Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Inbox — on deck·56 in this wave

Wave

Inbox — on deck

Briefs Nova has teed up and are ready to run — each task's prompt is a complete, self-contained brief.

TacTile › Inbox — on deck

44/56 done12 open2 open blockers

Selected taskclear

Suspended custom domain can be detached and re-added to evade suspension

DoneOwner · Vivt_3ef8ebe2

Found 2 Oct overnight while tracing PR #699 (billing un-suspends abuse domains). In apps/api/tactile-api/src/routes/customDomains.ts, detachDomain does not check status, and addDomain checks uniqueness only against OTHER accounts. So an owner whose domain is suspended (by billing or admin/abuse) can detach it and add it again as a fresh row, which evades the suspension with no billing event. A migration comment mentions a re-registration cooldown, but no cooldown check was found in code. Billing reinstate also has no plan-tier check.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Suspended custom domain can be detached and re-added to evade suspension** · done

Found 2 Oct overnight while tracing PR #699 (billing un-suspends abuse domains). In apps/api/tactile-api/src/routes/customDomains.ts, detachDomain does not check status, and addDomain checks uniqueness only against OTHER accounts. So an owner whose domain is suspended (by billing or admin/abuse) can detach it and add it again as a fresh row, which evades the suspension with no billing event. A migration comment mentions a re-registration cooldown, but no cooldown check was found in code. Billing reinstate also has no plan-tier check.

Where it sits: TacTile › Inbox — on deck

## The brief on file

[2026-10-15 · Viv] CLOSED on the r28 rule: the Done-when is a root-fix draft PR with tests in the existing apps/api test file, no migration applied, no deploy, product calls left to Matthew, and it never asks for a merge. This supersedes the "PREPARED, not closed ... waits on your merge" header below; what waits on Matthew is the merge, not this task. PR #702 https://github.com/TacTile-dev/TacTile/pull/702 (r28/domain-reattach-evasion, head 8b46d015, draft, base r28/billing-suspend-marker = PR #699 aacc97a0). NOT merged, NOT deployed, #699's migration 202610020410 NOT applied. EVIDENCE: apps/api/tactile-api tests/routes/billing-webhook.test.ts 39/39 in ~/TacTile-dev/TacTile-r28verify-702-1015 (my own run tonight, tree clean at 8b46d015), custom-domain cases (j)-(w) = 14 (j anchor; k admin defect; l billing defect; m legacy NULL-source row; n race; o detached-then-suspended; p reinstate lifts; q audited; r and w fail closed; s-v cooldown). Mutations by the builder and the acceptance reader, each restored to 39/39: add-side hold off 35/39 (k,m,o,q); customDomains.ts reverted to #699's copy 29/39; PATCH status guard dropped 38/39 (n); pre-read refusal off 35/39 (k,l,m,q); verified_at dropped from the cooldown 37/39 (v,w). GATE (acceptance reader, 2 of 3 runs used, no third): run 2 exit 0, "passing with known-red: verify:secrets-rotation", 55/56; verify:api-test 973/973 including (k) and (w); verify:unit 230 files / 4637 tests; tied to this worktree by gate temp dir tmp.arSrxAi1jx (56 logs, 179 path references, all TacTile-r28verify-702-1015). CI: #702 has never had CI (its base is not main, 0 checks); #699 under it has verify red only at "Secrets rotation audit" (the sanctioned red) with semgrep, dep-scan, static-firewall and playwright green. VERDICTS: acceptance CONFIRMED (Done-when item by item against customDomains.ts:923 detach refusal, :964 PATCH guard, :426 add refusal, :467 cooldown); safety CONFIRMED (11 files, none under apps/tactile-hub, apps/internal-hub, root AGENTS.md/CLAUDE.md, .env or plist; no migration in #702; no production host in any log). CAVEATS: the CONFIRMED rests on the r28 close rule, which Matthew has not formally blessed; the merged result is not gated (the gate ran on base 938b9a6c; git merge-tree is clean for #699 onto main 4f2c1d6b and #702 onto that). STILL MATTHEW'S, unchanged (the DECISION block below stands): keep detach blocked for a suspended domain and ship the 30-day cooldown with no admin clear (PR decisions 1-2). MERGE ORDER: #699 first, then retarget #702 to main, and #699 before #759 (its migration-order rule 3 flags a migration dated before main's newest 202610052300; #699's is 202610020410): filed as t_013f5f47, it covers six open PRs, not only #699. FIX AT SQUASH: commit 8b46d015 and the PR title carry no (t_3ef8ebe2) suffix, and the commit body says "10 of the 15" where it is 14 (the PR body already corrects it); the PR body's last Checks sentence ("full verify:unit and the rest of the chain were not run") is stale, they have since run. RESIDUALS, open and not blocking: t_3429fb88 (cleanup job drops the hold), t_58cdb1e3 (status poll guard), t_6365d5e7 (account deletion bypass), t_fa616d55 (Plus reinstate).

