[HugoXK]

social: a read-only window draws no Sharing or members invite write

Fixes #2418
Owner: Dev-4
Reviewer: Birfy
Written-by: Dev-4
Claim-Id: 642b54ba1a2843b9bdb399bb636d9e60
Branch: dev/4-social-invite-readonly
Tip: d608f2c
Tree: 8798dcfb21e7e860e932006e5c6bd5da253b9479
Base: dd9c5a0
Diff: 4 files, +82/−4
Tier: T2
why: [] — the highest path is plugins/social/client.js at T2 under the live risk-rules.json at this base; plugins/*/test/** and changelog.d/** are T1, docs/** is T0
Docs-changed: docs/subsystems/social.md (the read-only paragraph now names the two cards)

What was wrong

A read-only window still drew two social cards whose every control writes, and the host refuses all of them with bot/read-only (core/src/host/channel.js:308):

• Bot settings → Sharing (plugins/social/client.js:3487 BotSocialDetails) took roster and then dropped it at :3493, so OwnBotSharing (:3498) had no window state at all. A probe with the read-only roster drew invite-to-bot, mint-invite, share-with-friend and manage-access, plus the buttons Copy invite link for Alice, Share with a friend and People with access (Revoke), i.e. social/create-invite, social/share-with-friend and social/revoke-grant.
• A local group's Members card (plugins/social/client.js:1166 LocalInviteRow) had the same gap: a probe drew room-invite-mint and the button Create link, i.e. host('room-invite-mint').

Both cards are the same class as #2219 (the sidebar's notices and + menu), #2228 (the room overview) and #2400 (the group overview): the window is named in roster.readOnly, the writes can only be refused, and the rest of the plugin already reads that state.

What changed

• plugins/social/client.js (+17/−3): BotSocialDetails hands roster to OwnBotSharing, which returns the window's own sentence in a sharing-readonly row instead of the three write panels; LocalInviteRow takes roster and returns the sentence in a room-invite-readonly row instead of the invite row. A writable window draws exactly what it drew before; nothing is opened or read to decide this, so no journal or settings file is touched.
• plugins/social/test/social-readonly.test.js (+63): four tests, two per card — the read-only window draws no write control and still says why, the writable window keeps every control.
• docs/subsystems/social.md (+1/−1): the read-only paragraph now names the two cards.
• changelog.d/2418-social-invite-readonly.fixed.md (+1).

What I ran

• Red first, clean dd9c5a05 + only this test file: plugins/social/test/social-readonly.test.js 12 tests, 10 pass, 2 fail — not ok 9 (Sharing still drew mint-invite,share-with-friend,manage-access) and not ok 11 (Members still drew room-invite-mint); the two "a writable window keeps them" tests already pass at the base, so the test is not passed by deleting the card.
• TZ=UTC ARCH_DOCS_BASE=dd9c5a05 npm run verify — exit 0, 4836/4836 tests, 0 fail (core 2844, social 574, tree 132, timeline 140, workflow 411, .github+policy 671/37, interop 26); arch-docs: OK (4 changed file(s)); lint 76/36/9/2/16 warnings, 0 errors.
• node scripts/ds-bot-patches.mjs check exit 0 (ds-bot/ pin, 10 patches, core/ = pin + patches); generate twice, exit 0 both, no diff — nothing under patches/ or core/client.js moved.
• node .github/scripts/check-mojibake.mjs --check (inside verify) and the changelog check pass.

Not run

• No smoke bench: nothing under core/index.js or core/src/host/ changed.
• No Node 24 job, no CI-only pack check / typecheck / actionlint.

Tip 6adbf1cff5 was built by the push helper from the same tree (8798dcfb) those checks ran on (d7b47a1f).

Checkpoint

{
  "pr": 2421,
  "claim": "Dev-4",
  "issue": 2418,
  "summary": "Bot settings → Sharing and a local group's Members card drew their write controls in a read-only window: the invite maker, Share with a friend, People with access and the room invite's Create link all call a write the host refuses there. Both cards now read the window's reason instead, and a writable window is unchanged. The tests mount the real client and count what each window state draws. The plugin's read-only paragraph in the subsystem doc names the two cards.",
  "files": ["plugins/social/client.js", "plugins/social/test/social-readonly.test.js", "docs/subsystems/social.md", "changelog.d/2418-social-invite-readonly.fixed.md"],
  "checks": { "ran": "TZ=UTC ARCH_DOCS_BASE=dd9c5a05 npm run verify; node scripts/ds-bot-patches.mjs check; node scripts/ds-bot-patches.mjs generate twice", "result": "green", "at": "d7b47a1f9baf6056a2f276454434a81a1d7a8f6b" },
  "next": "none — ready for review"
}

[HugoXK]

@Birfy — review request for the queue (one comment, this tip only).
Written-by: Dev-4

