fix(staleness): skip auto-import when store is read-only (GH#1089)

Track whether the store was actually opened read-only (vs just requested)
since the fallback logic may change opts.ReadOnly. Use this to skip
auto-import in staleness checks - importing would fail anyway if the
store is read-only.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cmd/bd/main.go

@@ -76,8 +76,9 @@ var (
 	sandboxMode    bool
 	allowStale     bool          // Use --allow-stale: skip staleness check (emergency escape hatch)
 	noDb           bool          // Use --no-db mode: load from JSONL, write back after each command
-	readonlyMode   bool          // Read-only mode: block write operations (for worker sandboxes)
+	readonlyMode    bool          // Read-only mode: block write operations (for worker sandboxes)
-	lockTimeout    time.Duration // SQLite busy_timeout (default 30s, 0 = fail immediately)
+	storeIsReadOnly bool          // Track if store was opened read-only (for staleness checks)
+	lockTimeout     time.Duration // SQLite busy_timeout (default 30s, 0 = fail immediately)
 	profileEnabled bool
 	profileFile    *os.File
 	traceFile      *os.File
@@ -787,6 +788,10 @@ var rootCmd = &cobra.Command{
 			}
 		}
 
+		// Track final read-only state for staleness checks (GH#1089)
+		// opts.ReadOnly may have changed if read-only open failed and fell back
+		storeIsReadOnly = opts.ReadOnly
+
 		if err != nil {
 			// Check for fresh clone scenario
 			if handleFreshCloneError(err, beadsDir) {

cmd/bd/staleness.go

@@ -46,7 +46,8 @@ func ensureDatabaseFresh(ctx context.Context) error {
 	// Database is stale - auto-import to refresh (bd-9dao fix)
 	// For read-only commands running in --no-daemon mode, auto-import instead of
 	// returning an error. This allows commands like `bd show` to work after git pull.
-	if !noAutoImport {
+	// Skip auto-import if store is read-only - it can't write anyway (GH#1089)
+	if !noAutoImport && !storeIsReadOnly {
 		autoImportIfNewer()
 		return nil
 	}