@@ -0,0 +1,16 @@
+---
+'@objectstack/service-sms': patch
+'@objectstack/runtime': patch
+---
+
+fix(service-sms, runtime): the Send test SMS refusals and the flow clone notice name the admin's controls instead of a REST recipe (#25345)
+
+Clause-②: no
+Metadata-protocol: none
+
+Two pieces of copy the console shows an admin told them to call the REST API.
+
+- **Send test SMS** (`sms/test`): when the test could not go to the signed-in admin's own number, the refusal said to pass "to" in the request body. The settings page has no recipient field, so that advice could not be followed from it. Each refusal now says that nothing was sent and what the admin can do on the page: press Send test SMS signed in as an admin whose account has a phone number, or retry once the account can be read. A `to` in the request still wins, as before. It is now documented only in the handler's TSDoc, for API callers.
+- **Flow clone notice** (`FLOW_CLONE_NOTICE`, returned by `POST /api/v1/automation/:name/clone`): the notice told the admin to `PUT` the clone's complete definition with `status: 'obsolete'`, and named the toggle endpoint. It now names the two switches the console has. A packaged original is switched off with its Switch "…" off action on the Packaged automation page, and that switch does not reach the clone. The clone is switched off in Studio, with its Enabled switch and a publish. The REST recipe stays in the client SDK's `automation.toggle` TSDoc.
+
+No route, response shape, status or code changes: only the message text does. A caller that compared either string verbatim must update its copy.
@@ -49,6 +49,7 @@ import {
     FLOW_CLONE_DROPPED_KEYS,
     FLOW_CLONE_MUTATED_FIELDS,
     FLOW_CLONE_NAME_TAKEN_STATUS,
+    FLOW_CLONE_NOTICE,
     FLOW_CLONE_STATUS,
 } from '../flow-clone.js';
 
@@ -456,11 +457,27 @@ describe('#12156 — the source, the notice, and the gate', () => {
         // `obsolete`/`invalid`, so a cloned record-change flow runs beside the
         // one it was copied from. Saying so is cheaper than the surprise.
         expect(notice).toMatch(/off-switch/i);
-        // [#20726] And the off-switch it names is one the clone has: its own
-        // `status`, through its update door. A clone carries no package
-        // envelope, and the activation toggle switches packaged flows only.
-        expect(notice).toContain("status: 'obsolete'");
-        expect(notice).toContain('PUT /api/v1/automation/');
+        // [#20726] And it names the switches an admin has. A clone carries no
+        // package envelope, so the packaged-flow switch does not reach it; the
+        // clone is switched off in Studio, the original from its own row.
+        expect(notice).toContain('Switch "…" off');
+        expect(notice).toContain('does not reach the clone');
+        expect(notice).toContain('open it in Studio, set its Enabled switch to Disabled, and publish');
+    });
+
+    it('is admin copy: it names controls, never an endpoint or a request body', async () => {
+        // The console shows this notice verbatim on the clone result. The REST
+        // recipe for the same switch is developer copy, in the client SDK.
+        const source = packagedExemplar();
+        const { dispatcher } = makeDispatcher([source]);
+
+        const result = await dispatcher.handleAutomation(clonePath(source.name as string), 'POST', NEW, CTX);
+        const notice: string = ((result.response?.body?.data ?? result.response?.body) as any)?.notice ?? '';
+
+        expect(notice).toBe(FLOW_CLONE_NOTICE);
+        expect(notice).not.toContain('/api/');
+        expect(notice).not.toMatch(/request body/i);
+        expect(notice).not.toMatch(/\b(PUT|POST)\b/);
     });
 
     it('is an authoring write — a caller without `manage_metadata` is refused 403, nothing registered', async () => {
 
