client: a locked Bot card with no tasks draws no heading - #2298

…2299)

Fixes ThinkFlowLab#2284
Written-by: Dev1
Owner: Dev1
Reviewer: Birfy
Claim-Id: fdf1298faa3542aea854e775ae0e4364
Branch: dev/1-inbox-readonly-actions
Base: 5d6193a
Tree: 2a61cce
Verified commit: 922a2acb6239f703f8a96675df87f467614dc133
Pushed head: 8dbfc9d

## Scope

A read-only window's Inbox drew the whole *Needs you* action set, and
every one of those actions is a write the host refuses with
`bot/read-only`: answering a question (`answer-question`), the task
input (`task-answer-input`), **Accept** (`task-accept-result`) and
**Send back** (`task-send-back`). The rows and their **Open** action
stay; the four writes are not drawn, and one sentence at the top of the
dialog carries the host's own read-only words (the same `bt-read-only`
`role="status"` hint the Settings header, the sidebar, the schedule page
and the boards draw). An **Approval** card keeps **Reject** and
**Allow**: `approval-answer` is one of the reads a read-only channel
allows, so it is not part of this defect. A writable window — including
a blank or missing `readOnly` — draws exactly the tree it drew before,
pinned by a sha256 of the fixture.

The gate is `lockedWindow` imported from `schedules.js` (ThinkFlowLab#2232/ThinkFlowLab#2298);
no second copy of the predicate. The card builds its write block with a
spread so the writable children list is byte-for-byte the same, and the
dialog's hint is added the same way.

Changed files (8, +345/−10):

- `core/src/client/inbox.js` (+10/−2) — import `lockedWindow`; `locked`
in `InboxCard` and `InboxDialog`; the two write components are drawn
only when unlocked; one hint line at the top of the dialog body
- `core/test/inbox-readonly.test.js` (new, +157) — six cases: the three
locked cards (result, question, task input), the locked dialog's one
hint, the approval reverse, and the writable reverse with the recorded
tree hash
- `core/client.js` (+4/−2) — regenerated by `npm run build`
- `patches/ds-bot/0008-client-bundle.patch` (+5/−3),
`patches/ds-bot/files/src/client/inbox.js` (+10/−2),
`patches/ds-bot/files/test/inbox-readonly.test.js` (new, +157) —
regenerated by `node scripts/ds-bot-patches.mjs generate`
- `docs/subsystems/core-client.md` (+1/−1) — the `inbox.js` subsystem
row
- `changelog.d/2284-inbox-readonly-actions.fixed.md` (new, +1)

## Red first, on the new base `5d6193a0`

With only `core/test/inbox-readonly.test.js` added to the clean base
tree: **6 tests / 2 pass / 4 fail**. The four reds are the writes and
the hint; the two greens are the reverses that must not move.

- `inbox-readonly.test.js:111` — result card: expected `["Open"]`,
actual `["Send back","Accept","Open"]`
- `inbox-readonly.test.js:115` — question card: expected `["Open"]`,
actual `["A","B","Submit","Open"]`
- `inbox-readonly.test.js:121` — task input: expected `["Open"]`, actual
`["Submit","Open"]`
- `inbox-readonly.test.js:127` — dialog: expected 1 `bt-read-only`
`role="status"` line carrying the lock text, actual `0`
- Green before and after: an approval keeps `["Reject","Allow
once","Always allow for this Bot","Always allow for this
group","Open"]`; a writable window keeps `["Send
back","Accept","Open"]`, `["A","B","Submit","Open"]`,
`["Submit","Open"]` and its recorded tree sha256
`b19823e6ca04389a3325e312aaf4807b84b55b882a255c3546d15c9c8ec23d41` /
3088 bytes.

After the fix the file is **6/6/0**.

## Gates at this tip

- `node core/scripts/build-client.mjs --check` — silent, exit 0
- `node scripts/ds-bot-patches.mjs generate` twice; the second pass
writes nothing (sha256 of every `patches/ds-bot/**` file plus
`core/client.js` identical before and after)
- `node scripts/ds-bot-patches.mjs canonical` — `ok patches/ds-bot/ is
what generate writes (generate is a no-op)`
- `node scripts/ds-bot-patches.mjs check` — three `ok` lines (`ds-bot/`
= the pin; 10 patches apply cleanly in order; `core/` equals `ds-bot/` +
`patches/ds-bot/`)
- `TZ=UTC ARCH_DOCS_BASE=5d6193a06b8a4cae2b650b1ee6d7d0cd6baf4dcb npm
run verify` — exit 0, 8 suites, **4664 tests / 4664 pass / 0 fail**:
core 2715 (clean base 2709 + the 6 new cases), social 570, tree 132,
timeline 140, workflow 411, `.github/scripts` 633, interop 37, live-e2e
26; lint 74/36/9/2/16/0 warnings, **0 errors** in every package;
`arch-docs: OK (8 changed file(s))`

Not run: the smoke test (this changes no `core/index.js` or
`core/src/host/` file), and the CI `package` job's own extras (pack
check, typecheck, actionlint) which `verify` does not include.

## Checkpoint

<!-- flybot:checkpoint -->
```json
{
 "pr": 2299,
 "claim": "Dev1",
 "issue": 2284,
 "summary": "A read-only window's Inbox drew the whole Needs-you action set, and the host refuses every one of those writes with bot/read-only. The four writes (answer a question, the task input, Accept, Send back) are no longer drawn when the window is locked, and the dialog carries the same bt-read-only hint the Settings header and boards draw. Rows and Open stay, and an Approval keeps Reject and Allow because approval-answer is one of the reads a read-only channel allows. A writable window draws exactly the tree it drew before, pinned by a fixture sha256.",
 "files": [
  "core/src/client/inbox.js",
  "core/test/inbox-readonly.test.js",
  "docs/subsystems/core-client.md"
 ],
 "checks": {
  "ran": "TZ=UTC ARCH_DOCS_BASE=5d6193a0 npm run verify; node core/scripts/build-client.mjs --check; node scripts/ds-bot-patches.mjs check; CI at this tip: tests-ok, Node 24, plugins, package, merge-gate",
  "result": "green",
  "at": "8dbfc9dee7b9c33e9d4f5247b951e2f228c9891e"
 },
 "next": "none — T1, PASS at this tip, green tests-ok; enqueue through the merge queue"
}
```
<!-- /flybot:checkpoint -->