Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Handle partially-written and orphaned physical tags

To doOwner · Vivt_aa2ffb7a

Unlocks 1Approve: NFC/QR Core Pipeline

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Handle partially-written and orphaned physical tags** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## Unlocks 1

- Approve: NFC/QR Core Pipeline

## The brief on file

Viv — make a failed tag write recoverable. Done when: if programming is interrupted mid-write, the app detects the partial state on the next tap and offers to finish or reset it, and a hash reserved in the backend but never successfully written to a chip is either cleaned up or clearly re-usable. WHY THIS MATTERS MORE THAN A NORMAL ERROR PATH: unlike a failed web request, a half-programmed NFC tag is a physical object already in someone's hand, possibly already stuck on a product. The registration and the write are two separate steps that can diverge — the backend can hold a reserved hash for a chip that never took the payload. Files: apps/ios/TacTileConnect/Features/NFCStampTest/, apps/android/.../data/nfc/NfcRegistrationService.kt, apps/api/tactile-api/src/routes/nfc.ts

[overnight 29→30 Sep] SERVER HALF DONE in draft PR #658 (commit 939f0d58, see t_053105ae); left TODO for the client / hardware half. The task's premise needs correcting first.
PREMISE: 'a hash reserved in the backend but never written to a chip' is not a state this system can be in. The LOCKED decision (context/decisions/2026-07-04-nfc-chip-compatibility.md item 4; docs/nfc/ndef-format.md 4a and 4b) is: reserve = validate-only (POST /api/nfc/hash/check persists nothing) → write → post-write verify → register. The failure it designs for is the REVERSE, a programmed-but-unregistered orphan, recovered by 'a later scan 404s → claim'. Both apps implement that routing (iOS NFCScanRouter.swift:182 hash not in DB → claim-eligible, :296 no owner → claim; Android NfcScanRouter.kt:132 and :160), and the decision says NOT to 'fix' orphans by auto-retrying registration inside the write session.
WHAT WAS BROKEN AND IS NOW FIXED: the server-side half-registration (trigger row inserted, profile upsert failed, or the reply lost) blocked the owner's own retry with 409 forever; a same-owner retry now completes it (and Android's retryRegistration() now actually works). Written into docs/nfc/ndef-format.md 4b.
STILL OPEN: (a) iOS's shipped 'Program NFC Tag' path (NFCStampTestService, register gap 26) mints a hash locally and never registers, so every tag it programs is an orphan BY CONSTRUCTION; that is a separate decision (route it through NFCRegistrationService per the register's fix) and should be its own task. (b) Failure copy: iOS says 'Tag programmed, but linking failed: <raw error>' (QRMakerHostView.swift:698) with no 'scan it again to finish' guidance; Android's RegisterFailure carries 'Registration failed.'; spec 4b asks for 'you can finish setup by scanning it again'. (c) 'Offers to finish or reset': finish = claim/encode works; reset = reprogram exists in the encode flow, but DELETE /api/nfc/:hash 404s (register gap 27), so there is no server-side unregister. (d) Torn writes on real hardware were NOT tested (a Type 2 write sets the length TLV last, so a torn write should read back blank/writable; that is reasoning, not verified). Est. 2-3 h plus a physical tag.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Handle partially-written and orphaned physical tags