@@ -166,23 +166,29 @@ export const FLOW_CLONE_DROPPED_KEYS: readonly string[] = Object.freeze([
  *     and the only thing standing between them and that surprise is this
  *     sentence.
  *
- * [#20726, ADR-0126 §7.2] The off-switch it names is the CLONE's own: its
- * `status`, published through `PUT /:name`. A clone carries no package
+ * [#20726, ADR-0126 §7.2] The clone's own off-switch is its `status`
+ * (`obsolete`), published through `PUT /:name`. A clone carries no package
  * envelope (see {@link FLOW_CLONE_DROPPED_KEYS}), so it is a flow authored in
  * this deployment, and the activation toggle — which switches packaged flows
  * only — refuses it. That holds whatever the clone was copied from: the clone
- * door takes any registered flow as its source, packaged or not, so the
- * notice makes no claim about the source's provenance.
+ * door takes any registered flow as its source, packaged or not.
+ *
+ * The notice is admin copy — the console shows it verbatim on the clone
+ * result — so it names the controls the admin uses, never an endpoint or a
+ * request body: the Packaged automation page's `Switch "…" off` action for a
+ * packaged original, and Studio's Enabled switch (publish to apply) for the
+ * clone. The REST recipe is developer copy and lives in the client SDK's
+ * `automation.toggle` TSDoc.
  */
 export const FLOW_CLONE_NOTICE =
     'References are not re-pointed: this clone calls exactly what the original called '
     + '(subflows, actions and objects are unchanged). It is created with status `draft`, '
     + 'which is a lifecycle label and NOT an off-switch — a cloned record-change or schedule '
     + 'flow is bound to its trigger and will run alongside the flow it was copied from. '
-    + 'If that is not what you want, switch the clone off through its own status: send its '
-    + 'complete definition with `status: \'obsolete\'` to `PUT /api/v1/automation/<name>`. '
-    + 'The activation toggle (`POST /api/v1/automation/<name>/toggle`) switches packaged flows '
-    + 'only and refuses the clone.';
+    + 'If that is not what you want, switch one of them off. A packaged original is switched '
+    + 'off on the Packaged automation page, with its Switch "…" off action; that switch covers '
+    + 'packaged flows only and does not reach the clone. To switch the clone itself off, open it '
+    + 'in Studio, set its Enabled switch to Disabled, and publish.';
 
 /** ADR-0112 envelope for the same-name refusal: a status AND a code. */
 export const FLOW_CLONE_NAME_TAKEN_STATUS = 409;
 
@@ -78,6 +78,11 @@ const SYSTEM_CTX = { isSystem: true } as const;
  * sign-in is enabled, so the refusal for a caller without one says exactly
  * that, and that nothing was sent. A read that fails is reported as a failed
  * read, never as "you have no number".
+ *
+ * Every refusal is admin copy the settings page shows: it names what the admin
+ * does (press Send test SMS signed in as an admin whose account has a number),
+ * never a request field or an endpoint. The `to` override is for API callers
+ * and is documented here, not in the refusal.
  */
 async function resolveSmsTestRecipient(
   payload: unknown,
@@ -91,15 +96,17 @@ async function resolveSmsTestRecipient(
   }
   if (typeof userId !== 'string' || userId === '') {
     return {
-      refusal: 'No recipient — nothing was sent. This call names no "to" number and carries no signed-in '
-        + 'user whose own number the test could go to; pass "to" in the request body.',
+      refusal: 'No recipient — nothing was sent. The test SMS goes to the signed-in admin\'s own phone number, '
+        + 'and no one is signed in on this call. Sign in as an admin whose account has a phone number, then '
+        + 'press Send test SMS again.',
     };
   }
   const engine = getEngine();
   if (!engine) {
     return {
       refusal: 'No data engine is available to read your account\'s phone number — nothing was sent. '
-        + 'Pass "to" in the request body to name a recipient.',
+        + 'The test SMS goes to the signed-in admin\'s own number, so it can be sent only once that number '
+        + 'can be read; press Send test SMS again when the data service is up.',
     };
   }
   let row: Record<string, unknown> | null;
@@ -112,16 +119,17 @@ async function resolveSmsTestRecipient(
   } catch (err: any) {
     return {
       refusal: `Could not read your account's phone number to send the test SMS to (${err?.message ?? String(err)}) `
-        + '— nothing was sent. Pass "to" in the request body to name a recipient.',
+        + '— nothing was sent. The test SMS goes to the signed-in admin\'s own number; press Send test SMS '
+        + 'again once your account can be read.',
     };
   }
   const raw = row?.phone_number;
   const to = typeof raw === 'string' ? normalizeSmsRecipient(raw) : undefined;
   if (!to) {
     return {
       refusal: 'Your account has no phone number, and the test SMS is sent to the signed-in admin\'s own number '
-        + '— nothing was sent. A number is on an account only where phone sign-in is enabled; otherwise pass '
-        + '"to" in the request body.',
+        + '— nothing was sent. A number is on an account only where phone sign-in is enabled: press Send test SMS '
+        + 'while signed in as an admin whose account has a phone number.',
     };
   }
   return { to };
 
