The first thing the newly registered runner found. tools/check-no-pin-capture.sh
fails on main:
FAIL: pin_input is not hidden by default in the DSL
(review item 0.3: hiding must survive a DSL reload)
Reproduced locally, so this is a real defect and not runner flakiness.
69f6fb2 -- "fix(map): NigigMapView packed vertex shader for new DrawVector;
fix pay sheet visible" -- deleted TWO lines from shared_pay_sheet.rs. Its
message says it removed `visible: false` from `pin_eye_btn := Button`
because "Button does not have DSL property visible". Whatever the merit of
that for the Button, the same commit silently took the line off
`pin_input` as well, and pin_input is a RobrixTextInput, which does
support the property -- 6f05c47 had added it there deliberately eight days
earlier for exactly this reason.
Consequence: both M-Pesa PIN controls have rendered by default in every
non-demo build since. The runtime code only ever calls
set_visible(cx, true), and only under #[cfg(feature = "demo")] -- nothing
hides them -- so the DSL was the entire mechanism. The comment three lines
above still read "The DSL hides the PIN controls by default so a reload
cannot surface them", which had become false.
That is review item 0.3 / defect B11: the hiding must survive a DSL
reload, because a hot-reloaded or re-instantiated sheet re-applies the
definition and a runtime-only call does not run again.
Restored on both controls. On the Button: the stated reason for removing
it does not hold in this tree -- nigig-build's cad/mod.rs has three
Buttons carrying `visible: false` in the DSL (workspace_split_axis_btn,
desktop_workspace_sync_toggle_btn, ai_cancel_button) and they do not warn.
Verified `cargo check -p nigig-pay-ui --lib` is clean with both lines
back.
Also hid the parent `pin_visibility_row`, so the container and its
children agree and a future edit to one child cannot re-expose the field
on its own.
tools/check-no-pin-capture.sh now passes end to end:
PIN controls are hidden by default in the UI definition
no PIN capture in a packaging build; the default retains it deliberately
Worth stating plainly: this shipped because a map shader commit touched a
payments file and no CI ran. The gate that catches it has existed the
whole time.
ee8d10d978