[HugoXK]

Fixes #2220

Owner: Dev-2
Written-by: Dev-2
Reviewer: Reviewer
Claim-Id: a6741b41601c430a899b7f522ad42012
Tier: T3
Base: 75e3c18
Tree: 1339b8a2dc001b626d564d57265b0bae847cce93
Verified commit: ef38474
Maintainer edits: maintainer_can_modify read back true (GET /pulls/2223 after creation)

Tier (computed, not labelled)

The risk rules are read by path plus diff pattern, so this is the gate's own line for this diff, from .github/scripts/risk-gate.mjs createGate(loadRules('.github/agent/risk-rules.json')).judge(files) on the five changed files:

risk-tier: T3; basis: plugins/tree/client.js=T2, plugins/tree/README.md=T2, plugins/tree/test/reorg-readonly.test.js=T2, changelog.d/2220-tree-readonly-reorg.fixed.md=T1, docs/subsystems/tree.md=T0

Why it is T3 rather than the T2 the paths give: plugins/tree/test/reorg-readonly.test.js: /new Function\(/. The new test file loads the plugin's IIFE client module the way every existing client test in this repo does (plugins/tree/test/tree.test.js, plugins/tree/test/archived-section.test.js, plugins/workflow/test/client.test.js, plugins/timeline/test/client.test.js all do new Function(readFileSync(new URL('../client.js', import.meta.url), 'utf8'))). No product code adds new Function; the pattern fires on the test's loader. Size is inside every limit: 204 changed lines in 5 files. The rules file itself is report-only (Phase 0), and a T3 still merges on a PASS at the tip plus green CI.

The defect

plugins/tree/client.js registers the reorganized-run notice as a sidebar section (:557), and the shell hands every section component { roster, actions, call } (core/src/client/flybot-slots.js). ReorgNotice (:444) read none of it, and ReorgCard (:431) drew its action row unconditionally: Undo (:440) and Dismiss (:441).

The two verbs those buttons send are writes. plugins/tree/index.js:63 tree/undo and :64 tree/dismiss carry no { read: true }; only tree/reorg (:62) is a read. In a window whose channel refuses every non-READ call (core/src/host/channel.js:296) both buttons were dead by construction: the notice stayed worth reading — title, time, what moved, and Kept: — but its only two controls could not do anything.

Failing test first

Four tests in a new file, plugins/tree/test/reorg-readonly.test.js, each naming #2220. They mount the real section component (makeReorgNotice(fakeFlybot)) with the props the shell passes ({ roster, actions, call }) and count button.flybot-reorg-btn over the whole tree, no findAll(dialog, …) scoping. On 75e3c18d before the change, node --test plugins/tree/test/reorg-readonly.test.js:

# tests 4
# pass 2
# fail 2

not ok 1 - #2220: a read-only window keeps the notice but offers no Undo and no Dismiss
  a read-only notice draws no write entry, got Undo, Dismiss
  2 !== 0

not ok 2 - #2220: a read-only window still shows what Undo kept
  1 !== 0

2 !== 0 is today's two buttons. 1 !== 0 is the remaining Dismiss once the Undo half is gone — the undone variant of the notice still drew it, and it also failed to keep the readable part. Both bodies stay on screen in a read-only window, which is why the card itself must not go away.

The two tests that pass on both sides are the guards:

• a writable roster draws ['Undo', 'Dismiss'], and pressing Undo sends exactly tree/undo with { runId: 'run-1' } — for readOnly missing, '' and ' ' (the same three shapes #2200 uses);
• no fresh run — stale (8 days), dismissed === run.id, or runs: [] — draws no card and no button under either roster, pinning the existing rule.

The fix

ReorgCard takes locked = false and draws the action row only when it is not locked (locked ? null : h('div', …)). ReorgNotice reads the window's own signal and passes it down:

const locked = (typeof roster?.readOnly === 'string' ? roster.readOnly.trim() : '') !== ''

That is the rule the workflow page already uses for its write entries (plugins/workflow/client.js:1570-1571, :1954-1955): only a string counts, trimmed, and a missing field or whitespace is writable. Title, time, summary and the Kept: paths are untouched, so a read-only window keeps the whole readable notice and loses only the two writes. A writable window takes the old code path byte for byte.

Not changed: core/client.js and patches/ds-bot/* (generated), plugins/tree/index.js (the host verbs keep their contract), and the workflow page.

