cozyclay 3.1.4 → 3.1.6

package/src/workflow/agent-turn-telemetry.js

@@ -0,0 +1,222 @@
+// The analytics of one agent turn, owned by the browser request (createHttpTransport.turn in agent-client.js):
+// agent:turn_requested, the validated execution_telemetry frames, the terminal agent:turn_<outcome>, then exactly one
+// agent:turn_summary and the post-turn edit window (post-turn-edits.js). Only closed values leave here: never tool
+// names, arguments, messages or authored text.
+import { bucketMs } from "../analytics.js";
+import { bucketLong, refusalCodeOf } from "../analytics-strict.js";
+import { bucketFrictionCount } from "../analytics-friction.js";
+import { AGENT_TOOL_CATEGORIES, EXECUTION_TELEMETRY_VALUES } from "../execution-telemetry.js";
+import { closePostTurnWindow, openPostTurnWindow } from "../post-turn-edits.js";
+import { AGENT_FAILURE_CODES } from "./agent-failure-codes.js";
+import { noteTurnOutcome } from "./connect-telemetry.js";
+import { notePromptTurnEnded, takePrompt } from "./prompt-telemetry.js";
+
+const validTelemetryId = (value) => typeof value === "string" && /^[a-f0-9]{32}$/.test(value);
+const exactKeys = (value, keys) => value && typeof value === "object" && !Array.isArray(value)
+	&& Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+const advisory = (read, fallback) => { try { return read(); } catch { return fallback; } };
+
+// motion.compile drafts per turn correlation id (src/commands/motion3.js). A turn that never finishes must not leak:
+// past this many turns the oldest is forgotten.
+const DRAFT_TURNS = 16;
+// The post-turn window's timer never keeps a process (a test, the sidecar's node checks) alive.
+const windowTimers = {
+	set: (fn, ms) => { const timer = setTimeout(fn, ms); timer?.unref?.(); return timer; },
+	clear: (timer) => clearTimeout(timer), now: () => Date.now(),
+};
+const drafts = new Map();
+
+/** One compiled draft of `turnId` (the bus context's turnId): { clean, problems, stuck }. */
+export function noteTurnDraft(turnId, { clean, problems, stuck } = {}) {
+	if (typeof turnId !== "string" || !turnId) return;
+	const draft = { clean: Boolean(clean), problems: Number.isFinite(problems) ? problems : 0 };
+	const row = drafts.get(turnId);
+	if (row) { row.n += 1; row.last = draft; row.stuck ||= Boolean(stuck); return; }
+	drafts.set(turnId, { n: 1, first: draft, last: draft, stuck: Boolean(stuck) });
+	while (drafts.size > DRAFT_TURNS) drafts.delete(drafts.keys().next().value);
+}
+
+/** The drafts part of agent:turn_summary for `turnId`; the turn's drafts are cleared. */
+function takeDrafts(turnId) {
+	const row = drafts.get(turnId);
+	drafts.delete(turnId);
+	if (!row) return { drafts: "0", qa_trend: "na", stuck: false };
+	const qa = (draft) => (draft.clean ? "clean" : "problems");
+	const trend = row.n < 2 ? "na" : row.last.problems < row.first.problems ? "improved" : row.last.problems > row.first.problems ? "worse" : "flat";
+	return { drafts: bucketFrictionCount(row.n), qa_first: qa(row.first), qa_last: qa(row.last), qa_trend: trend, stuck: row.stuck };
+}
+
+// "TARGET_NOT_READY: The scene is not ready." -- the sidecar sends a refused Studio call as tool.done { ok: false }
+// with the code only as the error's prefix (bin/agent/pi-tools.mjs formatToolError). A stop is no refusal.
+const refusalOf = (event) => {
+	if (event.ok === false) {
+		const code = /^([A-Z][A-Z0-9_]*):/.exec(typeof event.error === "string" ? event.error : "")?.[1];
+		return code && code !== "ABORTED" ? code : null;
+	}
+	return event.result?.ok === false && typeof event.result.code === "string" ? event.result.code : null;
+};
+
+/** The tool part of agent:turn_summary, read from the turn's tool.start / tool.done frames. */
+function createToolTally(clock, startedAt) {
+	const started = new Set(), done = new Set(), refusals = new Map();
+	let calls = 0, failed = 0, refused = 0, stale = 0, authored = false, firstAt = null;
+	return {
+		note(event) {
+			const id = typeof event?.callId === "string" ? event.callId : null;
+			if (event?.type === "tool.start") {
+				if (id && started.has(id)) return;
+				if (id) started.add(id);
+				calls += 1;
+				if (firstAt === null) firstAt = clock();
+				return;
+			}
+			if (event?.type !== "tool.done" || (id && done.has(id))) return;
+			if (id) done.add(id);
+			if (event.ok === false) failed += 1;
+			if (event.ok === true && event.result?.authored === true) authored = true;
+			if (event.autoRebased === true) stale += 1;
+			const code = refusalOf(event);
+			if (code) { refused += 1; const key = refusalCodeOf(code); refusals.set(key, (refusals.get(key) ?? 0) + 1); }
+		},
+		applied() { authored = true; },
+		props(outcome) {
+			let top = "none", most = 0;
+			for (const [code, n] of refusals) if (n > most) { top = code; most = n; }
+			const open = [...started].some((id) => !done.has(id));
+			return {
+				tool_calls: bucketFrictionCount(calls), tool_failed: bucketFrictionCount(failed), refused: bucketFrictionCount(refused), refusal_top: top,
+				stale_retry: bucketFrictionCount(stale), authored,
+				...(firstAt === null ? {} : { first_tool: bucketLong(firstAt - startedAt) }),
+				cancel_phase: outcome !== "cancelled" ? "na" : calls === 0 ? "before_tool" : open ? "during_tool" : "after_tool",
+			};
+		},
+	};
+}
+
+// The real browser request owns the attempt, including HTTP refusal and Stop.
+// These IDs never use panel session IDs, model call IDs or authored content.
+/** `surface` is already resolved: "studio" or "workflow". */
+export function startAgentTurn({ surface, capture, now, correlationId = null }) {
+	// The next turn ends the previous turn's edit window.
+	closePostTurnWindow();
+	const turnId = advisory(() => {
+		const bytes = new Uint8Array(16);
+		globalThis.crypto.getRandomValues(bytes);
+		return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+	}, null);
+	const clock = () => advisory(() => { const value = now(); return Number.isFinite(value) ? value : NaN; }, NaN);
+	// A Studio turn already has a host-owned id and its frozen envelope has no
+	// room for a second one, so the sidecar names its frames with THAT id. The
+	// analytics id stays the local hex one: it is the only id analytics accepts.
