@agent-native/core 0.121.2 → 0.122.0

package/corpus/templates/calendar/.agents/skills/upgrade-agent-native/SKILL.md

@@ -56,7 +56,29 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    - Runs `skills update scaffold --project`
    - Runs `typecheck` when the project has that script
 
-3. **If upgrade or typecheck fails**
+3. **Pull upstream template changes (optional, separate from the bump)**
+
+   `agent-native upgrade` moves package versions. It never touches files that
+   were copied out of a template at scaffold time, so template fixes and
+   improvements do not arrive with a bump.
+
+   ```bash
+   agent-native template status        # recorded ref vs latest, drift counts
+   agent-native template diff          # what upstream changed, read-only
+   agent-native template sync          # 3-way merge it into the app
+   ```
+
+   `sync` defaults to the ref matching the installed `@agent-native/core`, so
+   run it after `upgrade`. It merges per file against a pristine baseline
+   stored in `refs/agent-native/template-baseline/<app-path>`; files upstream
+   did not touch are left alone, and real collisions get conflict markers.
+   After resolving markers, run `agent-native template accept` — the baseline
+   deliberately does not advance past an unresolved merge.
+
+   Apps scaffolded before provenance existed have no baseline. Create one
+   with `agent-native template baseline` before the first sync.
+
+4. **If upgrade or typecheck fails**
 
    - Read the concrete error
    - Fix **app** source, actions, config, or env — not framework packages
@@ -68,7 +90,7 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    copied component; do not use that path to reproduce framework runtime
    behavior or hide version skew.
 
-4. **Dry-run / partial runs**
+5. **Dry-run / partial runs**
 
    ```bash
    agent-native upgrade --dry-run

package/corpus/templates/calendar/_gitignore

@@ -37,3 +37,4 @@ data/.sessions.json
 learnings.md
 
 .vercel/
+.agent-native/

package/corpus/templates/chat/.agents/skills/upgrade-agent-native/SKILL.md

@@ -56,7 +56,29 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    - Runs `skills update scaffold --project`
    - Runs `typecheck` when the project has that script
 
-3. **If upgrade or typecheck fails**
+3. **Pull upstream template changes (optional, separate from the bump)**
+
+   `agent-native upgrade` moves package versions. It never touches files that
+   were copied out of a template at scaffold time, so template fixes and
+   improvements do not arrive with a bump.
+
+   ```bash
+   agent-native template status        # recorded ref vs latest, drift counts
+   agent-native template diff          # what upstream changed, read-only
+   agent-native template sync          # 3-way merge it into the app
+   ```
+
+   `sync` defaults to the ref matching the installed `@agent-native/core`, so
+   run it after `upgrade`. It merges per file against a pristine baseline
+   stored in `refs/agent-native/template-baseline/<app-path>`; files upstream
+   did not touch are left alone, and real collisions get conflict markers.
+   After resolving markers, run `agent-native template accept` — the baseline
+   deliberately does not advance past an unresolved merge.
+
+   Apps scaffolded before provenance existed have no baseline. Create one
+   with `agent-native template baseline` before the first sync.
+
+4. **If upgrade or typecheck fails**
 
    - Read the concrete error
    - Fix **app** source, actions, config, or env — not framework packages
@@ -68,7 +90,7 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    copied component; do not use that path to reproduce framework runtime
    behavior or hide version skew.
 
-4. **Dry-run / partial runs**
+5. **Dry-run / partial runs**
 
    ```bash
    agent-native upgrade --dry-run

package/corpus/templates/chat/_gitignore

@@ -41,3 +41,4 @@ data/.sessions.json
 learnings.md
 
 .vercel/
+.agent-native/

package/corpus/templates/clips/.agents/skills/upgrade-agent-native/SKILL.md

@@ -56,7 +56,29 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    - Runs `skills update scaffold --project`
    - Runs `typecheck` when the project has that script
 
