mcp-scraper 0.95.1 → 0.96.0

package/CHANGELOG.md

@@ -4,6 +4,63 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.96.0] - 2026-10-12
+
+### Security
+
+- Keep raw browser and provider diagnostics out of public Maps failures and SERP results, including retained files. SERP clients should read normalized capture content from `harvestResult` instead of `providerPayload`.
+
+### Added
+
+- Retrieve complete retained results through `artifact_describe`, `artifact_read` and `artifact_download`. Text reads continue from the returned offset; binary files remain downloadable in their original format, with explicit file and download-link expiry. Temporary MCP results remain accessible for seven days; retained reports keep their existing 24-hour access window.
+- Inspect saved failures, retries, fallback attempts, provider costs, billing and cleanup through the admin trace endpoint and CTO report. Inspection reads existing work without rerunning acquisition or changing charges.
+- Report customer usage by service and client, including failures, retries, refunds, provider costs, credit spending and cash receipts. Filter customer and fleet reports by time, service, plan and declared client labels, and inspect request chains and degradation windows. Request capture is opt-in through `MCP_ANALYTICS_CAPTURE=1`; missing historical data remains explicit.
+- Reconcile reported transcript and search provider charges through hourly maintenance, including spend from failed attempts. Replace estimates on the original receipt without double-counting costs or changing customer credits; delayed and unavailable charges remain distinguishable from zero.
+
+### Changed
+
+- Keep the approved initial MCP routing map concise, and replace the old domain manual with on-demand guidance for chat and terminal delivery, intent and flags, result coverage and recovery. Correct stale generic Memory write descriptions to use the Research and CRM owners; keep tool requirements in their schemas and preparation responses.
+- Organize implementations by behavior and state ownership so contributors can edit features in focused files. HTTP and MCP adapters call the feature owners; shared database, execution, billing, concurrency, browser and provider-cost code have dedicated homes. Update the edit guide and remove unused empty source placeholders while preserving public entrypoints and existing credentials.
+- Bound ordinary Google Search recovery to two primary attempts followed by one SERP API fallback. Both primary attempts retain the requested page count; the one-page fallback reports partial coverage for a two-page request. Rich one-page searches use the API directly, while date-filtered searches retain their browser route.
+- Use account-confirmed browser usage rates for new cost calculations. Show monthly plan allowances and configured hosting estimates separately from request costs, with their date, scope and calculation basis.
+- Provide a testing skill for the current implementation that distinguishes isolated candidate checks from production checks.
+- Serve the migration branch across the server, web app, Memory and scheduler, with branch-specific automatic deployments. Package branch-local Memory storage and tools into its hosted build so retained-file reads use the same implementation that was tested.
+
+### Fixed
+
+- Preserve complete CRM and Research tool descriptions, correct domain-specific field meanings and keep transport authentication out of public CRM search arguments. Align video limits, transcription fallbacks, ongoing browser costs and write/retry guidance with actual behavior.
+- Preserve request IDs on streamed MCP responses so SDK callbacks and customer reports can correlate the completed call.
+- Keep oversized MCP tool, resource and Task responses within the shared delivery budget while retaining complete formatted results and transcripts. Preserve small responses, readable previews and recovery identifiers; report storage failures without claiming complete content was saved.
+- Authorize retained files against their producer's owner, preserve immutable file versions and reconstruct Unicode across text windows. Reject text reads of binary files, support storage streams without byte-length headers, renew download links and expose retained ZIPs through the existing archive reader. Terminal clients retrieve hosted files through the authenticated backend.
+- Preserve complete URL, Wayback, website, connected-data, directory and media results before offload, including page bodies and metadata when local report saving is disabled. Provide full plain-text transcripts alongside structured results and readable manifests for original binary files. Prevent report filename collisions and resume bounded expired-file cleanup without changing durable retention.
