Admin sees stock and orders change live, and every admin action leaves a trail #78

Pushed. Both halves of #30 were already in main (#11 live, #34/#12 the trail), so this pull is the gap that was left.

---

The two halves of this issue landed separately — the bus, the stream and the data-live regions in #11, the actor on every admin write in #34 and #12 — and this closes the one admin page they left behind. /admin/orders/<number> was the page an admin sits on while a payment settles or a refund goes back, and it was the only order page still needing a reload: it loaded no script and had no region. It is now a single data-live region, so the status pill, the totals, what is left to refund, the payments table and the history swap together and the page is never half of one state and half of another.

To keep that from making every order's event a refetch for every open order page, a region may now carry data-live-key, and a keyed one wants only events that name its subject — matched against the values an event already carries ({id, number, cents}), so src/live.ts still knows nothing about what any page is showing. static/live.js opens its stream only when there is a document and exports wants, which lets the test import the file the browser is actually served and hold the predicate up against a region rather than against a copy of it.

Worth looking at in the preview: place an order, open /admin/orders/<number> in one tab, pay it in another, and watch the pill go from awaiting payment to paid without a reload; then refund part of it and watch the payments table and the refundable amount follow. /admin/inventory in a third tab should not flicker while any of that happens — its regions are stock.moved only.

What I chose not to do: the issue's GET /events stays GET /admin/events, admin-only behind the same role check as the pages, which is what #11 decided and the README documents; nothing new was added to the ledger tables, since every admin write already names actor(ctx) (I checked all nineteen call sites); and I did not make the terminal redraw on the bus — its tabs re-query on every keypress, so it is never more than a keystroke behind, and giving its input loop a subscription is new scope rather than this issue's. bun test is 133 passing, and passing under --randomize.

🤖 Generated with Claude Code

Closes #30

Reviewed pull #78 and approved it, anchored to static/live.js:56. Nothing was pushed and the clone is back to a clean bb98ad6.

What the review rests on: the suite is green at this head (133 pass, also under --randomize); reverting the three source files while keeping the tests makes both new tests fail, so they are real behaviours; and driving the whole path against a local server with a signed admin identity showed order.paid arriving on /admin/events carrying the order number that the keyed region matches on, with the refetched page going from "Awaiting payment" to "Paid". On the preview, /admin, /admin/orders/<n> and /admin/events are all 403 to an unsigned caller, and the content-addressed script is the repo byte for byte.

I also opened issue #83 for the gap the change makes visible but does not introduce: a short payment, a mock decline and a failed refund write rows into the payments table and history that this now-live region holds, yet emit nothing on the bus.

The two halves of this issue landed separately — the bus, the stream and the data-live regions in #11, the actor on every admin write in #34 and #12 — and this closes the one admin page they left behind. /admin/orders/<number> is the page an admin sits on while a payment settles or a refund goes back, and it was the only order page still needing a reload: no script, no region. It is now a single data-live region, so the status pill, the totals, what is left to refund, the payments table and the history swap together and the page is never half of one state and half of another.

To keep that from making every order's event a refetch for every open order page, a region may now carry data-live-key, and a keyed one wants only events that name its subject — matched against the values an event already carries ({id, number, cents}), so src/live.ts still knows nothing about what any page is showing. static/live.js opens its stream only when there is a document and exports wants, which lets the test import the file the browser is actually served and hold the shipped predicate up rather than a copy of it.

Worth looking at in the preview: place an order, open /admin/orders/<number> in one tab, pay it in another, and watch the pill go from awaiting payment to paid without a reload; then refund part of it and watch the payments table and the refundable amount follow. /admin/inventory in a third tab should not flicker while any of that happens — its regions are stock.moved only.

Since the approval at 590a0e3 the only change is the review's nit: the README's live-pages paragraph is rewrapped to the width the rest of the file keeps to, words only, so static/live.js and its content-addressed name are byte for byte what was reviewed. The two non-blocking notes I have left alone deliberately — the bus's silence on a short payment, a mock decline and refund-failed is real and is now visible from this page, but it is #83's shape and not this pull's to grow into; and a typed-then-blurred refund amount being replaced by a freshly rendered figure is the same trade the already-live tables make, in the safer direction.

What I chose not to do: the issue's GET /events stays GET /admin/events, admin-only behind the same role check as the pages, which is what #11 decided and the README documents; nothing new was added to the ledger tables, since every admin write already names actor(ctx) at all nineteen call sites; and the terminal's input loop stays unsubscribed — its tabs re-query on every keypress, so it is never more than a keystroke behind.

🤖 Generated with Claude Code