@yuneta/gobj-ui 5.14.2 → 5.15.0

package/README.md

@@ -430,6 +430,38 @@ Logical DOM classes: `JSON_VIEWER`, `JSON_TOOLBAR`, `JSON_SEARCH`, `JSON_TREE`,
 `JSON_ROW`, `JSON_KEY`, `JSON_VALUE`, `JSON_SUMMARY`, `JSON_COLLAPSED`,
 `JSON_TIME`. The gclass imports its own `c_yui_json.css`.
 
+### Read-only treedbs: `readonly`
+
+`C_YUI_TREEDB_TOPICS` takes a **`readonly`** attr, propagated to every topic it
+builds. It is not one more button flag: it is the STATE of the treedb and it
+beats each `with_*` flag at once, because a treedb whose tranger the yuno does
+not master answers **every** write with
+
+```
+ERROR -1: <yuno>: treedb '<name>' is READ-ONLY, this yuno is not the master of its tranger
+```
+
+(the yuno refuses since SDK 7.13.0), so offering the buttons anyway turns a
+fact into an error message per click. Ask the yuno which it is with
+`command-yuno id=<yuno> service=<treedb> command=treedb-info`, which answers
+`{treedb_name, master, schema_version, topics}` — and remember the flag is per
+TREEDB and is runtime state: a yuno is routinely the master of its
+`treedb_system_schema` and a replica of a data treedb it shares.
+
+What `readonly` takes away: the edition mode, the *new* / *delete* / *paste*
+buttons, the in-row edit icons, and the write half of the record form's toolbar
+(`copy` stays — reading a record includes taking it with you) with the cells not
+editable. The record form still OPENS: looking is the point of a replica.
+
+Two implementation notes worth keeping:
+
+- the decision lives in **`treedb_write_plan.js`** (pure, tested), not in five
+  `!readonly && with_x` expressions — five places to forget the sixth;
+- and the write **events** are refused as well, in both gclasses, with a
+  `log_error`. Hiding a button is not the same as refusing a write: an event can
+  still arrive from a keyboard path or a form that outlived the flag, and an
+  ignored write is exactly the behaviour this whole change exists to stop.
+
 ### C_YUI_TREEDB_SCHEMA — the treedb as a graph of topics (prototype)
 
