From 8d5b47aa9c3a53b8f76c3de12817c15c058ee2bf Mon Sep 17 00:00:00 2001
From: Thomas <28439359+thoda-dev@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:21:25 +0200
Subject: [PATCH 1/2] fix(read): stop claiming a wrong password burns a read

---
 apps/app/app/pages/p/[id].vue | 9 ++++++++-
 apps/app/i18n/locales/en.json | 3 ++-
 apps/app/i18n/locales/fr.json | 3 ++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/apps/app/app/pages/p/[id].vue b/apps/app/app/pages/p/[id].vue
index 61eb858..5feadff 100644
--- a/apps/app/app/pages/p/[id].vue
+++ b/apps/app/app/pages/p/[id].vue
@@ -35,6 +35,13 @@ const metaError = ref('')
 const meta = ref<MetaResponse | null>(null)
 const fragmentKey = ref<Bytes | null>(null)
 
+// The password clause only holds where there is a password: `reveal.post.ts` folds the unlock hash
+// into the atomic UPDATE, so a wrong one matches no row and spends nothing.
+const burnWarning = computed(() => [
+  t('read.burnWarningDescription'),
+  ...(meta.value?.passwordProtected ? [t('read.burnWarningPassword')] : [])
+].join(' '))
+
 onMounted(async () => {
   const keyParam = new URLSearchParams(window.location.hash.replace(/^#/, '')).get('key')
   if (!keyParam) {
@@ -174,7 +181,7 @@ async function copyText() {
           color="warning"
           variant="subtle"
           :title="t('read.burnWarningTitle')"
-          :description="t('read.burnWarningDescription')"
+          :description="burnWarning"
         />
         <UAlert
           v-if="revealError"
diff --git a/apps/app/i18n/locales/en.json b/apps/app/i18n/locales/en.json
index fc37865..e58e9a2 100644
--- a/apps/app/i18n/locales/en.json
+++ b/apps/app/i18n/locales/en.json
@@ -99,7 +99,8 @@
     "readsRemaining": "Reads remaining: {count}",
     "passwordLabel": "This paste is password protected",
     "burnWarningTitle": "Revealing consumes one read",
-    "burnWarningDescription": "Once revealed, this counts against the paste's read limit — even if the password turns out to be wrong.",
+    "burnWarningDescription": "Once revealed, this counts against the paste's read limit.",
+    "burnWarningPassword": "A wrong password costs nothing: the read is only spent once the password is right.",
     "reveal": "Reveal",
     "copyText": "Copy",
     "downloadFile": "Download {name}",
diff --git a/apps/app/i18n/locales/fr.json b/apps/app/i18n/locales/fr.json
index 685a143..0495fb9 100644
--- a/apps/app/i18n/locales/fr.json
+++ b/apps/app/i18n/locales/fr.json
@@ -99,7 +99,8 @@
     "readsRemaining": "Lectures restantes : {count}",
     "passwordLabel": "Ce paste est protégé par un mot de passe",
     "burnWarningTitle": "Révéler consomme une lecture",
-    "burnWarningDescription": "Une fois révélé, ceci compte dans la limite de lectures du paste — même si le mot de passe s'avère incorrect.",
+    "burnWarningDescription": "Une fois révélé, ceci compte dans la limite de lectures du paste.",
+    "burnWarningPassword": "Un mot de passe incorrect ne coûte rien : la lecture n'est décomptée qu'avec le bon mot de passe.",
     "reveal": "Révéler",
     "copyText": "Copier",
     "downloadFile": "Télécharger {name}",

From c773dea4112d3e712e570ef7a8f5aec53a73e1d5 Mon Sep 17 00:00:00 2001
From: Thomas <28439359+thoda-dev@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:27:27 +0200
Subject: [PATCH 2/2] docs(read): note the legacy unlock-hash branch in the
 burn warning comment

---
 apps/app/app/pages/p/[id].vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/app/app/pages/p/[id].vue b/apps/app/app/pages/p/[id].vue
index 5feadff..6a14860 100644
--- a/apps/app/app/pages/p/[id].vue
+++ b/apps/app/app/pages/p/[id].vue
@@ -35,8 +35,8 @@ const metaError = ref('')
 const meta = ref<MetaResponse | null>(null)
 const fragmentKey = ref<Bytes | null>(null)
 
-// The password clause only holds where there is a password: `reveal.post.ts` folds the unlock hash
-// into the atomic UPDATE, so a wrong one matches no row and spends nothing.
+// Only where there is a password, and only for pastes carrying an unlock hash: `reveal.post.ts`
+// spends nothing on a wrong one, but its `isNull` legacy branch still burns a read.
 const burnWarning = computed(() => [
   t('read.burnWarningDescription'),
   ...(meta.value?.passwordProtected ? [t('read.burnWarningPassword')] : [])