Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Destinations build·43 in this wave

Wave

Android — Destinations build

Destination creation, viewers, and post-create editing. Creation is comprehensively built (~20 real builders across all 8 categories) despite stale in-code comments claiming otherwise. Editing is the real gap: only website and notes are editable post-create — 11 of 13 types show "Editing coming soon," mirroring iOS's destination-editing gap almost exactly.

TacTile › Launch TacTile › Android › Android — Destinations build

35/43 done8 open1 open blocker

Selected taskclear

Build verify:destructive-order — the check that catches the sixth instance automatically

DoneOwner · Vivt_1c8645b0

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Build verify:destructive-order — the check that catches the sixth instance automatically** · done

Where it sits: TacTile › Launch TacTile › Android › Android — Destinations build

## The brief on file

DONE AND MERGED 2026-08-03. PR #192 merged as fd04896e. Verified on main by content: scripts/verify/destructive-order.mjs present, .verify-baseline/destructive-order.json present, package.json chain entry AND a run: step in .github/workflows/verify.yml.

It is now check 18. AGENTS.md and CLAUDE.md document the three shapes and the escape hatch.

THE PART WORTH REMEMBERING. The check was validated against the PRE-FIX CODE OF ALL FIVE INSTANCES, not just against a clean tree. That is not ceremony — the first working draft reported a completely clean tree while four live instances sat in it. Its create-path-rollback suppression matched `${supabaseEnv.restUrl}`, which appears in literally every query, and silently disabled the whole delete-before-insert rule. A scanner that is quiet on both the broken and the fixed tree is worse than no scanner, because it manufactures confidence. Anyone modifying this file must re-run it against the historical buggy versions:

    git show <fix-commit>^:apps/api/tactile-api/src/routes/<file>.ts

Two further defects the same exercise exposed, both of which had been making it miss real bugs:
  - Function regions were tracked by BRACE DEPTH, so a multi-line signature whose closing `)` also carried a `}` ended the region immediately. pruneVideoActionsForOwner collapsed to three lines and its R2-before-DB ordering was invisible; statements were attributed to regions named after local variables. Now split on top-level declarations, which errs toward LARGER regions — it can merge two things and produce a dismissible false positive, rather than split a real defect in half and miss it.
  - The rollback detector matched `.catch(` as well as `catch (`, so a promise handler on the delete itself read as a rollback branch and hid triggers.ts::deleteTrigger entirely.

FALSE POSITIVES ARE ZERO on the current tree. The dominant class — a handler deleting uploads it just made, after its own failure — is suppressed STRUCTURALLY (inside a catch or a !ok branch, or filtered on an id this request minted) rather than baselined, so ~23 benign hits never reach the baseline. destinations.ts's best-effort R2 cleanup carries an inline `// allow-swallowed-destruction: <reason>` instead of a baseline entry, because a baselined entry stops carrying its reason.

BASELINE CARRIES 4 REAL FINDINGS, deliberately: videos.ts's prune (object-before-row) and both its call sites (swallowed-destruction) under t_c80e7372, plus triggers.ts::deleteTrigger. A permanently red check is one nobody reads — that is exactly how /legal shipped a dead mailto. Fix those two and run `pnpm verify:baseline` to ratchet down; note that command regenerates EVERY baseline and would have quietly ratcheted syncpack UP by one on this branch, so check `git diff .verify-baseline/` before committing its output.

STILL TO POINT IT AT: the sweep only read 15 of ~40 route files, and the scanner now covers all 359 TS files under apps/ and supabase/functions/ in one run — which is how it found triggers.ts, never opened by any auditor. apps/workers, apps/web server actions and apps/runs-engine are in scope and came back clean.

NEXT: t_c80e7372 (videos prune) is the remaining real instance, and fixing it removes 3 of the 4 baseline entries.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Destinations build

Build verify:destructive-order — the check that catches the sixth instance automatically