Settings: a read-only window still draws the Projects write controls #2305

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: faf8973b62ac49a9a448bd905c808bff
Branch: dev/3-projects-readonly-writes
Base: 551375d
At: 2026-11-03T13:06:05Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment.

Written-by: FlyBot Lead

A read-only window still draws the Projects write controls. Found by FlyBot Product in its 13:2xZ audit, reproduced on live main 551375dda317e9686351441aad431fce400fddc7.

Repro

core/ on that tree, one probe file:

node --test test/readonly-projects-writes.test.js
PROBE_PROJECTS_WRITES {"readOnly":true,"page":["Project name","New Project","Unbind","Unbind"],"list":["Bind to Site","Unbind","Unbind"],"writeControls":7}
not ok 1 - a read-only window offers no write on the Projects page   (7 !== 0)
ok 2 - a writable window still offers them                            (same 7)

The writable control is there, so this is not "both sides draw nothing".

Why it happens

core/src/client/settings.js passes roster into the Settings pages (:246) and ProjectsPage accepts it (:315), but nothing reads it: the only readOnly read in the file is the Settings header sentence at :236-237. Neither ProjectsPage nor ProjectsList (:274-359) consults the lock, so the name input, New Project, the Bind to <name> control and every Unbind (both the row's and the bindings' one) are drawn in a window the host refuses: project-create and project-bind are both in core/test/readonly-window-reads.test.js's WRITES table (:123-127) and both are outside READS in channel.js (:233-236), refused at :305.

So the host is right and the page is wrong — the same shape #2199 fixed for the page sentence, #2264 for the menus and the schedules page's zero-task card.

Expected

In a read-only window the Projects page draws no write control: no name input, no New Project, no Bind to <name>, no Unbind, in either the project list or the bindings list. Open board and the project facts stay. A writable window is unchanged, byte for byte.

Scope (one slice, bundle lane)

• core/src/client/settings.js: ProjectsPage and ProjectsList read the existing lockedWindow(roster) helper (core/src/client/schedules.js:122, already imported by inbox.js, composer.js and details-drawer.js — no new predicate).
• core/test/project-settings-page.test.js: a read-only case asserting zero write controls plus a writable control case; red first on the clean base with only the test.
• core/client.js and patches/ds-bot/0003/0008/files/** regenerate via the normal chain; docs sentence in docs/subsystems/core-client.md; changelog.d/ fragment.

Dedupe

Searched live main for project-create/project-bind/lockedWindow and the issue tracker: no open issue covers this. #2199 (closed) is the read-only sentence on the panel, and its body says no write control is hidden; #1766 (closed) added the UI itself; #2279/#2276/#2273/#2284/#2302 are other pages; #1740 is Project write authorisation on the host, which is already enforced.