+	const matchId = correlationId ?? turnId;
+	const startedAt = clock();
+	let terminal = false;
+	let applied = false;
+	const tools = new Map();
+	const seenTools = new Set();
+	const tally = createToolTally(clock, startedAt);
+	const emit = (event, props) => {
+		if (!turnId) return;
+		try { Promise.resolve(capture(event, props)).catch(() => {}); } catch { /* telemetry is advisory */ }
+	};
+	const finish = (outcome, failureCode) => {
+		if (terminal) return;
+		terminal = true;
+		noteTurnOutcome(outcome); notePromptTurnEnded(outcome);
+		if (outcome === "cancelled") {
+			for (const [id, tool] of tools) {
+				if (!seenTools.has(id)) emit("agent:tool_executed", { turn_id: turnId, tool_category: tool.category, outcome: "cancelled", duration_bucket: bucketMs(clock() - tool.startedAt) });
+			}
+		}
+		tools.clear();
+		emit(`agent:turn_${outcome}`, { turn_id: turnId, duration_bucket: bucketMs(clock() - startedAt), ...(outcome !== "succeeded" ? { failure_code: failureCode } : {}) });
+		const summary = advisory(() => ({ turn_id: turnId, outcome, wall: bucketLong(clock() - startedAt), ...tally.props(outcome), ...takeDrafts(matchId) }), null);
+		if (summary) emit("agent:turn_summary", summary);
+		// Only a Studio turn is followed by Studio edits; the Workflow canvas has no edit groups to count.
+		if (turnId && surface === "studio") openPostTurnWindow(turnId, emit, windowTimers);
+	};
+	emit("agent:turn_requested", { surface, turn_id: turnId });
+	// The prompt the panel staged as it sent this turn (prompt-telemetry.js), with the same turn id.
+	const prompt = takePrompt(turnId);
+	if (prompt) emit("agent:prompt_sent", prompt);
+	return {
+		turnId,
+		cancel: () => finish("cancelled", "aborted"),
+		fail: (code) => finish("failed", AGENT_FAILURE_CODES.has(code) ? code : "upstream"),
+		/** A tool.start / tool.done frame the panel sees (after replay dedupe). */
+		tool(event) {
+			if (!terminal) advisory(() => tally.note(event), null);
+		},
+		frame(frame) {
+			// Local sidecar frames are still an untrusted boundary. Reject the whole
+			// frame, including extra fields, before dedupe or analytics capture.
+			try {
+				if (!turnId || terminal) return;
+				if (frame.type === "execution_tool_started") {
+					if (!exactKeys(frame, ["type", "turn_id", "telemetry_id", "tool_category"]) || frame.turn_id !== matchId
+						|| !validTelemetryId(frame.telemetry_id) || !AGENT_TOOL_CATEGORIES.includes(frame.tool_category)) return;
+					if (!tools.has(frame.telemetry_id) && !seenTools.has(frame.telemetry_id)) tools.set(frame.telemetry_id, { category: frame.tool_category, startedAt: clock() });
+					return;
+				}
+				const { event, props } = frame;
+				if (props?.turn_id !== matchId) return;
+				if (event === "agent:tool_executed") {
+					if (!exactKeys(frame, ["type", "event", "props", "telemetry_id"]) || !validTelemetryId(frame.telemetry_id)
+						|| !exactKeys(props, ["turn_id", "tool_category", "outcome", "duration_bucket"])
+						|| !AGENT_TOOL_CATEGORIES.includes(props.tool_category) || !["succeeded", "failed", "cancelled"].includes(props.outcome)
+						|| !EXECUTION_TELEMETRY_VALUES.duration_bucket.has(props.duration_bucket) || seenTools.has(frame.telemetry_id)) return;
+					seenTools.add(frame.telemetry_id);
+					tools.delete(frame.telemetry_id);
+					emit(event, { turn_id: turnId, tool_category: props.tool_category, outcome: props.outcome, duration_bucket: props.duration_bucket });
+					return;
+				}
+				if (!exactKeys(frame, ["type", "event", "props"])) return;
+				if (event === "agent:result_applied") {
+					if (!applied && exactKeys(props, ["turn_id"])) { applied = true; tally.applied(); emit(event, { turn_id: turnId }); }
+					return;
+				}
+				if (!["agent:turn_succeeded", "agent:turn_failed", "agent:turn_cancelled"].includes(event)) return;
+				const outcome = event.slice("agent:turn_".length);
+				const hasFailure = Object.hasOwn(props, "failure_code");
+				if (!exactKeys(props, ["turn_id", "duration_bucket", ...(hasFailure ? ["failure_code"] : [])])
+					|| !EXECUTION_TELEMETRY_VALUES.duration_bucket.has(props.duration_bucket)
+					|| (hasFailure && (outcome === "succeeded" || !AGENT_FAILURE_CODES.has(props.failure_code)))) return;
+				finish(outcome, outcome === "cancelled" ? "aborted" : props.failure_code || "unknown");
+			} catch { /* foreign getters and malformed telemetry cannot affect a turn */ }
+		},
+	};
+}
+
+// The agent-busy signal (the update notice disables "Update now" while a turn runs, src/update/UpdateDialog.jsx).
+// createAgentTransport wraps every transport it returns, so the dock, an embedded Studio panel and sculpt mode all count.
+let runningTurns = 0;
+const turnListeners = new Set();
+const notifyTurns = () => {
+	for (const listener of [...turnListeners]) { try { listener(runningTurns > 0); } catch { /* a listener cannot break a turn */ } }
+};
+
+/** True while any transport.turn() returned by createAgentTransport has not settled. */
+export const agentTurnRunning = () => runningTurns > 0;
+
+/** `listener(running)` on every turn start and end; returns the unsubscribe. */
+export function subscribeAgentTurns(listener) {
+	turnListeners.add(listener);
+	return () => { turnListeners.delete(listener); };
+}
+
+/** Replace transport.turn in place so every end path (done, error, throw, abort) clears the signal. */
+export function trackAgentTurns(transport) {
+	const turn = transport?.turn;
+	if (typeof turn !== "function") return transport;
+	transport.turn = async function trackedTurn(...args) {
+		runningTurns += 1;
+		notifyTurns();
+		try {
+			return await turn.apply(this, args);
+		} finally {
+			runningTurns -= 1;
+			notifyTurns();
+		}
+	};
+	return transport;
+}

package/src/workflow/connect-telemetry.js

@@ -0,0 +1,86 @@
+// The model-connect funnel: agent:connect_opened -> agent:connect_started ->
+// agent:connect_finished, plus agent:model_changed. One attempt at a time: its
+// provider, method, how far it got (step) and when it began. Only closed values
+// leave: a provider id from the closed list (else "other"), a method, an outcome,
+// a step and a duration bucket. Never a key, token, account, email or message.
