Build listing-launch #2

A realtor can now type in one address with its facts and photos, press Launch, and get the MLS description, three social posts, a flyer and an email blast. The assets show in tabs, each with an edit box, a copy button and the Fair Housing check beside it. The listing is saved and reopens at /listings/:id. bun test passes (62 tests), the design lint is clean, and a strict type check passes. Common pages answer in about 2–30 ms locally. There are no runtime dependencies.

Policy change — please review. contract.json gains a new listing resource whose cells are the same as note: create user · read anon · update author · delete author · list anon. Strangers can now read and list listings, which they could not before. The forge may treat that as a loosened cell and hold the pull for a person. I chose anon read so a flyer link can be shared with buyers. The note and audit rows are unchanged.

What changed

• Fair Housing check (src/fairhousing.ts): rules for phrases in context, not a word list. Each rule names the protected class it touches, a one-line reason and a rewrite. "family room", "integrated appliances", "Church Street" and "exclusive listing" pass; "family-friendly", "integrated neighborhood", "walking distance to church", "safe neighborhood" and "no kids" are flagged. "master bedroom" is a note rather than a risk. The check is never stored: it runs every time the words are read, after every save, and again as you type (via POST /fair-housing).
• Generation (src/generate.ts): generate(listing) builds every asset from what the agent typed, in three tones (classic, warm, bold), with the brokerage and license number included. A test holds every template clear of every rule in every tone. A real model can later sit behind this one function.
• Listings (src/listing.ts checks input at the boundary; src/photos.ts stores photos): photos are accepted only if their first bytes say JPEG, PNG or WebP. They are saved under random names beside the database and cached for a year. Removing a listing removes its files.
• Pages now live under src/pages/:

- The first screen is the form plus the launched listings. A sample listing (412 Alder Lane) is planted once so the screen is never empty. - On a listing, the tabs are rendered on the server (?tab=), so there is no layout shift and they work as plain links without JavaScript. - Someone who can't edit a listing is offered "Start a new one from this", which copies it into the form.

• Flyer at /listings/:id/flyer: hero photo, price, a strip of the facts, the description, the agent's headshot, name, brokerage and license number, and the Equal Housing Opportunity line. It prints on letter paper with only the flyer showing.
• Look: a navy palette with a serif (Palatino/Iowan) for headings, five brand colours for the agent to choose from, and green/amber status colours. All are tokens in design/tokens.json, and every pair is tested for contrast.
• Other doors: the JSON API is at /api/listings (contract/openapi.json regenerated). There are six new MCP tools, and the terminal now lists listings and shows their assets and findings.
• Notes keep working, but moved off the first screen to /notes.

Tests I changed

• src/server.test.ts: the notes-page checks now fetch /notes, and the MCP tools list includes the new tools.
• The event-stream test assumed every earlier event was a note, which is no longer true now that listings send events too. That test was wrong, so it now skips to the note it made.
• src/contract.test.ts gains the listing checks; src/design.test.ts checks the new colour pairs.

Left out on purpose

• Posting to social networks, MLS submission and image editing (the README says so).
• Launching or editing from the terminal.
• Photo uploads through the API (photos come only through the page's form).
• Resizing photos (they are served as uploaded, up to 6 MB each).
• The Fair Housing check is a second pair of eyes, not legal advice; a person approves every word.

To try it in the preview

1. Open / and launch a listing with a few photos.
2. On the listing, type "family-friendly" into any edit box: the check turns amber within a second. Press Save and the edit is kept.
3. Open "Print flyer" and print or save it as a PDF.
4. Open the sample listing while signed in as someone else: it is read-only and offers "Start a new one from this".

🤖 Generated with Claude Code

Closes #1

Mason: please address sentinel's review on this pull, point by point, and push; keep the sample data and the README a realtor can read.

All of sentinel's points are fixed and pushed, with nothing I disagreed with. Pull #2 adds a listing launcher, and this round closes the 54 MB anonymous-upload hole and gives the terminal and MCP the same edit and remove verbs as the page. bun test passes (68), the design lint is clean, a strict type check passes, and the sample listing is still there.

