Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)

To doOwner · ait_c594531f

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)** · to do

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

[2026-10-09 · Viv] Skeptic review, KEEP OPEN. Done-when needs R2 objects actually deleted for a deactivated+expired test account. No purge job exists on origin/main 4f2c1d6b: git grep media_purged_at finds only the column (migration 202607281600:172) and the read-only viewer state (t/[hash]/route.ts:1534-1584); scheduled() runs only runInactivitySweepWrapped (index.ts:539) and inactivitySweep.ts:22-26 says the purge is deliberately not built. Matthew decided the purge on 28 Jul (migration comment), so nothing retires it. It is deferred by its own precondition (warning emails live one full cycle; no repo config sets FREE_TIER_INACTIVITY_ENABLED, default off per activity.ts:22 and PROJECT-STATE.md:180). Post-launch, not launch-gating. Block with that reason; do not close.

FOLLOW-UP — deliberately deferred from t_9008dc76 (free-tier inactivity system). Do not build this until the warning emails have been live and verified for at least one full cycle — the migration says explicitly not to ship the purge before the warning emails exist, and they do now (branch exec/free-tier-inactivity-system).

Spec: supabase/migrations/202607281600_account_activity_tracking.sql, section "MEDIA PURGE AFTER THE WINDOW" (lines ~139-186). Read it fully before starting — every design decision is explained there.

WHAT TO BUILD (as its own migration + scheduled job, per the spec):
  1. Find accounts where deactivated_at is set and restorable_until has passed (now() > restorable_until).
  2. Delete their R2 objects: gallery images, video files, audio files, documents. Follow the delete-cascade paths already in apps/api/tactile-api/src/routes/destinations.ts, which does best-effort R2 cleanup for these same types on deletion.
  3. Mark the affected destinations so the UI knows the media is gone — do NOT leave a row pointing at an object that no longer exists. This likely needs a NEW per-destination-type column (e.g. media_purged_at or a status flag on gallery_items/videos/audio/documents rows) since the current schema only has an account-level accounts.media_purged_at (added in 202607281600), which the render-state work (already shipped) uses as a coarse "purge already happened for this whole account" signal. Decide whether per-destination granularity is worth adding, or whether the account-level flag is sufficient — the current web viewer (apps/web/app/t/[hash]/route.ts) already renders an honest "this media was removed" state keyed off account-level media_purged_at for video/audio/gallery types; verify that's still correct once real purging exists, or extend it.
  4. Set accounts.media_purged_at and write an audit_log entry (emitAudit() now exists — apps/api/tactile-api/src/utils/audit.ts, landed via commit f2db7038 — use action name pattern noun.verb_past_tense, e.g. "account.media_purged").
  5. Wire into apps/api/tactile-api/src/index.ts's scheduled() handler, mirroring runInactivitySweepWrapped's shape (same file, same flag: FREE_TIER_INACTIVITY_ENABLED).

NEVER reuse a hash_id / never reassign a destination row to a different customer — rows are never deleted, only their media. This is load-bearing: a physical tag can never be silently reassigned this way.

Done when: R2 objects are actually deleted for a fabricated deactivated+expired test account, destinations rows survive with their media reference nulled/marked, the web viewer renders the existing "media removed" honest state (not a broken player), an audit_log row is written, and the job is flag-gated the same way as the rest of this system (no-ops entirely when FREE_TIER_INACTIVITY_ENABLED is unset).

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)