Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

custom-domain-cleanup hard-deletes a detached AND suspended row 30 days after detach, ending the suspension hold (#702 case (o))

DoneOwner · Vivt_3429fb88

Found by the r32 safety re-check of t_3ef8ebe2 (PR #702, head 8b46d015). #702 holds a suspended domain against detach and against a same-account re-add, including a row the owner detached BEFORE an admin suspended it (case (o): the admin suspend route patches by row id and does not filter on detached_at). But supabase/functions/custom-domain-cleanup/index.ts selects `detached_at is not null and detached_at < now()-30d` with NO status filter and hard-deletes the matches, so that detached+suspended row is deleted 30 days after the owner detached it and the hold lapses with it. Bounded and narrow (owner must detach first, admin suspends within the 30 days), not blocking #702. Not covered by t_58cdb1e3 (getDomainStatus PATCH), t_6365d5e7 (account-deletion cascade) or t_fa616d55.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**custom-domain-cleanup hard-deletes a detached AND suspended row 30 days after detach, ending the suspension hold (#702 case (o))** · done

Found by the r32 safety re-check of t_3ef8ebe2 (PR #702, head 8b46d015). #702 holds a suspended domain against detach and against a same-account re-add, including a row the owner detached BEFORE an admin suspended it (case (o): the admin suspend route patches by row id and does not filter on detached_at). But supabase/functions/custom-domain-cleanup/index.ts selects `detached_at is not null and detached_at < now()-30d` with NO status filter and hard-deletes the matches, so that detached+suspended row is deleted 30 days after the owner detached it and the hold lapses with it. Bounded and narrow (owner must detach first, admin suspends within the 30 days), not blocking #702. Not covered by t_58cdb1e3 (getDomainStatus PATCH), t_6365d5e7 (account-deletion cascade) or t_fa616d55.

Where it sits: TacTile › Inbox — on deck

## The brief on file

[2026-10-23 · Viv] r41 CLOSE (08:47 PDT): shipped on draft PR #781 https://github.com/TacTile-dev/TacTile/pull/781 (r40/edge-cf-retry, new commit 1bdfef16 on ef5eaa71, fast-forward, base main; not merged; NOT deployed, nothing applied). supabase/functions/custom-domain-cleanup/index.ts: .neq("status","suspended") on the select AND on the delete (the delete stays keyed on the selected ids, so it only narrows). New tests/unit/custom-domain-cleanup-suspended.test.ts drives the real handler against an in-memory table that applies not/lt/neq/in: 4/4 (anchor plain detached >30d still deleted; suspended+detached 31d and 400d not selected; not deleted; a row that turns suspended between select and delete survives). With audit-call-site-behaviour, audit-deno-mirror-parity and cf-fetch-retry: 59/59. The two audit tests were NOT edited: the reader confirmed they read only metadata keys / the audit.ts mirror and do not pin this query. Mutations red then restored: select filter removed 2/4, delete filter removed 1/4, both removed 3/4, "Suspended" 3/4, .eq 4/4. verify:destructive-order rc 0 with no finding here. Reader: COMMIT and TASK CONFIRMED. Gate 55/56 (start load1 2.25). merge-tree clean vs main and #699; vs #671 this file auto-merges (#671 conflicts elsewhere). CI read 08:46: verify red only at "Secrets rotation audit" (job 120498198073), playwright SUCCESS. The six-line PRODUCT DECISION (suspended+detached rows now live until an admin acts; recommend yes) is posted on #781.

CONTEXT: PR #702 (r28/domain-reattach-evasion, stacked on #699) makes a suspended custom domain un-removable by its owner and bars a same-account re-add of any suspended row, detached or not (billing-webhook.test.ts case (o)). The retention job supabase/functions/custom-domain-cleanup/index.ts (lines 37-44, 98-103) selects `.not("detached_at","is",null).lt("detached_at",cutoff)` and deletes with `.delete().in("id", ids)`: no status filter, so a row that is detached AND status='suspended' is hard-deleted 30 days after detached_at and the suspension hold ends.

DO: in the existing function, exclude suspended rows from both the select and the delete (`.neq("status","suspended")` on the select; the delete is keyed on the ids selected, so confirm it cannot widen). Update any Deno mirror and the tests that pin this function (tests/unit/audit-call-site-behaviour.test.ts and tests/unit/audit-deno-mirror-parity.test.ts both reference custom-domain-cleanup; read them first). Add one test: a detached row with status 'suspended' older than 30 days is NOT in the delete set; a detached 'detached' row of the same age still is (anchor).

PRODUCT CALL for Matthew, put it in the PR as a six-line DECISION block: a suspended+detached row would then live until an admin reinstates or removes it. Recommend yes (the hold is the point of the suspension); the alternative is to stamp a longer retention. Files: supabase/functions/custom-domain-cleanup/index.ts plus its two tests. Check them against open PR file lists before starting (#702 and #699 do not touch the function).

DONE WHEN: draft PR, targeted tests with counts, a mutation (filter removed -> the new test red, restored). Do NOT deploy the edge function (production) and do not apply anything.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

custom-domain-cleanup hard-deletes a detached AND suspended row 30 days after detach, ending the suspension hold (#702 case (o))