+- Preserve captured People Also Ask answers, linked entities, citations, source titles, descriptions and organic snippets. Expand available answer controls, report unfinished expansion as partial and retain full JSON and Markdown alongside bounded chat previews.
+- Verify the requested Maps business before merging profile data and preserve full review prose through fallback and saved retries. Keep valid profile material when enrichment fails, report incomplete fields and recognize ratings and review counts rendered on separate lines.
+- Use native rendered settings for managed browsers and submit Google searches through the homepage form. Preserve query filters, allow bounded automatic challenge recovery within the existing deadline and require readable results after recovery. Explicit interactive viewport requests and screenshot output sizes remain supported.
+- Require dedicated SERP credentials and reject incomplete configuration before acquisition. Preserve existing keys and other products' credential selection.
+- Preserve funded Reddit comments and the original retry identity across uncertain outcomes. Bound browser work by the request deadline, require confirmed remote cleanup before another attempt and derive refunds from applied charges, reporting unresolved settlement explicitly.
+- Preserve captured PAA and Search results, original holds and billing identity across interrupted creation, scheduling, settlement and publication. Same-key retries inspect or resume saved work instead of acquiring it again; stale workers cannot overwrite newer results, and uncertain cleanup stops automatic acquisition retries.
+- Recover pending PAA and Search callbacks without discarding completed results or changing their charges. Preserve accepted or uncertain delivery across restarts so a lost response cannot cause an automatic repeat send.
+- Prevent overlapping lead-list and directory workers from duplicating row or city acquisition. Require current funding and execution permission, preserve known results after later failures and recover original settlement without duplicate charges or refunds.
+- Preserve queued website, lead-list and directory work across expired dispatch claims and lost acknowledgments. Retain original holds when accepted work may still start and report unconfirmed handoffs accurately.
+- Prevent overlapping website phases, stale recovery attempts and cancellation from overwriting saved pages or settling another attempt. Rebuild exports from saved content with isolated assembly, validate cached content references and retain complete HTML and Markdown through interrupted recovery.
+- Prevent expired or replaced Sourcebook acquisition attempts from publishing stale revisions or refunds. Commit saved revisions and events together and recover lost replies without repeating acquisition.
+- Recover operation admissions and billing from saved execution and settlement records. Reject stale wallet writes, preserve original credit allocation and expiry rules, and retain existing billing keys when adopting original holds.
+- Charge media transcription by observed clip duration or timed transcript coverage instead of model processing time. Preserve available text and refund the transcription charge when duration is unavailable; expose transcript quality warnings and count spoken words across scripts.
+- Run CEO and CTO reports against an explicitly selected source checkout with credentials supplied separately. Support exact hourly windows, maintenance outcomes and customer/degradation reports; scope subscriber counts and recurring revenue to MCP products, distinguish calculated and reported costs and leave unavailable queue or shared-account costs unknown.
+- Remove credentials from browser connection errors before they reach logs or callers. Keep source-based startup compatible with extracted formatters, prevent imported test servers from starting background pollers and handle Sourcebook polling failures without unhandled rejections.
+- Show the 367-tool inventory consistently in documentation, rate metadata and the terminal installer.
+
+## [0.95.2] - 2026-09-29
+
+### Fixed
+
+- Preserve a missing directory job as a non-retryable not-found error in MCP status reads, and remove misleading retry wording from non-retryable extraction failures.
+
+### Changed
+
+- Generate a versioned public REST contract from the Maps search and directory route schemas, and use it to render those API reference rows. The SDK projects the same artifact into OpenAPI, Node types, and Python models.
+- Clarify Maps search website availability, local-pack mode, directory job polling, temporary workflow artifacts, and error retry versus billing fields across the API guide and MCP descriptions.
+
 ## [0.95.1] - 2026-09-25
 
