There is now a way to open a thread

The dead end

A designed empty state you cannot leave

An empty state that says what would be here is honest. An empty state with no way out of it is a dead end. There is now a way out of the empty state, and an ordinary action above a populated list, both landing in a small screen that asks two things and then walks you into what you made.

A name is optional, because the field is nullable on the wire and an untitled thread already has a word for itself. A required name would be the app inventing a rule the server does not have. A blank one is sent as nothing rather than as an empty string.

Two questions, asked at the open

Who can see it, and whether Bobby is in it

Bobby has three settings on a thread: automatic, mentioned, or out. A thread Bobby is out of never reaches the model, so no transcript of it exists to leak later. It is decided when the thread opens rather than changed afterwards — a household opening a thread about a birthday present should not have to win a race with the assistant.

Who may see it is the other question and is asked for the same reason. A thread that is public for the two seconds between being opened and being made private is a thread the whole household could have read. A household opening a private thread should no more have to win a race with its own members than with the assistant.

Renaming is open to anybody who can see the thread, which for a private one means its members only. Not the creator alone: threads outlive the people who open them, and a typo would be permanent once they leave. The row does not record who renamed it, and the fix for that is a column somebody has to add rather than a rule.

What a message can carry

Stored as you typed it

The store keeps the characters somebody typed and nothing rewrites the string. There is no markdown parser on the server and there should not be: four clients and Discord each render the same string their own way, and a client that does not understand a construct shows the source, which is still readable.

A message can carry a photograph with no caption, so the lower bound on the body was relaxed rather than asking every client to send a space. A space stored as a body is the store lying about what was typed, in the one table whose whole job is holding it.

An attachment names an object in the household’s own bucket. It is a description — an identifier, a kind, a size, a content hash — and there is no column an address could go into. A URL to view one comes from its own route, lasts 300 seconds, and is not to be kept. The visibility rule for an attachment is the same string the thread listing uses, in one statement, and the branch proved it by replacing that string with something always-true and watching both guards go red before restoring it. That is the only way to know a guard guards.

Names

Members were being labelled with the server’s own identifiers

A roster row read owner and adult where the design reads Creator and Manager, and the constants carrying those values are documented in the apps as compared against and never displayed. The name is a label and the identifier underneath is an identifier, so that renaming a group changes the word and nothing else. A role a build has never heard of is drawn as the server sent it — not blank, which reads as a rendering fault, and not guessed at, because an unknown role is somebody’s own word for a group they made.

A household of one used to read “1 people”. The count is the roster’s, so it is exact rather than approximate, which makes the singular reachable and worth spelling.