 A landing view that draws a treedb as a **graph of topics** — one node per

package/dist/gobj-ui.cjs.js

@@ -14404,6 +14404,7 @@ var attrs_table$5 = [
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "system", 0, false, "Manage system topics (true) or user topics (false)"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_STRING, "tabs_style", 0, "is-toggle is-fullwidth", "Bulma tab styling"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "with_cards_landing", 0, false, "Land on a grid of topic cards (list->detail): a card opens its table, with the tabs bar + a back-to-grid button. Off = tabs only (legacy)."),
+	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "readonly", 0, false, "The whole treedb is read-only: every topic opens without its write affordances and the write events are refused. Set it when this yuno is not the MASTER of the treedb's tranger -- only the master can write, and the yuno answers 'READ-ONLY' to a write since SDK 7.13.0 (ask `treedb-info`)"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_JSON, "card_action_routes", 0, null, "Per-card hash-route templates {info, table, graph} with a {topic} placeholder (host-supplied, route-agnostic). Present ⇒ cards show 3 icon actions; absent ⇒ a single card that opens the table."),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_JSON, "landing_routes", 0, null, "Host-supplied hashes for the two landing sub-views {cards, schema}; the toggle navigates to them so the landing is URL-addressable (ROUTING.md). Absent ⇒ toggle flips in-view only (legacy)."),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_STRING, "base_route", 0, "", "This view's base route (host-supplied); used to declare its sub-routes (topics / info / schema) to the site map (ROUTING.md contributor)."),
@@ -15184,12 +15185,14 @@ function process_treedb_descs$1(gobj) {
 	let descs = (0, _yuneta_gobj_js.gobj_read_attr)(gobj, "descs");
 	let system = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "system");
 	let treedb_name = (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name");
+	let readonly = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "readonly");
 	for (const [key, desc] of Object.entries(descs)) {
 		if (system) {} else if (key.substring(0, 2) === "__") continue;
 		let kw_topic_form = {
 			subscriber: gobj,
-			with_new_button: true,
-			with_delete_button: true,
+			readonly,
+			with_new_button: !readonly,
+			with_delete_button: !readonly,
 			treedb_name,
 			topic_name: key,
 			desc
@@ -15494,6 +15497,19 @@ function request_print_tranger$1(gobj, path) {
 	}, gobj);
 	if (ret) (0, _yuneta_gobj_js.log_error)(ret);
 }
+/***************************************************************
+*  The last gate before a write leaves for the yuno. The per-topic
+*  children already hide their write buttons when the treedb is
+*  read-only, but the record events converge HERE, and this is the
+*  gclass that owns the treedb: a write that got this far on a replica
+*  would travel, be refused by the yuno, and come back as a toast --
+*  after the table had already drawn the row.
+***************************************************************/
+function refuse_if_readonly$1(gobj, event) {
+	if (!(0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "readonly")) return false;
+	(0, _yuneta_gobj_js.log_error)(`${(0, _yuneta_gobj_js.gobj_short_name)(gobj)}: ${event} refused, treedb '${(0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name")}' is READ-ONLY`);
+	return true;
+}
 /***************************
 *      Actions
 ***************************/
@@ -15766,6 +15782,7 @@ function ac_treedb_node_deleted$1(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_create_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name");
 	let topic_name = (0, _yuneta_gobj_js.gobj_read_attr)(src, "topic_name");
 	let record = kw.record;
@@ -15783,6 +15800,7 @@ function ac_create_record(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_update_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name");
 	let topic_name = (0, _yuneta_gobj_js.gobj_read_attr)(src, "topic_name");
 	let record = kw.record;
@@ -15799,6 +15817,7 @@ function ac_update_record(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_delete_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name");
 	let topic_name = (0, _yuneta_gobj_js.gobj_read_attr)(src, "topic_name");
 	let record = kw.record;
@@ -16086,6 +16105,68 @@ function yui_tabulator_relocalize(table, t) {
 	}
 }
 //#endregion
+//#region src/treedb_write_plan.js
+/***********************************************************************
+*          treedb_write_plan.js
+*
+*      Which write affordances a treedb topic offers.
+*
+*      Pure, so it can be tested without a DOM: the gclass turns the
+*      plan into buttons and columns, this decides the plan. Same split
+*      as form_toolbar_plan.js.
+*
+*      The rule it exists to state ONCE: `readonly` is not one more
+*      button flag, it is the STATE of the topic and it wins over all of
+*      them. A treedb whose tranger this yuno does not master answers
+*      every write with "READ-ONLY" (the yuno refuses since SDK 7.13.0),
+*      so offering the buttons anyway only turns a fact into an error
+*      message per click. Written as `!readonly && with_x` in five
+*      places it is five places to forget the sixth.
+*
+*          Copyright (c) 2026, ArtGins.
+*          All Rights Reserved.
+***********************************************************************/
+var READONLY_FORM_TOOLBAR = ["copy"];
+/***************************************************************
+*  plan_treedb_writes(flags) -> plan
+*
+*      flags   {readonly, with_edition_mode, with_new_button,
+*               with_delete_button, with_paste_button,
+*               with_in_row_edit_icons}
+*              Every with_* defaults to TRUE when absent, which is
+*              what the gclass attrs default to: a caller that sets
+*              nothing gets the toolbar this view always had.
+*
+*      plan    the same names without the `with_` prefix, plus
+*              `form_toolbar`: the list to hand C_YUI_FORM, or null
+*              to leave the form's own default alone.
+***************************************************************/
+function plan_treedb_writes(flags) {
+	let f = flags || {};
+	let readonly = !!f.readonly;
+	let want = (name) => {
+		return f[name] === void 0 ? true : !!f[name];
+	};
+	if (readonly) return {
+		readonly: true,
+		edition_mode: false,
+		new_button: false,
+		delete_button: false,
+		paste_button: false,
+		in_row_icons: false,
+		form_toolbar: READONLY_FORM_TOOLBAR.slice()
+	};
+	return {
+		readonly: false,
+		edition_mode: want("with_edition_mode"),
+		new_button: want("with_new_button"),
+		delete_button: want("with_delete_button"),
+		paste_button: want("with_paste_button"),
+		in_row_icons: want("with_in_row_edit_icons"),
+		form_toolbar: null
+	};
+}
+//#endregion
 //#region src/c_yui_treedb_topic_with_form.js
 /***********************************************************************
 *          c_yui_treedb_topic_with_form.js
@@ -16107,6 +16188,7 @@ var attrs_table$4 = [
