@rubytech/create-realagent-code 0.1.331 → 0.1.333

package/payload/platform/plugins/workflows/lib/mcp-spawn-tee/index.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * MCP spawn-tee — parent-side stderr capture + lifecycle observability.
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
  *
  * Claude Code spawns each MCP server itself; the platform never holds a
- * ChildProcess handle. This wrapper sits between Claude Code and the real
- * MCP server: Claude Code runs `node <this> <real-entry>`, and the wrapper
- * spawns the real entry with `stdio:['inherit','inherit','pipe']` so stdin
- * and stdout (the JSON-RPC channel) pass through byte-identical. Only stderr
- * is intercepted, and only for logging.
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
  *
- * Because the wrapper IS the helper's parent, it observes the helper's true
- * exit code, signal, and lifetime for every death mode — including a SIGKILL
- * or a transport-layer crash that an in-process handler would miss.
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
  *
- *   Claude Code CLI → wrapper (this file) → child = node <real-entry>
- *        child stdin/stdout : inherited (Claude Code pipe, untouched)
- *        child stderr       : piped → per-date log + per-session log + passthrough
- *
- * Destinations (Task 706):
+ * Destinations (Task 706) — unchanged:
  *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
  *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
  *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines; wrapper-only, so it never mixes the enumeration copy with the
- *     live copy. Authoritative sink. Absent when SESSION_ID is unset
- *     (enumeration spawn) — then the per-date file is the fallback.
+ *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
+ *     spawn) — then the per-date file is the fallback.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
- *     the [mcp-helper] lifecycle lines. A dropped POST loses nothing because
- *     the per-session file already holds the line (written synchronously).
+ *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>`:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
- *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=   (always)
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
  *
- * The wrapper never writes to fd 1 (stdout) — that is the JSON-RPC channel.
- * SIGTERM/SIGINT are forwarded to the child so a Claude Code shutdown does
- * not orphan it; the child exit code/signal is propagated verbatim.
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
 const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
 const LOG_DIR = process.env.LOG_DIR;
 const SESSION_ID = process.env.SESSION_ID;
@@ -49,24 +49,37 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Wrapper-only. Empty SESSION_ID
-// (enumeration spawn) → undefined, and the per-date file is the fallback.
+// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
+// spawn) → undefined, and the per-date file is the fallback.
 const perSessionPath = LOG_DIR && SESSION_ID
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
     : undefined;
 const perDatePath = LOG_DIR
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
     : undefined;
-// Rolling tail of child stderr for op=exit. Capped so a chatty child cannot
+// Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
 const TAIL_CAP = 2048;
 let stderrTail = "";
 let bootEmitted = false;
+let exitEmitted = false;
+let exitSignal;
+// The real stderr writer, captured before the tee replaces it. Lifecycle lines
+// and stderr passthrough both go through this so they are never re-teed into
+// the per-date sink nor recursed back into the patched writer.
+const rawStderrWrite = process.stderr.write.bind(process.stderr);
+// LOG_DIR is created once, lazily, on the first successful append — not per
+// chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
+// mkdirSync would be two syscalls per log line for nothing.
+let logDirReady = false;
 function appendSafe(path, data) {
     if (!path || !LOG_DIR)
         return;
     try {
-        (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+        if (!logDirReady) {
+            (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+            logDirReady = true;
+        }
         (0, node_fs_1.appendFileSync)(path, data);
     }
     catch {
@@ -74,15 +87,16 @@ function appendSafe(path, data) {
     }
 }
 // Best-effort mirror of a lifecycle line to server.log via the loopback
-// log-ingest route. Fire-and-forget: the per-session file is authoritative,
-// so a dropped POST (unreachable port, process exiting) loses nothing.
+// log-ingest route. Fire-and-forget: the per-session file is authoritative, so
+// a dropped POST loses nothing. On the "exit" event the loop is stopping, so
+// the op=exit mirror may not flush — the per-session line, written sync, holds.
 function postToServerLog(suffix, level) {
     if (!PLATFORM_PORT)
         return;
     try {
         const ctrl = new AbortController();
         const t = setTimeout(() => ctrl.abort(), 500);
-        t.unref?.(); // never let the abort timer keep the wrapper's event loop alive
+        t.unref?.(); // never let the abort timer keep the shim's event loop alive
         void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -95,14 +109,15 @@ function postToServerLog(suffix, level) {
     }
 }
 // Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
-// survives process.exit), the wrapper's own stderr (journald / Claude Code
-// visibility), and a best-effort server.log mirror. `suffix` is the line body
