, an UNCLASSIFIED READER.
  *
@@ -267,6 +267,21 @@
  *     default away from its call site, and both go dark to every leg while a
  *     shipping component still renders them — and that edit would read as a
  *     tidy-up.
+ *   - `packages/app-shell/src/utils/flowResponse.ts` — reads ONE key, the
+ *     record form's permission line, for a failed flow run whose write node was
+ *     refused, through `getLoadedBuiltInLocales()` and never a static pack
+ *     import. Three chains, each written straight off the call so the
+ *     derivation can follow them: the active tag and its base language are
+ *     RUNTIME-indexed (opaque rows, class 1 below, like `outboundAgentText`),
+ *     and the `en` fallback is spelled in full and resolves to that leaf. It is
+ *     a TWO-segment key, under the property-chain leg's three-segment floor,
+ *     so that leg is blind to it; the full-key probe sees it only because the
+ *     same dotted key is spelled in this file's own comments. ⇒ covered BY
+ *     COINCIDENCE, the same tier as the two bullets above. Nothing is at risk
+ *     today for a second, unrelated reason: the record form reads the same key
+ *     as a literal `t()` argument, so the AST pass keeps it live. Drop both the
+ *     comment spelling and the form's call and this read goes dark while a
+ *     failed flow still shows it.
  *
  * The rest of the matches are TEST-only importers, deliberately not listed one
  * by one. A key read only by a test is not a key a user can see, so a test
@@ -743,6 +758,7 @@ export const ANALYSED_PACK_OBJECT_IMPORTERS = Object.freeze([
   'packages/plugin-grid/demo/main.tsx',
   'packages/plugin-grid/demo/bulk-actions.tsx',
   'packages/react/src/utils/nonGridRowCeiling.tsx',
+  'packages/app-shell/src/utils/flowResponse.ts',
 ]);
 
 /** A path is a TEST importer when it lives in a `__tests__` directory or is