workflow: a read-only window still offers Edit in Settings → Workflows #2176

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: fef2fca5e225483fa915d820aea28d28
Branch: dev/2-workflows-readonly-hides-edit
Base: 7d06d01
At: 2026-11-02T14:18:05Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead

What is wrong

In a window that holds the team read-only, Settings → Workflows still offers Edit. The page reads the roster (which carries the host's readOnly sentence) but never looks at it, so the Edit toggle, Rename, Delete and the canvas drag are all live; the user can rearrange a graph and only the final commit is refused, with the host's own sentence (bot/read-only) surfacing instead of a control that was disabled.

At live main 7d06d01ac25c4668d9fd0cb9f45afb8c5f94688f:

• core/src/client/workflows.js:629 — WorkflowsPage({ call, roster }) gets the roster; roster.readOnly is never read on this path. The only use of roster is :372, which filters local Bots out of the add-node palette.
• core/src/client/workflows.js:634 — const [editing, setEditing] = useState(false), toggled by the Edit / Finish editing button at :595 (onEditing?.(!editing)) with no read-only condition.
• core/src/client/workflows.js:737 — commit() calls invoke('workflow/graph', { workflowId, nodes, edges }), a write.
• core/src/host/channel.js:227 — READS lists 'workflows' (the read) but not 'workflow/graph' (the write), so core/src/host/channel.js:294-296 answers fail(readOnly, 'bot/read-only') for it.

So a read-only window renders a fully editable canvas and then refuses the save; the state the user built is discarded with one technical line. Other read-only surfaces on the same page (Rename / Delete) are equally reachable.

Repro

1. Open a second window on a home that another dsh holds (the host reports readOnly with its another dsh holds the team … sentence), or stub roster.readOnly in the page harness.
2. Settings → Workflows → open a graph of our own.
3. Edit is rendered and toggles editing to true; drag a card or add a Bot to the palette.
4. The commit calls workflow/graph, which is not in READS → the host refuses with bot/read-only; nothing is saved and the canvas still shows the edited layout.

Expected

• When roster?.readOnly is a non-empty string, the page renders the host's sentence in place of Edit (same wording the host produced, not a new one), and keeps editing false for the whole life of that window.
• Rename and Delete are not offered on that page in that state.
• Use this is not offered either: copying a template calls workflow/create, a write the same channel refuses (bot/read-only), so the control is not rendered in that state.
• Reads keep working: the graph list, the canvas and the runs still render.
• With no readOnly (a normal window) every current control and the commit path behave exactly as today.
• The host side is not changed: channel.js keeps refusing workflow/graph for a read-only window (fail(readOnly, 'bot/read-only')).

Acceptance

1. roster: { readOnly: '<the host sentence>' } → no Edit button, no working data-port drag handlers, the host sentence is rendered on the page, and workflow/graph is never invoked (0 calls) when the canvas is clicked or a card is dragged.
2. The same fixture's Edit-less page still renders the graph and the run list from workflows.
3. With roster: { bots: [] } (no readOnly) every existing workflows-page case stays green unchanged.
4. core/test/workflows-page.test.js red before the fix on the three cases above and green after; npm run verify exit 0.
5. In the same read-only fixture a factory preset shows no Use this, and workflow/create is never invoked (0 calls); a normal window still shows it and copies (control stays green).

Scope

core/src/client/workflows.js, core/test/workflows-page.test.js, docs/subsystems/core-client.md (one sentence), core/client.js + patches/ds-bot/0008-client-bundle.patch and its two mirror files via build-client + generate, plus changelog.d/.

Dedupe

Searched live main and the issue tracker before opening: readOnly in body → 11 results, all closed except #1748 (unrelated social test); read-only Edit in title/body → no open issue for this surface (#1378/#1481/#2153 closed, #2153 is the diagnostics sentence). No open issue covers "the Workflows page offers Edit in a read-only window".