Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Web›web-mobile — Surface build·31 in this wave

Approve: Surface buildTo do · blocker Viv — Fix Dashboard 'Create → Destination' tile to link to the destination picker instead of the QR page.Done Viv — Build the missing destination picker on QR Launchpad so users can connect a destination to an existing QR code from web.Done Viv — Add app-wide error.tsx and not-found.tsx boundaries to web-mobile.Done SPEC → backend: three dead QR shape values, a sticker key Android and web disagree on, and a grader blind to bothDone QR studio: four remaining silent-substitution hazards before decoratives/stickers shipDone SPEC → backend: collapse the duelling QR enums and make every offered shape render — Matthew decided parity, not documentationDone BLOCKED: logo interactive crop cannot be built on web — all five logo snapshot fields are inert in the TS rendererDone web-mobile production build sets no NEXT_PUBLIC_API_URL — six call sites fall back to same-origin and 404To do web-mobile /auth/callback redirects to an unsanitized ?redirect param (open redirect)Done Viv — Fix the 'forms' vs 'form' naming mismatch between web-mobile's disabled-category type and the backend destination type.Done Viv — Add 'action' and 'form' to the shared DestinationType union in the SDK.Done Viv — Wire up QR design editing from the Launchpad (prefill existing design into the editor).Done Viv — Add QR code deletion once a DELETE endpoint/SDK method exists.Done Viv — Wire the AI Insights tab to the real analytics insights endpoint once the SDK exposes it.Done Viv — Remove the unreachable 'Group-level analytics are in development' stub banner from Deep Dive, or wire it up if group-scope analytics ships.Done me — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding.To do Viv — Point 'Help Center' to a real docs/FAQ URL instead of duplicating the 'Contact Support' mailto link.Done Add loading.tsx route skeletons to web-mobileDone Pin test: web-mobile Deep Dive must not offer 'group' scope while useEntitySummary has no real group endpoint (follow-up to #712, t_288daf95)To do Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)Done Viv — Either finish the Menu destination builder or mark it disabled/coming-soon in the category picker.Done Viv — Add video, audio, and action to the destination CategoryPicker with an honest disabled/coming-soon state, instead of leaving them silently absent.Done Viv — Add a timeout/failure path to the cross-domain auth handoff when setSession() hangs.Done Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.Done Kaitlynn — Verify the 6 working destination builders (website, notes, gallery, document, link_hub, contact-via-card) end-to-end.Done Kaitlynn — Verify QR create, scan, and Launchpad view/manage flows end-to-end.Done Kaitlynn — Verify ConnectCard editor (create and edit) end-to-end.Done Kaitlynn — Verify all 6 Settings pages (profile, security, subscription, notifications, appearance, plus the settings hub) end-to-end.To do Kaitlynn — Verify Analytics tabs (all 7) render real data with correct empty/error states, confirming no fabricated data anywhere.Done Kaitlynn — Verify Assets browser (Triggers / Destinations / QR / Groups / Families tabs) end-to-end.Done

Wave

web-mobile — Surface build

TacTile › Launch TacTile › Web › web-mobile — Surface build

26/31 done5 open1 open blocker

Selected taskclear

Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)

DoneOwner · Vivt_a2be9c45

Done when: apps/web-mobile/features/qr/__tests__/qr-launchpad-delete-page.test.ts has a test for each of three paths, and each mutation turns at least one test red and is then restored: (1) the page's forgetDeletedQr call in handleDelete replaced by a no-op; (2) the `if (deleting) return;` guard at the top of handleDelete removed (two taps send two DELETEs); (3) the confirm sheet allowed to close while a delete is in flight (onClose always closing, or Cancel not disabled), which would hide a failure that arrives after dismissal. Files: apps/web-mobile/features/qr/pages/QRLaunchpadPage.tsx (about lines 157-175 and 457-490) and the test file above. HELD by draft PR #706 (branch r28/qr-delete-web-mobile): both files are in it.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)** · done