 ### Fixed
@@ -20,13 +77,13 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Scroll through large Google Maps review lists while the previous small review batch is being saved, then wait for that save before sending another batch or returning a result. A shorter pause between scrolls gives the browser more chances to load reviews within Kernel's ten-minute session.
+- Scroll through large Google Maps review lists while the previous small review batch is being saved, then wait for that save before sending another batch or returning a result. A shorter pause between scrolls gives the browser more chances to load reviews within Option 1's ten-minute session.
 
 ## [0.94.3] - 2026-09-25
 
 ### Fixed
 
-- Give large Google Maps review requests more scrolling time within Kernel's ten-minute session. A hosted 1,000-review run on 0.94.2 saved 828 reviews before its shorter scrolling allowance expired; this patch uses the remaining session time while retaining saved partial results and count-based billing.
+- Give large Google Maps review requests more scrolling time within Option 1's ten-minute session. A hosted 1,000-review run on 0.94.2 saved 828 reviews before its shorter scrolling allowance expired; this patch uses the remaining session time while retaining saved partial results and count-based billing.
 
 ## [0.94.2] - 2026-09-25
 
@@ -39,7 +96,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 ### Changed
 
 - Accept up to 1,000 reviews in a Maps place request across API, MCP, dashboard, and workflows. Scale the review scroll allowance with the requested count and preserve each saved review batch through interrupted runs.
-- Read the named business first during Bright Data service and area acquisition, matching the full Bright Data place path. Retry a challenged Bright Data browser once with a fresh session and meter both sessions. Keep a visible partial run and refund its hold if Google challenges both.
+- Read the named business first during Option 2 service and area acquisition, matching the full Option 2 place path. Retry a challenged Option 2 browser once with a fresh session and meter both sessions. Keep a visible partial run and refund its hold if Google challenges both.
 
 ### Fixed
 
@@ -52,23 +109,23 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Recoverable Maps place runs with owner-scoped status, paginated saved reviews and images, and explicit resume tools. MCP now reads the same run after a client timeout.
 - Incremental, revision-fenced Maps place checkpoints and five-minute repair of expired attempts and unsettled customer holds. Image ZIP packaging can resume from saved image URLs without reopening a browser.
 - Google Maps place calls accept an `include` declaration, including `all`, to request reviews, configured services and areas served, and images within the existing review and image limits.
-- Maps uses Bright Data Browser API for requested configured services and areas served, while Kernel remains the default for direct Google Maps discovery and place details.
+- Maps uses Option 2 Browser API for requested configured services and areas served, while Option 1 remains the default for direct Google Maps discovery and place details.
 
 ### Changed
 
 - Maps place requests reserve the maximum declared base and review charge before browser work, then settle completed attempts to the base plus unique saved reviews. Stopped attempts are refunded; saved results survive a billing repair.
 - Ordinary Maps searches now use state-targeted mobile browser egress when `location` names a US state, then direct egress after two failed mobile attempts. Searches without a state use direct egress; the MCP tool asks for a state without exposing proxy settings.
 