+// The connect UI needs the local sidecar, so a hosted build (no sidecar, the
+// panel stays offline) never reaches these calls.
+import { track } from "../analytics.js";
+import { admit } from "../analytics-friction.js";
+import { CONNECT_PROVIDERS, bucketLong } from "../analytics-strict.js";
+const METHODS = new Set(["oauth", "api_key", "chatgpt"]);
+const ENTRIES = new Set(["first_run", "failure_card", "signed_out", "menu", "other"]);
+const CONNECTED_KEY = "cozyclay.agentConnected";
+const OPENED_PER_SESSION = 5, MODEL_CHANGES_PER_SESSION = 10;
+
+let send = track, now = () => Date.now();
+let attempt = null;
+let lastTurnFailed = false;
+
+const providerOf = (id) => (CONNECT_PROVIDERS.includes(id) ? id : "other");
+const emit = (event, props) => { try { send(event, props); } catch { /* telemetry is advisory */ } };
+const storage = () => { try { return globalThis.localStorage ?? null; } catch { return null; } };
+
+/** The connect UI opened. The signed-out card counts as first_run until this browser profile has connected once. */
+export function connectOpened(entry) {
+	let value = ENTRIES.has(entry) ? entry : "other";
+	try { if (value === "signed_out" && storage()?.getItem(CONNECTED_KEY) !== "1") value = "first_run"; } catch { /* storage is optional */ }
+	if (admit("agent:connect_opened", OPENED_PER_SESSION)) emit("agent:connect_opened", { entry: value });
+}
+
+/** One attempt begins; an attempt still open is closed as abandoned first. */
+export function connectStarted(providerId, method) {
+	if (attempt) connectFinished("abandoned");
+	attempt = { provider: providerOf(providerId), method: METHODS.has(method) ? method : "api_key", startedAt: now(), step: "list" };
+	emit("agent:connect_started", { provider: attempt.provider, method: attempt.method });
+}
+
+/** How far the open attempt got: waiting (the flow runs), prompt (it asks for a key, address or code). */
+export function connectStep(step) {
+	if (attempt && ["list", "prompt", "waiting", "done"].includes(step)) attempt.step = step;
+}
+
+/** The open attempt ends: ok, failed, cancelled (the user's Cancel) or abandoned (closed or left unfinished). */
+export function connectFinished(outcome) {
+	const ended = attempt;
+	if (!ended) return;
+	attempt = null;
+	const step = outcome === "ok" ? "done" : ended.step;
+	emit("agent:connect_finished", { provider: ended.provider, method: ended.method, outcome, step, duration: bucketLong(now() - ended.startedAt) });
+	if (outcome === "ok") { try { storage()?.setItem(CONNECTED_KEY, "1"); } catch { /* storage is optional */ } }
+}
+
+/** The connect panel went away. A ChatGPT attempt goes on in the agent panel; any other is abandoned. */
+export function connectPanelClosed() {
+	if (attempt && attempt.method !== "chatgpt") connectFinished("abandoned");
+}
+
+/** The ChatGPT sign-in settles by ChatGPT's own status (`account`: /oauth/status), not by
+ * the panel's readiness: a key for another provider makes the panel ready while the
+ * ChatGPT sign-in is still pending. */
+export function connectAuthState(state, account) {
+	if (attempt?.method !== "chatgpt") return;
+	if (account?.signedIn === true) connectFinished("ok");
+	else if (state === "signing-in" || account?.pending === true) connectStep("waiting");
+	// The browser sign-in failed or was closed, with or without another provider ready:
+	// the sidecar reports neither apart.
+	else if (state === "signed-out" || state === "ready" || state === "no-entitlement") connectFinished("abandoned");
+}
+
+/** A model picked in the dropdown (`provider/id`), and whether the last turn had failed. */
+export function modelChanged(modelKey) {
+	const provider = providerOf(String(modelKey ?? "").split("/")[0]);
+	if (admit("agent:model_changed", MODEL_CHANGES_PER_SESSION)) emit("agent:model_changed", { provider, after_failure: lastTurnFailed });
+}
+
+/** agent-turn-telemetry.js reports each turn's outcome, for model_changed.after_failure. */
+export function noteTurnOutcome(outcome) {
+	lastTurnFailed = outcome === "failed";
+}
+
+/** Tests only: capture what is sent, drive the clock, and start clean; returns the restore. */
+export function connectTelemetrySeam({ capture = track, clock = () => Date.now() } = {}) {
+	const previous = [send, now];
+	send = capture; now = clock; attempt = null; lastTurnFailed = false;
+	return () => { [send, now] = previous; attempt = null; lastTurnFailed = false; };
+}

package/src/workflow/prompt-telemetry.js

@@ -0,0 +1,105 @@
+// agent:prompt_sent: one per prompt the user sends to the agent, so retry loops and
+// hesitation are measurable. Only numbers and closed values computed on the device
+// leave: a length bucket and a similarity grade against the previous prompt. The
+// text is never stored or sent; the previous prompt is kept only as its set of
+// lowercase words (to grade the next one) and is dropped on pagehide.
+//
+// AgentPanel stages a prompt as it sends (stagePrompt); the turn's telemetry takes
+// it when the turn really starts (takePrompt, agent-turn-telemetry.js), so a send the
+// store refuses (empty, already streaming) never becomes an event.
