Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·49 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

39/49 done10 open3 open blockers

Selected taskclear

ROUND 9 · SESSION — Backend: unblock the two cross-platform items other lanes are stuck behind

DoneOwner · ait_5ba602e6

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**ROUND 9 · SESSION — Backend: unblock the two cross-platform items other lanes are stuck behind** · done

Where it sits: TacTile › Inbox — on deck

## The brief on file

ROUND 9 — items 1, 2 and 4 delivered; item 3 partially (its prerequisite, which turned out to be a live data-loss bug); item 5 not started. Three PRs merged to main and ancestry-verified; API deployed to staging (447b502e live). scripts/verify/gate.sh exited 0 before every commit.

  #276  qr: give the logo fields a consumer, and stop losing Android's stickers  (merge 7eddeb24)
  #278  fix(form): `fields: []` deleted every question and returned 200          (merge 447b502e)

1. t_57483e80 — LOGO FIELDS NOW HAVE A CONSUMER. Web was right to refuse: all five
   geometry fields were read by nothing outside their own declaration.
   THE BRIEF'S STEP 2 WAS AIMED AT THE WRONG FILE, and that is the useful finding —
   resolve-options CANNOT read them, because the renderer's RenderOptions has no logo
   or centre concept at all (grep: zero hits). The logo is a qr-studio OVERLAY, so the
   fields had to land there. Added logoImageData + logoImageTransform to the snapshot
   (mirroring backgroundImageData exactly; additive and decode-safe both directions
   since Swift's Decodable ignores undeclared keys), centerElementFromSnapshot() to
   derive a CenterElement, and made renderCarriedDesign fall back to it when the
   caller passes center: null — which the desktop studio does. An EXPLICIT centre
   still wins, because iOS-parity callers pass text centres the snapshot cannot
   express. The crop rect is honoured in the compositor, not merely stored.
   This also removes the reason round 6 had to block saving a code with a logo.
   logoSliderValue's semantics are NOT settled and I did not guess — iOS is its only
   writer and nothing in TS ever read it, so there was no behaviour to preserve.
   sizeIdxForSliderValue accepts both plausible encodings and the comment says iOS
   owns confirming which, then DELETING the wrong branch.

2. t_d5b7c2f2 — STICKER BOUNDARY. STICKER_RESOURCE was camelCase-only, so Android's
   kebab id missed the map, `resource` was undefined, `sticker` was null and the
   guard skipped silently. camelCase stays what the snapshot PERSISTS (the locked
   decision); only what the boundary ACCEPTS changed. "none" resolves to an explicit
   absence; a genuinely unknown key still renders but WARNS.
   CROSS-LANE HALVES NAMED IN THE PR: iOS confirms the slider encoding and starts
   writing logoImageData; Android writes camelCase going forward (the read shim means
   existing designs stop losing their sticker immediately, no migration).

3. t_3dc4ae01 form.field.* — NOT WIRED, and scoping found why it could not be done
   safely yet. There are NO per-field endpoints, so all five ops are read-modify-write
   against PUT /api/form/:hash, a whole-collection replace of a JSONB column. That PUT
   accepted `fields: []` and DELETED EVERY QUESTION with a 200 OK. Fixed. Wider than
   the contact/link_hub drops: those lost the entries a caller mishandled, this lost
   all of them from a payload that looks like a no-op. verify:destructive-order cannot
   see this shape (no DELETE, just a column assignment) — third distinct data-loss
   shape this quarter its rule does not describe. The five ops remain open with the
   read-modify-write hazards written into t_3dc4ae01.

4. t_66f02ccb — BINDING DECIDED by Matthew: reuse the existing RateLimitV1 Durable
   Object. The question was smaller than it looked: the repo already HAS a
   sliding-window per-account limiter (apps/api/tactile-api/src/rate-limit-do.ts),
   bound as RATE_LIMIT_DO on both prod and staging and live behind the public resolver.
   So it needs a cross-script DO binding, not a fourth implementation. KV rejected
   (eventually consistent, ~1 write/s per key — under-counts exactly the burst it
   defends against); D1 rejected (SQL round-trip per call). Full recipe on the task,
   including the point that the unmetered path is tool handlers hitting PostgREST
   DIRECTLY — proxied writes are already covered, so a limiter on those alone would
   look like progress and change nothing.

5. NOT STARTED — squircle/diamond/cross rendering. Unchanged: resolveEyeShape has
   cases only for square/rounded/circle/heart and defaults to "rounded", so three of
   twenty-one eye options discard the user's pick while rendering a valid code.
   tests/unit/qr-studio-shape-coverage.test.ts still pins the three as dead and will
   fail when they are implemented — that failure is the signal to DELETE those three
   assertions, not to weaken the test. The pickers derive from the resolver
   (honoured-shapes.ts) so they pick the values up with no client change.

GATE: scripts/verify/gate.sh exit 0 on every commit — 17 of 18, known-red
verify:secrets-rotation only, which the gate names rather than counts.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

ROUND 9 · SESSION — Backend: unblock the two cross-platform items other lanes are stuck behind