-- Maps search and place requests now use a provider broker and report both the result provider and, for split place requests, the acquisition provider. Kernel discovery reads the Google Maps feed; Bright Data reads the visible Businesses pack or clicks More businesses for larger service-enriched searches.
-- Align Bright Data Maps acquisition with the observed Google Places DOM: recognize the `udm=local` finder after More businesses, open exact `pv-` result cards, read the `#local-place-viewer` profile and its complete Services and Areas Served dialogs, and verify place identity from its `ftid` Maps link. Named service requests use Kernel's place category to reach the organic Businesses pack before Bright Data enrichment.
-- Bright Data-only named place requests now begin on the organic Google SERP and use the matching knowledge panel's category to find the business in the organic Businesses results. A cold exact-name Places finder is reserved for profiles without a category, and a Google challenge is reported as a CAPTCHA rather than an unexplained missing business.
-- Bright Data-only place extraction stays in the opened Google Search Places viewer to read profile details, expanded hours, declared services and areas, photos, and review cards up to the requested limits; a live run collected 30 services, 10 areas, 50 reviews, and 10 photo URLs. Maps SERP navigation preserves provider errors and allows up to two minutes for slow Browser API navigation.
-- Bright Data Maps search, service acquisition, and place details can start one new browser session after the provider confirms `no_ready_cookies` with zero navigations, separately from Maps extraction retries; that recovery waits five seconds after connecting before navigation.
-- Bright Data place review and gallery collection now scale their time and scroll allowances with the declared review and image limits. A default full declaration has a five-minute planning budget; the largest allowed request has nine minutes.
+- Maps search and place requests now use a provider broker and report both the result provider and, for split place requests, the acquisition provider. Option 1 discovery reads the Google Maps feed; Option 2 reads the visible Businesses pack or clicks More businesses for larger service-enriched searches.
+- Align Option 2 Maps acquisition with the observed Google Places DOM: recognize the `udm=local` finder after More businesses, open exact `pv-` result cards, read the `#local-place-viewer` profile and its complete Services and Areas Served dialogs, and verify place identity from its `ftid` Maps link. Named service requests use Option 1's place category to reach the organic Businesses pack before Option 2 enrichment.
+- Option 2-only named place requests now begin on the organic Google SERP and use the matching knowledge panel's category to find the business in the organic Businesses results. A cold exact-name Places finder is reserved for profiles without a category, and a Google challenge is reported as a CAPTCHA rather than an unexplained missing business.
+- Option 2-only place extraction stays in the opened Google Search Places viewer to read profile details, expanded hours, declared services and areas, photos, and review cards up to the requested limits; a live run collected 30 services, 10 areas, 50 reviews, and 10 photo URLs. Maps SERP navigation preserves provider errors and allows up to two minutes for slow Browser API navigation.
+- Option 2 Maps search, service acquisition, and place details can start one new browser session after the provider confirms `no_ready_cookies` with zero navigations, separately from Maps extraction retries; that recovery waits five seconds after connecting before navigation.
+- Option 2 place review and gallery collection now scale their time and scroll allowances with the declared review and image limits. A default full declaration has a five-minute planning budget; the largest allowed request has nine minutes.
 
 ### Fixed
 
-- Attribute Maps provider cost to each browser actually used, including failed and retried Bright Data search, place, services acquisition, and startup recovery sessions. Kernel rotations and broker fallbacks are linked as retries for CEO reporting, which now shows failed-attempt spend separately. Kernel costs remain estimates; Bright Data sessions with delayed usage remain pending for reconciliation.
+- Attribute Maps provider cost to each browser actually used, including failed and retried Option 2 search, place, services acquisition, and startup recovery sessions. Option 1 rotations and broker fallbacks are linked as retries for CEO reporting, which now shows failed-attempt spend separately. Option 1 costs remain estimates; Option 2 sessions with delayed usage remain pending for reconciliation.
 - Include web-app embedding requests in the paid-action inventory and scan web source during future cost-coverage checks.
 - Include configured S3-compatible storage and remote media processing in the paid-action inventory, and show live Stripe account fee totals separately from MCP operation costs in the CEO report.
 
@@ -84,13 +141,13 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 ### Fixed
 
 - Render the CEO report headline and detail from one cost-ledger snapshot, and label cost-linked surcharge multiples as pricing targets rather than guaranteed realized margin.
-- Apply the owner-confirmed $1.50 per 1,000 successful Bright Data SERP requests to delivered provider receipts, with a guarded backfill for earlier successful requests. Failed attempts remain visibly unresolved until provider billing evidence is available.
+- Apply the owner-confirmed $1.50 per 1,000 successful Option 2 SERP requests to delivered provider receipts, with a guarded backfill for earlier successful requests. Failed attempts remain visibly unresolved until provider billing evidence is available.
 
 ## [0.93.2] - 2026-09-24
 
 ### Fixed
 
-- Show Google Search and other provider costs in the CEO report with separate calculated, actual-or-measured, and unresolved receipt coverage. Failed queries now stop the report, missing Bright Data SERP rates leave an explicit delivered-but-unpriced receipt, and historical cost rows no longer imply a margin from subscription MRR.
+- Show Google Search and other provider costs in the CEO report with separate calculated, actual-or-measured, and unresolved receipt coverage. Failed queries now stop the report, missing Option 2 SERP rates leave an explicit delivered-but-unpriced receipt, and historical cost rows no longer imply a margin from subscription MRR.
 