1. A stranger can no longer make the server hold a large upload.

• POST /listings now calls a new mayLaunch(db, who) in src/actions.ts before reading anything. It asks permit(who, "listing", "create"). If the answer is no, the server replies 401 or 403 without reading the body and records the refusal in the audit trail.
• The total upload a signed-in agent can send is now 24 MB of photos plus the 64 KB form cap, down from about 54 MB. Each photo is still at most 6 MB. A body over the cap goes back to the form with "Too large: up to 24 MB of photos in all." The form's hint says the same.
• New test in src/listings.test.ts: an anonymous POST whose body sends one chunk and then never finishes is still answered 401. That proves the body was never waited for. With the check removed, the test fails ("waited for the body"). The test sends that request on its own connection so the unfinished body can't leak into the next request.

2. The terminal can now edit and re-check.

• I split src/tty.ts into a session(db, who) that takes keys and returns the screen; the live terminal only runs when the file is executed directly. This let me test it.
• On an open listing, j/k move between assets. e puts the asset's words into the existing one-line input, where typing \n makes a line break; enter saves through editAsset and redraws the Fair Housing findings. t rewrites every asset in the next tone through retoneListing.
• Only the listing's agent or an admin gets past e or t; anyone else is told so.
• Launching a listing with photos stays on the page only, and the README says so.
• New src/tty.test.ts covers editing an asset and seeing the findings again, changing tone, being refused on someone else's listing, removing your own, and line breaks surviving the one-line input.

Smaller points.

• The terminal's remove now asks the delete permission (a new canRemoveListing), not the update one.
• MCP has a delete_listing tool that calls deleteListing; src/server.test.ts checks that a stranger is refused and an admin can remove. It's added to the README's tool list.

To try it: in the terminal, press enter on a listing, j to the short post, e, type "family-friendly", then enter. The status line turns amber and the reason appears under the asset.

🤖 Generated with Claude Code

Mason: round two from sentinel is on the pull; fix what it names (the high one first), push, and say in one line what changed.

All four of sentinel's points are fixed and pushed. Edits, tone changes and removals made in the terminal now reach open web pages live, and a launch's body is cut off at the cap. Photos are saved together with their listing or not at all, and C1 control characters are stripped from typed words. bun test passes (72), the design lint is clean, and a strict type check passes. I disagree with nothing in the review.

1. Terminal writes reach web pages live (the high one).

• Events are now rows in a new event table in the shared SQLite file (a new migration).
• emit(db, type, data) writes the row, and the server watches the table (follow in src/live.ts). It hands its own writes to open pages at once and picks up writes from another process every 250 ms.
• Event ids now come from the table, so Last-Event-ID and ?since= still replay the last 100. Each stream skips anything it already sent, so nothing arrives twice. The table keeps its newest 1,000 rows.
• The README's "appears without a reload" is now true for the terminal as well, and AGENTS.md shows the new emit(db, …) form.
• New test in src/tty.test.ts: a terminal session on its own connection to the data directory presses x. The server's /events stream then carries listing.removed for that listing.

2. The launch body is cut off at the cap.

• readBody and readForm take a drain limit (it stays eight times the cap everywhere else).
• POST /listings passes drain = 0, so the connection is cut as soon as the 24 MB cap is passed.
• readBody used to read one more chunk before checking that limit; it now stops at once.
• A new test streams a 100 MB body in 1 MB chunks against a 3 MB cap: at most six chunks are pulled.

3. No orphan photos.

• A launch names its files first, then inserts the row and writes the files inside one transaction. If either step throws, the transaction rolls back and the written files are removed.
• src/photos.ts now has nameFor, write and unwrite in place of save.
• A test covers both orders: an insert that fails leaves no file, and a file write that fails leaves no row.

4. No C1 control characters.

• line() and assetText() now strip U+0080–U+009F along with C0.
• I applied the same cleaning to note bodies, which the review did not name. Notes are also printed in other people's terminals; their control characters become a space.
• A test feeds U+009B (which some terminals treat as CSI) and ESC[2J through an address, the features, an asset and a note.

🤖 Generated with Claude Code