-3. **If upgrade or typecheck fails**
+3. **Pull upstream template changes (optional, separate from the bump)**
+
+   `agent-native upgrade` moves package versions. It never touches files that
+   were copied out of a template at scaffold time, so template fixes and
+   improvements do not arrive with a bump.
+
+   ```bash
+   agent-native template status        # recorded ref vs latest, drift counts
+   agent-native template diff          # what upstream changed, read-only
+   agent-native template sync          # 3-way merge it into the app
+   ```
+
+   `sync` defaults to the ref matching the installed `@agent-native/core`, so
+   run it after `upgrade`. It merges per file against a pristine baseline
+   stored in `refs/agent-native/template-baseline/<app-path>`; files upstream
+   did not touch are left alone, and real collisions get conflict markers.
+   After resolving markers, run `agent-native template accept` — the baseline
+   deliberately does not advance past an unresolved merge.
+
+   Apps scaffolded before provenance existed have no baseline. Create one
+   with `agent-native template baseline` before the first sync.
+
+4. **If upgrade or typecheck fails**
 
    - Read the concrete error
    - Fix **app** source, actions, config, or env — not framework packages
@@ -68,7 +90,7 @@ install → refresh scaffold skills → verify, then fix **app** code only.
    copied component; do not use that path to reproduce framework runtime
    behavior or hide version skew.
 
-4. **Dry-run / partial runs**
+5. **Dry-run / partial runs**
 
    ```bash
    agent-native upgrade --dry-run

package/corpus/templates/clips/.agents/skills/video-sharing/SKILL.md

@@ -46,6 +46,7 @@ Read this skill before:
 - **`recordings.visibility`** — framework-managed column from `ownableColumns()`.
 - **`recording_viewers`** + **`recording_events`** — view counting.
 - **`recording_views`** — append-only per-view log (who viewed, when) backing the owner-facing "Viewed by" popover. See "View counting" below.
+- **`recording_agent_views`** — outside agents reading a clip through its public agent APIs, counted separately from humans. See "Agent views" below.
 
 ## Dropping in the share UI
 
@@ -213,6 +214,11 @@ they can fetch only the visual context they need.
 
 ## View counting
 
+Clips counts **human views** and **agent views** separately. The two live in
+different tables and never mix — see "Agent views" below before touching either.
+
+### Human views
+
 A view counts when **any** of these is true:
 
 - The viewer has watched **≥ 5 seconds** of total real playback time
@@ -237,6 +243,34 @@ if (
 
 Events feeding this live in `recording_events`. The `/api/view-event` route receives `view-start`, `watch-progress` (every 5s), `seek`, `pause`, `resume`, `cta-click`, `reaction`. Aggregate into `recording_viewers` on write to keep `get-insights` fast.
 
+### Agent views
+
+An **agent view** is an outside agent reading a clip through its public agent
+APIs — `/api/agent-context.json`, `/api/agent-transcript.json`,
+`/api/agent-frame.jpg`. Those routes are agent-only surfaces (a human watching a
+clip never hits them), so a request on one is the signal.
+
+- **Table:** `recording_agent_views` — one row per `(recordingId, agentKey, viewSessionId)`.
+  `agentKey` is a sha256 of user-agent + request IP, so an agent is countable
+  across polls without ever storing its IP. `agentLabel` is the product name
+  parsed from the user-agent (Claude, ChatGPT, Perplexity, …), falling back to
+  `"Agent"` — never the raw user-agent string.
+- **Where it's written:** `recordAgentView` in `server/lib/agent-views.ts`,
+  called from `loadPublicAgentAccess` — the one choke point all three agent
+  routes share. Owner requests are skipped (they're previews, not views), and the
+  write is best-effort so view accounting can never fail an agent's read.
+- **Dedup:** one agent's burst of context + transcript + frame polls collapses
+  into a single view via a 30-minute window (`AGENT_VIEW_SESSION_MS`), with
+  `requestCount` recording how many polls that view covered.
+- **Reads:** `countRecordingAgentViews` and `listRecordingAgentViewers`. Surfaced
+  as `agentViews` / `agentViewers` on `get-recording-insights` and
+  `agentViewCount` on `get-recording-player-data`, and rendered in the views pill
+  popover (`RecordingViewsBadge`) next to human views.
+
+Keeping this in its own table is deliberate: no human-view query can pick agents
+up by forgetting a filter. Do not add agent rows to `recording_viewers` or
+`recording_views`.
+
 ### Per-viewer view records ("Viewed by")
 