 ## [0.93.1] - 2026-09-24
 
@@ -189,7 +246,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 - Retire the inactive Personal Assistant from server startup, HTTP and MCP routing, web navigation, Scheduler transitions, generated contracts, and Memory tool registration while preserving its source history, persisted data, secrets, and provider resources behind the verified archive branch.
 - Make two-page SERP capture perform a distinct page-two request, preserve page provenance and query/location intent, and report local-pack evidence as present, absent, incomplete, or unknown instead of silently claiming completeness.
-- Make Maps retries follow one immutable egress plan, retain location intent, close every browser/proxy attempt, and treat an already-gone Kernel session as successful cleanup.
+- Make Maps retries follow one immutable egress plan, retain location intent, close every browser/proxy attempt, and treat an already-gone Option 1 session as successful cleanup.
 
 ### Fixed
 
@@ -203,13 +260,13 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 - Add the fixture-tested operation, attempt, provider-receipt, reconciliation, and billing-link foundation needed to trace failed and retried SERP, PAA, Maps, extraction, and transcription work without treating missing provider cost as zero.
 - Add a generated MCP cost-coverage manifest and release gate that tracks every hosted input flag plus each named execution method's retry, timeout, billing, and cost-accounting owner.
-- Trace direct Bright Data SERP requests and Bright Data/Kernel browser attempts into the shared operation timeline, including provider identities, retry or fallback causality, immediate estimates, hourly due-gated Browser API reconciliation, and customer billing links.
-- Add a protected four-cell PAA benchmark runner for Kernel and Bright Data at 20 and 40 complete questions, with a dry-run contract gate, one paid attempt per cell, sanitized provider evidence, and no automatic replacement run.
+- Trace direct Option 2 SERP requests and Option 2/Option 1 browser attempts into the shared operation timeline, including provider identities, retry or fallback causality, immediate estimates, hourly due-gated Browser API reconciliation, and customer billing links.
+- Add a protected four-cell PAA benchmark runner for Option 1 and Option 2 at 20 and 40 complete questions, with a dry-run contract gate, one paid attempt per cell, sanitized provider evidence, and no automatic replacement run.
 - Add a once-daily due-gated purge of raw provider identifiers and verbose diagnostic errors after 30 days while preserving normalized cost facts and hashed correlation keys.
 
 ### Fixed
 
-- Skip Kernel proxy resolution when the active attempt uses Bright Data Browser, removing avoidable Kernel API traffic from Bright Data-first SERP and PAA work.
+- Skip Option 1 proxy resolution when the active attempt uses Option 2 Browser, removing avoidable Option 1 API traffic from Option 2-first SERP and PAA work.
 
 ## [0.90.4] - 2026-09-22
 
@@ -221,21 +278,21 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Route ordinary Bright Data SERP searches through the zone's native parsed proxy, returning Google results within the existing bounded deadline while preserving the REST endpoint as a configuration fallback.
+- Route ordinary Option 2 SERP searches through the zone's native parsed proxy, returning Google results within the existing bounded deadline while preserving the REST endpoint as a configuration fallback.
 - Keep Browser API credentials and interactive PAA behavior independent from the native SERP transport, with one provider request and no hidden retry or browser fallback.
 
 ## [0.90.2] - 2026-09-21
 
 ### Fixed
 
-- Unwrap Bright Data's object-valued REST response body before mapping parsed SERP fields, so successful direct searches return their organic results instead of an empty collection.
+- Unwrap Option 2's object-valued REST response body before mapping parsed SERP fields, so successful direct searches return their organic results instead of an empty collection.
 