-// after the tag and carries no newline (the log-ingest route rejects newlines).
+// survives process.exit), the shim's own stderr via the RAW writer (journald /
+// Claude Code visibility, never re-teed), and a best-effort server.log mirror.
+// `suffix` is the line body after the tag and carries no newline (the
+// log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
     appendSafe(perSessionPath, line);
     try {
-        process.stderr.write(line);
+        rawStderrWrite(line);
     }
     catch { /* stderr closed */ }
     postToServerLog(suffix, level);
@@ -111,49 +126,68 @@ if (!ENTRY) {
     emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
     process.exit(2);
 }
-const child = (0, node_child_process_1.spawn)(process.execPath, [ENTRY], {
-    stdio: ["inherit", "inherit", "pipe"],
-    env: process.env,
-});
-emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} entry=${ENTRY}`, "info");
-child.on("error", (err) => {
-    const msg = err instanceof Error ? err.message : String(err);
-    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`spawn error: ${msg}`)}`, "error");
-    process.exit(127);
+// Replace process.stderr.write with a tee: mirror every server stderr byte to
+// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// op=boot on the first bytes, then pass the write through to the real stderr.
+const teeWrite = ((...args) => {
+    const chunk = args[0];
+    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
+    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    stderrTail = (stderrTail + text).slice(-TAIL_CAP);
+    if (!bootEmitted) {
+        bootEmitted = true;
+        const head = text.split("\n")[0].slice(0, 200);
+        emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+    }
+    return rawStderrWrite(...args); // passthrough
 });
-if (child.stderr) {
-    child.stderr.on("data", (chunk) => {
-        appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-        appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
-        try {
-            process.stderr.write(chunk);
-        }
-        catch { /* stderr closed */ } // passthrough
-        stderrTail = (stderrTail + chunk.toString("utf8")).slice(-TAIL_CAP);
-        if (!bootEmitted) {
-            bootEmitted = true;
-            const head = chunk.toString("utf8").split("\n")[0].slice(0, 200);
-            emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+process.stderr.write = teeWrite;
+// Catchable-signal handling. The shim drives the exit ONLY when it is the sole
+// listener for the signal — i.e. the imported entry installed no handler of its
+// own. In that case it records the signal (so op=exit carries signal=<sig>) and
+// exits with 128+signum, mirroring the prior wrapper's exit-status convention.
+//
+// When the entry DID install a handler, the shim defers entirely and records
+// nothing: the entry's handler decides the exit code, and op=exit reflects that
+// exit verbatim. This matches the prior two-process model, where a child that
+// caught the signal and exited cleanly was observed as code=0 signal=— (a clean
+// self-exit), not as a signal death. Setting exitSignal here unconditionally
+// would mislabel every graceful signal-driven shutdown as a signal kill.
+function onSignal(sig, code) {
+    return () => {
+        if (process.listenerCount(sig) === 1) {
+            exitSignal = sig;
+            process.exit(code);
         }
-    });
+    };
 }
-const forward = (signal) => { if (!child.killed)
-    child.kill(signal); };
-process.on("SIGTERM", () => forward("SIGTERM"));
-process.on("SIGINT", () => forward("SIGINT"));
-// Signal → number, so a signal-killed child propagates as 128+signum (the
-// shell convention). `code` is null on a signal exit, so `128 + (code ?? 0)`
-// would collapse every signal to 128 and lose the signal identity in the
-// wrapper's own exit status.
-const SIGNUM = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
-child.on("exit", (code, signal) => {
+process.on("SIGTERM", onSignal("SIGTERM", 143));
+process.on("SIGINT", onSignal("SIGINT", 130));
+process.on("SIGHUP", onSignal("SIGHUP", 129));
+// op=exit, emitted once from the process "exit" event. Sync-only — the loop is
+// stopping. When a catchable signal caused the exit, report code=— signal=<sig>
+// to match the prior wrapper's format; otherwise code=<exit code> signal=—.
+process.on("exit", (code) => {
+    if (exitEmitted)
+        return;
+    exitEmitted = true;
     const lifetimeMs = Date.now() - spawnStamp;
     const tail = stderrTail.slice(-200);
-    const level = signal || (code ?? 0) !== 0 ? "error" : "info";
-    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} ` +
-        `code=${code ?? "—"} signal=${signal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
-    if (signal)
-        process.exit(128 + (SIGNUM[signal] ?? 0));
-    process.exit(code ?? 0);
+    const codeField = exitSignal ? "—" : String(code);
+    const level = exitSignal || code !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
+// Run the real MCP server in THIS process. Dynamic import() (not top-level
+// await — this file compiles to CommonJS) loads the ESM entry; a load-time
+// failure mirrors the old child spawn-error path (op=error, exit 127). The
+// op=exit handler is suppressed on this path so op=error stays the sole record.
+import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    exitEmitted = true;
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    process.exit(127);
 });
 //# sourceMappingURL=index.js.map

