fix: stabilize rpg publish and launch

server-rs/crates/spacetime-module/src/custom_world.rs

@@ -2593,13 +2593,10 @@ fn execute_publish_world_action(
 ) -> Result<CustomWorldAgentOperationSnapshot, String> {
     ensure_publishable_stage(session.stage, "publish_world")?;
 
-    let draft_profile =
-        if let Some(explicit) = payload.get("draftProfile").and_then(JsonValue::as_object) {
-            explicit.clone()
-        } else {
-            parse_optional_session_object(session.draft_profile_json.as_deref())
-                .ok_or_else(|| "publish_world requires draft_profile_json".to_string())?
-        };
+    // 中文注释：发布动作不再信任前端携带的 draftProfile。
+    // 点击发布前，结果页 profile 必须先通过 sync_result_profile 写回
+    // custom_world_agent_session.draft_profile_json；正式发布只读取这份会话真相。
+    let draft_profile = read_publish_world_draft_profile_from_session(session)?;
     let gate = summarize_publish_gate_from_json(
         &session.session_id,
         session.stage,
@@ -2613,18 +2610,9 @@ fn execute_publish_world_action(
         ));
     }
 
-    let profile_id = payload
-        .get("profileId")
-        .and_then(JsonValue::as_str)
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(ToOwned::to_owned)
-        .unwrap_or_else(|| gate.profile_id.clone());
+    let profile_id = gate.profile_id.clone();
     let setting_text = resolve_publish_world_setting_text(payload, &draft_profile, session);
-    let legacy_result_profile_json = payload
-        .get("legacyResultProfile")
-        .map(serialize_json_value)
-        .transpose()?;
+    let legacy_result_profile_json = None;
     let author_public_user_code = read_optional_text_field(payload, &["authorPublicUserCode"])
         .unwrap_or_else(|| build_public_user_code_from_owner_user_id(&session.owner_user_id));
     let author_display_name = read_optional_text_field(payload, &["authorDisplayName"])
@@ -2669,6 +2657,13 @@ fn execute_publish_world_action(
     Ok(build_custom_world_agent_operation_snapshot(&operation))
 }
 
+fn read_publish_world_draft_profile_from_session(
+    session: &CustomWorldAgentSession,
+) -> Result<JsonMap<String, JsonValue>, String> {
+    parse_optional_session_object(session.draft_profile_json.as_deref())
+        .ok_or_else(|| "publish_world requires draft_profile_json".to_string())
+}
+
 fn execute_revert_checkpoint_action(
     ctx: &ReducerContext,
     session: &CustomWorldAgentSession,
@@ -5256,6 +5251,26 @@ mod tests {
         );
     }
 
+    #[test]
+    fn publish_world_draft_profile_comes_from_session_not_payload() {
+        let session = build_test_custom_world_agent_session(
+            "seed",
+            RpgAgentStage::ReadyToPublish,
+            Some(r#"{"id":"saved-profile","name":"已保存草稿"}"#),
+        );
+        let draft_profile =
+            read_publish_world_draft_profile_from_session(&session).expect("session draft exists");
+
+        assert_eq!(
+            draft_profile.get("id").and_then(JsonValue::as_str),
+            Some("saved-profile")
+        );
+        assert_eq!(
+            draft_profile.get("name").and_then(JsonValue::as_str),
+            Some("已保存草稿")
+        );
+    }
+
     #[test]
     fn custom_world_agent_session_direct_work_content_ignores_empty_created_session() {
         let empty_session =