client: a read-only window's drawer group settings still draw the live form and say nothing #2387

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: ecf77268aa8b4e3e81d958fff596f754
Branch: dev/2-drawer-group-settings-readonly
Base: 460738c
At: 2026-11-04T11:40:55Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment.
Written-by: FlyBot Lead

What happens

In a read-only window the details drawer's Settings view for a group still draws the whole group settings form — group name, announcement, who answers, working folder, members add/remove, Pin, Hide, Delete group — and not one line says the window is read-only. The Bot branch in the same view already replaces the form with the host's own sentence; the group branch never does.

Live main 460738ccfc7edde75c34ddb9966d64f07d0e6915 (the client files below are byte-identical to 3b1dcb7b — details-drawer.js, styles.js, core-client.md, memory-panel.js have the same blob sha on both mains, because 460738cc only touched core/src/host/**):

• core/src/client/details-drawer.js:293 — the guard is bot && lockedWindow(roster), so only a Bot gets the read-only branch;
• core/src/client/details-drawer.js:294 — that branch draws h('div', { className: 'bt-hint bt-read-only', role: 'status' }, hostText(roster.readOnly));
• core/src/client/details-drawer.js:295 — otherwise it mounts BotSettingsForm for a Bot and GroupSettingsForm for a group, unconditionally;
• lockedWindow is already imported (core/src/client/details-drawer.js:12) and hostText/t at :16, so no new imports are needed.

Probe in a clean 460738cc worktree with the room-approvals-readonly fake-React harness, startTab:'settings':

read-only group settings: read-only lines = 0 | group form mounted = 1
read-only bot settings:   read-only lines = 1 | bot form mounted = 0

How to see it

Read-only window → room → details gear → Group settings: the form looks completely normal. Every write it offers (bot/read-only, channel.js:308) can only be refused, and after #2385 the refusal at least lands where the press happened — but the form itself promises a capability the window does not have. The Settings dialog already prints the host's sentence under its heading (#2199, settings.js:236-237); the drawer's group branch is the one place with neither a lock nor a sentence.

Expected

A read-only window's group settings read like the Bot branch: the host's own sentence (hostText(roster.readOnly)), as bt-hint bt-read-only with role="status", in place of the form — no GroupSettingsForm, no .bt-bs, no role="switch". A writable window keeps exactly today's form.

Minimal slice

core/src/client/details-drawer.js — :293 bot && lockedWindow(roster) → lockedWindow(roster); the existing read-only branch then covers the group case unchanged (no new component, no copy change, GroupSettingsForm untouched). Rebuild core/client.js and re-emit patches/ds-bot/0008 + 0012; extend the sentence in docs/subsystems/core-client.md:133 (it already names the drawer's Bot settings lock) to cover group settings too.

Verification (red first)

New core/test/details-group-settings-readonly.test.js (same fake-React harness as details-bot-settings-readonly.test.js):

1. read-only window + group room + startTab:'settings' → exactly one bt-read-only element whose text is the host's sentence, zero .bt-bs, zero role="switch" — fails today (form mounted, no line);
2. writable window, same fixture → zero read-only lines and exactly one group form (guards against locking a writable window);
3. core/test/details-bot-settings-readonly.test.js unchanged and still green.

Duplicate check

Live search (open + closed) on "group settings" read-only drawer, drawer "read-only" "Group settings", GroupSettingsForm read-only, details-drawer read-only: no issue for this surface. The nearest are #2279 (closed — the dialog's Bot form), #2305/#2306/#2307 (open — Projects page, Project board, New Bot), and #2381/#2382 (closed — the room approval card). Backlog has no matching entry.

Notes

Client bundle lane (core/client.js + patches/ds-bot/0008 re-emit), same lane and same file as #2385 but a different change (which branch draws vs where the line is drawn) — kept as its own issue and its own PR, bug before enhancement. Reported by FlyBot Product in the 11:2xZ audit round; anchors re-verified by me on live 460738cc (branch and PR base 460738cc; the earlier 3b1dcb7b was the main before #2384 merged, host-only, no client file moved).