Hi,
Passing the -ro flag to the server is fine to express the intent to not allow writes on the client side, but that begs the question - should the server believe it? If you intend to have an image be read-only, then the proper way to handle that is just to mark it read-only on the server side. What you are asking for is basically to have the server mark images as read-only dynamically if all of the clients are read-only, but it's not worth the effort to deal with corner cases. Just declare it read only and move on ...
I'm trying to work out in my head how to change an image on the server side and notify the DOS side safely, but I don't see a good path to doing so. I can send the asynchronous notification to the DOS side; that's not a problem. If DOS is only doing reads the media changed flag will work, at least on the later versions of DOS. But I'm also kind of paranoid about dirty buffers and corruption, and if anything gets added it has to be able to keep people from shooting themselves in the foot.
Doing the media change thing also isn't fool proof - it basically screws any program that has files open. They need to know to reopen the files again. This goes for TSRs to, so even detecting you are at a DOS prompt is not safe enough.
Looking at the bigger picture ...
This is a block level device. DOS manages the blocks, chooses when to flush dirty buffers, chooses the caching policy, etc. Having something else reaching in and changing the blocks is just not something any operating system is designed to handle. The analogy is having a SATA hard drive with two connectors going to two different machines, each able to touch the same areas of the disk.
For the kinds of access you are looking for you really want filesystem level sharing, where DOS can read files but it can't assume complete ownership of the blocks. That's where things like NFS, SMB, and EtherDFS come in. There is also a new program called NETMOUNT that was announced on the FreeDOS facebook page that looks promising; it looks like EtherDFS but it's done using IP and UDP.
(Note: I don't use Facebook. Ever.)