social: a read-only window still draws the Sharing card's and the group Members' invite entries #2418

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 642b54ba1a2843b9bdb399bb636d9e60
Branch: dev/4-social-invite-readonly
Base: dd9c5a0
At: 2026-11-04T16:52:11Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Owned-by: FlyBot Dev-4 (branch dev/4-social-invite-readonly)

In a read-only window the Bot settings → Sharing card and the group chat's Members card still draw their invite write entries, and every press is refused by the host.

Reproduction (live main a091ddc0, read-only roster):

1. Open a Bot's details → Sharing. The card is mounted by flybot.bot.details → BotSocialDetails (plugins/social/client.js:3487), which is handed roster by the slot (core/src/client/flybot-slots.js:233) but drops it: return h(OwnBotSharing, { bot }) at :3493. OwnBotSharing({ bot } = {}) (:3498) never looks at a roster, so a read-only window is drawn with invite-to-bot, mint-invite, share-with-friend, manage-access and the buttons Copy invite link for … / Share with a friend / People with access → Revoke.
2. Open a group chat → Members. LocalInviteRow({ room } = {}) (plugins/social/client.js:1166, registered at :3992 for flybot.room.members) has the same gap: a read-only window still draws room-invite-mint and Create link.
3. Pressing any of them cannot work: social/create-invite, social/share-with-friend, social/revoke-grant and room-invite-mint are writes, so core/src/host/channel.js:308 refuses them with bot/read-only. The reader is told the window is read-only only after the press.

Expected: a read-only window draws no write entry on either card; each card says in one line why it cannot act (sharing-readonly / room-invite-readonly), the same way the room overview already does (#2228/#2400). A writable window is unchanged.

Scope: plugins/social/client.js (the two components above; both already have the roster available), one test file (plugins/social/test/social-readonly.test.js, four cases: two red on the base — one per card — two green controls proving a writable window keeps its entries), docs/subsystems/social.md one line, one changelog fragment. No core/client.js, no patches/ds-bot/0008, no core/src/host/** — this is the plugins/** lane.

Red-first evidence (clean a091ddc0 + only the new cases): social-readonly.test.js 12 tests → 10 pass / 2 fail; not ok 9 Sharing still draws mint-invite, share-with-friend, manage-access; not ok 11 Members still draws room-invite-mint.

Duplicate check (live main + closed issues): #2219/#2221 fixed Bot Social's own write surfaces and the +/context menus, #2228/#2233 and #2400/#2401 fixed the room overview card, #2238/#2239 the Bot menu — none of them touch BotSocialDetails/OwnBotSharing or LocalInviteRow, and the live probe above still shows both entries. No open issue or open PR names these two surfaces.