+import { CONNECT_PROVIDERS, bucketLong } from "../analytics-strict.js";
+import { bucketFrictionCount } from "../analytics-friction.js";
+
+const VIA = new Set(["typed", "retry_button", "regenerate", "chip", "supervisor"]);
+const STAGED_MS = 10_000;
+
+let now = () => Date.now();
+let previousTokens = null, lastTurn = null, turns = 0, draftStartedAt = null, fromChip = false, staged = null;
+if (typeof globalThis.addEventListener === "function") globalThis.addEventListener("pagehide", () => { previousTokens = null; staged = null; });
+
+/** The prompt's words: lowercased, split on anything that is not a letter or digit. No stemming, no dictionary. */
+export function promptTokens(text) {
+	return new Set(String(text ?? "").toLowerCase().split(/[^\p{L}\p{N}]+/u).filter(Boolean));
+}
+
+/** Jaccard of two word sets: >= 0.9 same, >= 0.5 near, else different; first without a previous prompt. */
+export function similarityGrade(previous, next) {
+	if (!previous) return "first";
+	let shared = 0;
+	for (const token of next) if (previous.has(token)) shared += 1;
+	const union = previous.size + next.size - shared;
+	const jaccard = union === 0 ? 1 : shared / union;
+	return jaccard >= 0.9 ? "same" : jaccard >= 0.5 ? "near" : "different";
+}
+
+/** 1-20, 21-80, 81-240, gte241 characters. */
+export function bucketPromptLength(n) {
+	if (n <= 20) return "1-20";
+	if (n <= 80) return "21-80";
+	if (n <= 240) return "81-240";
+	return "gte241";
+}
+
+/** A keystroke (or paste) into the draft: composing starts now if it had not; a chip's text was edited. */
+export function noteDraftInput() {
+	if (draftStartedAt === null) draftStartedAt = now();
+	fromChip = false;
+}
+
+/** The draft was consumed without a new turn (an accepted steering message): composing starts over. */
+export function noteDraftConsumed() {
+	draftStartedAt = null;
+	fromChip = false;
+}
+
+/** A suggestion chip filled the draft. */
+export function noteChipDraft() {
+	if (draftStartedAt === null) draftStartedAt = now();
+	fromChip = true;
+}
+
+/** The panel is sending `text`: keep only what the event needs, never the text. */
+export function stagePrompt(text, { via = "typed", model = "", attached = false, taskMode = false } = {}) {
+	try {
+		const trimmed = String(text ?? "").trim();
+		if (!trimmed) return;
+		const how = via === "typed" && fromChip ? "chip" : VIA.has(via) ? via : "typed";
+		const provider = String(model ?? "").split("/")[0];
+		const composing = (how === "typed" || how === "chip") && draftStartedAt !== null;
+		staged = { at: now(), tokens: promptTokens(trimmed), props: {
+			provider: CONNECT_PROVIDERS.includes(provider) ? provider : "other", via: how, prompt_len: bucketPromptLength(trimmed.length),
+			...(composing ? { compose_ms: bucketLong(now() - draftStartedAt) } : {}), attached: Boolean(attached), task_mode: Boolean(taskMode),
+		} };
+	} catch {
+		staged = null;
+	}
+}
+
+/** The turn started: the staged prompt as agent:prompt_sent's payload for `turnId`, or null. */
+export function takePrompt(turnId) {
+	const prompt = staged;
+	staged = null;
+	if (!prompt || !turnId || now() - prompt.at > STAGED_MS) return null;
+	turns += 1;
+	const props = {
+		turn_id: turnId, ...prompt.props, similarity: similarityGrade(previousTokens, prompt.tokens),
+		gap: lastTurn ? bucketLong(now() - lastTurn.at) : "first", prev_outcome: lastTurn?.outcome ?? "none", turn_index: bucketFrictionCount(turns),
+	};
+	previousTokens = prompt.tokens;
+	draftStartedAt = null;
+	fromChip = false;
+	return props;
+}
+
+/** A turn ended (agent-turn-telemetry.js): the next prompt's gap and prev_outcome. */
+export function notePromptTurnEnded(outcome) {
+	lastTurn = { outcome: ["succeeded", "failed", "cancelled"].includes(outcome) ? outcome : "none", at: now() };
+}
+
+/** Tests only: drive the clock and start a clean session; returns the restore. */
+export function promptTelemetrySeam(clock = () => Date.now()) {
+	const previous = now;
+	const reset = () => { previousTokens = null; lastTurn = null; turns = 0; draftStartedAt = null; fromChip = false; staged = null; };
+	now = clock; reset();
+	return () => { now = previous; reset(); };
+}

package/tools/dev/pages/privacy.html

@@ -5,13 +5,13 @@
   "og_title": "CozyClay privacy: analytics and telemetry disclosure",
   "headline": "Privacy",
   "description": "What cozyclay.org and the cozyclay npm package collect (anonymous usage analytics via PostHog, no cookies, no session recording, no project content), how to opt out, and what the hosted demo stores.",
-  "published": "2026-09-10"
+  "published": "2026-10-25"
 }
 ---
       <div class="hero">
         <h1>Privacy</h1>
         <p class="lede">Short version: anonymous usage counts, no cookies, no recordings, never your project content. Every part of it can be turned off.</p>
-        <p class="meta">Effective September 10, 2026</p>
+        <p class="meta">Effective October 25, 2026</p>
       </div>
 
       <section>
@@ -42,7 +42,7 @@
           A copied start command such as <code>npx cozyclay --via site</code> stores that one source label
           with the first-launch receipt instead of asking where you heard about CozyClay.
           Prompt text, asset names,
-          file names, project content, local paths and any user-entered text are never collected. Session
+          file names, project content, local paths and any user-entered text are never collected. For a prompt sent to the agent, only two values derived from its text leave the device: a length bucket and a similarity grade (first, same, near or different) that the browser computes against the previous prompt. Neither the text nor its words are sent; the previous prompt is kept in the page only as its set of words, until the page closes. Session
           duration and action counts are bucketed. Source checkouts, forks, development servers, CI and tests
           send nothing.
