Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Web›web-mobile — Surface build·31 in this wave

Approve: Surface buildTo do · blocker Viv — Fix Dashboard 'Create → Destination' tile to link to the destination picker instead of the QR page.Done Viv — Build the missing destination picker on QR Launchpad so users can connect a destination to an existing QR code from web.Done Viv — Add app-wide error.tsx and not-found.tsx boundaries to web-mobile.Done SPEC → backend: three dead QR shape values, a sticker key Android and web disagree on, and a grader blind to bothDone QR studio: four remaining silent-substitution hazards before decoratives/stickers shipDone SPEC → backend: collapse the duelling QR enums and make every offered shape render — Matthew decided parity, not documentationDone BLOCKED: logo interactive crop cannot be built on web — all five logo snapshot fields are inert in the TS rendererDone web-mobile production build sets no NEXT_PUBLIC_API_URL — six call sites fall back to same-origin and 404To do web-mobile /auth/callback redirects to an unsanitized ?redirect param (open redirect)Done Viv — Fix the 'forms' vs 'form' naming mismatch between web-mobile's disabled-category type and the backend destination type.Done Viv — Add 'action' and 'form' to the shared DestinationType union in the SDK.Done Viv — Wire up QR design editing from the Launchpad (prefill existing design into the editor).Done Viv — Add QR code deletion once a DELETE endpoint/SDK method exists.Done Viv — Wire the AI Insights tab to the real analytics insights endpoint once the SDK exposes it.Done Viv — Remove the unreachable 'Group-level analytics are in development' stub banner from Deep Dive, or wire it up if group-scope analytics ships.Done me — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding.To do Viv — Point 'Help Center' to a real docs/FAQ URL instead of duplicating the 'Contact Support' mailto link.Done Add loading.tsx route skeletons to web-mobileDone Pin test: web-mobile Deep Dive must not offer 'group' scope while useEntitySummary has no real group endpoint (follow-up to #712, t_288daf95)To do Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)Done Viv — Either finish the Menu destination builder or mark it disabled/coming-soon in the category picker.Done Viv — Add video, audio, and action to the destination CategoryPicker with an honest disabled/coming-soon state, instead of leaving them silently absent.Done Viv — Add a timeout/failure path to the cross-domain auth handoff when setSession() hangs.Done Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.Done Kaitlynn — Verify the 6 working destination builders (website, notes, gallery, document, link_hub, contact-via-card) end-to-end.Done Kaitlynn — Verify QR create, scan, and Launchpad view/manage flows end-to-end.Done Kaitlynn — Verify ConnectCard editor (create and edit) end-to-end.Done Kaitlynn — Verify all 6 Settings pages (profile, security, subscription, notifications, appearance, plus the settings hub) end-to-end.To do Kaitlynn — Verify Analytics tabs (all 7) render real data with correct empty/error states, confirming no fabricated data anywhere.Done Kaitlynn — Verify Assets browser (Triggers / Destinations / QR / Groups / Families tabs) end-to-end.Done

Wave

web-mobile — Surface build

TacTile › Launch TacTile › Web › web-mobile — Surface build

26/31 done5 open1 open blocker

Selected taskclear

QR studio: four remaining silent-substitution hazards before decoratives/stickers ship

DoneOwner · ait_7c541a36

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**QR studio: four remaining silent-substitution hazards before decoratives/stickers ship** · done

Where it sits: TacTile › Launch TacTile › Web › web-mobile — Surface build

## The brief on file

DONE — PR #270, merged to main as 6eda04da (base=main confirmed before merge, ancestry after). Deployed to staging, version f6e2cdec.

All four cleared, each with a test that FAILS when its fallback is reintroduced — verified by actually putting each fallback back, not by assuming. The decorative one fails with "5-petal-flower written without a width: expected undefined to be 2".

1. DECORATIVE SHAPE WITHOUT ITS WIDTH — closed. decorativeSelection() writes id, width and fill gap together from the descriptor, and clearing takes all three so a stale width cannot leak onto the next shape. The underlying package contradiction stands and is specced (t_d5b7c2f2): DECORATIVE_DEFAULT_OUTLINE_WIDTH is 2.0, all 58 descriptors say 2, the resolver falls back to 0.5. Writing explicitly means the studio is right either way.

2. RANDOMISED PALETTE — closed, and it was three failures not one. Below two colours render-carried skips the block entirely (flat render, no error); render-carried counts the RAW array while resolve-options filters empty strings first, so ["", "#FF0000"] activates on one path only; and seed 0 is the fallback on BOTH paths, so omitting it collapses every such design onto one pixel pattern. The editor refuses fewer than two usable colours, never writes an empty entry, and mints a positive seed.

3. GRADIENT MIDPOINTS — closed. Editable up to iOS's cap of three, for background and module fills.

4. TRANSPARENT BACKGROUND — closed, AND ONE CLAIM IN THIS TASK WAS WRONG. The toggle was genuinely missing and is now there. But "poisons the meter" is not true: the grader resolves "transparent" to null, tracks it in ColorField.unparsed, and caps the finding at C with "their contrast could not be verified" (factors.ts:369-377). The meter is honest. What IS wrong is the REMEDY it prints — "express every colour as a #RRGGBB hex" — which blames the user for a deliberate choice. grade.ts now adds the true reason instead: the background is whatever material the code is printed on, which cannot be measured from a design file.

ALSO NOT EXPOSED, deliberately: decorativeOutlineColorLocked. It is in the snapshot type and in iOS but NOTHING in the TS renderer reads it — a toggle would write a field with no effect, which is the same defect this task exists to close. The behaviour it stands for is modelled directly (leave the outline colour unset and it follows the module colour).

Item 4 of the original list — `design: null` wiping the blob via typeof null === "object" — is backend's and stays with them.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

web-mobile — Surface build

QR studio: four remaining silent-substitution hazards before decoratives/stickers ship