Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·23 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageTo do Suppress analytics event writes for free-tier accountsTo do Unify the four conflicting hash validation patternsTo do Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Public scan landing page polishTo do Fix tap_count hardcoded to 0 in NFC metadata endpointTo do Add hash exhaustion alertingTo do Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingTo do Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsTo do Close the check-then-insert race on hash claimingTo do Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsTo do Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

4/23 done19 open1 open blocker

Selected taskclear

Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)

To doOwner · ait_c594531f

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

FOLLOW-UP — deliberately deferred from t_9008dc76 (free-tier inactivity system). Do not build this until the warning emails have been live and verified for at least one full cycle — the migration says explicitly not to ship the purge before the warning emails exist, and they do now (branch exec/free-tier-inactivity-system).

Spec: supabase/migrations/202607281600_account_activity_tracking.sql, section "MEDIA PURGE AFTER THE WINDOW" (lines ~139-186). Read it fully before starting — every design decision is explained there.

WHAT TO BUILD (as its own migration + scheduled job, per the spec):
  1. Find accounts where deactivated_at is set and restorable_until has passed (now() > restorable_until).
  2. Delete their R2 objects: gallery images, video files, audio files, documents. Follow the delete-cascade paths already in apps/api/tactile-api/src/routes/destinations.ts, which does best-effort R2 cleanup for these same types on deletion.
  3. Mark the affected destinations so the UI knows the media is gone — do NOT leave a row pointing at an object that no longer exists. This likely needs a NEW per-destination-type column (e.g. media_purged_at or a status flag on gallery_items/videos/audio/documents rows) since the current schema only has an account-level accounts.media_purged_at (added in 202607281600), which the render-state work (already shipped) uses as a coarse "purge already happened for this whole account" signal. Decide whether per-destination granularity is worth adding, or whether the account-level flag is sufficient — the current web viewer (apps/web/app/t/[hash]/route.ts) already renders an honest "this media was removed" state keyed off account-level media_purged_at for video/audio/gallery types; verify that's still correct once real purging exists, or extend it.
  4. Set accounts.media_purged_at and write an audit_log entry (emitAudit() now exists — apps/api/tactile-api/src/utils/audit.ts, landed via commit f2db7038 — use action name pattern noun.verb_past_tense, e.g. "account.media_purged").
  5. Wire into apps/api/tactile-api/src/index.ts's scheduled() handler, mirroring runInactivitySweepWrapped's shape (same file, same flag: FREE_TIER_INACTIVITY_ENABLED).

NEVER reuse a hash_id / never reassign a destination row to a different customer — rows are never deleted, only their media. This is load-bearing: a physical tag can never be silently reassigned this way.

Done when: R2 objects are actually deleted for a fabricated deactivated+expired test account, destinations rows survive with their media reference nulled/marked, the web viewer renders the existing "media removed" honest state (not a broken player), an audit_log row is written, and the job is flag-gated the same way as the rest of this system (no-ops entirely when FREE_TIER_INACTIVITY_ENABLED is unset).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)