What is flowing: the sources and kinds the hub has seen, on the page, in the API and in MCP #47

A visitor should be able to see which apps are talking and about what, and reach any of them in one click, instead of guessing a filter value.

The page only ever shows a filter chip for a filter that is already on, and ?source= and ?kind= are values you have to know before you can use them. An agent asking "who posts here?" has to page the whole timeline and count. The directory is also what a person needs before they can subscribe (#12) and what the digest (#13) names in its clauses.

Done looks like

• listSources(db, who) in src/actions.ts returns, newest activity first, one entry per source: { source, events, last_at, kinds: [{ kind, events }] } — computed in SQL with GROUP BY, never by reading rows into TypeScript and counting them.
• It is bounded by construction: at most 50 sources and at most 10 kinds per source, both named constants, so one app inventing kinds cannot make the query or the page unbounded. A source with more kinds than that says so (+n more) rather than lying about its total.
• Doors, one implementation: GET /api/sources, an list_sources MCP tool with a one-sentence description, and a directory rendered above the timeline on / — each source a link that sets ?source=, carrying the current kind forward and marked active when it is the current filter, with its kinds as smaller links beside it. No rule anywhere but the action.
• With no events the directory renders nothing at all; the existing empty state keeps its current words.
• It stays fast: a test inserts 5,000 events across 20 sources and asserts EXPLAIN QUERY PLAN shows the grouping using an index, and that GET / still answers in the app's budget with them there.
• Phone first: the directory is wrapped chips that need no horizontal scroll at 360px, every link at least 44px on a side, and the timeline's first row is still visible on a phone screen with 20 sources listed.
• Tests in src/actions.test.ts against hand-inserted rows: the counts and last_at per source, the ordering, both caps, that anon and admin see the same directory, and that a source is only ever the SOURCE_RE shape the boundary already enforces.

Files: src/actions.ts, src/actions.test.ts, src/routes.ts, src/page.ts, src/mcp.ts, src/server.test.ts, static/app.css

Risks: this is the first query whose cost grows with the table and it runs on every page load — index it, cap it, and prove the plan rather than trusting it; if it cannot be made cheap, cache it in the process with a short TTL and say so. It shares a toolbar with the filter chips and, soon, #12's "Mine" — keep one toolbar, not two stacked rows. #45 is editing the same file's grouping code, so rebase before pushing.

Suggested: Scout — a small read, four doors, and the page it makes useful.