Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Backend API·33 in this wave

Approve: Backend APITo do · blocker Implement /api/profile or remove routeDone Implement /api/uploadDone Implement destination analyticsDone Add upload size limits and file validationDone Define the API versioning strategyDone Verify all 14 destination content read endpointsDone Verify the five existing destination update endpoints workIn progress Fix the stale SENTRY_RELEASE on tactile-apiDone iOS decodes payment_destinations as an array — a latent whole-list decode failureTo do Add staging.tactile.to to the API CORS allowlistDone Emit CardSchema (not bare ActionPreview) from the 12 non-QR tool preview generatorsDone pnpm verify is red on main, and CI hides 9 more failures by excluding three test filesDone EMIT LEG: send method:\"link\" from the clients, or the Link bucket stays at zeroTo do POST /api/events/open is documented public+unauth but 401s anonymouslyDone Staging has no RATE_LIMIT_DO binding — both rate limiters fail open thereDone Mask the Wi-Fi password before it reaches agent proposal cards (blocks WifiCard)Done link_hub.ts has the identical partial-drop hole contact.ts just hadDone Add /health endpointDone Replace link-click placeholder zeroDone Verify documents/gallery/audio routes completeDone Add structured logging via pino-compatible APIIn progress Add request-id middlewareDone Add Sentry to WorkersDone Verify the four completed Backend API items in productionIn progress Build update endpoint for menu destinationsDone Build update endpoint for link_hub destinationsDone Build update endpoint for payment destinationsDone Build update endpoint for wifi destinationsDone Build update endpoint for bluetooth destinationsDone Build update endpoint for action destinationsDone Build the webhook MCP module (tools/webhook.ts) — Matthew chose SHIP over cutDone Derive per-type opIds for destination.create/edit so Website + Gallery cards can renderDone

Wave

Backend API

The long pole — Auth, Billing, Email, Custom Domains and Edge Functions all wait on this gate.

TacTile › Launch TacTile › Backend & Infrastructure › Backend API

27/33 done6 open1 open blocker

Selected taskclear

link_hub.ts has the identical partial-drop hole contact.ts just had

DoneOwner · Vivt_919a7be6

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**link_hub.ts has the identical partial-drop hole contact.ts just had** · done

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Backend API

## The brief on file

DONE 2026-08-07 — PR #260, merged to main (merge 9fb02bbc, ancestry verified), deployed to staging.

Confirmed exactly as filed: link_hub.ts mapped links, `.filter()`ed out entries with neither a label nor a url INDIVIDUALLY, and guarded the full-collection replace only on `validLinks.length === 0`. So `[good, blank]` replaced the ENTIRE hub with just `good` and returned 200 — the blank entry's slot destroyed, the response reporting success. The all-unusable case was caught; the mixed case, which is what a client bug in one row looks like, was not.

FIXED on the destructive UPDATE path (PATCH /api/link-hub/:hash): count the drops, refuse with the count before anything is written, and say nothing was changed. Message mirrors contact.ts's.

CREATE STAYS UNGATED, consistent with the decision recorded on t_ff155928: on create there is nothing to destroy, so the failure mode is "a link you typed is missing", not "a link you had is gone". Gating create would also break hub creation for any client currently sending one blank row — a wider blast radius than the bug.

THE VALIDITY PREDICATE WAS NOT COPIED FROM contact.ts, per the warning in this task. A link entry is usable if it has a label OR a url; contact's test is `type`/`kind` presence and profile's is a string `value`. Each type accepts different shapes and porting one into another is how a data-loss bug becomes an outage.

WORTH KEEPING: PATCH /api/link-hub/:hash had NO test coverage at all before this — the file's 9 existing tests were all POST. Added 3, including a fully-valid case so the fix cannot over-refuse.

NEGATIVE CONTROL RUN, per the rule that a test passing on both trees proves nothing: with the route reverted the two new bug-detecting tests FAIL (10 pass / 2 fail); with the fix, 12 pass.

CLAUDE.md's description of this file is still correct and should stay — it holds it up as the reference implementation for safe destructive ORDERING, and the ordering was always right (insert-then-delete-by-id). What was wrong was the parse-time drop sitting above it, which is precisely why copying this file as a template propagated the bug into contact.ts. Both halves are right now.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Backend API

link_hub.ts has the identical partial-drop hole contact.ts just had