fix(#14): surface explicit writable diagnostics in API and read-only banner

src/lib/components/NetworkDiagram.svelte

@@ -73,7 +73,8 @@
 	let saveState: SaveState = 'saved';
 	let dataSourceLabel = jsonPath;
 	let writable = false;
-	let readOnlyNotice = 'Read-only deployment; changes are not persisted.';
+	const defaultReadOnlyNotice = 'Read-only deployment; changes are not persisted.';
+	let readOnlyNotice = defaultReadOnlyNotice;
 
 	let showEthernetLabels = false;
 	let diagramViewMode: DiagramViewMode = 'network';
@@ -401,6 +402,13 @@
 		return 'Unexpected error';
 	}
 
+	function resolveReadOnlyNotice(reason: string | null | undefined): string {
+		if (!reason) {
+			return defaultReadOnlyNotice;
+		}
+		return `Read-only: ${reason}`;
+	}
+
 	function createGraphStyles(theme: ThemeMode): cytoscape.Stylesheet[] {
 		const nodeText = theme === 'dark' ? '#e2e8f0' : '#1e293b';
 		const textOutline = theme === 'dark' ? '#0f172a' : '#f8fafc';
@@ -976,8 +984,12 @@
 			});
 
 			if (response.status === 403) {
+				const body = (await response.json().catch(() => ({}))) as {
+					error?: string;
+					writableReason?: string | null;
+				};
 				writable = false;
-				readOnlyNotice = 'Read-only deployment; changes are not persisted.';
+				readOnlyNotice = resolveReadOnlyNotice(body.writableReason ?? body.error ?? null);
 				saveState = 'unsaved';
 				return;
 			}
@@ -998,10 +1010,14 @@
 			const body = (await response.json()) as {
 				data: NetworkData;
 				writable: boolean;
+				writableReason?: string | null;
 				source: string;
 				updatedAt: string;
 			};
 			writable = body.writable;
+			readOnlyNotice = body.writable
+				? defaultReadOnlyNotice
+				: resolveReadOnlyNotice(body.writableReason);
 			dataSourceLabel = body.source;
 			lastSavedSnapshot = JSON.stringify(body.data);
 			networkData = cloneNetworkData(body.data);
@@ -1385,6 +1401,7 @@
 			const body = (await response.json()) as {
 				data: NetworkData;
 				writable: boolean;
+				writableReason?: string | null;
 				source: string;
 				updatedAt: string;
 			};
@@ -1396,6 +1413,9 @@
 				networkData = cloneNetworkData(validation.data);
 				ensureSelectedTargetValid();
 				writable = body.writable;
+				readOnlyNotice = body.writable
+					? defaultReadOnlyNotice
+					: resolveReadOnlyNotice(body.writableReason);
 				dataSourceLabel = body.source;
 				lastSavedSnapshot = JSON.stringify(networkData);
 				saveState = 'saved';
@@ -1414,6 +1434,7 @@
 				networkData = cloneNetworkData(fallbackData);
 				ensureSelectedTargetValid();
 				writable = false;
+				readOnlyNotice = 'Read-only: API unavailable; using bundled static data.';
 				dataSourceLabel = jsonPath;
 				lastSavedSnapshot = JSON.stringify(networkData);
 				saveState = 'saved';

src/lib/server/networkPersistence.ts

@@ -1,5 +1,6 @@
 import {
 	checkWritableState as checkWritableStateCore,
+	getWritableState as getWritableStateCore,
 	isWriteEnabled as isWriteEnabledCore,
 	readNetworkFile as readNetworkFileCore,
 	writeNetworkFile as writeNetworkFileCore
@@ -12,6 +13,11 @@ export interface NetworkFileMetadata {
 	updatedAt: string;
 }
 