 ## [0.90.1] - 2026-09-21
 
 ### Changed
 
-- Route ordinary `search_serp` calls through one parsed Bright Data SERP API request when the dedicated production zone is configured, avoiding browser startup and cleanup while leaving interactive PAA on Browser API.
-- Keep saved SERP identities on their existing Kernel-backed path and retain the browser path as the configuration fallback for local and unconfigured environments.
+- Route ordinary `search_serp` calls through one parsed Option 2 SERP API request when the dedicated production zone is configured, avoiding browser startup and cleanup while leaving interactive PAA on Browser API.
+- Keep saved SERP identities on their existing Option 1-backed path and retain the browser path as the configuration fallback for local and unconfigured environments.
 
 ### Fixed
 
@@ -278,7 +335,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Changed
 
-- Cap every Kernel browser session at a ten-minute absolute lifetime and move expired-session reconciliation from the minute root cron to a dedicated hourly audit.
+- Cap every Option 1 browser session at a ten-minute absolute lifetime and move expired-session reconciliation from the minute root cron to a dedicated hourly audit.
 - Disable the inactive Personal Assistant reminder, reconciliation, and inbound cron schedules while preserving their routes and implementation.
 - Disable the inactive Personal Memory heartbeat and weekly rollup registrations in the production scheduler while preserving their implementation.
 - Pause twice-daily automatic memory optimization while preserving the workflow for deliberate use, preventing all-vault fan-out from consuming background execution capacity.
@@ -287,10 +344,10 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Treat Kernel's not-found response during legacy session deletion as successful cleanup, preventing already-closed sessions from retrying forever.
+- Treat Option 1's not-found response during legacy session deletion as successful cleanup, preventing already-closed sessions from retrying forever.
 - Show browser sessions awaiting provider cleanup separately in the CTO report instead of hiding them behind a non-null close timestamp.
 - Cast the analytics pruning clock before PostgreSQL interval arithmetic so the root cron no longer fails every minute while pruning scheduled occurrences.
-- Explicitly delete Kernel screenshot sessions after capture, including when closing the browser connection fails.
+- Explicitly delete Option 1 screenshot sessions after capture, including when closing the browser connection fails.
 
 ## [0.89.7] - 2026-09-18
 
@@ -409,7 +466,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Give each `reddit_thread` retrieval a 300-second end-to-end deadline, with two 60-second Kernel attempts and two 60-second managed-browser backup attempts, instead of exhausting the full retry ladder in about 50 seconds. The MCP client now waits long enough to receive the endpoint's structured terminal result.
+- Give each `reddit_thread` retrieval a 300-second end-to-end deadline, with two 60-second Option 1 attempts and two 60-second managed-browser backup attempts, instead of exhausting the full retry ladder in about 50 seconds. The MCP client now waits long enough to receive the endpoint's structured terminal result.
 
 ## [0.88.2] - 2026-09-02
 
@@ -446,19 +503,19 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Kept Bright Data telemetry lookup off the Reddit response critical path and reallocated the saved time to 17-second backup attempts, so all four provider attempts can finish before production ends the request.
+- Kept Option 2 telemetry lookup off the Reddit response critical path and reallocated the saved time to 17-second backup attempts, so all four provider attempts can finish before production ends the request.
 
 ## [0.86.4] - 2026-09-02
 
 ### Fixed
 
-- Kept the complete two-primary, two-backup Reddit retry ladder inside the production request window by limiting Kernel attempts to 8 seconds, Bright Data attempts to 14 seconds, and browser cleanup to 1 second.
+- Kept the complete two-primary, two-backup Reddit retry ladder inside the production request window by limiting Option 1 attempts to 8 seconds, Option 2 attempts to 14 seconds, and browser cleanup to 1 second.
 
 ## [0.86.3] - 2026-09-02
 
 ### Fixed
 
-- Applied 45-second Kernel and 35-second Bright Data deadlines to the complete Reddit browser-attempt lifecycle, and made known-thread primary attempts find and click the target through DuckDuckGo before the residential landing.
+- Applied 45-second Option 1 and 35-second Option 2 deadlines to the complete Reddit browser-attempt lifecycle, and made known-thread primary attempts find and click the target through DuckDuckGo before the residential landing.
 