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_STRING, "treedb_name", 0, null, "Remote service treedb name"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_STRING, "topic_name", 0, null, "Topic name"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_POINTER, "desc", 0, null, "Description of topics"),
+	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "readonly", 0, false, "The topic cannot be written: no edition mode, no new/delete/paste, no in-row icons, and the record form opens without its save toolbar. Set it when the treedb is not the master of its tranger (only the master can write; the yuno refuses otherwise), or when the user lacks the authz"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "with_edition_mode", 0, true, "Enable EDITION mode showing EDIT Button toolbar"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "with_new_button", 0, true, "Button toolbar NEW"),
 	(0, _yuneta_gobj_js.SDATA)(_yuneta_gobj_js.data_type_t.DTP_BOOLEAN, "with_delete_button", 0, true, "Button toolbar DELETE"),
@@ -16269,11 +16351,12 @@ async function readClipboard(gobj) {
 function build_ui$4(gobj) {
 	function create_table_toolbar() {
 		let $table_toolbar = [];
-		let with_edition_mode = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_edition_mode");
-		let with_new_button = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_new_button");
-		let with_delete_button = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_delete_button");
+		let plan = write_plan(gobj);
+		let with_edition_mode = plan.edition_mode;
+		let with_new_button = plan.new_button;
+		let with_delete_button = plan.delete_button;
 		let with_copy_button = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_copy_button");
-		let with_paste_button = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_paste_button");
+		let with_paste_button = plan.paste_button;
 		let toolbar_id = (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "toolbar_id");
 		if (with_edition_mode) {
 			$table_toolbar = (0, _yuneta_gobj_js.createElement2)(["div", {
@@ -16716,7 +16799,7 @@ function create_tabulator(gobj) {
 			"</button>"
 		].join("");
 	}
-	if ((0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_in_row_edit_icons")) columns.push({
+	if (write_plan(gobj).in_row_icons) columns.push({
 		field: "_operation",
 		title: "Op",
 		hozAlign: "center",
@@ -16995,15 +17078,17 @@ function open_form_dialog(gobj, mode, record) {
 		},
 		[]
 	]);
+	let form_plan = write_plan(gobj);
 	let form = (0, _yuneta_gobj_js.gobj_create_pure_child)("form_" + (0, _yuneta_gobj_js.clean_name)((0, _yuneta_gobj_js.gobj_name)(gobj)), "C_YUI_FORM", {
 		template: build_form_template(gobj),
 		record,
 		fkey_options: build_fkey_options(gobj),
 		form_mode: mode,
+		...form_plan.form_toolbar ? { toolbar: form_plan.form_toolbar } : {},
 		render_mode: "edit",
 		pkey: desc.pkey || "id",
 		topic_name,
-		editable: true,
+		editable: !form_plan.readonly,
 		$parent: $body
 	}, gobj);
 	priv.form = form;
@@ -17530,6 +17615,34 @@ function show_dropdown_popup_menu(gobj, x, y, items, callback) {
 	let $with_focus = $element.querySelector(".with-focus");
 	if ($with_focus) $with_focus.focus();
 }
+/***************************************************************
+*  A read-only topic refuses the write EVENTS too, not only their
+*  buttons. The buttons are gone, but an event can still arrive: a
+*  keyboard path, a hosted form that outlived the flag, a caller that
+*  sends EV_SAVE_RECORD itself. Refusing here is what makes `readonly`
+*  a state of the gclass rather than a way of drawing it -- and it
+*  fails LOUDLY, because an ignored write is how the backend used to
+*  behave and what this whole change exists to stop.
+***************************************************************/
+function write_plan(gobj) {
+	return plan_treedb_writes({
+		readonly: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "readonly"),
+		with_edition_mode: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_edition_mode"),
+		with_new_button: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_new_button"),
+		with_delete_button: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_delete_button"),
+		with_paste_button: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_paste_button"),
+		with_in_row_edit_icons: (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "with_in_row_edit_icons")
+	});
+}
+/***************************************************************
+*  A read-only topic refuses the write EVENTS too, not only their
+*  buttons.
+***************************************************************/
+function refuse_if_readonly(gobj, event) {
+	if (!(0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "readonly")) return false;
+	(0, _yuneta_gobj_js.log_error)(`${(0, _yuneta_gobj_js.gobj_short_name)(gobj)}: ${event} refused, topic '${(0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "topic_name")}' is READ-ONLY`);
+	return true;
+}
 /***************************
 *      Actions
 ***************************/
@@ -17622,6 +17735,7 @@ function ac_node_deleted$1(gobj, event, kw, src) {
 *      and the Op column is visible (with row's edit/delete icons)
 ************************************************************/
 function ac_edition_mode(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let tabulator = (0, _yuneta_gobj_js.gobj_read_attr)(gobj, "tabulator");
 	let editable = (0, _yuneta_gobj_js.gobj_read_bool_attr)(gobj, "editable");
 	editable = !editable;
@@ -17665,6 +17779,7 @@ function ac_edition_mode(gobj, event, kw, src) {
 *      - the backend will broadcast the new record that will be added to table
 ************************************************************/
 function ac_new_row(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let row = {};
 	let desc = (0, _yuneta_gobj_js.gobj_read_attr)(gobj, "desc");
 	for (let i = 0; i < desc.cols.length; i++) {
@@ -17694,6 +17809,7 @@ function ac_new_row(gobj, event, kw, src) {
 *          kw {index:, row:}
 ************************************************************/
 function ac_delete_rows(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let tabulator = (0, _yuneta_gobj_js.gobj_read_attr)(gobj, "tabulator");
 	if ((0, _yuneta_gobj_js.json_size)(kw) === 0) {
 		let rows = tabulator.getSelectedData();
@@ -17757,6 +17873,7 @@ function ac_copy_rows(gobj, event, kw, src) {
 *  From internal
 ************************************************************/
 function ac_paste_rows(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	if (kw.topic_name === (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "topic_name") && kw.treedb_name === (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "treedb_name")) for (let row of kw.rows) (0, _yuneta_gobj_js.gobj_publish_event)(gobj, "EV_CREATE_RECORD", {
 		topic_name: (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "topic_name"),
 		record: row
@@ -17769,6 +17886,7 @@ function ac_paste_rows(gobj, event, kw, src) {
 *  fkeys, times and numbers). Route by the form's mode.
 ************************************************************/
 function ac_form_save_record(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let mode = (0, _yuneta_gobj_js.gobj_read_str_attr)(src, "form_mode");
 	(0, _yuneta_gobj_js.gobj_publish_event)(gobj, mode === "create" ? "EV_CREATE_RECORD" : "EV_UPDATE_RECORD", {
 		topic_name: (0, _yuneta_gobj_js.gobj_read_str_attr)(gobj, "topic_name"),

