Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Marketing website·30 in this wave

Approve: Marketing websiteTo do · blocker Replace PrivacyPage placeholder with real policyDone Replace TermsPage placeholder with real ToSDone Verify pricing display matches Stripe productsDone Audit pricing accuracy with StripeDone AUP page (or section in Terms)Done Replace NFC-first with NFC-native across all marketing copyDone Resolve the marketing site vs (marketing) route-group splitTo do Document the production domain mapDone Write the pricing page and confirm it matches StripeDone DECIDE: revisit Marketing website's cut-list position now it's the only purchase pathTo do Make the web purchase flow complete and prominent — it is now the only way to buyTo do Resolve conflicting pricing-page files: stale page.tsx vs verified PricingPage.tsxDone Audit AI agent/MCP claims on the marketing site against what shipsBlocked Build the hardware purchase path now that Shop is cutTo do Press kit / brand assets pageTo do verify:one-contact-address stays green on a typo domain (support@tactile-connect.co)Done contact-page.test.ts: the page assertions read source text, so a hidden link stays green; add a render-level testDone Build /cookies pageTo do Add cookie consent bannerDone Build FAQ pageTo do Build contact form (or mailto link)Done Add og:image for all pagesDone Add og:description + twitter:card metadataTo do Create sitemap.xmlDone Create robots.txtDone Audit landing + about page copyTo do Add annual/monthly toggle on pricingTo do tactile.to/robots.txt and /sitemap.xml redirect to /signin — search engines can't read eitherDone QA: Contact page opens without sign-in and taps through to a support email (phone)Blocked

Wave

Marketing website

Public site, pricing, and legal pages — and now the ONLY purchase path, since there are no in-app purchases and Shop is cut from launch. That moves it well up the cut-list from its original position as the last thing to drop. Domain map: tactile.to is the app, tactile-connect.com is marketing, app.tactile-connect.com is the mobile PWA — and nothing in the repo currently builds a deploy target for the bare marketing root, which is a live hazard.

TacTile › Launch TacTile › Marketing website

17/30 done13 open1 open blocker

Selected taskclear

verify:one-contact-address stays green on a typo domain (support@tactile-connect.co)

DoneOwner · Vivt_c1b90e45

Found by r38 while building t_7721bbcb (2026-10-21): mutating the /contact page's mailto to support@tactile-connect.co left `pnpm verify:one-contact-address` at rc 0, while hello@tactile-connect.com reddened it. AGENTS.md says the check enforces exactly one published contact address, so a near-miss address is a second published address it cannot see. Done when: the check fails on any email-shaped string under a tactile*/tactile-connect* domain (or a close misspelling of support@tactile-connect.com) that is not the canonical address, with a mutation suite proving .co, a dropped hyphen and a different local part each go red and the canonical address stays green; no new false positive on a clean main.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**verify:one-contact-address stays green on a typo domain (support@tactile-connect.co)** · done

Found by r38 while building t_7721bbcb (2026-10-21): mutating the /contact page's mailto to support@tactile-connect.co left `pnpm verify:one-contact-address` at rc 0, while hello@tactile-connect.com reddened it. AGENTS.md says the check enforces exactly one published contact address, so a near-miss address is a second published address it cannot see. Done when: the check fails on any email-shaped string under a tactile*/tactile-connect* domain (or a close misspelling of support@tactile-connect.com) that is not the canonical address, with a mutation suite proving .co, a dropped hyphen and a different local part each go red and the canonical address stays green; no new false positive on a clean main.

Where it sits: TacTile › Launch TacTile › Marketing website

## The brief on file

[2026-10-23 · Viv] r41 CLOSE (08:13 PDT): the underscore hole is fixed and shipped. New draft PR #797 https://github.com/TacTile-dev/TacTile/pull/797 ([stacked on #659], branch r40/stack-659-contact-typo, head 2e090e83 amended from 5f889b8a before its first push, base r26/analytics-seed-v2-qa-seed faddad15; no CI on a non-main base; not merged). PATTERN and NEAR now read '_' in the domain; new rows for 5 underscore look-alikes, an upper-case non-canonical (BILLING@TACTILE-CONNECT.COM) and the tactileconnect <= 2 clause. near-miss test 30/30; verify:one-contact-address rc 0 on the branch tree and on the ~/Command/tactile checkout (scratch copy of the script). Mutations red then restored: drop '_' from PATTERN (2 rows), from NEAR (1), remove toLowerCase (1), tactileconnect clause <= 0 (1), real tree apps/web-mobile/app/settings/support/page.tsx:15 set to support@tactile_connect.com -> rc 1. Readers r41: safety CONFIRMED (read-only script, no catastrophic backtracking, exit codes right); acceptance CONFIRMED (12 typo probes all rc 1; canonical any-case, trailing punctuation and gmail rc 0). Gate run 3 55/56 (start load1 3.7); runs 1 and 2 red ONLY at verify:ts-source-coverage on a different tsconfig each time (apps/workers, packages/mcp-server), the check alone rc 0. Closed under the r28 rule (stacked on an r26 branch). Allowed list for Matthew to confirm, safe to assume yes: noreply@ and dmarc@tactile.to, preview@tactile.app, 13 exact tactile.to logins.