 On top of the aggregate `viewCount` shown in the library and the `views` stat in the insights panel, Clips records **individual view records** — who viewed a clip and when — so the owner can see a timeline, not just a number.

package/corpus/templates/clips/AGENTS.md

@@ -17,7 +17,11 @@ ladder.
 - Store large file/blob payloads in configured file/blob storage, not SQL: no
   base64, `data:` URLs, images, video/audio, PDFs, ZIPs, screenshots,
   thumbnails, or replay chunks in app tables, `application_state`, `settings`,
-  or `resources`; persist URLs, ids, or handles instead.
+  or `resources`; persist URLs, ids, or handles instead. Hosted/shared
+  recording uploads require configured storage — do not preserve video bytes
+  in SQL as a production fallback. The only exception: local SQLite/dev flows
+  may keep scratch chunks while a user connects Builder.io or S3-compatible
+  storage.
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 - Use actions for recording metadata, transcripts, cleanup, summaries, chapters,
   comments, spaces/folders, meetings, and sharing. Do not bypass access helpers.
@@ -106,9 +110,6 @@ ladder.
   Anthropic/OpenAI power the agent chat; Gemini powers cleanup, titles, and
   meeting notes; any optional third-party speech provider is limited to
   desktop voice dictation and is not used for recording transcripts.
-- Hosted/shared recording uploads require configured storage. Do not preserve
-  video bytes in SQL as a production fallback; only local SQLite/dev flows may
-  keep scratch chunks while a user connects Builder.io or S3-compatible storage.
 - Use `view-screen` when the active recording, transcript segment, meeting, or
   share context is unclear.
 - Calendar-sourced meeting actions are shortcuts, but do not add raw

package/corpus/templates/clips/_gitignore

@@ -37,3 +37,4 @@ data/.sessions.json
 learnings.md
 
 .vercel/
+.agent-native/

package/corpus/templates/clips/actions/cleanup-transcript.ts

@@ -489,6 +489,11 @@ function buildPrompt({
     "dueDate"?: string              // ISO date if explicitly mentioned
   }>
 }
+Rules for summaryMd:
+- Write it the way the person who made this recording would describe it themselves — plain, direct, and about the subject matter.
+- Never narrate the recording from the outside. Do not write "the speaker", "the presenter", "the narrator", "the author", "the team", "the video", "this recording", "this clip", "this meeting", "the discussion covered", or any equivalent framing.
+- Lead with the topic, decisions, and specifics. Name a person only when who said or owns something actually matters.
+- No praise, no meta commentary about the transcript, no "overall" wrap-up sentence.
 Rules for action items:
 - Attribute each action item to a specific attendee whenever the transcript makes the owner clear (e.g. "I'll send the deck", "Alice will follow up").
 - The "assigneeEmail" MUST be one of the attendee emails listed in the <context> block above — do not invent emails or use display names.

package/corpus/templates/clips/actions/get-recording-insights.ts

@@ -3,8 +3,10 @@
  *
  * Owner-only — uses assertAccess at editor level (owners always satisfy).
  *
- * Returns: views, uniqueViewers, completionRate, dropOff (100 buckets),
- * ctaConversionRate.
+ * Returns: views (total counted human view sessions, so a returning viewer
+ * counts again), agentViews (outside agents reading the clip's agent APIs),
+ * uniqueViewers (distinct people behind those views), completionRate,
+ * dropOff (100 buckets), ctaConversionRate.
  *
  * Usage:
  *   pnpm action get-recording-insights --recordingId=<id>
@@ -12,11 +14,19 @@
 
