Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

getDomainStatus poll can overwrite an admin suspension that lands mid-poll (PATCH has no status guard)

DoneOwner · Vivt_58cdb1e3

Pre-existing on main, found by the independent review of PR #702 (t_3ef8ebe2). Out of scope for #702; narrow window.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**getDomainStatus poll can overwrite an admin suspension that lands mid-poll (PATCH has no status guard)** · done

Pre-existing on main, found by the independent review of PR #702 (t_3ef8ebe2). Out of scope for #702; narrow window.

Where it sits: TacTile › Inbox — on deck

## The brief on file

[2026-10-23 · Viv] DONE (r40, 03:50 PDT) against draft PR #779 (r40/api-hardening, head bc9bfaba, off origin/main 4f2c1d6b; not merged, not deployed).
WHAT: commit bc9bfaba "fix(custom-domains): keep a mid-poll admin suspension from being overwritten by the status poll (t_58cdb1e3)"; files: apps/api/tactile-api/src/routes/customDomains.ts, tests/unit/custom-domain-poll-suspension.test.ts.
EVIDENCE: customDomains.ts getDomainStatus: PATCH URL gains &status=in.(pending_dns,pending_cert). When it returns zero rows: re-read with the same filter as the first read (502 if the re-read fails, 404 if the row is gone), return that row, and skip the accounts.primary_custom_domain_id PATCH, KV invalidation and the domain.verification_failed audit row. A non-2xx PATCH keeps its old behaviour.; Test: new tests/unit/custom-domain-poll-suspension.test.ts (pattern from audit-call-site-behaviour.test.ts: real customDomainsRoute, real HS256 session, stub models PostgREST so a filtered PATCH matches nothing once the row is suspended). `npx vitest run tests/unit/custom-domain-poll-suspension.test.ts` rc...
MUTATION: Removed the status=in.(pending_dns,pending_cert) filter: 2 failed | 1 passed (the named suspended-row test and the audit variant). Removed the `&& !superseded` gate on the active branch: 1 failed | 2 passed. Restored: 3 passed.
READERS: safety CONFIRMED (The Done-when is met: with the PATCH routed to return [], the poll returns the current suspended row. The only non-GET request is that guarded PATCH, which wrote nothing; there is no accounts write...); acceptance CONFIRMED (Clause: 'a test where the PATCH is routed to return [] shows the poll returns the current (suspended) row and writes nothing'. The test 'returns the current suspended row and writes nothing when the guarded PATCH matches no row' does this. Its stub returns ...).
GATE: bash scripts/verify/gate.sh passed 55 of 56 (sanctioned verify:secrets-rotation only) on run 3, start load1 3.87. Hunk independence: git merge-tree clean against every open PR touching these files (builder, re-run by the safety reader).
CI on #779, read 03:45 PDT: verify red ONLY at "Secrets rotation audit"; playwright cancelled by the shared concurrency group (not run); semgrep, static-firewall, dep-scan, changes pass.

[2026-10-15 · Viv] FILED from the independent review of PR #702 (r28/domain-reattach-evasion, head 8b46d015, draft). Searched the live hub on 15 Oct for "getDomainStatus" and "mid-poll": no open task covers it. Pre-existing on main, out of scope for #702.

WHAT IS WRONG (read from the repo at 8b46d015, not exercised). apps/api/tactile-api/src/routes/customDomains.ts getDomainStatus (about lines 695-870) reads a pending_dns or pending_cert row, asks Cloudflare, then PATCHes the row (about lines 789-792) with a filter of id + account_id only. If an admin suspends that row between the read and the PATCH, the PATCH writes pending_dns, pending_cert or active over 'suspended' and the suspension is lost. detachDomain already guards its own write (status=neq.suspended&detached_at=is.null, about line 964). The window is one Cloudflare round trip and it only bites a row that was still pending when suspended, so it is narrow.

FIX: add the status the poll read to the PATCH filter (for example &status=in.(pending_dns,pending_cert)) and, when the PATCH returns zero rows, re-read the row and return it instead of the stale one.

DONE WHEN: a test where the PATCH is routed to return [] shows the poll returns the current (suspended) row and writes nothing; remove the filter and the named test goes red. Land after #699 and #702 merge. No deploy, no migration, no production call.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

getDomainStatus poll can overwrite an admin suspension that lands mid-poll (PATCH has no status guard)