Plan: preset tag-ID registry requirement (anti-scam — codes must match DB, no user-created codes)

where_woof.md

@@ -97,6 +97,14 @@ CREATE TABLE scans (
 - Tag status: `unset` → `active` → `suspended` (admin can suspend).
 - Billing: **Stripe (Australia)** — **NOT in the front-end phase**; phased later.
 
+### ⚠️ Preset tag IDs (anti-scam, confirmed 2026-08)
+
+Tag codes are **preset at manufacture** (printed QR + NFC) and **must match the database registry** — there are no user-created tag codes. A scanned or claimed code that does not exist in the `tags` table is rejected ("tag not found / already claimed"). The 2014 system enforced the same rule via a `productid_hash` on the QR URL — *"if productid_hash is not set we can do NO REGISTERING"* — and tied each tag to a sold product (`onlineorderproductid`).
+
+- The DB must be **seeded with the real manufactured tag IDs** (production list from the manufacturer, or recovered old IDs) — TEST codes are dev-only.
+- Long-term (Laravel admin, Phase 4+): each tag is linked to a sold product/order for stronger validation (mirrors the old `products`/`online_order_product_details` model).
+- Old product IDs from the 2014 system are **not in the .13 archive** (old live `websitebuilder` DB not preserved) — recover from the old hosting account / manufacturer list, or generate fresh IDs.
+
 ## Endpoints — GOAT front-end
 
 | Method | Path | Purpose |