 import { defineAction } from "@agent-native/core";
 import { assertAccess } from "@agent-native/core/sharing";
-import { eq } from "drizzle-orm";
+import { count, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
-import { clampCompletionPct } from "../shared/view-analytics.js";
+import {
+  countRecordingAgentViews,
+  listRecordingAgentViewers,
+} from "../server/lib/agent-views.js";
+import {
+  clampCompletionPct,
+  displayViewerName,
+  isCountedViewerRow,
+} from "../shared/view-analytics.js";
 
 export default defineAction({
   description:
@@ -39,11 +49,31 @@ export default defineAction({
       .from(schema.recordingEvents)
       .where(eq(schema.recordingEvents.recordingId, args.recordingId));
 
-    const views = viewerRows.filter((v) => v.countedView).length;
+    const [[viewLogRow], agentViews, agentViewers] = await Promise.all([
+      db
+        .select({ value: count() })
+        .from(schema.recordingViews)
+        .where(eq(schema.recordingViews.recordingId, args.recordingId)),
+      countRecordingAgentViews(args.recordingId),
+      listRecordingAgentViewers(args.recordingId),
+    ]);
+
+    // Same definition as `countedViewCondition`, applied to rows already in
+    // memory so this action keeps its single viewer-row read. One row per
+    // person, so this is the distinct-viewer count, not the view total.
+    const countedViewers = viewerRows.filter(isCountedViewerRow).length;
     const uniqueViewers = new Set(
-      viewerRows.map((v) => v.viewerEmail ?? `anon:${v.id}`),
+      viewerRows
+        .filter(isCountedViewerRow)
+        .map((v) => v.viewerEmail ?? `anon:${v.id}`),
     ).size;
 
+    // Mirrors `countRecordingViews`: `recording_views` only exists from
+    // migration v46, so clips recorded before it have zero log rows. Floor the
+    // total at the counted-viewer count so those clips keep reporting a real
+    // number instead of 0, and so total can never read below uniqueViewers.
+    const views = Math.max(Number(viewLogRow?.value ?? 0), countedViewers);
+
     const completionRate =
       viewerRows.length === 0
         ? 0
@@ -75,8 +105,12 @@ export default defineAction({
     }
 
     const ctaClicks = events.filter((e) => e.kind === "cta-click").length;
+    // CTA conversion is per person, so the denominator is counted viewers — not
+    // `views`, which counts repeat sessions from the same viewer.
     const ctaConversionRate =
-      views === 0 ? 0 : Math.min(100, (ctaClicks / views) * 100);
+      countedViewers === 0
+        ? 0
+        : Math.min(100, (ctaClicks / countedViewers) * 100);
 
     // Top viewers by total watch ms
     const topViewers = viewerRows
@@ -85,13 +119,15 @@ export default defineAction({
       .slice(0, 20)
       .map((v) => ({
         viewerEmail: v.viewerEmail,
-        viewerName: v.viewerName,
+        viewerName: displayViewerName(v.viewerName),
         totalWatchMs: v.totalWatchMs ?? 0,
         completedPct: clampCompletionPct(v.completedPct),
       }));
 
     return {
       views,
+      agentViews,
+      agentViewers,
       uniqueViewers,
       completionRate,
       ctaConversionRate,

