Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode table

To doOwner · Vivt_9e672afd

The canonical NDEF spec still describes a deleted view model, cites moved lines, says its TODOs are all resolved while one remains, and is silent on URI identifier decoding.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode table** · to do

The canonical NDEF spec still describes a deleted view model, cites moved lines, says its TODOs are all resolved while one remains, and is silent on URI identifier decoding.

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

[2026-10-23 · Viv] r40 NOTE (status unchanged, task stays open): commit shipped on a draft PR; both readers REFUTED the task, not fixable on this branch. Not merged, not deployed.

LANDED: PR #783 https://github.com/TacTile-dev/TacTile/pull/783, base main. Branch r40/ndef-format-doc, head c83dbe82a7b24494864015f518179ac980a052ec (amended from dcba4325), one commit on main 4f2c1d6b, 2 files: docs/nfc/ndef-format.md (rewritten against the code: deleted view model gone, extractHash moved, symbol names instead of line cites, messageIsEmpty consolidation stated as unfinished, Android and web parsers in front matter and the parser table, URI decode table, size limits, 8 of 111 tests pin bytes) and tests/unit/ndef-format-symbols.test.ts (new; pins every backticked symbol to its declaring type, the parser lengths and the parser inventory).

EVIDENCE: new test 13/13; verify:unit rc=0, 235 files, 4703 tests; the test also passed on HEAD merged with each of 48 open PRs touching NFC Swift/Kotlin, web-mobile or docs/nfc, and on a 10-PR stack. Mutations M1-M8 (doc and code) each red, restored 13/13. Gate: 1 full run, start load1 5.38, rc=0, 55 of 56, only verify:secrets-rotation.

READERS on the task (re-review on c83dbe82; both CONFIRMED the commit): SAFETY REFUTED (fixable=false) - clause 3 not met: the audit doc exists only on draft #759, and D8's golden-test cite is still at NFCGoldenNDEFTests.swift:15. ACCEPTANCE REFUTED (fixable=false) - "NOT MET at two places in section 3" for clause 1, and clause 3 not met.

CI: base is main, so GitHub CI runs on #783; its result is not in tonight's evidence files, so I make no claim about it.

DONE-WHEN CLAUSES:
1. "the doc matches the code at cited symbols": UNMET per the acceptance reader (the safety reader judged it met). The GET_VERSION intro (doc lines 261-264) still says the table is what NFCStampTestService uses, and the source line (276-277) still reads "Source: NFCStampTestService.processTag (byte [6] switch)". Both are false on main: the encoder parses the table through NFCChipCatalog.variant(fromGetVersion:) (NFCEncoderWriter.swift:500), and the stamp test's getChipVariant reads byte [6] only and processTag discards it. Left as is on purpose: #687 rewrites those lines.
2. "a reviewer can grep every named symbol": MET (both readers).
3. "row D8 can be struck": UNMET. docs/audit/2026-10-ndef-signoff.md exists only on draft #759 (r31/tooling-docs-ship). D8's point that the Swift golden test comment cites makeWriteMessage at :629 is still true at NFCGoldenNDEFTests.swift:15; #765 (r32/native-agent-ndef) rewrites that line to ":652", still a line cite.
SEQUENCING: the 2026-10-15 note said to edit ndef-format.md only after #658 and #687 merge or close; both are still open. Merged with #687 the doc contradicts itself (acceptance reader, merged-687-doc.md: line 275 against 311-318), so whoever lands second reconciles it by hand.

NEXT SESSION, after Matthew merges #687, #765 and #759: fix the two section-3 lines, make the golden-test comment name the function instead of a line, reconcile with #658/#687, strike D8 in the merged audit doc, then re-run both readers.
Test reach (acceptance reader): the decode table, size facts, GET_VERSION ownership and worded line cites are not pinned by the test.
Possible new tasks (builder): WebNfcScanner calls record.toText(), which W3C NDEFRecord does not define (not tried on a device); apps/web-mobile/AGENTS.md hard rule 3 says "No NDEFReader" yet WebNfcScanner uses it.

[2026-10-15 · Viv] Where the audit doc is: docs/audit/2026-10-ndef-signoff.md exists only on draft PR #759 (branch r31/tooling-docs-ship, https://github.com/TacTile-dev/TacTile/pull/759) until Matthew merges it. Any "r31/tooling-docs draft PR" pointer in this task means #759.

[2026-10-15 · Viv] Found by the NDEF sign-off (t_92603a30), audit doc docs/audit/2026-10-ndef-signoff.md section 3 row D8. Cites are origin/main 4f2c1d6b. SEQUENCE: edit docs/nfc/ndef-format.md only after drafts #658 and #687 merge or are closed; both edit it.

FIX LIST:
1. NFCEncoderFlowViewModel was deleted (commit 4fb2637e, t_4702fd6c); sections 1, 4d and 5 still describe it. NFCScanInterpreter.extractHash is now NFCTagClassifier.extractHash (NFCTagClassifier.swift:45). Rewrite the 3-way-parser table to the current state.
2. Line cites: "ConfigLayout (NFCEncoderWriter.swift:633-646)" is :935-985; "NFCScanAnalysis.swift:243-257" no longer holds the extractHash; the Swift golden test comment cites makeWriteMessage at :629 (now :652). Prefer symbol names over line numbers.
3. Section 4d says messageIsEmpty is duplicated three times and must be canonicalised. It still exists as NFCTagClassifier.isEmpty (:35), NFCStampTestService.messageIsEmpty (:498) and Android's inline isEmpty in NfcWriter.readTag. Either finish the consolidation or say so; "Open TODOs: None" is false.
4. Front matter says "future Android + web NFC-tap parsers": Android exists (NdefUriDecoder, NdefMessageBuilder, NfcWriter) and diverges (see the Android host-anchor and read-back tasks from this audit).
5. Missing from the spec: the URI identifier decode table. iOS stamp-test extractHashFromNDEF handles 0x01-0x04 and treats any other code as "no prefix" (NFCStampTestService.swift:452-458); Android decodes 0x00-0x04 and returns null otherwise (NdefUriDecoder.kt:15-31); the classifier path uses CoreNFC's full table. Also missing: Android throws IllegalArgumentException for a URI payload over 255 bytes (about 253 characters of URL, NdefMessageBuilder.kt:72) where iOS gates on the tag's capacity (NFCEncoderWriter.swift:615).
6. Section 1 should state that "111 unit tests" is the Swift NFC logic suite (21+20+6+27+37) of which 8 assert bytes.

DONE WHEN: the doc matches the code at cited symbols, a reviewer can grep every named symbol, and the audit table in docs/audit/2026-10-ndef-signoff.md row D8 can be struck.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode table