Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›iOS›iOS — Settings, Analytics & tools build·133 in this wave

Approve: iOS Settings, Analytics & toolsTo do · blocker Pro-gate Deep Dive, Compare, Map, and Overview to match backend's plus-tier requirementDone · blocker Decide fate of ProfilePhotoCropReviewView (ship or delete)To do Decide fate of Analytics Overview tab (ship or delete)To do Decide fate of legacy Dashboards widget system (~15 files)To do Decide Goals v2 scope (recurrence, prefill, streak history, sort, status, taxonomy)To do Add re-edit support for saved ConnectCards and Social Hub destinationsDone Build proposed-data mapping layer for native AI proposal cardsDone Decide routing for 'Program NFC Tag' hub tileTo do Build iOS NFC tap-to-write re-encode, password-protect, and mode persistenceTo do Verify analytics numbers against ground truth (not just rendering)To do Define real scope of the destination-analytics pipeline before it's built blindTo do Verify no analytics events are recorded for free accountsTo do Fix unregistered tactile:// URL scheme breaking every AI card "Open in editor" handoffDone Agent sessions: add the PATCH-title and hard-DELETE routes (route layer only — the DB is ready)Done Money display: no currency column on payments, forced 2-decimal formatting, and silent "$" fallback on bad currency codesTo do insights.ts calls callAnthropicMessages directly instead of createModelProvider, violating ADR-0001's amendmentDone Fix stale 'coming soon' copy on Company Info cardDone Produce real Quick Tutorial product walkthrough videoTo do Host and wire real Quick Tutorial videoTo do Delete dead stub properties in SettingsHostViewModelDone Analytics dead-code sweep — Deep Dive legacy + stale commentsTo do Fix 'Set goal' button closure-binding bug in Deep DiveTo do Wire custom date-range Apply in Dashboards device distribution widgetDone Decide fate of Map breadcrumb drill-down featureTo do Fix deprecated GeoTableWidget rendering during loading windowDone Add filter-aware empty state copy to Goals listTo do Fix scoped-goal display name resolution in Goal SheetDone Decide fate of multi-entity Compare dashboard widget conceptTo do Decide fate of Sources dashboard tile (needs new API endpoint)To do Add rename/delete UI for dashboardsDone Decide whether dashboard share/export is in scopeTo do Decide Pro-lock widget scope for Dashboards paletteTo do Fix duplicate widget title bug in Dashboard tilesDone Surface tier-verification error in AnalyticsProGateDone Wire Mute Destination to real persisted stateDone Wire menu destination edit submission (currently a no-op stub)Done Delete dead ConnectCard editor files (FieldEditorView, CardPreviewView, CardStyleSheet)Done AI surface dead-code and stale-comment sweepDone Fix GalleryCard empty state at zero proposed itemsDone Decide real scope for QRLaunchpad Share & ExportTo do Sign off: Settings surfaces not flagged in this auditTo do Sign off: Analytics files/widgets confirmed clean in this auditTo do Sign off: ConnectCard field editors and models confirmed cleanTo do Sign off: AI stubbed-banner behavior confirmed working as intendedTo do Sign off: QR generator and NFC stamp-test harness confirmed clean outside tracked gapsTo do Wire in or remove orphaned AnalyticsKitRealtimeScreen per decisionDone Build real AI Q&A dashboard widget or remove per decisionTo do Build multi-entity Compare dashboard widget or remove per decisionTo do Build Sources dashboard tile backend + wiring or remove per decisionTo do Build dashboard share/export or confirm out of scope per decisionTo do Mark specific widgets Pro-exclusive or remove lock machinery per decisionTo do Wire Map breadcrumb drill-down or remove per decisionTo do Decide: delete the preview-only Analytics widget island (7 files, 8 uncalled client methods)To do Android: two more places show a plan refusal (403) as a generic failure - Assets Families tab, Home insight cardDone A/B variant assignment hashes the daily visitor_hash, so one visitor can change variant from one day to the nextTo do Android: add a ViewModel test that generateInsight() maps a tier refusal to the Pro upsellDone iOS: pin the Deep Dive fetch set with a stubbed-client test (6 requests for account/trigger/destination, 7 for campaign/group)To do iOS Deep Dive trigger hero shows a change percentage without checking the Worker honoured the compare windowDone previousYearWindow gives a zero-length or reversed prior window when the window ends on Feb 29Done Android Activity chart overlays a "last year" line even when the Worker answered the previous periodTo do Wire ProfilePhotoCropReviewView Save + Change Photo buttonsTo do Fix Contact Support photo-library attachment (picker bound to nil)Done Build Segment + Zapier analytics connectorsBlocked Notify user when custom domain provisioning completesBlocked Wire in or remove Analytics Overview tab per decisionTo do Build real custom-range comparison in Deep Dive (Compare sheet + Activity widget)To do Wire 'Continue conversation' CTA to real Insights screenTo do Show real errors instead of fake seed data