package/dist/gobj-ui.es.js

@@ -14399,6 +14399,7 @@ var attrs_table$5 = [
 	SDATA(data_type_t.DTP_BOOLEAN, "system", 0, false, "Manage system topics (true) or user topics (false)"),
 	SDATA(data_type_t.DTP_STRING, "tabs_style", 0, "is-toggle is-fullwidth", "Bulma tab styling"),
 	SDATA(data_type_t.DTP_BOOLEAN, "with_cards_landing", 0, false, "Land on a grid of topic cards (list->detail): a card opens its table, with the tabs bar + a back-to-grid button. Off = tabs only (legacy)."),
+	SDATA(data_type_t.DTP_BOOLEAN, "readonly", 0, false, "The whole treedb is read-only: every topic opens without its write affordances and the write events are refused. Set it when this yuno is not the MASTER of the treedb's tranger -- only the master can write, and the yuno answers 'READ-ONLY' to a write since SDK 7.13.0 (ask `treedb-info`)"),
 	SDATA(data_type_t.DTP_JSON, "card_action_routes", 0, null, "Per-card hash-route templates {info, table, graph} with a {topic} placeholder (host-supplied, route-agnostic). Present ⇒ cards show 3 icon actions; absent ⇒ a single card that opens the table."),
 	SDATA(data_type_t.DTP_JSON, "landing_routes", 0, null, "Host-supplied hashes for the two landing sub-views {cards, schema}; the toggle navigates to them so the landing is URL-addressable (ROUTING.md). Absent ⇒ toggle flips in-view only (legacy)."),
 	SDATA(data_type_t.DTP_STRING, "base_route", 0, "", "This view's base route (host-supplied); used to declare its sub-routes (topics / info / schema) to the site map (ROUTING.md contributor)."),
@@ -15179,12 +15180,14 @@ function process_treedb_descs$1(gobj) {
 	let descs = gobj_read_attr(gobj, "descs");
 	let system = gobj_read_bool_attr(gobj, "system");
 	let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
+	let readonly = gobj_read_bool_attr(gobj, "readonly");
 	for (const [key, desc] of Object.entries(descs)) {
 		if (system) {} else if (key.substring(0, 2) === "__") continue;
 		let kw_topic_form = {
 			subscriber: gobj,
-			with_new_button: true,
-			with_delete_button: true,
+			readonly,
+			with_new_button: !readonly,
+			with_delete_button: !readonly,
 			treedb_name,
 			topic_name: key,
 			desc
@@ -15489,6 +15492,19 @@ function request_print_tranger$1(gobj, path) {
 	}, gobj);
 	if (ret) log_error(ret);
 }
+/***************************************************************
+*  The last gate before a write leaves for the yuno. The per-topic
+*  children already hide their write buttons when the treedb is
+*  read-only, but the record events converge HERE, and this is the
+*  gclass that owns the treedb: a write that got this far on a replica
+*  would travel, be refused by the yuno, and come back as a toast --
+*  after the table had already drawn the row.
+***************************************************************/
+function refuse_if_readonly$1(gobj, event) {
+	if (!gobj_read_bool_attr(gobj, "readonly")) return false;
+	log_error(`${gobj_short_name(gobj)}: ${event} refused, treedb '${gobj_read_str_attr(gobj, "treedb_name")}' is READ-ONLY`);
+	return true;
+}
 /***************************
 *      Actions
 ***************************/
@@ -15761,6 +15777,7 @@ function ac_treedb_node_deleted$1(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_create_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
 	let topic_name = gobj_read_attr(src, "topic_name");
 	let record = kw.record;
@@ -15778,6 +15795,7 @@ function ac_create_record(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_update_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
 	let topic_name = gobj_read_attr(src, "topic_name");
 	let record = kw.record;
@@ -15794,6 +15812,7 @@ function ac_update_record(gobj, event, kw, src) {
 *  }
 ********************************************/
 function ac_delete_record(gobj, event, kw, src) {
+	if (refuse_if_readonly$1(gobj, event)) return -1;
 	let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
 	let topic_name = gobj_read_attr(src, "topic_name");
 	let record = kw.record;
@@ -16081,6 +16100,68 @@ function yui_tabulator_relocalize(table, t) {
 	}
 }
 //#endregion
+//#region src/treedb_write_plan.js
+/***********************************************************************
+*          treedb_write_plan.js
+*
+*      Which write affordances a treedb topic offers.
+*
+*      Pure, so it can be tested without a DOM: the gclass turns the
+*      plan into buttons and columns, this decides the plan. Same split
+*      as form_toolbar_plan.js.
+*
+*      The rule it exists to state ONCE: `readonly` is not one more
+*      button flag, it is the STATE of the topic and it wins over all of
+*      them. A treedb whose tranger this yuno does not master answers
+*      every write with "READ-ONLY" (the yuno refuses since SDK 7.13.0),
+*      so offering the buttons anyway only turns a fact into an error
+*      message per click. Written as `!readonly && with_x` in five
+*      places it is five places to forget the sixth.
+*
+*          Copyright (c) 2026, ArtGins.
+*          All Rights Reserved.
+***********************************************************************/
+var READONLY_FORM_TOOLBAR = ["copy"];
+/***************************************************************
+*  plan_treedb_writes(flags) -> plan
+*
+*      flags   {readonly, with_edition_mode, with_new_button,
+*               with_delete_button, with_paste_button,
+*               with_in_row_edit_icons}
+*              Every with_* defaults to TRUE when absent, which is
+*              what the gclass attrs default to: a caller that sets
+*              nothing gets the toolbar this view always had.
+*
+*      plan    the same names without the `with_` prefix, plus
+*              `form_toolbar`: the list to hand C_YUI_FORM, or null
+*              to leave the form's own default alone.
+***************************************************************/
+function plan_treedb_writes(flags) {
+	let f = flags || {};
+	let readonly = !!f.readonly;
+	let want = (name) => {
+		return f[name] === void 0 ? true : !!f[name];
+	};
+	if (readonly) return {
+		readonly: true,
+		edition_mode: false,
+		new_button: false,
+		delete_button: false,
+		paste_button: false,
+		in_row_icons: false,
+		form_toolbar: READONLY_FORM_TOOLBAR.slice()
+	};
+	return {
+		readonly: false,
+		edition_mode: want("with_edition_mode"),
+		new_button: want("with_new_button"),
+		delete_button: want("with_delete_button"),
+		paste_button: want("with_paste_button"),
+		in_row_icons: want("with_in_row_edit_icons"),
+		form_toolbar: null
+	};
+}
+//#endregion
 //#region src/c_yui_treedb_topic_with_form.js
 /***********************************************************************
 *          c_yui_treedb_topic_with_form.js
@@ -16102,6 +16183,7 @@ var attrs_table$4 = [