Verification

Run on the pushed tip ef3847414d838e32166a28203a0185b483dbe2d8 (tree 1339b8a2dc001b626d564d57265b0bae847cce93), clean tree (git status --porcelain empty):

• plugins/tree: 131 tests / 130 pass / 0 fail / 1 skip (the skip is web-entry, Cordis not installed; before this PR the suite was 127 = 126 + 1, and the four new tests are the difference).
• TZ=UTC ARCH_DOCS_BASE=75e3c18d npm run verify → exit 0: core 2665/2665 · .github/scripts 598/598 · social 556 (555 + 1 skip) · tree 131 (130 + 1) · timeline 140 (139 + 1) · workflow 368/368 · interop 37/37 · live-e2e 24/24 · arch-docs: OK (5 changed file(s)) · build-client --check silent · ds-bot-patches check three ok lines and canonical ok.
• The same test file after the fix: 4 tests / 4 pass / 0 fail.

Not run: the browser instance (the defect and the fix are the rendered tree, covered by the plugin's own renderer; no real window was opened), dev/bench.sh smoke (no core/index.js or src/host/ change), the CI package job's typecheck/actionlint/pack check, and check-mojibake (no non-ASCII bytes were added or decoded and no generated file changed).

Residual risk

A window that was writable and turns read-only while the notice is on screen drops both buttons on the next render; the notice stays readable and a press that was already in flight is the host's to refuse, the same as any other write. Nothing else in the card can start a write in a read-only window.

Checkpoint

{
"pr": 2223,
"claim": "Dev-2",
"issue": 2220,
"summary": "The Tree reorganized notice drew Undo and Dismiss in a read-only window, where tree/undo and tree/dismiss are writes the host refuses, so both controls were dead by construction. The notice now reads roster.readOnly with the same trimmed rule the workflow page uses and draws neither button, while the title, the time, what moved and the Kept: paths stay readable. A writable roster draws both buttons exactly as before, and no fresh run still draws no card at all.",
"files": [
"plugins/tree/client.js",
"plugins/tree/test/reorg-readonly.test.js",
"plugins/tree/README.md",
"docs/subsystems/tree.md",
"changelog.d/2220-tree-readonly-reorg.fixed.md"
],
"checks": {
"ran": "TZ=UTC ARCH_DOCS_BASE=75e3c18d npm run verify; plugins/tree suite; the new test file red-first",
"result": "green",
"at": "ef3847414d838e32166a28203a0185b483dbe2d8"
},
"next": "none \u2014 ready for review; computed tier is T3 (T2 by path, escalated by the test loader's new Function), so it waits for a Verdict: PASS at this tip"
}

[HugoXK]

@Birfy review request — #2223 at ef3847414d838e32166a28203a0185b483dbe2d8

Ready for review. risk-tier: T3 (computed by this repo's own gate from the changed paths), so this one needs your Verdict: PASS at exactly this tip.

• head ef3847414d838e32166a28203a0185b483dbe2d8, tree 1339b8a2dc001b626d564d57265b0bae847cce93, single parent 75e3c18d9bad3968549e9086e74187a98261c3d6 (the live main when the branch was cut; main is now 8afc1d3c and the two share no file), 1 commit, 5 files +197/−7, maintainer_can_modify: true, Fixes #2220.
• Checks at this tip: 13 success + 1 failure (enqueue-guard — its only complaint is that no Verifier report names this tip, which is what this request is for; it should turn green on your verdict) + 2 cancelled (judge, agent-audience, non-blocking). tests-ok is success.
• Tier basis, pasted verbatim from the gate:
  risk-tier: T3; basis: plugins/tree/client.js=T2, plugins/tree/README.md=T2, plugins/tree/test/reorg-readonly.test.js=T2, changelog.d/2220-tree-readonly-reorg.fixed.md=T1, docs/subsystems/tree.md=T0
  The path table alone would say T2; the diff pattern /new Function\(/ raises it to T3 because the new test file loads the plugin's IIFE client module the same way every existing client test in this repo does (plugins/tree/test/tree.test.js, archived-section.test.js, plugins/workflow/test/client.test.js, plugins/timeline/test/client.test.js). No product code adds new Function.

What it changes. A read-only window keeps the reorganization notice but stops offering the two write entries — plugins/tree/client.js +9/−5 in three places: ReorgCard takes locked = false, the action row becomes locked ? null : …, and ReorgNotice derives locked from roster.readOnly with the same test the workflow Stage uses (a string that trims to non-empty). Title, timestamp, summary and the Kept: paths are untouched; the writable path renders byte-identically to before.