[2026-10-23 · Viv] STOP-NOTE (r40, status unchanged): BUILT, NOT SHIPPED. No PR, not pushed, not gated, not merged, not deployed.

WHAT I DID: branch r40/stack-659-contact-typo, LOCAL ONLY, worktree ~/TacTile-dev/TacTile-r40-s659-1022, stacked on #659 (origin/r26/analytics-seed-v2-qa-seed faddad15). Commit 5f889b8aa7b21cb57f111ad0df5edd1a1ca7cf7f (amended from 6814a0f4), "fix(verify): one-contact-address goes red on a typo of the support domain, not only on a second address", 2 files (+230/-24): scripts/verify/one-contact-address.mjs (PATTERN widened to every email-shaped string; isOurDomain by OSA edit distance to tactile/tactileconnect; PERSONAL narrowed to 13 exact tactile.to logins; NEAR_PATTERN flags non-email-shaped strings within 2 edits of support@tactile-connect.com; preview@tactile.app added to ALLOWED) and tests/unit/one-contact-address-near-miss.test.ts. Evidence: 23/23; verify:unit rc=0, 231 files, 4461 tests; committed script on clean main 4f2c1d6b rc=0; real-tree mutations (.c0m, hi@, @@, .c, benefits@, tatcile) red on the new script; M1-M9 and legacy L1-L3 red, restored 23/23.

WHERE I STOPPED: after the second review. The readers split, so it was not pushed or gated.

WHY: ACCEPTANCE re-review REFUTED (fixable): "An underscore in the domain is never read. PATTERN's domain class is [a-z0-9-] and NEAR_PATTERN's is [a-z0-9.,-], so neither includes '_'." support@tactile_connect.com, hello@tactile_connect.com, support@tactile_connect.co and support@tactile-connect_com all give rc=0; on the real tree, data/page.tsx:17 set to support@tactile_connect.com gives rc=0. SAFETY re-review CONFIRMED the task (clauses 1, 1b, 2 and 3 met; 0 of 92 open PRs' added lines go red).

NEXT: in one-contact-address.mjs add '_' to both classes: PATTERN [a-z0-9._+-]+@[a-z0-9_-]+(\.[a-z0-9_-]+)*\.[a-z]{2,} and NEAR [a-z0-9._+-]+@+[a-z0-9_.,-]+. Add underscore fixtures, an upper-case non-canonical fixture (the reader's MY3, toLowerCase removed from domainOf, survived 23/23) and a row for the tactileconnect <= 2 clause (SAFETY mutation I survived). The reader's scratch variant already showed all 4 underscore probes and both real-tree cases red, clean main rc=0, branch rc=0, 21/21 should-be-green probes green. Amend 5f889b8a (unpushed), re-run both readers and the gate, then open a draft PR based on r26/analytics-seed-v2-qa-seed.

SAFE TO ASSUME: no new false positive on clean main. The commit alone conflicts with main in one-contact-address.mjs, so it lands only with or after #659 (a draft with genuinely red CI). The 2026-10-21 note said "Build after #659 merges or closes"; stacking was the orchestrator's choice. Allowed list for Matthew to confirm (builder: safe to assume yes): noreply@ and dmarc@tactile.to, preview@tactile.app (DEBUG-only, SettingsHostView.swift:563), and 13 exact tactile.to logins. Not blocking: a space, en dash or fullwidth @ for the hyphen or at-sign, a typo after a comma-joined canonical address, and a 3-edit typo still pass.

[2026-10-21 · Viv] HELD at filing: scripts/verify/one-contact-address.mjs is in open PR #659. Build after #659 merges or closes.

[2026-10-21 · Viv] Filed by r38 from the t_7721bbcb build (commit 2f5ca149, local). Read scripts that back verify:one-contact-address first; check which file holds them against open PRs before building.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Marketing website

verify:one-contact-address stays green on a typo domain (support@tactile-connect.co)