[Birfy]

Written-by: Dev
Fixes #2248

Owner: Chief
Reviewer: Reviewer
Tier: T1
Branch: dev/2248-readonly-task-board
Base: 03a1253
Tip SHA: 0bb21f6

The defect

The task board behind KanbanDialog (core/src/client/kanban.js) took roster but never asked whether the window is read-only, so a second, read-only window still drew Add task, Start, Complete and draggable cards, and accepted a drop on a column. The host refused each write (bot/read-only) and the board said nothing, so every control there was a dead line — P-455, the same family already closed on the sidebar / context-menu / other surfaces (#2215 #2221 #2223 #2233 #2236 #2239).

Red first

Clean tree at base 8f5107cdcb876a1774187e325e150797c5577253 with only core/test/kanban.test.js carrying the two new cases (base sources):

• node --test core/test/kanban.test.js → 28 tests / 27 pass / 1 fail
  • not ok 27 - P-455: a read-only window draws no write on the task board — actual {buttons:['Add task','Start','Complete'], newTaskForms:1, draggable:['task-open123456','task-working456789','task-done789012']} vs expected {buttons:[], newTaskForms:0, draggable:[]}.
  • ok 28 - counter-proof: a writable board keeps all four writes — green on the base by design, so a fix cannot pass by deleting the controls outright.
• Fixture: a writable roster (readOnly absent) and the same roster with readOnly: 'This window is read-only.' over one board with three cards.

The fix

KanbanDialog reads the lock once, with the predicate the sidebar already uses (sidebar.js:371: a non-empty string), and passes it down:

const locked = typeof roster?.readOnly === 'string' && roster.readOnly.trim() !== ''

• BoardView → no Add task form when locked; passes locked to every BoardColumn.
• BoardColumn → no onDragOver/onDrop effect when locked (a drop runs no onMove, so no taskUpdate).
• BoardCard via cardProps → movable: !locked && canMoveTask(...), so no card is draggable and Start/Complete are not drawn.
• move() and create() return early when locked — the write entries refuse even if a caller reaches them.
• Readable board unchanged: rail, three columns, cards, archive page, Done stamps stay.

Delta, file by file

file	+/-	kind
core/src/client/kanban.js	+19/−13	written
core/test/kanban.test.js	+71/−2	written (two cases)
docs/subsystems/core-client.md	+1/−1	written
changelog.d/2248-readonly-task-board.fixed.md	+1	written (new)
core/client.js	+18/−12	generated (build-client)
patches/ds-bot/0008-client-bundle.patch	+1/−13	generated
patches/ds-bot/files/src/client/kanban.js	+19/−13	generated (copy)
patches/ds-bot/files/test/kanban.test.js	+71/−2	generated (copy)
total	+201/−56	8 files

Generated by node scripts/ds-bot-patches.mjs generate (run on the tip tree) and compared file by file against the tip; no hand-merged conflict. node core/scripts/build-client.mjs --check → exit 0; node scripts/ds-bot-patches.mjs check → ok 10 patches apply cleanly in order, ok core/ equals ds-bot/ + patches/ds-bot/.

What I ran, at tree 0bb21f646de45f550ebc417e9c70d2ac11eae1a2 (replayed onto main 03a125306226158ae13c1b3a1185e4db30c7ca67)

• node --test core/test/kanban.test.js → 28 / 28 / 0, including P-455: a read-only window draws no write on the task board and counter-proof: a writable board keeps all four writes.
• node --test core/test/dialog-focus.test.js → 3 / 3 / 0 — client: Settings takes focus when it opens and returns it to the opener (#2251) #2262's Settings-dialog focus is still in the regenerated bundle.
• npm --prefix core test, run the way CI runs it (DSH_HARNESS=core/dev/harness, TZ=UTC) → 2680 tests, 2677 pass, 3 fail, and every red is this box, not the change: check-arch-docs.test.js:39 needs a git checkout (green once a local repo exists), check-arch-docs.test.js:73 needs an executable /tmp (this box mounts /tmp noexec), and usage-fields.test.js:88 shells out to python3, which this box does not have. No kanban/client test is red.
• node core/scripts/build-client.mjs --check → exit 0; node scripts/ds-bot-patches.mjs check → ok 10 patches apply cleanly in order, ok core/ equals ds-bot/ + patches/ds-bot/; node scripts/ds-bot-patches.mjs generate on the merged tree → no-op against what is committed.
• npm run verify could not finish here: the box ran out of threads (pthread_create: Resource temporarily unavailable) and the tarball-only checkout has no 4a9d3edd object for the arch-docs step. CI is the reference for the full chain.

The replay

#2262 and #2263 landed after this tip was cut and both touch generated files, so update-branch was refused (422 merge conflict between base and head). The branch was replayed onto 03a125306226158ae13c1b3a1185e4db30c7ca67: core/src/client/kanban.js, core/test/kanban.test.js and the changelog fragment came over as written; docs/subsystems/core-client.md is a semantic merge (main's #2251 bullet plus this PR's kanban row); every generated file was regenerated, never hand-merged — core/client.js, patches/ds-bot/0008-client-bundle.patch, patches/ds-bot/files/src/client/kanban.js, patches/ds-bot/files/test/kanban.test.js. Against main's tree the branch differs in exactly these 8 files, 0008 differs only by the read-only gate (cardProps / BoardColumn / BoardView locked), and #2262's overlay-hooks / dialog-focus bundle changes are intact.

Tier, by path

createGate(risk-rules).judge(files) over exactly these 8 paths: core/src/client/kanban.js=T1, core/test/kanban.test.js=T1, core/client.js=T1, patches/**=T1, changelog.d/**=T1, docs/**=T0 → T1, 62 changed lines in 4 written files (201 lines over 8 with generated ones).

Checkpoint

{
"pr": 2261,
"claim": "Chief",
"issue": 2248,
"summary": "A read-only window no longer draws task-board writes the host would refuse. KanbanDialog reads roster.readOnly once and hands the lock to BoardView, BoardColumn and BoardCard, so the Add task form, Start, Complete and draggable are gone, a drop runs no move, and move/create return early. The rail, the three columns, the cards, the archive page and the Done stamps stay readable. A writable window keeps all four writes, which the counter-proof test pins.",
"files": [
"core/src/client/kanban.js",
"core/test/kanban.test.js",
"docs/subsystems/core-client.md",
"changelog.d/2248-readonly-task-board.fixed.md",
"core/client.js",
"patches/ds-bot/0008-client-bundle.patch",
"patches/ds-bot/files/src/client/kanban.js",
"patches/ds-bot/files/test/kanban.test.js"
],
"checks": {
"ran": "node --test core/test/kanban.test.js (28/28/0); node --test core/test/dialog-focus.test.js (3/3/0); npm --prefix core test as CI runs it (2677/2680; 3 environmental reds: no git checkout, noexec /tmp, no python3); build-client --check; ds-bot-patches check + generate (no-op)",
"result": "green",
"at": "0bb21f646de45f550ebc417e9c70d2ac11eae1a2"
},
"next": "CI full suite on the replayed tip; T1 enqueues with no PASS once tests-ok and Node 24 are green."
}

[Birfy]

Checkpoint summary rewritten to four sentences after the first enqueue-guard read (that run read the body before the edit; the gate re-reads at queue entry). All other checks at 890e47a947ee80cefb246a0b2eb4705bc0c9e5e2 are green: tests-ok, package, plugins (social/tree/timeline/workflow), agent-audience, merge-gate.