in Deep Dive asset pickerDone Wire real Avg-time-to-arrive / Next-action KPIs or remove tilesDone Fix Live Activity Feed entity scoping and add loading/error stateBlocked Decide whether Compare tab should be Pro-gatedDone Surface real errors instead of fake totals in Compare tabDone Fix Real-time tab mock-data fallbacks and missing connection/error UIDone Decide fate of orphaned AnalyticsKitRealtimeScreen.swiftDone Fix Map tab hardcoded mock country data and missing error stateDone Wire Dashboards Geo widget tile actions (view full map, granularity chips)To do Delete confirmed-dead legacy Dashboards widget codeTo do Add loading state and surface errors in Goals listDone Fix Goal Sheet stale error state and build asset-picker retry chipDone Build approved Goals v2 scope itemsTo do Wire Dashboards 'Pick a goal' pill and remove hardcoded fallback progressDone Decide fate of AI Q&A dashboard widget stubTo do Decide fate of ConnectCard photo field typeTo do Fix Preview Destination to show real saved card, not fake demo dataDone Persist Destination Name/Description edits on Save and CloseDone Replace AgentConnectCard's hardcoded fake account name with real OAuth dataBlocked Complete AgentDraftStore seeding for remaining proposal card typesDone Wire real 'Send test event' for WebhookCardDone Decide when to build the real Webhook destination connectorTo do Wire agent pending-approvals badge to real pending countTo do Decide whether Approvals Inbox needs Tweak supportDone Add Tweak support to Approvals InboxTo do Build real rename/delete endpoints for agent sessionsDone Auto-refresh QR image after white-label domain reprogramBlocked Build real Static Program flow in NFCStampTestViewTo do Build real Bulk Program flow in NFCStampTestViewTo do Fix NFC Lock Tag toggle (silent no-op, no persistence)Done Build real QR export per decided scopeTo do Decide the account-timezone plan for analytics day-boundariesTo do Wire the account-timezone decision into rollups and AnalyticsRangeTo do QA: brand-new zero-scan account across every Analytics tabBlocked Load-test analytics queries against a high-volume partitioned accountBlocked Verify AI proposal card "Open in editor" handoffs are dead on iPhoneDone Cards whose tweak feedback sends a placeholder instead of the user's edit (iOS #240 defect b, remaining)Done Source-attribution RPC pivot labels don't match the API's by_campaign/by_group keysDone iOS Dashboards "Top performers" tile 400s for a family/campaign-scoped assetTo do is_first_seen only detects "first scan today", not "first scan ever"Done visitor_year_hash keys on browser major version, so browser auto-updates and shared IPs silently reshuffle unique-visitor countsTo do UA parser misclassifies iPad Safari as desktop macOS and Android tablets as mobileDone "hybrid" trigger medium renders as "unknown" on iOS and AndroidTo do Android 24h analytics chart always requests day granularity, never hourlyDone Android goal editor has no "daily" recurrence optionDone Android shows generic 403 error cards instead of an upsell on Free-tier Deep Dive/Compare/Goals/MapDone Android AI Insights 403 (Free/Plus) shows as a generic "couldn't generate" failure, not an upsellDone Android Deep Dive geo region/city drill-down hard-caps at 8 rows with no way to see moreDone Android analytics map has no centroid for Iceland, Luxembourg, Croatia, Costa Rica or EstoniaDone iOS Trigger Mix / Compare NFC% gauge silently excludes link and direct opensDone iOS Deep Dive fetches trigger/destination/campaign/group-scoped data that no live screen ever rendersTo do web-mobile production deploy is 3 months and 89 commits behind origin/main's analytics featureDone destinations.total_opens is read by two endpoints but never incremented anywhereBlocked analytics_rollups_daily and analytics_alerts have no readers anywhere in the appTo do document/notes/video/audio destinations never fire the funnel beacon — Deep Dive funnel widget is permanently all-zero for themDone Decide: Families Leaderboard on iOS (Deep Dive + Dashboards tile) - the roster request can only 400To do Pin the first-seen call site in events.ts: swapping visitor_year_hash for visitor_hash leaves every test greenDone Plus promises "AI analytics (Basic)" but AI Insights is Pro-only: align server or plan listsTo do iOS Activity widget Custom range shows page-level priors under a Custom labelTo do API answers compare=previous_year with the previous period, so iOS "Same period last year" shows the wrong comparisonDone Check the funnel beacon is accepted from a browser: sendBeacon sends credentials and utils/cors.ts sets no Access-Control-Allow-CredentialsDone Run the fixed funnel beacon in WebKit and Firefox: the t_e9f24402 browser run was Chromium 143 onlyBlocked Android Activity "Same period last year" totals row compares with the previous period until the API deploys; no meta.compare checkDone Geo tile: Region and City chips leave the Analytics tile on an endless skeleton (tile VM loads countries only)To do QA: opening a document, note, video or audio link now counts as a view in Analytics (desktop web)Blocked