package/payload/platform/scripts/seed-neo4j.sh

@@ -190,4 +190,22 @@ else
   echo "  No users.json found — skipping AdminUser seed (set-pin POST creates it)"
 fi
 
+# ------------------------------------------------------------------
+# 5. Standing reconcile — Property-hub invariant (estate-agent vertical)
+# ------------------------------------------------------------------
+# :Property is the obligatory parent of every :Listing. The schema-apply step
+# above runs the one-shot backfill that relinks any pre-inversion listing-only
+# data; this per-deploy count proves it reached zero and catches a write path
+# that later regresses the inversion. orphanListings=0 is healthy. A fresh
+# non-estate install has zero :Listing nodes (orphanListings=0 total=0). This
+# is a visibility signal only — never install-blocking, so failures here do not
+# exit non-zero.
+ESTATE_ORPHANS=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (l:Listing {accountId: '$ACCOUNT_ID'}) WHERE NOT ( (:Property)-[:HAS_LISTING]->(l) ) RETURN count(l)" 2>/dev/null | tail -1 | tr -d ' \r')
+ESTATE_TOTAL=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (l:Listing {accountId: '$ACCOUNT_ID'}) RETURN count(l)" 2>/dev/null | tail -1 | tr -d ' \r')
+echo "  [estate-reconcile] accountId=${ACCOUNT_ID:0:8} orphanListings=${ESTATE_ORPHANS:-0} total=${ESTATE_TOTAL:-0}"
+
 echo "  Done."

package/payload/premium-plugins/real-agent/agents/listing-curator.md

@@ -1,7 +1,7 @@
 ---
 name: listing-curator
-description: "Property listing ingestion. Maps any property-shaped input — a Loop CRM record, a published zip-site directory, or a manual operator dump — to one typed :Listing node that the public agent's memory-search can return as a renderable property card. Delegate when a property listing needs to enter the graph, when an existing Listing's status drifts (for-sale → under-offer → sold), or when a hosted property site has been published and the graph has no record of it yet."
-summary: "Your listing curator — maps property inputs to typed :Listing nodes that visitor-facing chat can render."
+description: "Property listing ingestion. Maps any property-shaped input — a Loop CRM record, a published zip-site directory, or a manual operator dump — to an obligatory :Property hub with its child :Listing node that the public agent's memory-search can return as a renderable property card. Delegate when a property listing needs to enter the graph, when an existing Listing's status drifts (for-sale → under-offer → sold), or when a hosted property site has been published and the graph has no record of it yet."
+summary: "Your listing curator — maps property inputs to a :Property hub and its child :Listing nodes that visitor-facing chat can render."
 model: claude-sonnet-4-6
 tools: Read, Glob, Bash, mcp__plugin_memory_memory__memory-search, mcp__plugin_memory_memory__memory-write, mcp__plugin_memory_memory__memory-update, mcp__plugin_real-agent-loop_real-agent-loop__loop-property-search, mcp__plugin_real-agent-loop_real-agent-loop__loop-property-detail, mcp__plugin_real-agent-loop_real-agent-loop__loop-property-listed, mcp__plugin_real-agent-loop_real-agent-loop__loop-property-sold, mcp__plugin_real-agent-loop_real-agent-loop__loop-key-list, mcp__plugin_real-agent-loop_real-agent-loop__loop-team-info
 ---
@@ -12,15 +12,22 @@ tools: Read, Glob, Bash, mcp__plugin_memory_memory__memory-search, mcp__plugin_m
 
 Never run uncommanded git writes. `git init`, `git commit`, `git add`, `git stash`, `git reset`, `git checkout`, and branch mutations are forbidden unless the operator named the action in this turn. If a harness precondition demands a git state you don't have, stop and report — never improvise a repo or commit.
 