 	SDATA(data_type_t.DTP_STRING, "treedb_name", 0, null, "Remote service treedb name"),
 	SDATA(data_type_t.DTP_STRING, "topic_name", 0, null, "Topic name"),
 	SDATA(data_type_t.DTP_POINTER, "desc", 0, null, "Description of topics"),
+	SDATA(data_type_t.DTP_BOOLEAN, "readonly", 0, false, "The topic cannot be written: no edition mode, no new/delete/paste, no in-row icons, and the record form opens without its save toolbar. Set it when the treedb is not the master of its tranger (only the master can write; the yuno refuses otherwise), or when the user lacks the authz"),
 	SDATA(data_type_t.DTP_BOOLEAN, "with_edition_mode", 0, true, "Enable EDITION mode showing EDIT Button toolbar"),
 	SDATA(data_type_t.DTP_BOOLEAN, "with_new_button", 0, true, "Button toolbar NEW"),
 	SDATA(data_type_t.DTP_BOOLEAN, "with_delete_button", 0, true, "Button toolbar DELETE"),
@@ -16264,11 +16346,12 @@ async function readClipboard(gobj) {
 function build_ui$4(gobj) {
 	function create_table_toolbar() {
 		let $table_toolbar = [];
-		let with_edition_mode = gobj_read_bool_attr(gobj, "with_edition_mode");
-		let with_new_button = gobj_read_bool_attr(gobj, "with_new_button");
-		let with_delete_button = gobj_read_bool_attr(gobj, "with_delete_button");
+		let plan = write_plan(gobj);
+		let with_edition_mode = plan.edition_mode;
+		let with_new_button = plan.new_button;
+		let with_delete_button = plan.delete_button;
 		let with_copy_button = gobj_read_bool_attr(gobj, "with_copy_button");
-		let with_paste_button = gobj_read_bool_attr(gobj, "with_paste_button");
+		let with_paste_button = plan.paste_button;
 		let toolbar_id = gobj_read_str_attr(gobj, "toolbar_id");
 		if (with_edition_mode) {
 			$table_toolbar = createElement2(["div", {
@@ -16711,7 +16794,7 @@ function create_tabulator(gobj) {
 			"</button>"
 		].join("");
 	}
-	if (gobj_read_bool_attr(gobj, "with_in_row_edit_icons")) columns.push({
+	if (write_plan(gobj).in_row_icons) columns.push({
 		field: "_operation",
 		title: "Op",
 		hozAlign: "center",
@@ -16990,15 +17073,17 @@ function open_form_dialog(gobj, mode, record) {
 		},
 		[]
 	]);
+	let form_plan = write_plan(gobj);
 	let form = gobj_create_pure_child("form_" + clean_name(gobj_name(gobj)), "C_YUI_FORM", {
 		template: build_form_template(gobj),
 		record,
 		fkey_options: build_fkey_options(gobj),
 		form_mode: mode,
+		...form_plan.form_toolbar ? { toolbar: form_plan.form_toolbar } : {},
 		render_mode: "edit",
 		pkey: desc.pkey || "id",
 		topic_name,
-		editable: true,
+		editable: !form_plan.readonly,
 		$parent: $body
 	}, gobj);
 	priv.form = form;
@@ -17525,6 +17610,34 @@ function show_dropdown_popup_menu(gobj, x, y, items, callback) {
 	let $with_focus = $element.querySelector(".with-focus");
 	if ($with_focus) $with_focus.focus();
 }
+/***************************************************************
+*  A read-only topic refuses the write EVENTS too, not only their
+*  buttons. The buttons are gone, but an event can still arrive: a
+*  keyboard path, a hosted form that outlived the flag, a caller that
+*  sends EV_SAVE_RECORD itself. Refusing here is what makes `readonly`
+*  a state of the gclass rather than a way of drawing it -- and it
+*  fails LOUDLY, because an ignored write is how the backend used to
+*  behave and what this whole change exists to stop.
+***************************************************************/
+function write_plan(gobj) {
+	return plan_treedb_writes({
+		readonly: gobj_read_bool_attr(gobj, "readonly"),
+		with_edition_mode: gobj_read_bool_attr(gobj, "with_edition_mode"),
+		with_new_button: gobj_read_bool_attr(gobj, "with_new_button"),
+		with_delete_button: gobj_read_bool_attr(gobj, "with_delete_button"),
+		with_paste_button: gobj_read_bool_attr(gobj, "with_paste_button"),
+		with_in_row_edit_icons: gobj_read_bool_attr(gobj, "with_in_row_edit_icons")
+	});
+}
+/***************************************************************
+*  A read-only topic refuses the write EVENTS too, not only their
+*  buttons.
+***************************************************************/
+function refuse_if_readonly(gobj, event) {
+	if (!gobj_read_bool_attr(gobj, "readonly")) return false;
+	log_error(`${gobj_short_name(gobj)}: ${event} refused, topic '${gobj_read_str_attr(gobj, "topic_name")}' is READ-ONLY`);
+	return true;
+}
 /***************************
 *      Actions
 ***************************/
@@ -17617,6 +17730,7 @@ function ac_node_deleted$1(gobj, event, kw, src) {
 *      and the Op column is visible (with row's edit/delete icons)
 ************************************************************/
 function ac_edition_mode(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let tabulator = gobj_read_attr(gobj, "tabulator");
 	let editable = gobj_read_bool_attr(gobj, "editable");
 	editable = !editable;
@@ -17660,6 +17774,7 @@ function ac_edition_mode(gobj, event, kw, src) {
 *      - the backend will broadcast the new record that will be added to table
 ************************************************************/
 function ac_new_row(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let row = {};
 	let desc = gobj_read_attr(gobj, "desc");
 	for (let i = 0; i < desc.cols.length; i++) {
@@ -17689,6 +17804,7 @@ function ac_new_row(gobj, event, kw, src) {
 *          kw {index:, row:}
 ************************************************************/
 function ac_delete_rows(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let tabulator = gobj_read_attr(gobj, "tabulator");
 	if (json_size(kw) === 0) {
 		let rows = tabulator.getSelectedData();
@@ -17752,6 +17868,7 @@ function ac_copy_rows(gobj, event, kw, src) {
 *  From internal
 ************************************************************/
 function ac_paste_rows(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	if (kw.topic_name === gobj_read_str_attr(gobj, "topic_name") && kw.treedb_name === gobj_read_str_attr(gobj, "treedb_name")) for (let row of kw.rows) gobj_publish_event(gobj, "EV_CREATE_RECORD", {
 		topic_name: gobj_read_str_attr(gobj, "topic_name"),
 		record: row
@@ -17764,6 +17881,7 @@ function ac_paste_rows(gobj, event, kw, src) {
 *  fkeys, times and numbers). Route by the form's mode.
 ************************************************************/
 function ac_form_save_record(gobj, event, kw, src) {
+	if (refuse_if_readonly(gobj, event)) return -1;
 	let mode = gobj_read_str_attr(src, "form_mode");
 	gobj_publish_event(gobj, mode === "create" ? "EV_CREATE_RECORD" : "EV_UPDATE_RECORD", {
 		topic_name: gobj_read_str_attr(gobj, "topic_name"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yuneta/gobj-ui",
-  "version": "5.14.2",
+  "version": "5.15.0",
   "type": "module",
   "main": "dist/gobj-ui.cjs.js",
   "module": "dist/gobj-ui.es.js",

