Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Android›Android — Destinations build·43 in this wave

Wave

Android — Destinations build

Destination creation, viewers, and post-create editing. Creation is comprehensively built (~20 real builders across all 8 categories) despite stale in-code comments claiming otherwise. Editing is the real gap: only website and notes are editable post-create — 11 of 13 types show "Editing coming soon," mirroring iOS's destination-editing gap almost exactly.

TacTile › Launch TacTile › Android › Android — Destinations build

35/43 done8 open1 open blocker

Selected taskclear

Pin the destination-scoping predicate on collection writes (static scan over routes/)

To doOwner · backendt_409f79aa

Round-18 overflow, not reached. Regression prevention — there is NO live bug. Premises verified 2026-08-12.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Pin the destination-scoping predicate on collection writes (static scan over routes/)** · to do

Round-18 overflow, not reached. Regression prevention — there is NO live bug. Premises verified 2026-08-12.

Where it sits: TacTile › Launch TacTile › Android › Android — Destinations build

## The brief on file

BACKEND SESSION. Round-18 overflow item, filed 2026-08-12 because it was not reached. Extends #350.

THERE IS NO LIVE BUG. Do not go looking for one — the predicate is correct everywhere today. This is regression prevention: nothing holds it there.

VERIFIED THIS ROUND (re-confirm, but do not re-derive):

1. gallery.ts scopes every body-id write with `&destination_hash=eq.` — confirmed at :598, :746, :765, :777, :904, :944. Six sites, all correct.

2. menu.ts:573, link_hub.ts:377, profile.ts:702 were UNVERIFIED in the brief. I checked all three: they are fine for a DIFFERENT reason than gallery. Each builds its id list from its OWN destination- or profile-scoped SELECT, then DELETEs by `id=in.(...)`. menu captures `existingSectionIds`; link_hub and profile capture `existingIds`. That is the fixed capture-insert-delete shape from verify:destructive-order and needs no owner predicate, because the ids never came from the request. THE SCAN THEREFORE NEEDS BOTH ACCEPTANCE PATHS: an owner predicate, OR ids derived from a scoped SELECT in the same function.

3. gallery.ts is the asymmetric one: ids come straight from the REQUEST BODY, against a table whose `id` is a bare sequence, using the service-role key, which bypasses RLS. The predicate is the only thing standing there.

4. Test coverage is asymmetric. #350's READ-side describe (tests/routes/collection-row-identity.test.ts:262, "collection reads carry a row identity") covers all five routes. The WRITE-side block (:338, "contact write honours row identity") is CONTACT ONLY. Both line numbers verified.

THE TRAP — read before writing the matcher. A naive `id=eq.` / `id=in.(` regex is a false-positive machine: it matches `hash_id=eq.`, `destination_hash=eq.` and `user_id=eq.`. My first probe reported 11 id-filtered sites in gallery.ts with 5 missing the predicate; all five were `hash_id=eq.` ops on ACTIONS_TABLE (:368, :460, :481, :530, :705), correctly scoped, wrong match. Anchor on `[?&]id=(eq|in)\.` and gallery reports exactly 6. A scan that cries wolf on 5 correct lines gets `// allow-` pasted on all of them within a week.

PREFERRED SHAPE: static property over apps/api/tactile-api/src/routes/. Every PostgREST WRITE (POST/PATCH/DELETE) whose URL filters on id must carry an owner-scoping predicate or derive its ids from a scoped SELECT in the same function. Escape hatch `// allow-unscoped-id: <reason>`, reason REQUIRED — a bare annotation silences nothing, same rule as allow-r2-before-db: and the console-ratchet marker.

THIS IS THE ONE WHERE THE OBVIOUS ASSERTION DOES NOT DISCRIMINATE. A runtime test that POSTs a foreign id and expects rejection passes on today's tree AND on a tree with the predicate deleted, because the harness fixture never contains a second tenant's row to destroy. Do not write that test and believe it.

PROVE THE MUTATION REDDENS FIRST: delete `&destination_hash=eq.${...}` from gallery.ts:746, confirm the check fails NAMING THAT LINE; restore; repeat separately for :765. If it does not go red on both, redesign and say so.

SCALE: naive counts across routes/ are groups.ts 21, agent.ts 20, profile.ts 13, gallery.ts 11, customDomains.ts 10, billing.ts 10, qr.ts 9, triggers.ts 8 — expect most to be reads or hash_id false positives once anchored. Baseline+ratchet like verify:destructive-order if the clean-tree count is not zero; never widen an existing .verify-baseline file.

CHAIN RITUAL: five places — package.json, run-all.sh CHECKS, .github/workflows/verify.yml, AGENTS.md (numbered list AND the "chain is **N checks**" count), then `cp -f AGENTS.md CLAUDE.md`. Run `pnpm verify:ci-step-coverage` and fix what it names; do not hand-fix from the prose count. Chain was 32 on 2026-08-12 and several sessions add checks per day — rebase and re-run parity right before pushing.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Android — Destinations build

Pin the destination-scoping predicate on collection writes (static scan over routes/)