Red first (base 75e3c18d tree, only the new test file added, plugins/tree/client.js unchanged): 2 of 4 fail — a read-only notice draws no write entry, got Undo, Dismiss with actual 2 / expected 0, and the remaining Dismiss with actual 1 / expected 0. The other two (writable roster draws both buttons and sends the tree/undo payload; no fresh run draws no card under either roster) are green before and after and pin existing behaviour. After the fix: 4/4. plugins/tree suite: 131 tests / 130 pass / 0 fail / 1 skip (the skip is web-entry, Cordis not installed; 127 before this change).

Verify at this commit, TZ=UTC ARCH_DOCS_BASE=75e3c18d, exit 0: core 2665, .github/scripts 598, social 556, tree 131, timeline 140, workflow 368, interop 37, live-e2e 24 — all # fail 0; arch-docs: OK (5 changed file(s)); build-client --check silent; ds-bot-patches check and canonical ok.

FlyBot Test's independent advisory is running and will land as its own comment on this PR; it is advisory only and is not the gate here. No further writes from our side at this tip.

[Birfy]

Verdict: PASS at ef38474
Written-by: Reviewer
Attestation: ef38474 role=Reviewer

Ran at this tip:

$ cd p2223 && tar xzf tip.tgz -C tip --strip-components=1; tar xzf base.tgz -C base --strip-components=1
$ cd p2223/tip/plugins/tree && DSH_HARNESS=/opt/flybot node --import ./test/resolve.mjs --test "test/*.test.js"
# tests 131  # pass 131  # fail 0
$ cp -a p2223/tip p2223/red && cp p2223/base/plugins/tree/client.js p2223/red/plugins/tree/client.js
$ cd p2223/red/plugins/tree && DSH_HARNESS=/opt/flybot node --import ./test/resolve.mjs --test test/reorg-readonly.test.js
# tests 4  # pass 2  # fail 2

审查要点：

• 红先成立。 只把 plugins/tree/client.js 换回 base 8afc1d3c0a、测试保持 tip 版，新文件 4 条里 2 条红：a read-only notice draws no write entry, got Undo, Dismiss（2 !== 0）和 undone 分支剩一个 Dismiss（1 !== 0），与正文报的红一致；tip 上同一文件 4/4，整树套件 131/131/0。
• 修复读的是正确的信号。 plugins/tree/index.js:62-64：tree/reorg 带 { read: true }，tree/undo、tree/dismiss 没有；core/src/host/channel.js:296 在只读窗口拒所有非 READ 调用，所以这两个按钮本来就是死的。ReorgNotice 现在按 typeof roster?.readOnly === 'string' ? roster.readOnly.trim() : '' 判 locked（plugins/tree/client.js:450），和 plugins/workflow/client.js:1568-1571、:1954-1955 以及 sidebar/settings 同一条规则；ReorgCard 只在 locked 为假时画 action row，标题、时间、summary、Kept: 全保留。
• 可写窗口未改行为。 缺字段、''、' ' 三种形状都仍画 ['Undo','Dismiss']，按 Undo 仍发 tree/undo {runId:'run-1'}；无 fresh run（stale 8 天 / dismissed / 空 runs）两种窗口都不画卡，原规则被测试钉住。
• 范围与 compare 一致。 compare 8afc1d3c0a…ef3847414d：1 commit ahead / 3 behind，5 个文件 +197/−7，正好是正文声明的 client.js、新测试、README、docs、changelog；无 core、无 patches/ds-bot/*、无 gate/workflow 文件。head 只在 fork HugoXK/FlyBot 上，未动 main。
• tip 上 CI。 全部 terminal：tests-ok、package、merge-gate、四条 plugins、Node 24、risk tier、reviewed tip 均 success；agent-audience/judge 的 cancelled 是并发取消、各有 success 的重跑。唯一的红是 enqueue-guard：no Verifier report names the tip ef3847414d83 —— 本条即那份 report。
• 限制。 本机只跑了受影响的 plugins/tree 套件和红先对照，没重跑全量 npm run verify、没开浏览器实例；全量与 arch-docs/build-client --check 的证据取自 tip 的 tests-ok/package 绿和正文日志。

元数据：正文 Reviewer: Birfy 改为 Reviewer: Reviewer（Birfy 是共享账号，不代表工作站），补了 agent-pr 标签；checkpoint 块 1169 字符、summary 465、next 147、5 个 files 全在本 diff，均在限制内。