package/corpus/templates/clips/actions/get-recording-player-data.ts

@@ -7,6 +7,7 @@
  *   - reactions
  *   - chapters (parsed from recording.chaptersJson)
  *   - CTAs
+ *   - counted-view total
  *
  * This is the read endpoint the player/:id and share/:id routes use.
  * Access is gated by assertAccess at viewer level — for public-visibility
@@ -20,23 +21,24 @@
 import { defineAction, embedApp } from "@agent-native/core";
 import { readAppState } from "@agent-native/core/application-state";
 import { buildDeepLink } from "@agent-native/core/server";
-import {
-  getRequestOrgId,
-  getRequestUserEmail,
-} from "@agent-native/core/server/request-context";
 import { resolveAccess, ForbiddenError } from "@agent-native/core/sharing";
-import { and, asc, eq, or, sql } from "drizzle-orm";
+import { asc, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { isAgentRecordingCaller } from "../server/lib/agent-recording-access.js";
+import { countRecordingAgentViews } from "../server/lib/agent-views.js";
 import { isMediaVerificationPending } from "../server/lib/media-verification-state.js";
 import { resolvePlayerVideoUrl } from "../server/lib/player-video-url.js";
 import {
   canOpenDirectRecordingPage,
   isRecordingExpired,
 } from "../server/lib/recording-page-access.js";
-import { parseSpaceIds } from "../server/lib/recordings.js";
+import { hasExplicitRecordingShare } from "../server/lib/recording-share-grant.js";
+import {
+  countRecordingViews,
+  parseSpaceIds,
+} from "../server/lib/recordings.js";
 import { parseBrowserDiagnosticsRow } from "../shared/browser-diagnostics.js";
 import {
   CLIPS_BUILDER_CREDITS_STATE_KEY,
@@ -93,7 +95,7 @@ function recordingDeepLink(recordingId: string): string {
 
 export default defineAction({
   description:
-    "Fetch everything the player page needs for a recording: metadata, transcript, comments, reactions, chapters, CTAs, and the caller's effective role. Agent calls receive a bounded transcript payload; browser player calls receive the full transcript.",
+    "Fetch everything the player page needs for a recording: metadata, transcript, comments, reactions, chapters, CTAs, the counted-view total, and the caller's effective role. Agent calls receive a bounded transcript payload; browser player calls receive the full transcript.",
   schema: z.object({
     recordingId: z.string().describe("Recording ID"),
   }),
@@ -121,55 +123,13 @@ export default defineAction({
       throw new ForbiddenError("Recording has expired");
     }
 
-    let hasExplicitShare = access.role === "owner";
-    if (
-      rec.visibility === "public" &&
-      access.role !== "owner" &&
-      !rec.password &&
-      isAgentRecordingCaller(ctx?.caller)
-    ) {
-      hasExplicitShare = true;
-    }
-    if (
-      rec.visibility === "public" &&
-      access.role !== "owner" &&
-      !hasExplicitShare
-    ) {
-      const userEmail = getRequestUserEmail()?.trim().toLowerCase();
-      const orgId = getRequestOrgId();
-      const principals = [];
-      if (userEmail) {
-        principals.push(
-          and(
-            eq(schema.recordingShares.principalType, "user"),
-            sql`lower(${schema.recordingShares.principalId}) = ${userEmail}`,
-          ),
-        );
-      }
-      if (orgId) {
-        principals.push(
-          and(
-            eq(schema.recordingShares.principalType, "org"),
-            eq(schema.recordingShares.principalId, orgId),
-          ),
-        );
-      }
-      if (principals.length > 0) {
-        const [share] = await db
-          .select({ id: schema.recordingShares.id })
-          .from(schema.recordingShares)
-          .where(
-            and(
-              eq(schema.recordingShares.resourceId, args.recordingId),
-              or(...principals),
-            ),
-          )
-          .limit(1);
-        hasExplicitShare = Boolean(share);
-      } else {
-        hasExplicitShare = false;
-      }
-    }
+    const hasExplicitShare = await hasExplicitRecordingShare({
+      recordingId: args.recordingId,
+      role: access.role,
+      visibility: rec.visibility,
+      hasPassword: Boolean(rec.password),
+      isAgentCaller: isAgentRecordingCaller(ctx?.caller),
+    });
 