[2026-10-15 · Viv] R32 SAFETY RE-CHECK of #702, builder evidence: no commit, no push, no gate run. Heads unchanged: #702 8b46d015 (base r28/billing-suspend-marker), #699 aacc97a0, origin/main 4f2c1d6b. #702 statusCheckRollup is still empty, so no CI has ever run on it; the local gate is the evidence.
GATE LOG TIE (the plan pointed at the wrong file): scratchpad tactile-r31/gate2.log (14:54:52) is the web-responsive-audit batch's run 2 (it follows tsc1.log, cwd TacTile-web-responsive-audit-1015), not #702's. The #702 runs are tactile-r31/rev-acc/gate-702-run1.log (13:45, 54/56, ts-source-coverage SIGSEGV flake) and gate-702-run2.log (13:55, exit 0, 55/56, known-red secrets-rotation only). Tie of run 2 to ~/TacTile-dev/TacTile-r28verify-702-1015 at 8b46d015: (a) the gate temp dir it names, T/tmp.arSrxAi1jx, still exists with 56 per-check logs written 13:51-13:55 and 179 path references, all under TacTile-r28verify-702-1015 and none under another worktree; (b) its api-test log shows 973/973 and the #702-only cases (k) THE DEFECT admin and (w) cooldown lookup, which are absent from #699's test file; unit log 230 files / 4637 tests; (c) the worktree HEAD reflog has one entry (13:05:05, 8b46d015, never moved) and the newest tracked-file mtime is 13:27:40 (a mutation restore), 23 minutes before run 2 wrote its first log; git status is clean now.
RE-RUN in that worktree: billing-webhook.test.ts 39/39, custom-domain cases (j)-(w) = 14. Mutation 1, add-side suspended hold off (if (heldRows.length > 0) -> if (false && ...)): 35/39, red exactly (k),(m),(o),(q). Mutation 2, customDomains.ts reverted to #699's copy: 29/39, red (k)(l)(m)(n)(o)(p)(q)(r)(s)(w), anchors (j)(t)(u)(v) green. Both restored; status clean, 39/39 again. merge-tree: #699 aacc97a0 onto origin/main 4f2c1d6b clean (rc 0); #702 8b46d015 onto that result clean (rc 0); 11 files, +1199/-73, one migration (#699's, unapplied).
DIFF vs DONE-WHEN: detach of a suspended row is a 409 in the read and again in the PATCH's own WHERE (status=neq.suspended, return=representation; zero rows -> 409, no Cloudflare delete); add refuses a same-account suspended row, detached or not, keyed on status; the 30-day cooldown is promised by 20260510_custom_domains.sql lines 77 and 148 and the threat model, and is enforced; both lookups fail closed; no migration in #702. The product calls are in the PR body under "Decisions for Matthew".
NEW RESIDUAL, filed as t_3429fb88 (low, not blocking): custom-domain-cleanup has no status filter, so a row the owner detached BEFORE an admin suspended it (case (o)) is hard-deleted 30 days after detach and the hold lapses. Still open: t_58cdb1e3, t_6365d5e7.
NOT CLOSED by this pass: waits on an independent reader, then the close. Merge order stands: #699 first, then retarget #702 to main.

