A deleted name stays deleted - #182
Merged
Merged
Conversation
The naming step prefills a reopened creation's title and signature, and an untouched reopen re-shares that very capsule, so backspacing the prefill away and pressing Enter shipped the old name anyway: the form said unnamed while creation.num, the README, the postcard headline, and the folder slug all still carried it. That is the exact shape this project calls a truth defect, an outcome that does not depend on what the player actually did. The cause was one Option per field standing for two different questions. There are two levels here: whether a share carries a naming decision at all answers whether the player was asked, and each field answers what they left. They are separate now, and core gained without_title and without_author so a clearing has a verb, since with_title refuses an empty string, which is what pushed the faces into conflating the two in the first place. The regression drives the only path a player has: open a titled and signed capsule, backspace both fields empty, and require the written capsule, the README, and the folder name to carry nothing, while a share that never opened the step keeps both. Mutation-verified against the old behavior. Found by bug hunt round six; the finding survived an adversarial verifier that traced it from the overlay to the bytes on disk.
There was a problem hiding this comment.
Pull request overview
Fixes a share-flow truth defect where clearing the prefilled title and author during the F4 naming step could still re-share the previously saved identity, causing the capsule, README, postcard headline, and folder slug to retain a name the player deleted. The implementation separates "was the player asked" from "what did they leave" and adds explicit core APIs for clearing identity.
Changes:
- Introduce
ShareIdentity(nestedOptionfields) and plumb it through the app share path so cleared fields explicitly clear capsule identity. - Add
StudioCreation::without_titleandStudioCreation::without_authorto represent identity removal as an explicit operation. - Add a regression test covering the reopen + clear + share path, plus update the changelog entry for the fix.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| faces/app/src/main.rs | Adds ShareIdentity, applies it during share writing (including clearings), and adds a regression test for the cleared-prefill scenario. |
| crates/core/src/studio.rs | Adds explicit without_title and without_author methods to support clearing identity in a first-class way. |
| CHANGELOG.md | Documents the fix in the Unreleased section. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…s whether one was made identity() always had a decision to report, so returning it wrapped in the outer Option said nothing and blurred what that Option is for. It returns the decision now; the confirm path wraps it, which is exactly where the question of whether the player was asked belongs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug hunt round six's one fully verified finding, fixed. (The hunt itself ran five finders with adversarial verification and was cut short by a model usage limit partway through; this finding survived a verifier that traced it from the overlay to the bytes on disk.)
The defect
The F4 naming step prefills a reopened creation's title and signature, and an untouched reopen re-shares that very capsule. So backspacing the prefill away and pressing Enter shipped the old name anyway: the form said unnamed while creation.num, the README, the postcard headline, and the folder slug all still carried it. Reachable from Gallery Enter or a dropped .num on any previously named capsule.
It is a truth defect in the project's own sense: an outcome that does not depend on what the player actually did.
The cause and the shape of the fix
One Option per field was standing for two different questions. There are two levels: whether a share carries a naming decision at all answers whether the player was asked; each field answers what they left. Those are separate now (Option, with Option fields inside), and core gained without_title and without_author so a clearing has a verb. with_title deliberately refuses an empty string, which is exactly what pushed the faces into conflating a clearing with an absence.
The lock
The regression drives the only path a player has: open a titled and signed capsule, backspace both fields empty through the real key handlers, then require the written capsule, the README, and the folder name to carry nothing, while a share that never opened the step still keeps both. Mutation-verified: reverting the clearing arm fails it.
Full workspace gates green through the pre-commit hook.