         </p>
@@ -85,42 +85,69 @@ cclay telemetry on</code></pre>
           <table>
             <thead><tr><th>Event</th><th>Purpose</th></tr></thead>
             <tbody>
-              <tr><td>install:first_launch, app:session_started, app:session_ended</td><td>Counting installs and sessions; duration and action counts are bucketed. install:first_launch may carry heard_from (x, hn, reddit, github, friend, other, site or playground), from the first-launch prompt or a copied <code>npx cozyclay --via</code> command. app:session_ended also carries per-session edit gesture counts in five groups, pose_edit_bucket, camera_edit_bucket, object_edit_bucket, shot_edit_bucket and prompt_edit_bucket, each bucketed (0, 1-3, 4-10 or gte11); never what was edited</td></tr>
-              <tr><td>feature:used</td><td>One signal per feature per session: a fixed feature name such as pose_edit (a real bone or pose change), pose_save (saving a pose to the library), camera_fly or export_video</td></tr>
+              <tr><td>install:first_launch, app:session_started, app:session_ended</td><td>Counting installs and sessions; duration and action counts are bucketed. install:first_launch may carry heard_from (x, hn, reddit, github, friend, other, site or playground), from the first-launch prompt or a copied <code>npx cozyclay --via</code> command. app:session_ended also carries scenes_touched (how many scenes were created or loaded in the session, an exact count capped at 20, not bucketed), session_id (the opaque random session id the PostHog SDK generates, used only to join a session's last events, such as an error just before it ended) and per-session edit gesture counts in five groups, pose_edit_bucket, camera_edit_bucket, object_edit_bucket, shot_edit_bucket and prompt_edit_bucket, each bucketed (0, 1-3, 4-10 or gte11); never what was edited</td></tr>
+              <tr><td>app:friction_summary</td><td>Once per session, next to app:session_ended: how much friction the session had, as closed buckets only. active_time (the session duration bucket); counts of refusals the Studio gave the user (refusals_ui) and the agent (refusals_agent), user undos (undos), errors (errors), browser long tasks (long_tasks) and motion compiles (compiles), each as 0, 1, 2, 3, 4-5, 6-10 or gte11; the longest long task (long_task_max: lt50, 50-150, 150-500, 500-2000 or gte2000 ms); the share of late playback ticks (late_tick_ratio: 0, lt5, 5-20, 20-50 or gte50 %). rage_clicks and dead_clicks count every ui:rage_click and ui:dead_click, shortcut_ignored every shortcut:ignored, search_empty every search:no_results, and nav_thrash and camera_thrash every nav:thrash and camera:thrash, including those past their event's cap. Never which command, control, key or text was involved.</td></tr>
+              <tr><td>studio:refused</td><td>A command the Studio refused, as closed values only: code (one of the Studio's fixed error codes, such as INVALID_ARGUMENT, STALE_SCENE or TARGET_BUSY, else other), origin (ui for the user's own control, agent for the agent or an MCP client), phase (admission, refused before any change, or commit, refused after it started changing) and group (the command's family: object, shot, cast, scene, motion, edit, task, agent or other). At most 3 per code, group and origin per session; the rest are only counted in app:friction_summary. A cancel the caller asked for is not a refusal. Never the command's arguments, target or message.</td></tr>
+              <tr><td>edit:undone</td><td>A user undo (agent undos are not counted): age (lt2s, 2-10s, 10-60s or gte60s since the undone edit was made, only when the undo was done and its age is known), kind (pose, camera, object, shot, prompt, agent_turn for the agent's whole turn, ik_preview for an un-applied IK drag, or other), via (key, menu or button) and result (done, noop when there was nothing to undo, or refused). At most 20 per session. Never what was undone.</td></tr>
+              <tr><td>agent:turn_summary</td><td>One per agent turn: turn_id (the same random id as agent:turn_*); outcome (succeeded, failed or cancelled); wall (the turn's length) and first_tool (time to the first tool call, absent without tools), each lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m; counts of tool calls (tool_calls), failed tool calls (tool_failed), tool calls the Studio refused (refused), commands re-sent once after a stale revision or a busy gesture (stale_retry) and motion compiles (drafts), each as 0, 1, 2, 3, 4-5, 6-10 or gte11; refusal_top (the most frequent refusal code, or none); authored (true or false: the turn changed the scene); qa_first and qa_last (clean or problems, absent without drafts); qa_trend (improved, flat, worse, or na with fewer than 2 drafts); stuck (true or false: the motion compiler's stop rule fired); cancel_phase (before_tool, during_tool, after_tool or na). No prompt text, tool names, messages or responses.</td></tr>
+              <tr><td>agent:post_turn_edit</td><td>One per agent turn: turn_id (the same random id) and the user's own edit gestures in the 120 seconds after the turn ended, closed early when the next turn starts or the page closes. edited (true or false); counts per group (pose, camera, object, shot, and prompt_block, which counts edits to a take's prompt and take fields), each as 0, 1, 2, 3, 4-5, 6-10 or gte11, where one continuous drag is one gesture; first_delay (time to the first edit: lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m), only when edited is true. Never which object or what changed.</td></tr>
+              <tr><td>motion:draft_compiled</td><td>One per motion compile (each draft the agent's motion work produces), at most 50 per session; the rest only move app:friction_summary compiles. draft_index (the draft's number for its character in the turn) and qa_problems as 0, 1, 2, 3, 4-5, 6-10 or gte11; qa_clean; qa_frames (frame-level QA issues: 0, 1-10, 11-50, 51-200 or gte201); compile (the whole compile, QA included: lt50, 50-150, 150-500, 500-2000 or gte2000 ms); installed, stuck, repaired, searched and adjusted (true or false); frames (take length: lt30, 30-120, 121-480 or gte481). Never the motion spec, the take, skill names or QA text.</td></tr>
+              <tr><td>shortcut:ignored</td><td>A bound Studio key that did nothing, as closed values only: key_class (undo, redo, mode, transform, frame, duplicate or delete) and reason (no_selection, wrong_mode, workflow_mode, busy or empty_history). At most 5 per key_class per session; the rest only move app:friction_summary shortcut_ignored. Keys typed into a text field, a list box or an editable area, and keys of an input-method composition, are never looked at. Never the key character.</td></tr>
+              <tr><td>shortcut:unbound</td><td>A common key combination the Studio has no binding for, pressed outside any text field: combo (copy, paste, cut, select_all, group, find, rename or help). At most 3 per combo per session. Never the key character.</td></tr>
+              <tr><td>help:shortcuts_opened</td><td>Help &gt; Keyboard shortcuts was opened. No properties. At most 3 per session.</td></tr>
+              <tr><td>search:no_results</td><td>A search in the Content browser (surface assets) or the Outliner (outliner) that has shown nothing for 1 second: surface and query_len (the length of the search, 1, 2-3, 4-8 or gte9 characters). At most 3 per surface per session; every one moves app:friction_summary search_empty. Never the search text.</td></tr>
