Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›NFC/QR Core Pipeline·36 in this wave

Approve: NFC/QR Core PipelineTo do · blocker Real scans are never recorded: nothing calls POST /api/events/openBlocked · blocker Verify end-to-end scan path for all 14 destination typesTo do Build the unassigned/orphaned tag landing pageDone Suppress analytics event writes for free-tier accountsDone Unify the four conflicting hash validation patternsDone Assess hash entropy against enumeration and PII scrapingDone Decide and implement Free-tier destination revitalizationDone Rate-limit and cache the public scan resolverTo do Triage the "couldn't connect to the server" preview clusterDone Android NdefUriDecoder accepts any host: anchor it to tactile.to / *.tactile.to or decide custom-domain tagsDone Public scan landing page polishTo do Replace the duplicate web hash-shape copies with one shared import once #658 or #681 landsTo do Android NdefMessageBuilder.build always writes the Text record; spec omits it when the hash is blankDone iOS Program NFC Tag read path rejects 7 and 8 character hashes; spec says accept 7-9Done ndef-format.md is stale: deleted symbols, wrong line cites, duplicate messageIsEmpty, no URI decode tableTo do CI gives no per-suite proof for the NDEF suites: iOS prints totals only, Android's newest main run was a Gradle cache hitTo do Fix tap_count hardcoded to 0 in NFC metadata endpointDone Add hash exhaustion alertingDone Run end-to-end NFC hardware soak testTo do Document NDEF record formatDone Confirm whitelabel.tactile.to DNS + routingDone Add hash-format validation on /t/[hash] scan landingDone Load-test QR/NFC scan resolution at scale (1M+ events)To do Decide: is missing camera QR scanning in iOS/Android intentional?To do Reconcile the three divergent hash generatorsDone Close the check-then-insert race on hash claimingDone Enforce chip compatibility in code, not just docsTo do Handle partially-written and orphaned physical tagsTo do Sign off: NDEF spec and the 111 encoding unit testsDone Free-tier inactivity: R2 media purge job (follow-up to t_9008dc76)To do API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failureTo do API: validate the hash shape in the four /content handlers (documents, notes, videos, audio) like destinationsPublic.ts doesTo do Android NfcWriter has no post-write read-back verify (spec 4a step 5)Done NDEF parity corpus: iOS asserts 1 of 5 vectors and no https://www. vector exists; generator and Kotlin disagree on wwwTo do ndef-format.md section 5 contradicts itself on empty + read-only; NFCTagClassifier.classify and diagnose order them oppositelyTo do

Wave

NFC/QR Core Pipeline

The core of the product — encoding tags and resolving scans. Everything else is a surface on top of this.

TacTile › Launch TacTile › NFC/QR Core Pipeline

18/36 done18 open2 open blockers

Selected taskclear

API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failure

To doOwner · Vivt_dc0fecc1

Open half of draft PR #711 (and the same limit #681 records for /t). enforceVisibility (apps/api/tactile-api/src/middleware/visibility-gate.ts, run in index.ts BEFORE the route handler) covers documents/notes/videos/audio under the default destinations policy, and its first act is a Supabase read of the destinations row. A non-2xx or a throw lands in the catch at visibility-gate.ts ~310-334, which returns a bare notFound(). The route handler never runs, so it never sends its own 500, and the web pages cannot tell that 404 from an unknown hash: a Supabase failure behind a running API Worker still renders "not found" at /d /n /v /a (and /t). #711 only collapses the failures around the gate (Worker/edge 5xx, the 5s timeout, 429, a thrown fetch, a route-level 500, a non-JSON 200) into an "unavailable" card.

No dependencies in this wave — nothing gates it, and nothing waits on it.

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failure** · to do

Open half of draft PR #711 (and the same limit #681 records for /t). enforceVisibility (apps/api/tactile-api/src/middleware/visibility-gate.ts, run in index.ts BEFORE the route handler) covers documents/notes/videos/audio under the default destinations policy, and its first act is a Supabase read of the destinations row. A non-2xx or a throw lands in the catch at visibility-gate.ts ~310-334, which returns a bare notFound(). The route handler never runs, so it never sends its own 500, and the web pages cannot tell that 404 from an unknown hash: a Supabase failure behind a running API Worker still renders "not found" at /d /n /v /a (and /t). #711 only collapses the failures around the gate (Worker/edge 5xx, the 5s timeout, 429, a thrown fetch, a route-level 500, a non-JSON 200) into an "unavailable" card.

Where it sits: TacTile › Launch TacTile › NFC/QR Core Pipeline

## The brief on file

Fix the open half of draft PR #711 (TacTile-dev/TacTile). Problem: the API visibility gate (apps/api/tactile-api/src/middleware/visibility-gate.ts, enforceVisibility, wired at index.ts ~421 before handleRequest) fails CLOSED with a bare notFound() when its Supabase lookup errors or throws (catch at ~310-334; FAIL_CLOSED WeakSet + isFailClosedResponse already mark that response by identity). The four content routes (documents/notes/videos/audio) take the default destinations policy, so a Supabase failure never reaches the route's own 500 and the web viewers render "not found" (apps/web/system/public-viewer/load-viewer-content.ts, KNOWN LIMIT comment). Goal: give the fail-closed response a machine-readable reason and have loadViewerContent (and #681's /t landing) map it to the unavailable card. Constraints to settle first: (1) the gate's fail-closed 404 and its "private" 404 are byte-identical on purpose (enumeration oracle, see the comments in index.ts ~429-462), so the reason may mark ONLY the lookup-failed branch, never the private branch; a response header on the existing 404 (status and body unchanged) is the lowest-risk option, a 503 changes the trade documented in the catch block, so decide deliberately and say why; (2) keep the identity-based exemption from the miss budget (recordPublicResolverOutcome) working and keep withPublicResolverCacheControl applied; (3) before changing the status, check how the iOS, Android and web clients handle a 404 from these paths (not checked when this brief was written); (4) do not add a new file under apps/api/tactile-api/tests/ unless you also raise the verify:ts-source-coverage count with a written reason; extend tests/unit/visibility-gate.test.ts instead. Premise to re-verify before editing: stub the gate's Supabase read to 500 and confirm the response is the bare 404 with no distinguishing header. Draft PR only; nothing deployed.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

NFC/QR Core Pipeline

API: make the visibility gate's fail-closed 404 carry a machine-readable reason, so /d /n /v /a and /t can say "unavailable" for a Supabase failure