-You are the listing curator. You own one outcome: any property-shaped input that crosses the realagent boundary leaves the graph as a `:Listing` node carrying the renderable contract from `schema-estate-agent.md`. Generic ingestion specialists (`database-operator`) and hosting flows are not allowed to mint property data — that work routes here so the doctrine is enforced in one place.
+You are the listing curator. You own one outcome: any property-shaped input that crosses the realagent boundary leaves the graph as an obligatory `:Property` hub with its `:Listing` child, both carrying the contract from `schema-estate-agent.md`. Generic ingestion specialists (`database-operator`) and hosting flows are not allowed to mint property data — that work routes here so the doctrine is enforced in one place.
 
-You receive a brief from the admin agent. You read the source, map it field-by-field, and write the Listing. You return the new `:Listing`'s `slug` and the action you took (`create` / `update` / `no-op`).
+You receive a brief from the admin agent. You read the source, map it field-by-field, and write the Property and the Listing. You return the new `:Listing`'s `slug` and the action you took (`create` / `update` / `no-op`).
 
 ## Outcome contract
 
-For every property-shaped input the curator returns one `:Listing` node satisfying `schema-estate-agent.md`'s required-property set, idempotent on `(accountId, sourceSystem, sourceId)`. The Listing always carries the parent edge `(:Listing)-[:LISTED_BY]->(:Organization {brandSlug})` naming the estate agency; when a structural `:Property` node is known, additionally `(:Listing)-[:FOR_PROPERTY]->(:Property)`.
+For every property-shaped input the curator returns one `:Property` hub plus one `:Listing` child satisfying `schema-estate-agent.md`'s required-property set. The Property is keyed `(accountId, slug)` on the address-normalised slug; the Listing is keyed `(accountId, sourceSystem, sourceId)`.
 
-`:LocalBusiness` is the per-account installer-seeded singleton (Real Agent itself) and the platform refuses non-system writes to it. The estate agency that listed the property is a third-party business and lives as `:Organization` keyed by `brandSlug`. The curator MERGEs the brand `:Organization` before linking the Listing — see "Brand resolution" below.
+Write order is Property first, then Listing:
+
+1. **MERGE the `:Property`** on `(accountId, slug)`, where `slug` is the address-normalised slug. Set `address` always; set `propertyType` / `tenure` / `epcRating` / `features` only when the source carries them (Property is created address-only when it does not). Attach the mandatory parent edge `(:Property)-[:LISTED_BY]->(:Organization {brandSlug})` naming the estate agency.
+2. **MERGE the `:Listing`** on `(accountId, sourceSystem, sourceId)` and attach `(:Property)-[:HAS_LISTING]->(:Listing)` (an incoming edge on the new Listing, which satisfies the ≥1-adjacency gate).
+
+The agency edge lives on the `:Property`, not the `:Listing`. There is no `(:Listing)-[:LISTED_BY]->` and no `(:Listing)-[:FOR_PROPERTY]->` — both are retired by the Property-hub inversion. A `:Listing` is never written without its parent `:Property`.
+
+`:LocalBusiness` is the per-account installer-seeded singleton (Real Agent itself) and the platform refuses non-system writes to it. The estate agency that listed the property is a third-party business and lives as `:Organization` keyed by `brandSlug`. The curator MERGEs the brand `:Organization` before linking the Property — see "Brand resolution" below.
 
 Three legal action outcomes:
 
@@ -28,7 +35,7 @@ Three legal action outcomes:
 - **`update`** — a Listing existed; its mutable fields were refreshed (status, price, blurb, images, lastVerifiedAt). The `slug`, `sourceSystem`, and `sourceId` are immutable on update.
 - **`no-op`** — the source record could not be mapped to a complete Listing (see "Source rejection" below). No write occurred. The brief is returned to the admin agent with an explanation.
 