package/src/c_yui_treedb_topic_with_form.js

@@ -76,6 +76,8 @@ import {yui_tabulator_lang, yui_tabulator_relocalize} from "./yui_tabulator_i18n
 
 import {t} from "i18next";
 
+import {plan_treedb_writes} from "./treedb_write_plan.js";
+
 import "./c_yui_treedb_topic_with_form.css";
 import "./tabulator.css";
 
@@ -97,6 +99,7 @@ SDATA(data_type_t.DTP_STRING,   "topic_name",           0,  null,   "Topic name"
 SDATA(data_type_t.DTP_POINTER,  "desc",                 0,  null,   "Description of topics"),
 
 /*---------------- Edition Mode ----------------*/
+SDATA(data_type_t.DTP_BOOLEAN,  "readonly",             0,  false,  "The topic cannot be written: no edition mode, no new/delete/paste, no in-row icons, and the record form opens without its save toolbar. Set it when the treedb is not the master of its tranger (only the master can write; the yuno refuses otherwise), or when the user lacks the authz"),
 SDATA(data_type_t.DTP_BOOLEAN,  "with_edition_mode",    0,  true,   "Enable EDITION mode showing EDIT Button toolbar"),
 SDATA(data_type_t.DTP_BOOLEAN,  "with_new_button",      0,  true,   "Button toolbar NEW"),
 SDATA(data_type_t.DTP_BOOLEAN,  "with_delete_button",   0,  true,   "Button toolbar DELETE"),
@@ -343,11 +346,16 @@ function build_ui(gobj)
         // TODO pon autorización, solo si está autorizado a modificar los datos!!!
         // TODO deja que estos botones se queden en el top cuando se hace scroll (clip ?)
         let $table_toolbar = [];
-        let with_edition_mode = gobj_read_bool_attr(gobj, "with_edition_mode");
-        let with_new_button = gobj_read_bool_attr(gobj, "with_new_button");
-        let with_delete_button = gobj_read_bool_attr(gobj, "with_delete_button");
+        /*  One plan decides every write affordance (treedb_write_plan.js):
+         *  `readonly` is the STATE of the topic and beats each with_* flag,
+         *  and stating that in five `!readonly &&` expressions is five places
+         *  to forget the sixth.  */
+        let plan = write_plan(gobj);
+        let with_edition_mode = plan.edition_mode;
+        let with_new_button = plan.new_button;
+        let with_delete_button = plan.delete_button;
         let with_copy_button = gobj_read_bool_attr(gobj, "with_copy_button");
-        let with_paste_button = gobj_read_bool_attr(gobj, "with_paste_button");
+        let with_paste_button = plan.paste_button;
 
         let toolbar_id = gobj_read_str_attr(gobj, "toolbar_id");
 
@@ -884,7 +892,7 @@ function create_tabulator(gobj)
         ].join('');
     }
 
-    let with_in_row_edit_icons = gobj_read_bool_attr(gobj, "with_in_row_edit_icons");
+    let with_in_row_edit_icons = write_plan(gobj).in_row_icons;
     if(with_in_row_edit_icons) {
         columns.push({
             field: '_operation',
@@ -1306,6 +1314,7 @@ function open_form_dialog(gobj, mode, record)
                  style: 'display:flex; flex-direction:column; height:100%;'}, []]
     );
 
+    let form_plan = write_plan(gobj);
     let form = gobj_create_pure_child(
         "form_" + clean_name(gobj_name(gobj)),
         "C_YUI_FORM",
@@ -1314,13 +1323,18 @@ function open_form_dialog(gobj, mode, record)
             record:         record,
             fkey_options:   build_fkey_options(gobj),
             form_mode:      mode,
+            /*  A read-only topic still OPENS its form -- looking at a record
+             *  is the point of a replica -- with the cells not editable and
+             *  the write half of the toolbar gone. A null plan leaves the
+             *  form's own default alone.  */
+            ...(form_plan.form_toolbar ? {toolbar: form_plan.form_toolbar} : {}),
             /*  Editing the raw topic record: structured cols
              *  (template / table / coordinates) are raw JSON editors,
              *  not interpreted into sub-widgets (the pre-merge behaviour). */
             render_mode:    "edit",
             pkey:           desc.pkey || "id",
             topic_name:     topic_name,
-            editable:       true,
+            editable:       !form_plan.readonly,
             $parent:        $body
         },
         gobj
@@ -2066,6 +2080,42 @@ function show_dropdown_popup_menu(gobj, x, y, items, callback)
 
 
 
+/***************************************************************
+ *  A read-only topic refuses the write EVENTS too, not only their
+ *  buttons. The buttons are gone, but an event can still arrive: a
+ *  keyboard path, a hosted form that outlived the flag, a caller that
+ *  sends EV_SAVE_RECORD itself. Refusing here is what makes `readonly`
+ *  a state of the gclass rather than a way of drawing it -- and it
+ *  fails LOUDLY, because an ignored write is how the backend used to
+ *  behave and what this whole change exists to stop.
+ ***************************************************************/
+function write_plan(gobj)
+{
+    return plan_treedb_writes({
+        readonly:               gobj_read_bool_attr(gobj, "readonly"),
+        with_edition_mode:      gobj_read_bool_attr(gobj, "with_edition_mode"),
+        with_new_button:        gobj_read_bool_attr(gobj, "with_new_button"),
+        with_delete_button:     gobj_read_bool_attr(gobj, "with_delete_button"),
+        with_paste_button:      gobj_read_bool_attr(gobj, "with_paste_button"),
+        with_in_row_edit_icons: gobj_read_bool_attr(gobj, "with_in_row_edit_icons")
+    });
+}
+
+/***************************************************************
+ *  A read-only topic refuses the write EVENTS too, not only their
+ *  buttons.
+ ***************************************************************/
+function refuse_if_readonly(gobj, event)
+{
+    if(!gobj_read_bool_attr(gobj, "readonly")) {
+        return false;
+    }
+    log_error(`${gobj_short_name(gobj)}: ${event} refused, topic ` +
+        `'${gobj_read_str_attr(gobj, "topic_name")}' is READ-ONLY`);
+    return true;
+}
+
+
                     /***************************
                      *      Actions
                      ***************************/
@@ -2242,6 +2292,9 @@ function ac_node_deleted(gobj, event, kw, src)
  ************************************************************/
 function ac_edition_mode(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let tabulator = gobj_read_attr(gobj, "tabulator");
 