     if (
       !canOpenDirectRecordingPage({
@@ -193,20 +153,27 @@ export default defineAction({
       access.role === "owner" ||
       access.role === "admin" ||
       access.role === "editor";
-    const [cleanupStateRaw, builderCreditsRaw, verificationPending] =
-      await Promise.all([
-        readAppState(`transcript-cleanup-${args.recordingId}`).catch(
-          () => null,
-        ),
-        canEditRecording
-          ? readAppState(CLIPS_BUILDER_CREDITS_STATE_KEY).catch(() => null)
-          : Promise.resolve(null),
-        isMediaVerificationPending({
-          ownerEmail: rec.ownerEmail,
-          recordingId: args.recordingId,
-          recordingStatus: rec.status,
-        }),
-      ]);
+    // This action is on a 1-3s poll from the player, so every read here shares
+    // one Promise.all instead of adding serial round-trips.
+    const [
+      cleanupStateRaw,
+      builderCreditsRaw,
+      verificationPending,
+      viewCount,
+      agentViewCount,
+    ] = await Promise.all([
+      readAppState(`transcript-cleanup-${args.recordingId}`).catch(() => null),
+      canEditRecording
+        ? readAppState(CLIPS_BUILDER_CREDITS_STATE_KEY).catch(() => null)
+        : Promise.resolve(null),
+      isMediaVerificationPending({
+        ownerEmail: rec.ownerEmail,
+        recordingId: args.recordingId,
+        recordingStatus: rec.status,
+      }),
+      countRecordingViews(args.recordingId).catch(() => 0),
+      countRecordingAgentViews(args.recordingId).catch(() => 0),
+    ]);
     const cleanupState =
       cleanupStateRaw && typeof cleanupStateRaw === "object"
         ? (cleanupStateRaw as Record<string, unknown>)
@@ -338,6 +305,8 @@ export default defineAction({
 
     return {
       role: access.role,
+      viewCount,
+      agentViewCount,
       recording: {
         id: rec.id,
         organizationId: rec.organizationId,

package/corpus/templates/clips/actions/list-clip-views.ts

@@ -19,6 +19,7 @@ import { desc, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { displayViewerName } from "../shared/view-analytics.js";
 
 export default defineAction({
   description:
@@ -49,10 +50,7 @@ export default defineAction({
       views: rows.map((v) => ({
         id: v.id,
         viewerEmail: v.viewerEmail,
-        // Anonymous rows store the `anon:<sessionId>` dedup key in
-        // viewer_name (same convention as recording_viewers). Return null so
-        // callers render "Someone" instead of the raw session key.
-        viewerName: v.viewerName?.startsWith("anon:") ? null : v.viewerName,
+        viewerName: displayViewerName(v.viewerName),
         viewedAt: v.viewedAt,
       })),
     };

package/corpus/templates/clips/actions/list-recordings.ts

@@ -21,6 +21,7 @@ import {
 } from "../server/lib/agent-recording-access.js";
 import { resolvePlayerVideoUrl } from "../server/lib/player-video-url.js";
 import {
+  countedViewCondition,
   getActiveOrganizationId,
   ownerEmailMatches,
   parseSpaceIds,
@@ -63,6 +64,31 @@ export function resolveListRecordingMedia(
   };
 }
 
+type ViewCountRow = { recordingId: string; count: number | string | null };
+
+/**
+ * `recording_views` only exists from migration v46, so pre-migration clips have
+ * no log rows and must fall back to their counted-viewer count instead of
+ * dropping to 0. Same floor as `countRecordingViews`, so a library card and the
+ * clip page always agree.
+ */
+export function mergeViewCounts(
+  countedViewerRows: ViewCountRow[],
+  viewLogRows: ViewCountRow[],
+): Record<string, number> {
+  const merged: Record<string, number> = {};
+  for (const row of countedViewerRows) {
+    merged[row.recordingId] = Number(row.count ?? 0);
+  }
+  for (const row of viewLogRows) {
+    merged[row.recordingId] = Math.max(
+      merged[row.recordingId] ?? 0,
+      Number(row.count ?? 0),
+    );
+  }
+  return merged;
+}
+
 export default defineAction({
   description:
     "List recordings visible to the current user. Supports filtering by view (library/shared/space/archive/trash/all), folder, space, tag, free-text, and sort. Public/unlisted recordings are discoverable only when owned by or previously viewed by the current user; the shared view returns accessible recordings owned by someone else.",
@@ -229,11 +255,26 @@ export default defineAction({
     }
 
