Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Web›web-mobile — Surface build·31 in this wave

Approve: Surface buildTo do · blocker Viv — Fix Dashboard 'Create → Destination' tile to link to the destination picker instead of the QR page.Done Viv — Build the missing destination picker on QR Launchpad so users can connect a destination to an existing QR code from web.Done Viv — Add app-wide error.tsx and not-found.tsx boundaries to web-mobile.Done SPEC → backend: three dead QR shape values, a sticker key Android and web disagree on, and a grader blind to bothDone QR studio: four remaining silent-substitution hazards before decoratives/stickers shipDone SPEC → backend: collapse the duelling QR enums and make every offered shape render — Matthew decided parity, not documentationDone BLOCKED: logo interactive crop cannot be built on web — all five logo snapshot fields are inert in the TS rendererDone web-mobile production build sets no NEXT_PUBLIC_API_URL — six call sites fall back to same-origin and 404To do web-mobile /auth/callback redirects to an unsanitized ?redirect param (open redirect)Done Viv — Fix the 'forms' vs 'form' naming mismatch between web-mobile's disabled-category type and the backend destination type.Done Viv — Add 'action' and 'form' to the shared DestinationType union in the SDK.Done Viv — Wire up QR design editing from the Launchpad (prefill existing design into the editor).Done Viv — Add QR code deletion once a DELETE endpoint/SDK method exists.Done Viv — Wire the AI Insights tab to the real analytics insights endpoint once the SDK exposes it.Done Viv — Remove the unreachable 'Group-level analytics are in development' stub banner from Deep Dive, or wire it up if group-scope analytics ships.Done me — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding.To do Viv — Point 'Help Center' to a real docs/FAQ URL instead of duplicating the 'Contact Support' mailto link.Done Add loading.tsx route skeletons to web-mobileDone Pin test: web-mobile Deep Dive must not offer 'group' scope while useEntitySummary has no real group endpoint (follow-up to #712, t_288daf95)To do Viv — Pin the three unguarded delete paths on the web-mobile QR Launchpad (cache repair, double-submit, sheet while deleting)Done Viv — Either finish the Menu destination builder or mark it disabled/coming-soon in the category picker.Done Viv — Add video, audio, and action to the destination CategoryPicker with an honest disabled/coming-soon state, instead of leaving them silently absent.Done Viv — Add a timeout/failure path to the cross-domain auth handoff when setSession() hangs.Done Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.Done Kaitlynn — Verify the 6 working destination builders (website, notes, gallery, document, link_hub, contact-via-card) end-to-end.Done Kaitlynn — Verify QR create, scan, and Launchpad view/manage flows end-to-end.Done Kaitlynn — Verify ConnectCard editor (create and edit) end-to-end.Done Kaitlynn — Verify all 6 Settings pages (profile, security, subscription, notifications, appearance, plus the settings hub) end-to-end.To do Kaitlynn — Verify Analytics tabs (all 7) render real data with correct empty/error states, confirming no fabricated data anywhere.Done Kaitlynn — Verify Assets browser (Triggers / Destinations / QR / Groups / Families tabs) end-to-end.Done

Wave

web-mobile — Surface build

TacTile › Launch TacTile › Web › web-mobile — Surface build

26/31 done5 open1 open blocker

Selected taskclear

Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.

DoneOwner · Kaitlynnt_d0d181fc

Viewport: mobile browser (PWA). Done when: each flow completes successfully including the handoff's token-scrub-on-success behavior, and the setSession-hang edge case confirmed either fixed or logged.

Waiting on 2 · 1 still openme — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding.Viv — Add a timeout/failure path to the cross-domain auth handoff when setSession() hangs.

Unlocks 1Approve: Surface build

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.** · done

Viewport: mobile browser (PWA). Done when: each flow completes successfully including the handoff's token-scrub-on-success behavior, and the setSession-hang edge case confirmed either fixed or logged.

Where it sits: TacTile › Launch TacTile › Web › web-mobile — Surface build

## Waiting on 2

- me — Decide whether to complete the orphaned device-trust / verify-device feature on web-mobile or delete the dead scaffolding. — to do
- Viv — Add a timeout/failure path to the cross-domain auth handoff when setSession() hangs. — done

1 of those is still open. If one genuinely blocks this, say so and stop rather than working around it.

## Unlocks 1

- Approve: Surface build

## The brief on file

[2026-09-27 restart audit] OBSOLETE: empty-prompt/stale duplicate superseded by t_035683f5, t_ead12d16, t_98827cae, t_3fb34acb. Confirmed prompt was empty (len=0) before closing.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

web-mobile — Surface build

Kaitlynn — Verify auth + cross-domain handoff end-to-end: sign in, sign up, forgot/reset password, and the tactile.to → app.tactile-connect.com handoff flow.