     /*
@@ -2307,6 +2360,9 @@ function ac_edition_mode(gobj, event, kw, src)
  ************************************************************/
 function ac_new_row(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     /*
      *  Build default values. TODO no debería estar en desc configuration?
      */
@@ -2352,6 +2408,9 @@ function ac_new_row(gobj, event, kw, src)
  ************************************************************/
 function ac_delete_rows(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let tabulator = gobj_read_attr(gobj, "tabulator");
 
     if(json_size(kw) === 0) {
@@ -2451,6 +2510,9 @@ function ac_copy_rows(gobj, event, kw, src)
  ************************************************************/
 function ac_paste_rows(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     /*----------------------------*
      *  Paste rows
      *----------------------------*/
@@ -2478,6 +2540,9 @@ function ac_paste_rows(gobj, event, kw, src)
  ************************************************************/
 function ac_form_save_record(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let mode = gobj_read_str_attr(src, "form_mode");
     gobj_publish_event(
         gobj,

package/src/c_yui_treedb_topics.js

@@ -77,6 +77,7 @@ SDATA(data_type_t.DTP_JSON,     "descs",            0,  null,   "Description of
 SDATA(data_type_t.DTP_BOOLEAN,  "system",           0,  false,  "Manage system topics (true) or user topics (false)"),
 SDATA(data_type_t.DTP_STRING,   "tabs_style",       0,  "is-toggle is-fullwidth", "Bulma tab styling"),
 SDATA(data_type_t.DTP_BOOLEAN,  "with_cards_landing",0, false,  "Land on a grid of topic cards (list->detail): a card opens its table, with the tabs bar + a back-to-grid button. Off = tabs only (legacy)."),
+SDATA(data_type_t.DTP_BOOLEAN,  "readonly",         0,  false,  "The whole treedb is read-only: every topic opens without its write affordances and the write events are refused. Set it when this yuno is not the MASTER of the treedb's tranger -- only the master can write, and the yuno answers 'READ-ONLY' to a write since SDK 7.13.0 (ask `treedb-info`)"),
 SDATA(data_type_t.DTP_JSON,     "card_action_routes",0, null,   "Per-card hash-route templates {info, table, graph} with a {topic} placeholder (host-supplied, route-agnostic). Present ⇒ cards show 3 icon actions; absent ⇒ a single card that opens the table."),
 SDATA(data_type_t.DTP_JSON,     "landing_routes",   0,  null,   "Host-supplied hashes for the two landing sub-views {cards, schema}; the toggle navigates to them so the landing is URL-addressable (ROUTING.md). Absent ⇒ toggle flips in-view only (legacy)."),
 SDATA(data_type_t.DTP_STRING,   "base_route",       0,  "",     "This view's base route (host-supplied); used to declare its sub-routes (topics / info / schema) to the site map (ROUTING.md contributor)."),
@@ -997,6 +998,7 @@ function process_treedb_descs(gobj)
     let descs = gobj_read_attr(gobj, "descs");
     let system = gobj_read_bool_attr(gobj, "system");
     let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
+    let readonly = gobj_read_bool_attr(gobj, "readonly");
     for(const [key, desc] of Object.entries(descs)) {
         if(system) {
         } else {
@@ -1008,10 +1010,13 @@ function process_treedb_descs(gobj)
         let kw_topic_form = {
             subscriber: gobj,  // HACK get all output events
 
-            // TODO set according the authz
-            //with_edit_button: true,
-            with_new_button: true,
-            with_delete_button: true,
+            /*  One flag, not three: a read-only treedb has no writable
+             *  topic. (The old TODO here asked for the authz to decide the
+             *  buttons; the authz is a per-user question the backend answers
+             *  per command, while this is a property of the STORE.)  */
+            readonly: readonly,
+            with_new_button: !readonly,
+            with_delete_button: !readonly,
 
             treedb_name: treedb_name,
             topic_name: key,
@@ -1619,6 +1624,25 @@ function request_print_tranger(gobj, path)
 
 
 
+/***************************************************************
+ *  The last gate before a write leaves for the yuno. The per-topic
+ *  children already hide their write buttons when the treedb is
+ *  read-only, but the record events converge HERE, and this is the
+ *  gclass that owns the treedb: a write that got this far on a replica
+ *  would travel, be refused by the yuno, and come back as a toast --
+ *  after the table had already drawn the row.
+ ***************************************************************/
+function refuse_if_readonly(gobj, event)
+{
+    if(!gobj_read_bool_attr(gobj, "readonly")) {
+        return false;
+    }
+    log_error(`${gobj_short_name(gobj)}: ${event} refused, treedb ` +
+        `'${gobj_read_str_attr(gobj, "treedb_name")}' is READ-ONLY`);
+    return true;
+}
+
+
                     /***************************
                      *      Actions
                      ***************************/
@@ -2051,6 +2075,9 @@ function ac_treedb_node_deleted(gobj, event, kw, src)
  ********************************************/
 function ac_create_record(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
     let topic_name = gobj_read_attr(src, "topic_name");
     let record = kw.record;
@@ -2079,6 +2106,9 @@ function ac_create_record(gobj, event, kw, src)
  ********************************************/
 function ac_update_record(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
     let topic_name = gobj_read_attr(src, "topic_name");
     let record = kw.record;
@@ -2106,6 +2136,9 @@ function ac_update_record(gobj, event, kw, src)
  ********************************************/
 function ac_delete_record(gobj, event, kw, src)
 {
+    if(refuse_if_readonly(gobj, event)) {
+        return -1;      /*  Error already logged  */
+    }
     let treedb_name = gobj_read_str_attr(gobj, "treedb_name");
     let topic_name = gobj_read_attr(src, "topic_name");
     let record = kw.record;