+              <tr><td>nav:thrash</td><td>4 or more switches of one panel or mode within 10 seconds with no edit in between: surface (dock_tab, mode or agent_panel), switches (4-5, 6-10 or gte11) and window_s (always 10). At most one per surface every 30 seconds; every one moves app:friction_summary nav_thrash. Never which tab or mode.</td></tr>
+              <tr><td>camera:thrash</td><td>6 or more viewport camera moves (orbit, fly or pan drags) within 20 seconds with no edit in between: gestures (6-10 or gte11), kind_mix (orbit, fly, pan or mixed) and window_s (always 20). At most one every 30 seconds; every one moves app:friction_summary camera_thrash. Never a camera position or view.</td></tr>
+              <tr><td>agent:connect_opened</td><td>The model-connect list opened: entry (first_run, failure_card, signed_out, menu or other; the signed-out card reads first_run until this browser profile has connected once). At most 5 per session.</td></tr>
+              <tr><td>agent:connect_started</td><td>One model-connect attempt began: provider (one of the providers CozyClay configures — openai-codex, anthropic, anthropic-subscription, openai, google, minimax, minimax-cn, openrouter, cliproxy, openai-compatible — or other) and method (oauth, api_key or chatgpt).</td></tr>
+              <tr><td>agent:connect_finished</td><td>That attempt ended: provider, method, outcome (ok, failed, cancelled with the Cancel button, abandoned when closed or left unfinished), step it had reached (list, prompt, waiting or done) and duration (lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m). Never the key, token, account, email or error text.</td></tr>
+              <tr><td>agent:model_changed</td><td>A model picked in the agent's model list: its provider (as above, or other) and after_failure (whether the last agent turn had failed). At most 10 per session.</td></tr>
+              <tr><td>agent:prompt_sent</td><td>One per prompt sent to the agent: turn_id (the same random id as agent:turn_*); provider (as for agent:connect_started, or other); via (typed, retry_button, regenerate, chip or supervisor); prompt_len (1-20, 21-80, 81-240 or gte241 characters); compose_ms (first keystroke to send, typed prompts only) and gap (since the previous turn ended, or first) as lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m; similarity (first, same, near or different, computed in the browser against the previous prompt's words); prev_outcome (succeeded, failed, cancelled or none); turn_index (1, 2, 3, 4-5, 6-10 or gte11); attached and task_mode (true or false). Never the prompt text or its words.</td></tr>
+              <tr><td>ui:rage_click</td><td>Three or more fast clicks (within 1 second and 24 pixels) on one primary control: control (a control id from a fixed list, such as tl_play or export_video, or other), clicks (3, 4-5 or gte6) and changed (whether the Studio responded within half a second). At most 2 per control per session. No coordinates, no text, no element or object ids.</td></tr>
+              <tr><td>ui:dead_click</td><td>A click on a primary control that did nothing: control (as above) and reason (aria_disabled when the control was disabled, refused when the Studio refused the command, no_effect when nothing changed within half a second). At most 2 per control per session. Clicks into text fields are never observed.</td></tr>
+              <tr><td>feature:used</td><td>One signal per feature per session: a fixed feature name such as pose_edit (a real bone or pose change), pose_save (saving a pose to the library), camera_fly, export_video, export_storyboard or export_render_pass</td></tr>
               <tr><td>$pageview, scene:created, scene:loaded, craft:first_action, activation:completed</td><td>Funnel and drop-off analysis</td></tr>
-              <tr><td>craft:first_edit</td><td>First successful Studio authoring change per editor mount; only a fixed edit-kind label and definition version 1 (not camera navigation, playback, loading, restore, or undo/redo)</td></tr>
+              <tr><td>craft:first_edit</td><td>First successful Studio authoring change per editor mount; only a fixed edit-kind label and definition version 2 (not camera navigation, playback, loading, restore, or undo/redo)</td></tr>
               <tr><td>playground:first_edit</td><td>The same versioned first-edit definition for Playground, counted separately from Studio; no prompts or scene contents</td></tr>
               <tr><td>project:saved, project:opened</td><td>Whether people keep their work (object counts and ages are bucketed; never names or paths)</td></tr>
-              <tr><td>motion:generate_requested</td><td>Explicit generation intent, not prompt-block editing: initiating surface (timeline, line_edit, trail, mcp, fal_card or agent), input_mode (prompt, pose, edit, a_to_b or still) and an ephemeral random request_id</td></tr>
-              <tr><td>motion:preflight_blocked</td><td>Request readiness refusal: request_id, surface and normalized reason (unconfigured, unreachable, unsupported_route, locked or missing_input). locked means the AI video route is not enabled for the account yet; missing_input means the A/B captures were incomplete</td></tr>
-              <tr><td>motion:preflight_passed</td><td>Request readiness accepted, before job start: request_id, surface and backend (none, local_kimodo, hosted or fal)</td></tr>
-              <tr><td>motion:job_started</td><td>Generation execution started: request_id, backend and input_mode</td></tr>
-              <tr><td>motion:job_succeeded</td><td>Generation completed before result application: request_id, backend, input_mode and bucketed duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s)</td></tr>
-              <tr><td>motion:job_failed</td><td>Generation failure or real cancellation: request_id, backend, input_mode, duration_bucket and normalized error_code (aborted, unsupported_route, generation_failed, quota or unknown), never raw error messages</td></tr>
-              <tr><td>motion:result_applied</td><td>A generated result was applied to its requesting character: request_id and backend. For the fal AI video route, applied means the generated clip was loaded into the Studio for extraction. Job success alone does not prove application.</td></tr>
               <tr><td>workflow:run_requested</td><td>Workflow execution requests: surface (workflow), ephemeral run_id and node_count_bucket (0, 1-3, 4-10 or gte11). No graph contents, node labels or outputs.</td></tr>
               <tr><td>workflow:run_succeeded, workflow:run_failed, workflow:run_cancelled</td><td>Workflow outcomes paired by run_id, with duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s); failures and actual cancellations also include failure_code (aborted, capture_failed, generation_failed or unknown). Starting another run does not imply cancellation.</td></tr>
               <tr><td>workflow:result_applied</td><td>Captured or generated image/video output was written to the Workflow canvas: run_id only, at most once per run, independently of a later failure. No image bytes or output contents.</td></tr>
               <tr><td>agent:turn_requested</td><td>Explicit Agent turn requests from surface (studio or workflow), paired by ephemeral turn_id. No prompts, responses or model identifiers.</td></tr>
               <tr><td>agent:tool_executed</td><td>Agent tool observations: turn_id, tool_category (workflow_read, workflow_write, workflow_run, frame_capture, image_generate, scene_write or other), outcome (succeeded, failed or cancelled) and duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s). Tool names, arguments and results are excluded.</td></tr>