     // Sort
-    const viewCountOrder = sql<number>`(
+    const countedViewerCount = sql<number>`(
       SELECT COUNT(1)
       FROM ${schema.recordingViewers}
       WHERE ${schema.recordingViewers.recordingId} = ${schema.recordings.id}
-        AND ${eq(schema.recordingViewers.countedView, true)}
+        AND ${countedViewCondition()}
+    )`;
+    const viewLogCount = sql<number>`(
+      SELECT COUNT(1)
+      FROM ${schema.recordingViews}
+      WHERE ${schema.recordingViews.recordingId} = ${schema.recordings.id}
+    )`;
+    // Same floor as `countRecordingViews`: `recording_views` only exists from
+    // migration v46, so pre-migration clips have no log rows and must fall back
+    // to the counted-viewer count instead of sorting as zero. CASE rather than
+    // MAX()/GREATEST() — the two-argument spelling differs across dialects.
+    const viewCountOrder = sql<number>`(
+      CASE WHEN ${viewLogCount} > ${countedViewerCount}
+        THEN ${viewLogCount}
+        ELSE ${countedViewerCount}
+      END
     )`;
     const orderBy =
       args.sort === "oldest"
@@ -321,25 +362,34 @@ export default defineAction({
       }
     }
 
-    // Count views per recording
+    // Count views per recording — two set-wide grouped reads, never one per
+    // recording.
     let viewsByRec: Record<string, number> = {};
     if (ids.length) {
-      const viewRows = await db
-        .select({
-          recordingId: schema.recordingViewers.recordingId,
-          count: sql<number>`COUNT(1)`,
-        })
-        .from(schema.recordingViewers)
-        .where(
-          and(
-            inArray(schema.recordingViewers.recordingId, ids),
-            eq(schema.recordingViewers.countedView, true),
-          ),
-        )
-        .groupBy(schema.recordingViewers.recordingId);
-      for (const v of viewRows) {
-        viewsByRec[v.recordingId] = Number(v.count ?? 0);
-      }
+      const [countedViewerRows, viewLogRows] = await Promise.all([
+        db
+          .select({
+            recordingId: schema.recordingViewers.recordingId,
+            count: sql<number>`COUNT(1)`,
+          })
+          .from(schema.recordingViewers)
+          .where(
+            and(
+              inArray(schema.recordingViewers.recordingId, ids),
+              countedViewCondition(),
+            ),
+          )
+          .groupBy(schema.recordingViewers.recordingId),
+        db
+          .select({
+            recordingId: schema.recordingViews.recordingId,
+            count: sql<number>`COUNT(1)`,
+          })
+          .from(schema.recordingViews)
+          .where(inArray(schema.recordingViews.recordingId, ids))
+          .groupBy(schema.recordingViews.recordingId),
+      ]);
+      viewsByRec = mergeViewCounts(countedViewerRows, viewLogRows);
     }
 
     const recordings = rows.map((row) => {

package/corpus/templates/clips/actions/list-viewers.ts

@@ -11,7 +11,10 @@ import { eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
-import { clampCompletionPct } from "../shared/view-analytics.js";
+import {
+  clampCompletionPct,
+  displayViewerName,
+} from "../shared/view-analytics.js";
 
 export default defineAction({
   description:
@@ -37,7 +40,7 @@ export default defineAction({
       .map((v) => ({
         id: v.id,
         viewerEmail: v.viewerEmail,
-        viewerName: v.viewerName,
+        viewerName: displayViewerName(v.viewerName),
         totalWatchMs: v.totalWatchMs ?? 0,
         completedPct: clampCompletionPct(v.completedPct),
         countedView: Boolean(v.countedView),