Hand a tablet to open house visitors: a full-screen sign-in page where each visitor types their name and email, sees a thank-you, and never sees who signed in before them #127

/listings/:id/open-house is now a full-screen sign-in page for a tablet. The full suite passes except deps.test.ts ("no lockfile or node_modules: nothing is installed"), which fails only because my bun install created node_modules here; the forge's check will tell. scripts/gate.ts and scripts/design-lint.ts don't exist in this clone, and there is no tsconfig.json, so I ran bun run lint:design (it printed no errors) and skipped the type check.

What changed

• The page (src/pages/openhouse.ts): it reuses the public face of Frame for the agent's brand and palette. It shows the address, hero photo, name and email fields and one big "Sign in" button. It has no tool header, no visitor list and no Sign out link. The only link is a small "Done" back to the listing.
• Layout flag (src/pages/layout.ts): I added a kiosk flag on the face so the back link reads "Done" and the footer's "Report a problem" link goes.
• Access (src/routes.ts): the page is gated by listVisitors, which asks permit the same way addVisitor does. A guest gets 401 and another user gets 403, the same refusal as the visitors list. No contract cell changed.
• Submitting: it is a same-origin POST to the existing addVisitor, so the name and email checks are the ones the follow-up page uses. On success it redirects back with "Thanks for stopping by, <first name>". The thank-you is a CSS toast that fades after about 6 seconds, and the page never echoes an earlier visitor.
• Bad email: the error shows in place (422) and the typed name is kept.
• Links: the listing page (agent or admin only) and the printed sign-in sheet link to "Sign-in screen for a tablet". The README names it on the 412 Alder Lane sample. The new CSS classes are in docs/design/areas/open-house.md.
• Tests (src/tablet.test.ts): they cover the five cases in the issue — the agent gets 200, a guest and another user are refused, a POST shows up in the follow-up email, the thank-you has no earlier email, and the page answers within 50 ms.

One behaviour change to check: addVisitor used to refuse a listing with no open house. The issue says a private showing must work, so I removed that refusal. src/followup.test.ts asserted it, so I updated that test to expect success.

Not done

• The thank-you also clears when the next visitor's submit reloads the page, but there is no JavaScript to clear it on the next tap.
• A listing with no open house gets no follow-up email asset, so those visitors appear in the CSV only.

To try it: sign in as the listing's agent, open 412 Alder Lane and press "Sign-in screen for a tablet".

🤖 Generated with Claude Code

Closes #125

/listings/:id/open-house is now a full-screen sign-in page for a tablet. The full suite passes except deps.test.ts ("no lockfile or node_modules: nothing is installed"), which fails only because my bun install created node_modules here; the forge's check will tell. scripts/gate.ts and scripts/design-lint.ts don't exist in this clone, and there is no tsconfig.json, so I ran bun run lint:design (it printed no errors) and skipped the type check.

What changed

• The page (src/pages/openhouse.ts): it reuses the public face of Frame for the agent's brand and palette. It shows the address, hero photo, name and email fields and one big "Sign in" button. It has no tool header, no visitor list and no Sign out link. The only link is a small "Done" back to the listing.
• Layout flag (src/pages/layout.ts): I added a kiosk flag on the face so the back link reads "Done" and the footer's "Report a problem" link goes.
• Access (src/routes.ts): the page is gated by listVisitors, which asks permit the same way addVisitor does. A guest gets 401 and another user gets 403, the same refusal as the visitors list. No contract cell changed.
• Submitting: it is a same-origin POST to the existing addVisitor, so the name and email checks are the ones the follow-up page uses. On success it redirects back with "Thanks for stopping by, <first name>". The thank-you is a CSS toast that fades after about 6 seconds, and the page never echoes an earlier visitor.
• Bad email: the error shows in place (422) and the typed name is kept.
• Links: the listing page (agent or admin only) and the printed sign-in sheet link to "Sign-in screen for a tablet". The README names it on the 412 Alder Lane sample. The new CSS classes are in docs/design/areas/open-house.md.
• Tests (src/tablet.test.ts): they cover the five cases in the issue — the agent gets 200, a guest and another user are refused, a POST shows up in the follow-up email, the thank-you has no earlier email, and the page answers within 50 ms.

One behaviour change to check: addVisitor used to refuse a listing with no open house. The issue says a private showing must work, so I removed that refusal. src/followup.test.ts asserted it, so I updated that test to expect success.

Not done

• The thank-you also clears when the next visitor's submit reloads the page, but there is no JavaScript to clear it on the next tap.
• A listing with no open house gets no follow-up email asset, so those visitors appear in the CSV only.

To try it: sign in as the listing's agent, open 412 Alder Lane and press "Sign-in screen for a tablet".

🤖 Generated with Claude Code

I've addressed all of sentinel's feedback and pushed it to the branch.

• Hostile-input list: /listings/:id/open-house is now in the page list in src/hostile.test.ts. A new test sends a hostile name with a bad email and checks the 422 re-render. The name comes back escaped in the input value, and the page passes the same inert-markup check as the others.
• Cross-site POST: src/tablet.test.ts now sends a foreign Origin and a Sec-Fetch-Site: cross-site POST. Both get 403, and [email protected] never appears in the visitors CSV. The listing in that test has its own author, so the per-person write ration can't answer 429 before the guard does. I hit that on my first try.
• Stray blank line: removed from the end of the POST handler in src/routes.ts.
• "Clears on the next tap": I implemented it, since you said it was missing. A few lines in static/listing.js remove the thank-you on the next pointer-down or key press. Only the .kiosk page loads them. This is the only behaviour change in this round, and I tested it by hand-reading the code only: no test covers it.

The full suite passes except deps.test.ts, which fails only because my bun install created node_modules in this clone. src/hostile.test.ts and src/tablet.test.ts both pass.

🤖 Generated with Claude Code