-              <tr><td>agent:turn_succeeded, agent:turn_failed, agent:turn_cancelled</td><td>Agent turn outcomes: turn_id and duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s); failures and actual cancellations also include failure_code (aborted, auth, rate_limited, tool_failed, upstream or unknown). Missing terminal delivery is not success.</td></tr>
+              <tr><td>agent:turn_succeeded, agent:turn_failed, agent:turn_cancelled</td><td>Agent turn outcomes: turn_id and duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s); failures and actual cancellations also include failure_code (aborted, auth, rate_limited, tool_failed, upstream, key_refused, stale_scene, capability_missing, busy, invalid_request or unknown). auth means CozyClay's local agent has no sign-in or refused the session; key_refused means the model provider rejected the key or credentials; stale_scene means the turn was refused because the scene changed underneath it; capability_missing means a required capability was unavailable, for example the live hub port was already in use; busy means another turn or target was busy; invalid_request means the request itself was rejected. Missing terminal delivery is not success.</td></tr>
               <tr><td>agent:result_applied</td><td>An Agent turn produced an acknowledged editor change: turn_id only, at most once per turn. Successful reads and focus/navigation do not prove applied output.</td></tr>
               <tr><td>mcp:tool_requested</td><td>Connected-editor MCP execution requests: ephemeral request_id and tool_category (read, camera, scene_write, prompt_authoring, frame_capture, motion_generate, motion_apply, project_io or other).</td></tr>
               <tr><td>mcp:tool_executed</td><td>Connected-editor MCP outcomes: request_id, tool_category (read, camera, scene_write, prompt_authoring, frame_capture, motion_generate, motion_apply, project_io or other), outcome (succeeded, failed, uncertain or cancelled) and duration_bucket (lt1s, 1-3s, 3-10s, 10-30s or gte30s). Control-plane success does not prove a mutation applied.</td></tr>
               <tr><td>mcp:result_applied</td><td>A connected editor acknowledged an MCP mutation, paired by request_id. Detached or disconnected MCP sessions remain unobserved.</td></tr>
               <tr><td>export:blocking_frame_succeeded, export:video_succeeded</td><td>Export reliability</td></tr>
-              <tr><td>export:attempt_started, export:attempt_succeeded, export:attempt_failed, export:attempt_cancelled</td><td>Export attempts and outcomes, paired by an ephemeral random attempt_id; export_kind (video, depth_video, frame or keyframe_pack), format (mp4, png or zip) and initiating surface (studio, workflow or embed). Terminal events include a bucketed duration_bucket; failures and real cancellations include only a normalized failure_code (unsupported_codec, encode_failed, render_failed, aborted or unknown), never raw error messages, filenames, URLs, paths, prompts or scene content. Success means pipeline completion or download handoff, not confirmation that the OS saved a file.</td></tr>
+              <tr><td>export:attempt_started, export:attempt_succeeded, export:attempt_failed, export:attempt_cancelled</td><td>Export attempts and outcomes, paired by an ephemeral random attempt_id; export_kind (video, depth_video, frame, keyframe_pack, contact_sheet, panel_pack, animatic, animation_project, workflow_send, storyboard, render_pass or otio), format (mp4, png, zip, cclayproject or otio), initiating surface (studio, workflow or embed), is_retry (whether the attempt retries an earlier one), retry_of (the retried attempt's attempt_id, only when is_retry is true) and objects (the scene's object count, bucketed 0, 1-3, 4-10 or gte11). Terminal events include a bucketed duration_bucket; failures and real cancellations include a normalized failure_code (unsupported_codec, encode_failed, render_failed, aborted or unknown), the stage where the export stopped (preparing, encoding, finalizing or handoff) and a progress bucket (0, 1-25, 26-50, 51-75 or 76-99 percent), never raw error messages, filenames, URLs, paths, prompts or scene content. Success means pipeline completion or download handoff, not confirmation that the OS saved a file.</td></tr>
+              <tr><td>export:saved</td><td>How each exported file was saved, one event per file: method (workspace, written into the export folder you chose, or download, a browser download) and reason (none; unsupported, the browser has no folder access; no_workspace, no export folder is chosen; permission, folder access was denied; or write_failed, the folder write failed and the file fell back to a download). Never the file name or path.</td></tr>
               <tr><td>export:keyframe_pack</td><td>Legacy Workflow pack handoffs, with numeric entries count and source=workflow; not an additional export attempt</td></tr>
+              <tr><td>sculpt_run</td><td>One event per finished Sculpt mode run: outcome (done, cancelled or failed), rounds (0 to 10), final_iou (how closely the final sculpt matched the reference image, 0 to 1 rounded to two decimals; omitted when the run was never scored), duration_ms (elapsed run time in milliseconds) and had_target (whether the run reworked an existing sculpt instead of creating one). Numbers only: never the reference image, recipe, part names or sculpt id.</td></tr>
               <tr><td>playground:opened, playground:first_action</td><td>Whether the home-page playground gets used</td></tr>
               <tr><td>app:error</td><td>Uncaught errors and unhandled promise rejections, at most ten distinct per session: error_kind (error or unhandled_rejection), error_type (a built-in name such as TypeError or DOMException, other or non_error), error_source (app, extension, external or unknown) and, only for the app's own scripts, error_file (the bundle file name), error_line and error_col. Never the error message, stack text, URLs, query strings, paths, prompts or scene content.</td></tr>
+              <tr><td>app:render_crash</td><td>A render error that brought up the studio's crash screen, at most two per session: error_type (the same closed labels as app:error). Never the error message, stack text, component names, file names or scene content.</td></tr>
+              <tr><td>app:gl_lost</td><td>The 3D view's graphics failed, at most once per kind per session: kind (unavailable when WebGL is off at startup, context_lost when the GPU context drops later). Never the GPU renderer string.</td></tr>
+              <tr><td>studio:ready</td><td>Once per session: how long the studio took to show its first frame, from page navigation to the first frame after the first render: boot (lt2s, 2-5s, 5-15s or gte15s). Never what was loaded.</td></tr>
+              <tr><td>playback:summary</td><td>One per playback run (play until stop, or until the frame rate or speed changes), at most 10 per session: duration (lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m); late_ticks, an estimate of dropped frames, not a measured one: the share of playback timer ticks that had to catch up more than one frame (0, lt5, 5-20, 20-50 or gte50 %); max_catchup (the most frames one tick caught up: 1, 2, 3-5 or gte6); fps (12, 24, 30, 60 or other); speed (0.5, 1, 2 or other); measured_fps (the browser's frame rate during playback, the device:profile frame-rate buckets). Every run also feeds app:friction_summary.late_tick_ratio. Never the scene, the take or the frame range.</td></tr>