Wave

iOS — Settings, Analytics & tools build

Remaining build work across Settings, Analytics, ConnectCard, the AI panel, and QR/NFC programming. Everything marked 'coming soon' here is intended to ship.

TacTile › Launch TacTile › iOS › iOS — Settings, Analytics & tools build

60/133 done73 open1 open blocker

Selected taskclear

Check the funnel beacon is accepted from a browser: sendBeacon sends credentials and utils/cors.ts sets no Access-Control-Allow-Credentials

DoneOwner · Vivt_e9f24402

Found by the adversarial read of the public viewer audit (t_adc2145a). Repo reading only: not confirmed in a browser, no production read made. Every live /t page inlines a beacon that posts with navigator.sendBeacon (credentials included) to the API, and the API's CORS helpers never send Access-Control-Allow-Credentials, so a browser may refuse the post and the funnel may under-report from real phones.

Unlocks 1Run the fixed funnel beacon in WebKit and Firefox: the t_e9f24402 browser run was Chromium 143 only

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Check the funnel beacon is accepted from a browser: sendBeacon sends credentials and utils/cors.ts sets no Access-Control-Allow-Credentials** · done

Found by the adversarial read of the public viewer audit (t_adc2145a). Repo reading only: not confirmed in a browser, no production read made. Every live /t page inlines a beacon that posts with navigator.sendBeacon (credentials included) to the API, and the API's CORS helpers never send Access-Control-Allow-Credentials, so a browser may refuse the post and the funnel may under-report from real phones.

Where it sits: TacTile › Launch TacTile › iOS › iOS — Settings, Analytics & tools build

## Unlocks 1

- Run the fixed funnel beacon in WebKit and Firefox: the t_e9f24402 browser run was Chromium 143 only

## The brief on file

[2026-10-16 · Viv] DONE against draft PR #768 (https://github.com/TacTile-dev/TacTile/pull/768, r33/beacon-credentials, one commit bc1706f6 on origin/main 4f2c1d6b; MERGEABLE; not merged, not deployed, no API change, cors.ts untouched, no production read or write). OWN ACCEPTANCE met on the first DONE-WHEN branch: a named unit test with counts drives the real handlePreflight, applyCorsHeaders and eventsRoute with the serialized beacon and goes red when the fix is removed. tests/unit/viewer-beacon.test.ts 13 plus destination-analytics.test.ts 18 = 31/31; verify:unit 234 files, 4702/4702. Mutations red then restored to 31/31: author 18 (old sendBeacon-JSON-first), 6 (fetch application/json), 2 (drop keepalive), 2 (drop credentials omit), 2 (last-resort Blob as JSON); reader 6, 18, 3 (double send), 4 (Content-Type check in events.ts). Real browser, headless Chromium 143, local stand-ins only (~/TacTile-dev/evidence/r33/beacon-credentials/): before 0 of 2 events landed on the default path, 0 of 2 from a non-allowlisted origin, 0 of 2 on a sendBeacon-only engine; after 2 of 2 on all four paths, zero preflights. GATE run 1 of 1: 55 of 56, only verify:secrets-rotation (sanctioned), exit 0. CI at 10:20 PDT on bc1706f6: verify red ONLY at step 23 "Secrets rotation audit" (the other verify steps green, including Unit tests, Test-file coverage and Gate/CI step parity); playwright, dep-scan, semgrep, static-firewall, changes pass; swift-parity skipping. READERS: acceptance CONFIRMED and safety CONFIRMED, commit correct, shippable. CORRECTION to the ship note above: "close after t_93a5a6e5" was circular, because t_93a5a6e5 depends on this task and cannot start until it is done. So this closes on its own acceptance and the residual stays open as t_93a5a6e5 (WebKit and Firefox run of the same four scenarios; iPhone Safari is the browser an NFC tap opens). THIS CLOSE DOES NOT CLAIM SAFARI OR FIREFOX: the browser proof is Chromium only. The deploy is Matthew's. ui_check none, so no QA card. Open caveats are in the PR body (author Skeptic Check, fetch-first order, text/plain lets any origin POST a funnel event so metering is the protection, characterisation test to delete if cors.ts gains Allow-Credentials, stale index.ts:150-152 anchor in r32/public-viewer-audit).