Done when: apps/web-mobile/features/qr/__tests__/qr-launchpad-delete-page.test.ts has a test for each of three paths, and each mutation turns at least one test red and is then restored: (1) the page's forgetDeletedQr call in handleDelete replaced by a no-op; (2) the `if (deleting) return;` guard at the top of handleDelete removed (two taps send two DELETEs); (3) the confirm sheet allowed to close while a delete is in flight (onClose always closing, or Cancel not disabled), which would hide a failure that arrives after dismissal. Files: apps/web-mobile/features/qr/pages/QRLaunchpadPage.tsx (about lines 157-175 and 457-490) and the test file above. HELD by draft PR #706 (branch r28/qr-delete-web-mobile): both files are in it.

Where it sits: TacTile › Launch TacTile › Web › web-mobile — Surface build

## The brief on file

[2026-10-16 · Viv] DONE (r33 qr-delete-pins, supersedes the BUILT, NOT PUSHED note below). Draft PR https://github.com/TacTile-dev/TacTile/pull/767 (base r28/qr-delete-web-mobile = #706's branch, head r33/qr-delete-pins, one commit 52a02cdb on #706 head 50001830, one file qr-launchpad-delete-page.test.ts +202/-3, QRLaunchpadPage.tsx untouched, author Skeptic Check, MERGEABLE, nothing pushed to any r24-r28 branch). Six new tests, 8 -> 14 in the file; verify:web-mobile-unit 12 files, 270 tests green; tsc -p apps/web-mobile rc 0; eslint clean. Mutations on QRLaunchpadPage.tsx, each red then restored with an empty diff: forget as a no-op 1 red (cache keeps 'AAA111222,BBB333444'); `if (deleting) return;` removed 1 red (delete called 3 times, expected 1); onClose always closes 2 red; Cancel not disabled 2 red. The acceptance reader added BottomSheet backdrop-only and Escape-only variants, 2 red each. Gate: scripts/verify/gate.sh run 1 of 1 exit 0, 55 of 56 passed, the one red verify:secrets-rotation (sanctioned). Both readers CONFIRMED on 52a02cdb (acceptance and safety). CI: the verify workflow only runs for PRs based on main, so #767 has no checks of its own (gh pr checks: none reported), same as #761; the local gate stands in, and nothing is red under the diff. Caveat the readers accepted: a click-only "tap Delete twice" cannot reach the guard because Button is disabled while loading, so one test calls the React-held onClick and a sibling pins disabled plus aria-busy; no product gap, no QA card (ui_check none). Does NOT close t_e285a04a (that is #706, unmerged). Merge #706 first, then retarget #767 to main.

[2026-10-16 · Viv] BUILT, NOT PUSHED, NOT CLOSED (r33 qr-delete-pins). One commit, 52a02cdb, on LOCAL branch r33/qr-delete-pins (worktree ~/TacTile-dev/TacTile-qr-delete-pins-1016), stacked on #706 head 50001830. Test-only: QRLaunchpadPage.tsx is untouched. Six new tests in qr-launchpad-delete-page.test.ts (8 -> 14; qr dir 23 -> 29; verify:web-mobile-unit 12 files, 270 tests green; tsc -p apps/web-mobile rc 0; eslint clean). merge-tree clean against origin/main (4f2c1d6b) and against #706's head. No other open PR touches either file.

MUTATIONS (each applied to QRLaunchpadPage.tsx, run, restored with git checkout HEAD --, page diff empty after):
(1) forget replaced by a no-op: 1 red, "removes the deleted code from the Create list's cache", expected 'AAA111222,BBB333444' to be 'BBB333444'.
(2) `if (deleting) return;` removed: 1 red, "refuses to start a second delete when its handler is reached", spy called 3 times, expected 1.
(3a) onClose always closes: 2 red (backdrop and Escape test, failure-after-dismissal test), sheet null.
(3b) Cancel not disabled: 2 red (Cancel test, failure-after-dismissal test).
Extra, outside the Done-when: loading={deleting} removed from Delete: 1 red ("disables Delete while the request is in flight").