[2026-10-15 · Viv] PREPARED, not closed: the safety reviewer REFUTED on missing evidence, and the acceptance reviewer then produced that evidence. Next round: one fresh safety re-check of the gate result below, then close. Waits on your merge.
DECISION (product scope): keep detach blocked for a billing-suspended domain, and ship the 30-day re-registration cooldown with no admin clear (PR #702 decisions 1-2).
RECOMMEND: yes to both; add an admin clear endpoint afterwards.
IF YES, NEXT: you merge #699, retarget #702 to main, merge #702. The #699 migration stays unapplied until your production batch.
COST IF YES: an owner behind a mistaken suspension needs support until a clear endpoint exists. COST IF NO: detach then re-add still evades a suspension.
SAFE TO ASSUME: nothing merges, migrates or deploys without you.
PR #702 https://github.com/TacTile-dev/TacTile/pull/702 (r28/domain-reattach-evasion, head 8b46d015, draft; base r28/billing-suspend-marker = PR #699 aacc97a0). MERGE ORDER: #699 first (#702 imports ../utils/customDomainSuspension, which exists only on #699), then retarget #702 to main. merge-tree vs origin/main 4f2c1d6b clean for both heads. #702 has never had CI.
EVIDENCE: billing-webhook.test.ts 39/39 (custom-domain cases (j)-(w) = 14); verify:api-test 973/973; verify:unit 230 files / 4637 tests; scoped-id-filters, destructive-order, migration-grants, agents-md-references and the rest of the targeted checks exit 0. GATE, run by the acceptance reviewer in ~/TacTile-dev/TacTile-r28verify-702-1015 (2 of 3 runs used): run 1 54/56, ts-source-coverage red on the known "tsc --showConfig failed twice" SIGSEGV flake (standalone rc 0); run 2 exit 0, "gate: passing with known-red: verify:secrets-rotation", 55/56. Mutations, each restored: add-side suspended hold off -> (k),(m),(o),(q) red; cooldown filter flipped -> (s),(t) red; customDomains.ts reverted to #699's version -> 10 of 39 red, 4 anchors pass.
REFUTATION, quoted (safety): "The plan's per-task spec for t_3ef8ebe2 makes one full gate.sh on 8b46d015 mandatory ... The builder's report says it was not run ... gh pr view 702 shows an empty statusCheckRollup, so no CI has ever run on this head ... 'CI not red under the diff' is therefore vacuous here." Repair hint: gate once in the clean worktree, then post. The gate above is that run; do not spend a third.
NOT BLOCKING: getDomainStatus PATCH (customDomains.ts:789-792) has no status guard, filed t_58cdb1e3. Commit 8b46d015 lacks the (t_3ef8ebe2) suffix and says "10 of the 15 new cases" where the PR says 14: fix at squash. Related: t_6365d5e7, t_fa616d55. #699's migration 202610020410 is NOT applied.

[2 Oct 2026 overnight — Viv: draft PR #702 https://github.com/TacTile-dev/TacTile/pull/702 — api: enforces the 30-day re-registration cooldown so an owner cannot detach a suspended custom domain and re-add it (stacked on #699); not merged, not deployed]

Verify on fresh GitHub main that a suspended custom domain (status=suspended, either source) can be detached and re-added by its owner to get a non-suspended row. Read customDomains.ts detachDomain/addDomain, the custom_domains migrations, and PR #699 (suspension_source marker) if merged. Fix at the root as a draft PR: block detach of a suspended domain, or carry the suspension across re-add for the same account+domain, and add the re-registration cooldown if the migration comment promises one. Include tests in the existing apps/api billing/custom-domain test files. Do not apply migrations or deploy. Product calls (e.g. whether detach is allowed for billing-suspended domains) go to Matthew in the PR.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Inbox — on deck

Suspended custom domain can be detached and re-added to evade suspension