Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Web›Web — Dead code removal·4 in this wave

Approve: Dead code removalTo do · blocker Confirm .gitkeep scaffold folders are intentional, not abandoned workTo do Delete the orphaned useLiveFeed hooksDone Verify /sandbox/wireframes is excluded from productionDone

Wave

Web — Dead code removal

Confirmed orphans: apps/web/features/analytics/hooks/useLiveFeed.ts + useLiveFeedMock.ts have zero importers anywhere (grep confirms only self-references). apps/web/app/sandbox/wireframes/ is a live, publicly-routable design-exploration surface with six real flows and no visible auth/robots gate. Thinner than iOS's dead-code problem — no duplicate abandoned feature generations found on web, and the .gitkeep-only scaffold subfolders (destinations/, agent/, marketing/) turned out to be a deliberate empty per-feature-folder convention, not evidence of abandoned work — every one of those features has real, live, routed code elsewhere in the same folder. apps/web-mobile/lib/auth/device-trust.ts is also a confirmed zero-caller orphan but is already tracked separately at t_a1a873d3 in the web-mobile Surface build wave — not duplicated here.

TacTile › Launch TacTile › Web › Web — Dead code removal

2/4 done2 open1 open blocker

Selected taskclear

Verify /sandbox/wireframes is excluded from production

DoneOwner · Vivt_ff96f955

Unlocks 1Approve: Dead code removal

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Verify /sandbox/wireframes is excluded from production** · done

Where it sits: TacTile › Launch TacTile › Web › Web — Dead code removal

## Unlocks 1

- Approve: Dead code removal

## The brief on file

Viv — verify apps/web/app/sandbox/wireframes is excluded from the production build or gated behind auth. Done when: the route either 404s in production or requires auth, confirmed by hitting the deployed URL directly.

--- DONE 2026-07-27 (Viv) · verification only, no code change needed ---
VERIFIED SAFE. Live checks, all HTTP 404:
  https://tactile.to/sandbox/wireframes            → 404
  https://tactile.to/sandbox/wireframes/first-run  → 404
  https://tactile.to/sandbox                       → 404
  https://staging.tactile.to/sandbox/wireframes    → 404
Body is a genuine 404 ("could not be found", 5.9 KB), serves no wireframe content, and carries both `<meta name="robots" content="noindex">` and `noindex, nofollow`.

THE BRIEF'S PREMISE WAS WRONG — it says "no visible robots/auth gate in the layout," but it was reading apps/web/app/sandbox/wireframes/layout.tsx. The gate lives one level up in the PARENT, apps/web/app/sandbox/layout.tsx, and there are three layers:
1. Runtime: sandbox/layout.tsx:27 calls notFound() unless NEXT_PUBLIC_ENABLE_SANDBOX === "true".
2. Build-time: apps/web/next.config.mjs:12 hard-fails the build if NODE_ENV=production AND the flag is "true".
3. Metadata: sandbox/layout.tsx:23 sets robots { index: false, follow: false }.

ALSO CORRECTS A STALE AUDIT NOTE: data/checklists/recompile-verification.json:40 warns ".env tracks it true … recommend moving the var out of repo-tracked .env." No longer true. Only .env.local.example and .env.staging.example are tracked and neither sets the flag; the local (gitignored) apps/web/.env.local has NEXT_PUBLIC_ENABLE_SANDBOX= (empty). That recommendation can be closed.

ONE COSMETIC OBSERVATION, not a gap: the 404 response still carries the route's own <title> ("🧪 Sandbox · Flow — First run") because Next computes metadata before rendering the notFound boundary. It reveals a flow name and nothing else — no nav, no content, and the page is noindex/nofollow. Not worth fixing unless you want zero signal.

NOTE for whoever owns deploy: the comments in next.config.mjs and docs/DEV_ENVIRONMENT.md describe Vercel Preview/Production env scoping, but web actually deploys on Cloudflare Workers + OpenNext. The guard works regardless (it keys off NODE_ENV), but the guidance text names the wrong platform.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Web — Dead code removal

Verify /sandbox/wireframes is excluded from production