+export interface WritableState {
+	writable: boolean;
+	reason: string | null;
+}
+
 export function isWriteEnabled(): boolean {
 	return isWriteEnabledCore();
 }
@@ -24,6 +30,10 @@ export async function writeNetworkFile(data: NetworkData): Promise<NetworkFileMe
 	return (await writeNetworkFileCore(data)) as NetworkFileMetadata;
 }
 
+export async function getWritableState(): Promise<WritableState> {
+	return (await getWritableStateCore()) as WritableState;
+}
+
 export async function checkWritableState(): Promise<boolean> {
 	return checkWritableStateCore();
 }

src/lib/shared/networkPersistenceCore.mjs

@@ -16,6 +16,7 @@ import path from 'node:path';
  * @typedef {{ machines: unknown[]; devices: unknown[] }} NetworkData
  * @typedef {{ source: string; updatedAt: string }} NetworkFileMetadata
  * @typedef {{ data: NetworkData } & NetworkFileMetadata} NetworkFileReadResult
+ * @typedef {{ writable: boolean; reason: string | null }} WritableState
  */
 
 const NETWORK_READ_ONLY = process.env.NETWORK_READ_ONLY === 'true';
@@ -43,6 +44,38 @@ export function isWriteEnabled() {
 	return !NETWORK_READ_ONLY;
 }
 
+/**
+ * @param {unknown} error
+ * @returns {string}
+ */
+function formatFileSystemErrorCode(error) {
+	if (error && typeof error === 'object' && 'code' in error && typeof error.code === 'string') {
+		return error.code;
+	}
+	return 'UNKNOWN';
+}
+
+/**
+ * @param {string} directory
+ * @param {string} label
+ * @returns {Promise<string | null>}
+ */
+async function assertDirectoryWritable(directory, label) {
+	try {
+		await mkdir(directory, { recursive: true });
+	} catch (error) {
+		return `${label} directory "${directory}" could not be created (${formatFileSystemErrorCode(error)}).`;
+	}
+
+	try {
+		await access(directory, constants.W_OK);
+	} catch (error) {
+		return `${label} directory "${directory}" is not writable (${formatFileSystemErrorCode(error)}).`;
+	}
+
+	return null;
+}
+
 /**
  * @param {string} dataFilePath
  * @returns {Promise<string>}
@@ -151,20 +184,62 @@ export async function writeNetworkFile(data) {
 }
 
 /**
- * @returns {Promise<boolean>}
+ * @returns {Promise<WritableState>}
  */
-export async function checkWritableState() {
+export async function getWritableState() {
 	if (!isWriteEnabled()) {
-		return false;
+		return {
+			writable: false,
+			reason: 'Writes disabled by NETWORK_READ_ONLY=true.'
+		};
 	}
 
 	const source = resolveDataFilePath();
 	const directory = path.dirname(source);
-	try {
-		await mkdir(directory, { recursive: true });
-		await access(directory, constants.W_OK);
-	} catch {
-		return false;
+	const dataDirectoryError = await assertDirectoryWritable(directory, 'Data');
+	if (dataDirectoryError) {
+		return {
+			writable: false,
+			reason: dataDirectoryError
+		};
 	}
-	return true;
+
+	const backupDirectory = resolveBackupDirectory();
+	const backupDirectoryError = await assertDirectoryWritable(backupDirectory, 'Backup');
+	if (backupDirectoryError) {
+		return {
+			writable: false,
+			reason: backupDirectoryError
+		};
+	}
+
+	try {
+		await access(source, constants.F_OK);
+	} catch {
+		return {
+			writable: true,
+			reason: null
+		};
+	}
+
+	try {
+		await access(source, constants.R_OK | constants.W_OK);
+	} catch (error) {
+		return {
+			writable: false,
+			reason: `Data file "${source}" exists but is not readable and writable (${formatFileSystemErrorCode(error)}).`
+		};
+	}
+
+	return {
+		writable: true,
+		reason: null
+	};
+}
+
+/**
+ * @returns {Promise<boolean>}
+ */
+export async function checkWritableState() {
+	return (await getWritableState()).writable;
 }