• PR social: a read-only window draws no Sharing or members invite write #2421 — social: a read-only window draws no Sharing or members invite write (#2418), base dd9c5a055471fdf268024b721c605a8f00881a16
• Tip d608f2cb69186763672911ebb29554a8253b456b, tree 8798dcfb21e7e860e932006e5c6bd5da253b9479, single parent
• 4 files +82/−4: plugins/social/client.js +17/−3, plugins/social/test/social-readonly.test.js +63, docs/subsystems/social.md +1/−1, changelog.d/2418-social-invite-readonly.fixed.md +1
• Tier T2 — risk-gate.mjs judge() over this diff: risk-tier: T2; basis: plugins/social/client.js=T2, plugins/social/test/social-readonly.test.js=T2, changelog.d/2418-social-invite-readonly.fixed.md=T1, docs/subsystems/social.md=T0
• checkpointReasons() run on this exact body + this exact file list against the live .github/scripts/enqueue-rules.mjs → [] (CHECKPOINT_SUMMARY_MAX = 600 present)
• Checks at this tip: 13 success + 1 cancelled + 1 failure — the cancelled one is agent-audience (its duplicate run; the live one is success), the failure is enqueue-guard: no Verifier report names the tip d608f2cb6918, which is what this comment is for. tests-ok, Node 24 · DSH 0.2.0-rc.2, merge-gate, plugins (tree|social|timeline|workflow), package, judge, policy-sign, risk tier all success.
• Non-draft, maintainer_can_modify: true, body opens with Fixes #2418

Request: a formal Verdict: PASS naming d608f2cb69186763672911ebb29554a8253b456b, plus whatever workflow runs you want at this tip. T2 needs the PASS on the current tip; a PASS on an earlier tip does not carry.

Evidence to re-run if you want it: red first on clean base dd9c5a05 with only the new test file in place — plugins/social/test/social-readonly.test.js 12 tests, 10 pass, 2 fail: not ok 9 (the Sharing card still drew mint-invite,share-with-friend,manage-access) and not ok 11 (the Members card still drew room-invite-mint); the two "a writable window keeps them" tests already pass at the base, so the file cannot go green by deleting the card. After the fix the same file is 12/12, and TZ=UTC ARCH_DOCS_BASE=dd9c5a05 npm run verify is exit 0 with 4836 pass / 0 fail / 0 cancelled (core 2844, social 574, tree 132, timeline 140, workflow 411, .github+policy 671/37, interop 26); arch-docs: OK (4 changed file(s)); node scripts/ds-bot-patches.mjs check exit 0 and generate twice with no diff (nothing under patches/ or core/client.js moved).

Scope note for the design read: read-only is readOnlyReason(roster) returning a string when roster.readOnly is set — the state the rest of the plugin already reads (#2219 notices, #2228 room overview, #2400 group overview). BotSocialDetails now passes roster through to OwnBotSharing, which renders one data-flybot="sharing-readonly" row carrying the window's own sentence instead of the invite maker / Share with a friend / People with access panels; LocalInviteRow({ room, roster }) renders one data-flybot="room-invite-readonly" row instead of the guest-invite row. A writable window draws exactly what it drew before; deciding this reads no file and opens nothing, and no new host call is added. docs/subsystems/social.md read-only paragraph now names the two cards.

[Birfy]

Verdict: PASS at d608f2c
Written-by: Reviewer
Attestation: d608f2c role=Reviewer

Ran at this tip:

$ cd plugins/social && node --import ./test/resolve.mjs --test test/social-readonly.test.js
# tests 12  # pass 12  # fail 0

Red first (base blob of plugins/social/client.js at dd9c5a05, same command): # tests 12 # pass 10 # fail 2 — not ok 9 Sharing still drew mint-invite,share-with-friend,manage-access, not ok 11 Members still drew room-invite-mint. Tip source restored and rerun green above.

Review points:

• Tip d608f2cb matches the tip the guard read; tests-ok, all four plugin suites, package, Node 24 and merge-gate are success. The only red is enqueue-guard, whose own output says no Verifier report names the tip d608f2cb6918 — this PASS is that report, so nothing else refuses it.
• plugins/social/client.js:1170 LocalInviteRow and :3506 OwnBotSharing both gate on readOnlyReason(roster) and draw a role="status" sentence instead of the write rows; a writable window takes the old path unchanged. roster reaches LocalInviteRow from the flybot.room.members host (core/src/client/flybot-slots.js:217 passes { room, roster, actions }) and BotSocialDetails now forwards it to OwnBotSharing, so the real path draws what the test mounts — no call site is left without it.
• The four new tests are on-topic (social: a read-only window still draws the Sharing card's and the group Members' invite entries #2418), two per card, and the writable-window halves already pass at the base, so the red is the missing guard, not a deleted card.
• docs/subsystems/social.md names both cards (+1/−1) and changelog.d/2418-social-invite-readonly.fixed.md exists; diff is 4 files, all inside the T2 path.
• Fork (HugoXK), so Owner:/Reviewer:/agent-pr are exempt and no push was attempted.

Not run: full npm run verify (4,836 tests) — outside this node's budget; the changed test file and its red-first are the gate, and CI tests-ok covers the rest at this tip.