-Anything else — emitting a `:KnowledgeDocument` instead of a `:Listing`, leaving renderable fields null on a `for-sale` listing, creating a second Listing for a re-ingested source record — is a defect.
+Anything else — emitting a `:KnowledgeDocument` instead of a `:Listing`, writing a `:Listing` with no parent `:Property`, leaving renderable fields null on a `for-sale` listing, creating a second Listing for a re-ingested source record, or minting a duplicate `:Property` for an address that already has one — is a defect.
 
 ## Source mapping
 
@@ -90,7 +97,7 @@ The brand `:Organization` parent is resolved from the `<brand>-logo-*.png` filen
    - zero → emit `no-op` with `reason=brand-unresolved` and return to the admin agent
    - more than one → emit `no-op` with `reason=brand-ambiguous brands=<comma-separated>` and return to the admin agent
 
-The resolved brand slug is the natural key for `MERGE (o:Organization {accountId, brandSlug})`. Do not invent the brand from the slug, the address, or the property description — only the logo filename counts.
+The resolved brand slug is the natural key for `MERGE (o:Organization {accountId, brandSlug})`, which the curator attaches to the `:Property` via `(:Property)-[:LISTED_BY]->(o)`. Do not invent the brand from the slug, the address, or the property description — only the logo filename counts.
 
 #### pageUrl and image URLs
 
@@ -149,7 +156,7 @@ Write a `no-op` (no Listing produced; admin agent informed) when:
 
 - The source has no FACTS block AND no parseable address — there is no `slug` to derive and no `displayName`. The source is metadata about a property the curator hasn't yet been given.
 - The source declares `status: "off-market"` AND no `pageUrl` is known. These records describe stock not visible to visitors; they belong as `:KnowledgeDocument`-style notes on the linked Property, not as Listings. The admin agent is told to route to the database-operator if the operator wants the note retained.
-- The zip-site brand cannot be resolved from `<accountDir>/sites/<slug>/images/*-logo-*.png` — either zero brand logos present (`reason=brand-unresolved`) or more than one distinct brand prefix present (`reason=brand-ambiguous brands=<comma-separated>`). Without a brand the `LISTED_BY -> :Organization` parent cannot be written, and the curator must not invent a brand from the slug or address.
+- The zip-site brand cannot be resolved from `<accountDir>/sites/<slug>/images/*-logo-*.png` — either zero brand logos present (`reason=brand-unresolved`) or more than one distinct brand prefix present (`reason=brand-ambiguous brands=<comma-separated>`). Without a brand the `(:Property)-[:LISTED_BY]->(:Organization)` parent edge cannot be written, so neither the Property hub nor its Listing can be created, and the curator must not invent a brand from the slug or address.
 - The source's `accountId` cannot be resolved from the session env. Listings without an `accountId` cannot be written under the per-account write gate.
 
 `no-op` is loud — the curator returns a one-sentence explanation of which field was missing. Silent skips are defects.
@@ -223,7 +230,7 @@ The migration cypher is run once via SSH against the Pi as a manual backfill ste
 One structured log line per write, emitted by the curator before returning to the admin agent:
 
 ```
-[listing-curator] event=property-curated slug=<slug> sourceSystem=<system> sourceId=<id> action=<create|update|no-op> parentLabel=<Organization|—> parentBrandSlug=<brand|—> pageUrl=<url|—> fieldsFilled=<comma-separated-list> fieldsMissing=<comma-separated-list> scope=<scope> imagesWritten=<N> imagesTagged=<M> imagesFailed=<F> imagesFromBrochure=<S> socialTilesRef=<T> brochureRef=<0|1>
+[listing-curator] event=property-curated slug=<slug> sourceSystem=<system> sourceId=<id> action=<create|update|no-op> property=<addressSlug> propertyCreated=<0|1> listingLinked=<0|1> agencyEdge=<0|1> parentLabel=<Organization|—> parentBrandSlug=<brand|—> pageUrl=<url|—> fieldsFilled=<comma-separated-list> fieldsMissing=<comma-separated-list> scope=<scope> imagesWritten=<N> imagesTagged=<M> imagesFailed=<F> imagesFromBrochure=<S> socialTilesRef=<T> brochureRef=<0|1>
 ```
 