+              <tr><td>guide:opened</td><td>The first-60-seconds guide opened, at most once per session: mode (animation or storyboard). Never step text or what you did.</td></tr>
+              <tr><td>guide:step</td><td>A guide step marked done, each step at most once per session: mode (animation or storyboard), step (1 to 4) and step_ms (time on that step: lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m).</td></tr>
+              <tr><td>guide:dismissed</td><td>The guide closed before its last step, at most once per session: mode (animation or storyboard) and reached (1 to 4, the step it was showing).</td></tr>
+              <tr><td>guide:completed</td><td>The guide's last step marked done, at most once per session: mode (animation or storyboard).</td></tr>
+              <tr><td>agent:panel_toggled</td><td>The agent panel opened or closed, at most 10 per session: open (true or false) and via (key for Cmd/Ctrl+B, button for the toolbar control). Never what the panel showed.</td></tr>
+              <tr><td>object:deleted_soon</td><td>You deleted an object you added in this session, at most 10 per session: age (how long after adding it: lt2s, 2-10s, 10-60s or gte60s). Object ids are reused names, so this is an estimate. Never the object's id, name or kind.</td></tr>
+              <tr><td>object:delete_undone</td><td>You undid an object deletion within its 7-second undo window, at most 10 per session: age (time from the deletion to the undo: lt2s or 2-10s). Never the object's id, name or kind.</td></tr>
+              <tr><td>update:notice_shown</td><td>The update notice appeared in the top bar of an npm studio, once per session: kind (global or npx) and behind (patch, minor or major: how far the running version is behind the newest release). Never a path or a command</td></tr>
+              <tr><td>update:clicked</td><td>A button on the update notice, at most 10 per session: action (update_now, copy_command, later, dismiss or release_notes) and kind (global or npx)</td></tr>
+              <tr><td>update:finished</td><td>A one-click update ended, at most 3 per session: outcome (ok or failed), error_class (none, permission, network, node_version, npm_missing or other) and duration (lt10s, 10-30s, 30-60s, 1-2m, 2-5m or gte5m). Never npm's output, a path or the command line</td></tr>
               <tr><td>device:profile</td><td>Once per session, whether the studio can run smoothly: gpu_vendor (nvidia, amd, intel, apple, qualcomm, arm, software, other or unknown), gpu_class (discrete, integrated, software or unknown), webgl (webgl2, webgl1 or none), cpu_bucket (1-4, 5-8, 9-16, gte17 or unknown), memory_bucket (lt4, 4-7, gte8 or unknown) and frame_rate_bucket (lt20, 20-40, 40-55, gte55 or unknown) from one three-second sample. The GPU renderer string and exact hardware values never leave the browser.</td></tr>
               <tr><td>survey:use_case</td><td>An optional question shown at most once after a successful export, only while telemetry is on: use_case (animation, film, game, ad_mv, personal, other or skip) and team (team, solo or skip). Closed choices only; no free text.</td></tr>
               <tr><td>hosted:composer_viewed, hosted:login_started, hosted:ticket_created, hosted:result_opened, hosted:opened_in_studio</td><td>Hosted demo funnel</td></tr>
             </tbody>
           </table>
         </div>
-        <p class="note">Motion request_id values are fresh random 32-character hexadecimal values, held only for one request; they are not persisted or derived from prompts, hosts, credentials, project content or other identifiers. The ambiguous motion:generate_blocked event stopped being emitted in the September 15, 2026 issue #273 contract. Historical events are not relabeled and are excluded from the new explicit-demand metric. Automatic line previews and prompt-block edits are not explicit Generate requests.</p>
-        <p class="note">Every regular app event and session-end beacon carries the same distribution (npm or hosted), app_version when available, origin_kind (local or hosted), internal_qa boolean, coarse operating-system label and, for npm sessions, install_kind (npx or global) and update_status (latest, outdated or unknown), read from the package's own cached update check. PostHog's free plan retains events for one year.</p>
+        <p class="note">Only the events in this table are sent; any other event name is dropped in the browser before it reaches PostHog. Every regular app event and session-end beacon carries the same distribution (npm or hosted), app_version when available, origin_kind (local or hosted), internal_qa boolean, coarse operating-system label and, for npm sessions, install_kind (npx or global) and update_status (latest, outdated or unknown), read from the package's own cached update check. The update notice asks the launcher on 127.0.0.1 whether a newer release exists; the launcher answers from that same cached check, so the notice adds no request to anyone else. Update now runs npm install -g cozyclay@&lt;version&gt; on your machine, and only when you press it. PostHog's free plan retains events for one year.</p>
         <p class="note">Workflow run_id, Agent turn_id and MCP request_id values are fresh random 32-character hexadecimal values held only for one execution. Execution telemetry contains only closed categories, outcomes and elapsed-time buckets; missing telemetry is left unknown, and a disconnected MCP editor is not backfilled.</p>
       </section>
 

package/tools/loc-baseline.json

@@ -1,11 +1,11 @@
 {
-	"bin/agent/agent-routes.mjs": 804,
+	"bin/agent/agent-routes.mjs": 799,
 	"bin/agent/agent-runner.mjs": 495,
 	"bin/agent/providers.mjs": 255,
 	"bin/agent/session-store.mjs": 324,
 	"bin/agent/supervisor.mjs": 283,
 	"bin/agent/video-adapters.mjs": 334,
-	"bin/cozyclay.mjs": 399,
+	"bin/cozyclay.mjs": 351,
 	"bin/live/cli.mjs": 456,
 	"mcp/live-hub.mjs": 529,
 	"mcp/tool-handlers.mjs": 1730,
@@ -14,12 +14,12 @@
 	"mcp/verify-live-controller.mjs": 340,
 	"mcp/verify-live-p0.mjs": 264,
 	"mcp/verify-live.mjs": 416,
-	"src/analytics.js": 1038,
-	"src/App.jsx": 4448,
-	"src/asset-pane.jsx": 643,
+	"src/analytics.js": 948,
+	"src/App.jsx": 4434,
+	"src/asset-pane.jsx": 642,
 	"src/camera-follow.js": 505,
 	"src/camera-move.js": 289,
-	"src/command-bus.js": 356,
+	"src/command-bus.js": 355,
 	"src/controls.jsx": 330,
 	"src/domains/cast.js": 717,
 	"src/domains/motion.js": 806,
@@ -28,7 +28,7 @@
 	"src/domains/shots.js": 411,
 	"src/dualview.jsx": 365,
 	"src/hierarchy-panel.jsx": 777,
-	"src/live-control.js": 338,
+	"src/live-control.js": 331,
 	"src/matte-editor.js": 486,
 	"src/matte.js": 472,
 	"src/motion/collision-blockers.js": 273,
@@ -60,14 +60,14 @@
 	"src/shell/MenuBar.jsx": 632,
 	"src/shell/ViewportToolbar.jsx": 567,
 	"src/shot-authoring.js": 345,
-	"src/stage-canvas-rigs.jsx": 350,
+	"src/stage-canvas-rigs.jsx": 349,
 	"src/stage-editor-gizmos.jsx": 1116,
 	"src/studio-agent-commands.js": 487,
 	"src/studio-agent-protocol.js": 480,
 	"src/studio-app-binding.js": 346,
 	"src/ui.jsx": 385,
-	"src/workflow/agent-client.js": 1369,
-	"src/workflow/AgentPanel.jsx": 811,
+	"src/workflow/agent-client.js": 1295,
+	"src/workflow/AgentPanel.jsx": 807,
 	"src/workflow/WorkflowBuilder.jsx": 592,
 	"tools/qa/css-rule-usage.mjs": 251,
 	"tools/run-tests.mjs": 441