Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Decide and implement Free-tier destination revitalization

DoneOwner · Vivt_9008dc76

Unlocks 2Approve: NFC/QR Core Pipeline Build the unassigned/orphaned tag landing page

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Decide and implement Free-tier destination revitalization** · done

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 2

- Approve: NFC/QR Core Pipeline
- Build the unassigned/orphaned tag landing page

## The brief on file

RESOLVED 2026-07-28 (reconciliation pass). Two concurrent sessions each built half of
this on separate branches — exec/free-tier-inactivity-system-landed (MCP-server touch,
email templates, web render states) and exec/free-tier-inactivity-system (requireSession
touch, inactivitySweep.ts, reactivate routes, the three emitAudit calls + follow-up
migration). Neither was shippable alone, and a prior report claimed this was committed
when it was actually sitting staged and orphaned behind a stuck git lock.

Verified everything against the actual repository (not branch names or prior reports),
then merged both halves into ONE branch: exec/free-tier-inactivity-system, commit
daecb376 (union of both halves' files — verified byte-for-byte identical to -landed's
content before staging) then b8a73083 (real bug fix: the architecture test forbidding
direct touch_account_activity calls had never actually been run — it false-positived on
two doc-comment mentions of the RPC name; fixed by stripping comments before the
substring check).

Verified by execution, not just typecheck: tsc --noEmit clean across apps/api/tactile-api,
packages/mcp-server, packages/email, apps/web. Got the sandbox's tsx/vitest test runners
working (sourced the missing linux-arm64 esbuild/rollup native bindings) — the previous
"cannot execute tests in this sandbox" note was an environment gap, not a hard limit.
apps/api/tactile-api's test:ci is green (389/389). Root verify:unit is green (2001/2001,
54 files), including a previously-untracked audit-redaction test (12 assertions) for the
audit.ts redaction net the three emitAudit calls depend on.

Confirmed present against supabase/migrations/202607281600_account_activity_tracking.sql:
both touch call sites (requireSession + mcp-server verifySupabaseJwt), the architecture
test (now passing), the sweep's 11mo/~360d/12mo thresholds, both email templates, both
web render states (deactivated + media-purged), self-serve + admin reactivate routes,
all three emitAudit calls, both migrations (202607281600 + 202607281630), and
FREE_TIER_INACTIVITY_ENABLED gating every entry point (default off, confirmed nothing
runs/renders with it off both by inspection and by an executed test).

Branch cleanup: exec/free-tier-inactivity-system-landed (never pushed to origin) is
fully superseded and safe to delete, but this sandbox's FUSE mount cannot unlink the
ref or its stale /tmp worktree — needs `git branch -D` on a real machine (one-liner in
PROJECT-STATE.md). Not blocking, since nothing points at the dead branch anymore.

Full branch audit done for this pass: exec/day1-dead-code-ci-legal,
exec/day2-web-destination-viewer, and exec/backend-destination-update-endpoints are all
already merged into main (git merge-base --is-ancestor confirms it) — PROJECT-STATE.md
had a stale "not merged" note for the latter two, corrected. No separate integration
branch was needed: exec/free-tier-inactivity-system IS main plus the complete,
reconciled feature — the single thing left to review.

No merge to main, no deploy, no production DB changes performed (hard limits held).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Decide and implement Free-tier destination revitalization