READ BEFORE THE READERS: the spec's "tap Delete twice" cannot reach the guard. Button renders disabled={disabled || loading}, so once the first DELETE is in flight a second click is swallowed before handleDelete runs. A click-only test stays green under mutation (2) (confirmed: the button test is green with the guard removed). The guard is a second line behind the disabled button, so the handler test calls the onClick React holds for the node (the __reactProps$ key). In a browser this is not a gap, so no product change.

STILL TO DO, not this stage: both readers on commit 52a02cdb, one gate, push as a draft PR (--base r28/qr-delete-web-mobile --head r33/qr-delete-pins, author Skeptic Check), then close. Status stays doing until then.

[2026-10-16 · Viv] FILED by the r33a closer of t_e285a04a. The acceptance reader mutated draft PR #706 at head 50001830 and found three paths that no test pins; each mutation stayed green at 23 of 23 (delete-qr.test.ts 15 + qr-launchpad-delete-page.test.ts 8). Those paths are read-verified only until this task lands.

BUILDER SPEC (copy-ready)
CONTEXT: #706 (https://github.com/TacTile-dev/TacTile/pull/706, branch r28/qr-delete-web-mobile, author MatthewKvamme) makes the QR Launchpad Delete row a real delete via tactile.triggers.delete(hashId). t_e285a04a closed on the draft: not merged, not deployed.

THE THREE GAPS (apps/web-mobile/features/qr/pages/QRLaunchpadPage.tsx)
1. Cache repair wiring. handleDelete passes `forget: () => forgetDeletedQr(mutateCache, hashId)` (about line 167). Replace it with a no-op and every test stays green: forgetDeletedQr and the step order are unit-tested in delete-qr.test.ts, but nothing proves the PAGE calls it. Effect if it regressed: the deleted code reappears in the Create list for the 10-15 s SWR dedupe window.
2. Double-submit guard. Remove `if (deleting) return;` at the top of handleDelete: still green. Effect: a second tap during a slow delete sends a second DELETE.
3. Sheet while deleting. The sheet uses `onClose={() => (deleting ? undefined : setDeleteOpen(false))}` and the Cancel button is `disabled={deleting}`. Letting the sheet close mid-delete: still green. Effect: a failure that arrives after dismissal shows no error anywhere.

DONE WHEN (paste verbatim into the spec): qr-launchpad-delete-page.test.ts has a test for each of the three paths, and each of these mutations turns at least one test red and is then restored: (1) forgetDeletedQr call replaced by a no-op; (2) the `if (deleting) return;` line removed; (3) the sheet allowed to close while deleting (onClose always closes, or Cancel not disabled).

HOW: add tests to apps/web-mobile/features/qr/__tests__/qr-launchpad-delete-page.test.ts; its harness already renders the real page inside SWRConfig with a `replace` spy and a mocked h.tactile.triggers.delete. (1) seed an SWR entry under ["qr-list", accountId] that contains the hash, delete, assert the entry no longer holds it. (2) make triggers.delete return a promise that never resolves, tap Delete twice, assert exactly one call. (3) with the delete pending, tap Cancel and the backdrop, assert the sheet is still open; then reject and assert the failure text is visible. Touch QRLaunchpadPage.tsx only if a test exposes a real gap. Match the vitest invocation used to run apps/web-mobile/features at #706's head (12 files, 264 tests green on 16 Oct).

WHERE TO WORK: both files are in #706, so this is HELD by it. Do NOT commit to r28/qr-delete-web-mobile. Either wait for #706 to merge and branch off origin/main, or branch off r28/qr-delete-web-mobile and open the draft with `--base r28/qr-delete-web-mobile` (the #755 pattern). New worktree under ~/TacTile-dev, one `bash scripts/verify/gate.sh` before any push, never merge.

EVIDENCE TO RETURN: the new test names, the three mutations each red with counts, each restored, merge-tree clean, both readers CONFIRMED.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

web-mobile — Surface build

Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)