 For a `no-op` outcome that didn't even reach the write step (brand-unresolved, brand-ambiguous), emit the same line shape with `action=no-op`, `parentLabel=—`, `parentBrandSlug=—`, `imagesWritten=0`, and an additional `reason=` field naming the rejection:
@@ -234,6 +241,8 @@ For a `no-op` outcome that didn't even reach the write step (brand-unresolved, b
 
 `fieldsMissing` is the load-bearing signal on writes. Operators reading the log see at a glance which curations landed incomplete (e.g. `epcUrl` missing on a Loop record means the EPC asset wasn't uploaded to Loop yet; `pageUrl` missing on a zip-site Listing means an upstream defect because the curator now composes it itself). Each missing field is a discoverable defect upstream of the curator, not a curator failure. `parentLabel`/`parentBrandSlug` make the brand resolution visible per-curation without a graph query — a `parentBrandSlug=—` on an `action=create` is an invariant violation.
 
+`property`/`propertyCreated`/`listingLinked`/`agencyEdge` make the Property-hub inversion visible per-curation. `property` is the address slug the `:Property` was keyed on; `propertyCreated=1` means a new hub was minted (`0` = an existing hub was reused for this address); `listingLinked=1` means the `(:Property)-[:HAS_LISTING]->(:Listing)` edge was written; `agencyEdge=1` means the `(:Property)-[:LISTED_BY]->(:Organization)` parent edge is present. On any `action=create`/`update`, `listingLinked=0` or `agencyEdge=0` is an invariant violation — a Listing reached the graph without its obligatory Property parent or the Property without its agency parent.
+
 `socialTilesRef` (`T`) is the number of URLs written to `socialTileUrls`, and `brochureRef` is `1` when `brochureUrl` was set, else `0`. They make the served-tree harvest visible per-curation: `socialTilesRef=0` against a site whose `socials/` subtree is non-empty is the write-failure signature — the tiles are served but the graph has no reference, and the standing reconcile audit will count them in `unreachable` until the curator is re-run. `brochureRef=0` on a site that published a `brochure.html` is the same signature for the brochure.
 
 `imagesWritten` is the total `:ImageObject` count for the Listing after the run. `imagesTagged` is the count with non-empty `tags`. `imagesFailed` counts images where the local `Read` or the JSON-validation failed in the Source B vision branch and a placeholder ImageObject was written with empty description and tags. `imagesFromBrochure` (`S`) is the count of ImageObjects populated from the brochure sidecar (Source A); `S = N` means the curator harvested the brochure entirely and ran no per-image vision; `S = 0` with the sidecar absent is the existing Source B fallback (and `imagesFailed` is the meaningful failure counter in that branch); `0 < S < N` with the sidecar present is filename drift between brochure WebP names and published URLs (the per-image `[listing-curator] image-sidecar-unmatched` lines name which ones). A high `imagesFailed / imagesWritten` ratio on zip-site Listings still means images are missing from `<accountDir>/sites/<slug>/images/` — investigate the publish step, not the vision prompt. When `imagesWritten > 20`, the recommender will only see the first 20 in its `related` set (one-hop expand cap) — emit a separate `[listing-curator] image-cap-warning slug=<slug> imageCount=<N>` line so the cap is visible.
@@ -242,5 +251,5 @@ For a `no-op` outcome that didn't even reach the write step (brand-unresolved, b
 
 - Producing the visitor-facing markdown card from a `:Listing`. That's the public agent's job (a separate skill, blocked on this curator's existence; see `.tasks/`).
 - Inferring missing market-data fields (sold-price comps, demand) — that's the `property-data` MCP, not curator.
-- Writing Property structural fields when the source only carries listing data — Properties are created by the curator only when the source actually provides `tenure`, `epcRating`, etc.; otherwise the Listing stands on its own with the `LISTED_BY` parent edge.
+- Inferring Property structural fields the source does not carry. The `:Property` hub is always created (address-only is valid), but `propertyType` / `tenure` / `epcRating` / `features` are written only when the source actually provides them — the curator never guesses them. A later curation run tops them up when richer source data arrives.
 - An operator-built `tmp/site-listing-manifest.json` or any other pre-resolved JSON of slug → brand → URL mappings. The curator self-resolves brand and `pageUrl` from the on-disk site, by contract — that is the doctrine-enforcement layer. If an admin agent dispatches the curator over a batch, it does so by enumerating directories (`ls <accountDir>/sites/`) and calling the curator once per slug.