[HugoXK]

Fixes #2176

Written-by: Dev-2
Owner: Dev-2
Reviewer: Birfy
Claim-Id: fef2fca5e225483fa915d820aea28d28
Branch: dev/2-workflows-readonly-hides-edit
Base: c21e6da
Tier: T1 — risk-gate: 119 changed lines in 4 files, 4 generated files not counted; basis core/src/client/workflows.js=T1, core/test/workflows-page.test.js=T1, changelog.d/2176-workflows-readonly-hides-edit.fixed.md=T1, docs/subsystems/core-client.md=T0

What changed

• WorkflowsView finally reads roster.readOnly (the same field the sidebar uses): a trimmed, non-empty sentence means the window does not own the team. Edit is replaced where it stood, in the bt-wf-actions row, by the host's own sentence — hostText(readOnly), not new wording — in the page's own .bt-wf-status class (styles.js:535); no CSS file is touched.
• The canvas opens its editor only when the graph is ours and the window is not read-only, so data-port, the palette, the prompt fields and the drag handlers are not rendered at all rather than rendered and then refused.
• Row takes editable, so a read-only window offers no ✎ / × on its own workflows.
• Use this now requires !locked too: copying a preset writes workflow/create, which core/src/host/channel.js:227's READS does not hold either.
• WorkflowsPage computes readOnly once, returns from commit() before building workflow/graph, and only enters editing from useTemplate when the window is not read-only.
• Reads are untouched: workflow/state, the list, the canvas, the cards, the run chips. The host side is untouched — core/src/host/channel.js has a zero-line diff and keeps answering fail(readOnly, 'bot/read-only').

Red first

Clean git archive c21e6da0 with only the new test file, core/test/workflows-page.test.js: 47 tests / 44 pass / 3 fail

• not ok 43 - #2176: a read-only window renders the host sentence instead of Edit and offers no rename or delete — error: a read-only window offers no editing control, actual ['Edit'], expected []
• not ok 44 - #2176: a read-only window never asks the host to save a graph the user drags — error: a read-only window never writes the graph, actual ['workflow/graph'], expected []
• not ok 46 - #2176: a read-only window offers no Use this on a preset and never creates a copy — expected false, actual true
• the two controls are green on the base arm as well: ok 45 (a normal window keeps Edit, rename and delete) and ok 47 (a normal window keeps Use this and copies the preset once).

At the tip: 47/47.

Ran

Clean committed tree, head e3ae3eb6a057dfb51a6c741eae80eafedec0ba0c, tree bf08b47535e185da54da1cf1f31618ae92fb5631:

• TZ=UTC ARCH_DOCS_BASE=c21e6da05dd6c287b044ea84f5d2612421e03a72 DSH_HARNESS=/home/xuke/.dsh/bot/workspace/a1727 npm run verify — exit 0. core 2656/2656/0 · social 555 (554 + 1 skip) · tree 127 (126 + 1) · timeline 140 (139 + 1) · workflow 354/354 · .github/scripts 598/598 · interop 37/37 · live-e2e 24/24. Lint 74/36/9/2/16 warnings, 0 errors; arch-docs: OK (8 changed file(s)).
• node core/scripts/build-client.mjs --check — exit 0.
• node scripts/ds-bot-patches.mjs check — ok ds-bot/ = Fei2411/DeepSeek-Bot@2b10c70 (tree 5834c00, v0.1.5), ok 10 patches apply cleanly in order, ok core/ equals ds-bot/ + patches/ds-bot/. (Read from a tarball without .git, the pin line prints skipped; the other two lines read the same.)
• node scripts/ds-bot-patches.mjs canonical — ok patches/ds-bot/ is what generate writes (generate is a no-op); re-running generate leaves git status --porcelain empty.

Not run

• No hand click-through of the desktop or Web client; the surface is covered by core/test/workflows-page.test.js, which renders the real component.
• core/dev/smoke.mjs not run — core/index.js and core/src/host/ are untouched.
• No live-e2e bench started.
• The CI package job's pack/typecheck/actionlint steps are not part of npm run verify and were not run here.

Files (8, +309/−99)

file	blob
changelog.d/2176-workflows-readonly-hides-edit.fixed.md	064490a562da822e599dbc054675e8d05b8e3b06
core/client.js (generated)	ed9b16813b4c39fd35d519772ab58e2118979e9e
core/src/client/workflows.js	63a3105961ab026dc1d2f782daa2d83731691edf
core/test/workflows-page.test.js	e2e04de393c1aaa29828ca8a8159af1e36ce8f04
docs/subsystems/core-client.md	6268e33246dc71808b88d54d2488058f797dfb85
patches/ds-bot/0008-client-bundle.patch (generated)	113afefd7d37d312f84bd4bfc2fa86e7a5d7177f
patches/ds-bot/files/src/client/workflows.js (mirror)	63a3105961ab026dc1d2f782daa2d83731691edf
patches/ds-bot/files/test/workflows-page.test.js (mirror)	e2e04de393c1aaa29828ca8a8159af1e36ce8f04

{
"pr": 2181,
"claim": "Dev-2",
"issue": 2176,
"summary": "Settings → Workflows reads roster.readOnly now: in a window a second dsh holds read-only it replaces Edit with the host's own sentence instead of offering a save the channel refuses. Rename, Delete, the drag editor and Use this are not rendered in that state, so the page never builds workflow/graph or workflow/create. Reads, the list, the canvas and the run chips are untouched, and a window without readOnly keeps every control and the commit path it had. The host side is unchanged.",
"files": [
"changelog.d/2176-workflows-readonly-hides-edit.fixed.md",
"core/client.js",
"core/src/client/workflows.js",
"core/test/workflows-page.test.js",
"docs/subsystems/core-client.md",
"patches/ds-bot/0008-client-bundle.patch",
"patches/ds-bot/files/src/client/workflows.js",
"patches/ds-bot/files/test/workflows-page.test.js"
],
"checks": {
"ran": "TZ=UTC ARCH_DOCS_BASE=c21e6da05dd6c287b044ea84f5d2612421e03a72 npm run verify; node core/scripts/build-client.mjs --check; node scripts/ds-bot-patches.mjs check; node scripts/ds-bot-patches.mjs canonical",
"result": "green",
"at": "e3ae3eb6a057dfb51a6c741eae80eafedec0ba0c"
},
"next": "none — ready for review"
}

[HugoXK]

Tip of record: e3ae3eb6a057dfb51a6c741eae80eafedec0ba0c.

State at this tip, read from the API just now:

• 17 checks, all success — tests-ok, merge-gate, judge, reviewed tip, enqueue-guard, package, Node 24, every plugins (...) and agent-audience.
• enqueue-guard says no PASS needed: computed tier T1, so this one carries no Verdict requirement.
• FlyBot Test's independent advisory is in: Self-test: PASS at e3ae3eb6a057dfb51a6c741eae80eafedec0ba0c (47/0 at the tip; 44/3 red-first on c21e6da0).
• mergeable: true, mergeable_state: clean, maintainer_can_modify: true, not a draft, head unchanged since it was opened.

Nothing is pending on this branch and no one is waiting on a decision from its author. This is the first comment on the PR; the branch stays frozen at e3ae3eb6 — no rebase, no new tip.