[2026-10-16 · Viv] SHIPPED AS DRAFT PR #768 (r33/beacon-credentials, commit bc1706f6, on origin/main 4f2c1d6b). Two readers CONFIRMED (acceptance and safety), commit correct. Gate run 1 of 1: 55 of 56, only verify:secrets-rotation red (sanctioned), rc 0, load1 5.8, CI idle. NOT CLOSED: the browser proof is Chromium 143 only and iPhone Safari is the browser an NFC tap opens; close after t_93a5a6e5 (WebKit and Firefox run) or when Matthew accepts the gap. No API change, cors.ts untouched. PR body carries the caveats: delivery order now fetch first and sendBeacon last resort; text/plain lets any origin POST a funnel event (CORS was never the protection, per-IP and per-hash metering is); the viewer-beacon characterisation test goes if cors.ts ever adds Allow-Credentials; r32/public-viewer-audit cites the stale index.ts:150-152 anchor.

[2026-10-16 · Viv] BUILT, NOT GATED, NOT PUSHED, NO READER YET. Option (b), commit bc1706f6 on local r33/beacon-credentials (worktree ~/TacTile-dev/TacTile-beacon-credentials-1016, on origin/main 4f2c1d6b). Real bug, not (c).
UNKNOWNS. (1) Cross-origin: the viewer reads apiOrigin = NEXT_PUBLIC_API_ORIGIN ?? "https://api.tactile.to" (apps/web/app/t/[hash]/route.ts:1525); apps/web/wrangler.jsonc:87 and :113 show the api. hosts, so tactile.to/t/<hash> to api.tactile.to is cross-origin. (2) The handler reads no cookie, Authorization or Content-Type: handleDestinationEvent only calls request.json() (events.ts:671); rate-limit.ts:85 exempts the path; no middleware checks content type. (3) Browsers DO block it. Headless Chromium 143, two local https servers, real cors.ts + events.ts + route.ts GET, no traffic off 127.0.0.1: default path 0 of 2 events landed (preflight 204 with ACAO and no Access-Control-Allow-Credentials; console: blocked by CORS policy); origin not on the allowlist 0 of 2 (preflight 403); sendBeacon-only engine 0 of 2; only the fetch fallback landed (2 of 2, no cookie).
FIX. fetch + keepalive + credentials omit + text/plain body (safelisted: no preflight, no allowlist dependence); sendBeacon only if there is no fetch, also with a text/plain Blob. No API change, so #703 and cors.ts are untouched. AFTER: 2 of 2 land on all four paths, zero preflights, no cookie except the sendBeacon-only path (it cannot drop credentials).
TESTS. viewer-beacon.test.ts 13 tests and destination-analytics.test.ts 18, 31/31 green; verify:unit 234 files, 4702/4702; web-check, agents-md-references, agents-sync, test-coverage, console-ratchet green. The new viewer-beacon tests run the SERIALIZED beacon through the real handlePreflight, applyCorsHeaders and eventsRoute. Five mutations red (failed/total of 31): old sendBeacon-JSON-first 18, fetch application/json 6, drop keepalive 2, drop credentials omit 2, last-resort Blob JSON 2; restored to 31/31.
EVIDENCE. ~/TacTile-dev/evidence/r33/beacon-credentials/ (browser-before.json, browser-after.json, browser-summary.txt, mutation-*.log, harness.mts).
RESIDUAL. Chromium only: no WebKit or Firefox here, and iPhone Safari is the browser an NFC tap opens (follow-up t_93a5a6e5, dep on this). On an origin the allowlist does not know the event lands but the browser logs a CORS error for the unreadable response. Related t_7dc5d66c (custom-domain KV key) is no longer a beacon blocker. Next: both readers, gate, draft PR, then close.