package/src/treedb_write_plan.js

@@ -0,0 +1,73 @@
+/***********************************************************************
+ *          treedb_write_plan.js
+ *
+ *      Which write affordances a treedb topic offers.
+ *
+ *      Pure, so it can be tested without a DOM: the gclass turns the
+ *      plan into buttons and columns, this decides the plan. Same split
+ *      as form_toolbar_plan.js.
+ *
+ *      The rule it exists to state ONCE: `readonly` is not one more
+ *      button flag, it is the STATE of the topic and it wins over all of
+ *      them. A treedb whose tranger this yuno does not master answers
+ *      every write with "READ-ONLY" (the yuno refuses since SDK 7.13.0),
+ *      so offering the buttons anyway only turns a fact into an error
+ *      message per click. Written as `!readonly && with_x` in five
+ *      places it is five places to forget the sixth.
+ *
+ *          Copyright (c) 2026, ArtGins.
+ *          All Rights Reserved.
+ ***********************************************************************/
+
+/*  What a read-only form keeps: reading a record includes taking it with
+ *  you, so `copy` stays and the write half goes.  */
+const READONLY_FORM_TOOLBAR = ["copy"];
+
+
+/***************************************************************
+ *  plan_treedb_writes(flags) -> plan
+ *
+ *      flags   {readonly, with_edition_mode, with_new_button,
+ *               with_delete_button, with_paste_button,
+ *               with_in_row_edit_icons}
+ *              Every with_* defaults to TRUE when absent, which is
+ *              what the gclass attrs default to: a caller that sets
+ *              nothing gets the toolbar this view always had.
+ *
+ *      plan    the same names without the `with_` prefix, plus
+ *              `form_toolbar`: the list to hand C_YUI_FORM, or null
+ *              to leave the form's own default alone.
+ ***************************************************************/
+function plan_treedb_writes(flags)
+{
+    let f = flags || {};
+    let readonly = !!f.readonly;
+    let want = (name) => {
+        return (f[name] === undefined) ? true : !!f[name];
+    };
+
+    if(readonly) {
+        return {
+            readonly:      true,
+            edition_mode:  false,
+            new_button:    false,
+            delete_button: false,
+            paste_button:  false,
+            in_row_icons:  false,
+            form_toolbar:  READONLY_FORM_TOOLBAR.slice()
+        };
+    }
+
+    return {
+        readonly:      false,
+        edition_mode:  want("with_edition_mode"),
+        new_button:    want("with_new_button"),
+        delete_button: want("with_delete_button"),
+        paste_button:  want("with_paste_button"),
+        in_row_icons:  want("with_in_row_edit_icons"),
+        form_toolbar:  null
+    };
+}
+
+
+export {plan_treedb_writes, READONLY_FORM_TOOLBAR};

package/src/treedb_write_plan.test.js

@@ -0,0 +1,83 @@
+/***********************************************************************
+ *          treedb_write_plan.test.js
+ *
+ *      What a read-only treedb topic must NOT offer, pinned.
+ *
+ *      The point of the file under test is that one flag beats five, so
+ *      these tests are mostly about the ways someone could get a write
+ *      affordance back by accident.
+ ***********************************************************************/
+import { describe, test, expect } from "vitest";
+import { plan_treedb_writes, READONLY_FORM_TOOLBAR } from "./treedb_write_plan.js";
+
+const WRITES = ["edition_mode", "new_button", "delete_button", "paste_button", "in_row_icons"];
+
+
+describe("writable (the default)", () => {
+    test("nothing set is everything on — the toolbar this view always had", () => {
+        const plan = plan_treedb_writes({});
+        for(const k of WRITES) {
+            expect(plan[k]).toBe(true);
+        }
+        expect(plan.readonly).toBe(false);
+    });
+
+    test("an absent flags object behaves the same", () => {
+        expect(plan_treedb_writes(undefined).new_button).toBe(true);
+        expect(plan_treedb_writes(null).delete_button).toBe(true);
+    });
+
+    test("the form keeps its OWN default toolbar (null, not a copy of it)", () => {
+        /*  Repeating the five names here is how the default drifts from
+         *  C_YUI_FORM's; null says "do not touch it".  */
+        expect(plan_treedb_writes({}).form_toolbar).toBe(null);
+    });
+
+    test("a single with_* off turns off only that one", () => {
+        const plan = plan_treedb_writes({with_delete_button: false});
+        expect(plan.delete_button).toBe(false);
+        expect(plan.new_button).toBe(true);
+        expect(plan.edition_mode).toBe(true);
+    });
+});
+
+
+describe("readonly beats every with_*", () => {
+    test("all write affordances off, even when each is explicitly asked for", () => {
+        const plan = plan_treedb_writes({
+            readonly:               true,
+            with_edition_mode:      true,
+            with_new_button:        true,
+            with_delete_button:     true,
+            with_paste_button:      true,
+            with_in_row_edit_icons: true
+        });
+        for(const k of WRITES) {
+            expect(plan[k]).toBe(false);
+        }
+    });
+
+    test("the form opens with copy only — reading includes taking the record", () => {
+        expect(plan_treedb_writes({readonly: true}).form_toolbar).toEqual(["copy"]);
+    });
+
+    test("the plan hands out a COPY of the toolbar, so a caller cannot mutate the constant", () => {
+        const plan = plan_treedb_writes({readonly: true});
+        plan.form_toolbar.push("save");
+        expect(READONLY_FORM_TOOLBAR).toEqual(["copy"]);
+        expect(plan_treedb_writes({readonly: true}).form_toolbar).toEqual(["copy"]);
+    });
+
+    test("readonly is reported, so the gclass can refuse the EVENTS too", () => {
+        /*  Hiding the buttons is not the same as refusing the write: an
+         *  event can still arrive from a keyboard path or a stale form.  */
+        expect(plan_treedb_writes({readonly: true}).readonly).toBe(true);
+    });
+
+    test("only a truthy readonly counts — a missing flag is writable", () => {
+        expect(plan_treedb_writes({readonly: false}).new_button).toBe(true);
+        expect(plan_treedb_writes({readonly: 0}).new_button).toBe(true);
+        expect(plan_treedb_writes({readonly: undefined}).new_button).toBe(true);
+        expect(plan_treedb_writes({readonly: "yes"}).new_button).toBe(false);
+    });
+});