@@ -55,11 +55,12 @@ function fakeEngine(users: UserRow[], opts: { userReadFails?: boolean } = {}) {
   };
 }
 
-async function serve(users: UserRow[], opts: { userReadFails?: boolean } = {}) {
+async function serve(users: UserRow[], opts: { userReadFails?: boolean; noEngine?: boolean } = {}) {
   const settings = new SettingsService({ env: {} });
   settings.registerManifest(smsSettingsManifest);
   const engine = fakeEngine(users, opts);
-  const services = new Map<string, unknown>([['settings', settings], ['objectql', engine]]);
+  const services = new Map<string, unknown>([['settings', settings]]);
+  if (!opts.noEngine) services.set('objectql', engine);
   const readyHooks: Array<() => Promise<void> | void> = [];
   const ctx = {
     logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
@@ -179,3 +180,49 @@ describe('served sms/test — the recipient', () => {
     expect(twilio).not.toHaveBeenCalled();
   });
 });
+
+// Every recipient refusal is admin copy: the settings page shows it beside the
+// Send test SMS button. It names what the admin does there, never a request
+// field or an endpoint — the `to` override is API-caller detail.
+describe('served sms/test — the recipient refusals are admin copy', () => {
+  const adminCopy = (message: unknown) => {
+    expect(typeof message).toBe('string');
+    const text = message as string;
+    expect(text).toContain('nothing was sent');
+    expect(text).toContain('Send test SMS');
+    expect(text).not.toContain('/api/');
+    expect(text).not.toMatch(/request body/i);
+    expect(text).not.toMatch(/pass "to"/i);
+  };
+
+  it.each([
+    ['an account with no phone number', [{ id: ADMIN_ID, phone_number: null }], {},
+      'Your account has no phone number', 'signed in as an admin whose account has a phone number'],
+    ['a failed account read', [{ id: ADMIN_ID, phone_number: ADMIN_PHONE }], { userReadFails: true },
+      'Could not read your account\'s phone number', 'once your account can be read'],
+    ['no data engine', [{ id: ADMIN_ID, phone_number: ADMIN_PHONE }], { noEngine: true },
+      'No data engine is available', 'when the data service is up'],
+  ] as const)('%s', async (_name, users, opts, opening, remedy) => {
+    const { twilio, pressSendTest } = await serve([...users], opts);
+
+    const answer = await pressSendTest({ ...TWILIO_DRAFT });
+
+    expect(answer.status).toBe(400);
+    expect(answer.body?.error?.code).toBe('SETTINGS_ACTION_FAILED');
+    const message = answer.body?.error?.details?.message;
+    expect(message).toMatch(new RegExp(`^${opening}`));
+    expect(message).toContain(remedy);
+    adminCopy(message);
+    expect(twilio).not.toHaveBeenCalled();
+  });
+
+  it('no signed-in user (in-process call)', async () => {
+    const { settings } = await serve([{ id: ADMIN_ID, phone_number: ADMIN_PHONE }]);
+
+    const result = await settings.runAction('sms', 'test', { ...TWILIO_DRAFT }, {});
+
+    expect(result.message).toMatch(/^No recipient — nothing was sent\./);
+    expect(result.message).toContain('Sign in as an admin whose account has a phone number');
+    adminCopy(result.message);
+  });
+});