[2026-10-16 · Viv] FIX, OR CLOSE AS NOT A BUG WITH EVIDENCE. Found by the adversarial read of the public viewer audit (t_adc2145a, branch r32/public-viewer-audit, docs/audit/2026-10-public-viewer-responsive.md). Repo reading only: NOT confirmed in a browser, and no production read was made.

WHAT LOOKS WRONG. Every live /t/<hash> page inlines the funnel beacon (apps/web/app/t/[hash]/route.ts:173-210, serialized from packages/destination-analytics/src/index.ts). It posts to {apiOrigin}/api/v1/events/destination with navigator.sendBeacon(url, a Blob of type application/json) (index.ts:150-152), and falls back to fetch with keepalive and mode cors only when sendBeacon is missing or returns false. sendBeacon sends credentials, and a JSON Blob is not a CORS-safelisted content type, so a browser sends a preflight first. The API answers preflights in apps/api/tactile-api/src/utils/cors.ts (handlePreflight; the header block sets Access-Control-Allow-Origin at :70) and decorates responses with applyCorsHeaders (origin only, :94). Neither sets Access-Control-Allow-Credentials, and the file header (:3-4) says it echoes the origin "so we can safely allow credentialed requests in the future". A grep for Allow-Credentials over apps/api finds nothing. A credentialed cross-origin request whose response lacks Access-Control-Allow-Credentials: true is blocked by browsers, so the beacon may never land and GET /api/analytics/destinations/funnel may under-report from every real phone. This surfaced because the audit's mock API had to echo the origin and allow credentials before the beacon landed. The handler is routes/events.ts:142 and :610 (POST /api/events/destination; the /api/v1 prefix mapping was not checked).

UNKNOWNS, RESOLVE FIRST (repo and local stand-ins only). (1) Are the viewer origin and apiOrigin cross-origin in production? Read the apiOrigin wiring in route.ts and the env bindings; a same-origin or custom-domain path would avoid CORS. (2) Does the events handler read any cookie or credential at all? If not, the beacon gains nothing from credentials. (3) Do browsers actually block it? Prove it with a local stand-in: drive the real handlePreflight and applyCorsHeaders (patterns: tests/unit/options-preflight.test.ts, tests/unit/cors-custom-header-exposure.test.ts) and, if a unit test cannot settle it, a headless Chromium against a local mock that serves exactly those headers.

DO. Pick one and say why. (a) Add Access-Control-Allow-Credentials: true for allowlisted origins only, never with "*", on the preflight and the applied response, with a test that goes red when the header is removed. (b) Make the beacon non-credentialed (fetch with credentials omit, or a text/plain Blob) with a test that pins it; this changes only the web bundle and the serialized snippet, not the API, so recommend it if unknown (2) says the endpoint reads no cookies. (c) If the local browser run shows the beacon already lands, close as not a bug with that run as the evidence and change no code.

FILES AND HOLDERS. apps/api/tactile-api/src/utils/cors.ts is edited by open PR #703 (r28/checkout-return-origin): run git merge-tree against its head and state the merge order; do not edit that branch. apps/web/app/t/[hash]/route.ts is edited by #681 and #655. Never touch apps/tactile-hub or apps/internal-hub.

DONE WHEN. A named unit test, with counts, drives the real CORS code or the serialized beacon with a credentialed request and fails when the fix is removed; or a local browser run shows the beacon lands with no change (a note, no code). Local stand-ins only; no production read or write; no *.spec.ts. Any API change stays a DRAFT PR: the deploy is Matthew's.

RELATED. t_8c0d6572 (document, note, video and audio viewers never fire the beacon), t_7dc5d66c (custom-domain CORS preflight reads a KV key nothing writes). Not a dependency of Approve: Web responsive depth (t_7dd3090b).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

iOS — Settings, Analytics & tools build

Check the funnel beacon is accepted from a browser: sendBeacon sends credentials and utils/cors.ts sets no Access-Control-Allow-Credentials