working epics ioc and tested

internal/datasource/epics/epics.go

@@ -342,10 +342,10 @@ func (e *EPICS) GetMetadata(ctx context.Context, signal string) (datasource.Meta
 
 // fetchMetadata retrieves metadata from a connected chid using ca_get.
 func (e *EPICS) fetchMetadata(chid C.chid, name string) datasource.Metadata {
-	// In EPICS, write access is governed by CA security (host/user rules), not
-	// by the field type.  Default to writable=true; the IOC will reject puts
-	// that violate its security policy.
-	meta := datasource.Metadata{Name: name, Writable: true}
+	// ca_write_access returns 1 if CA security permits puts from this client.
+	// This reflects the IOC's actual security policy (host/user ACLs), so we
+	// use it directly rather than defaulting to true and relying on put failures.
+	meta := datasource.Metadata{Name: name, Writable: C.ca_write_access(chid) != 0}
 
 	fieldType := C.ca_field_type(chid)
 	count := C.ca_element_count(chid)