 ## [0.86.2] - 2026-09-02
 
@@ -607,13 +664,13 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Added
 
-- Added a Kernel-only Reddit workflow that searches DuckDuckGo with a `site:reddit.com` query, switches the same browser to a residential proxy before clicking the selected result, and reads modern Reddit posts plus bounded rendered-comment expansion through dedicated search, thread, and combined REST endpoints.
-- Added a bounded managed-browser backup for Reddit thread hydration after the primary Kernel attempt fails or returns fewer than the semantic target, capped at 25 comments with measured bandwidth, duration, CAPTCHA, closure, and provider-cost telemetry.
+- Added a Option 1-only Reddit workflow that searches DuckDuckGo with a `site:reddit.com` query, switches the same browser to a residential proxy before clicking the selected result, and reads modern Reddit posts plus bounded rendered-comment expansion through dedicated search, thread, and combined REST endpoints.
+- Added a bounded managed-browser backup for Reddit thread hydration after the primary Option 1 attempt fails or returns fewer than the semantic target, capped at 25 comments with measured bandwidth, duration, CAPTCHA, closure, and provider-cost telemetry.
 
 ### Changed
 
-- Routed the production `reddit_thread` and `reddit_trending` MCP tools through modern Reddit on Kernel residential sessions, with DuckDuckGo site search for trend discovery; removed Google and old Reddit from their active execution path while preserving tool names, billing rates, bounded partial results, and refunds.
-- Cost probes now include Reddit Kernel sessions and any managed-browser fallback bytes and cost in the same request receipt, and identify when the backup contributed to total cost.
+- Routed the production `reddit_thread` and `reddit_trending` MCP tools through modern Reddit on Option 1 residential sessions, with DuckDuckGo site search for trend discovery; removed Google and old Reddit from their active execution path while preserving tool names, billing rates, bounded partial results, and refunds.
+- Cost probes now include Reddit Option 1 sessions and any managed-browser fallback bytes and cost in the same request receipt, and identify when the backup contributed to total cost.
 
 ### Fixed
 
@@ -658,7 +715,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Fixed
 
-- Persisted per-control PAA dispatch and 0.7/1.0/1.4-second confirmation telemetry in durable checkpoints, exposed recent interaction and attempt correlation through MCP status, attached Bright Data session IDs immediately after browser launch, and finalized dangling attempt rows during lease recovery without blocking customer settlement.
+- Persisted per-control PAA dispatch and 0.7/1.0/1.4-second confirmation telemetry in durable checkpoints, exposed recent interaction and attempt correlation through MCP status, attached Option 2 session IDs immediately after browser launch, and finalized dangling attempt rows during lease recovery without blocking customer settlement.
 - Prevented inline style, script, and hidden DOM text inside Google answer containers from falsely confirming that PAA answer material loaded.
 - Routed canonical `/assistant` page loads to the web app and the redacted private Assistant readiness endpoint to the main API function, preventing production 404s after the 0.79.1 launch.
 
@@ -682,7 +739,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Added Scheduling as the canonical Personal Assistant setup surface, with connection readiness for Gmail, Calendar, Zoom, browser profiles, Memory, SMS, and email; exact schedule confirmation; approval and spend review; run history; and explicit watch/takeover states.
 - Added owner-scoped browser profiles that can hold multiple independently verified login bindings, while every browser schedule grant selects one exact profile, login, domain, and action set.
 - Added immutable schedule revisions, readiness receipts, append-only activation records, additive legacy schedule projection, and single-owner occurrence transition receipts so migration cannot silently infer browser authority or double-dispatch work.
-- Added Kernel and private-Mac browser runtime boundaries with collision-resistant tenant namespaces, per-owner concurrency ceilings, bounded sessions, explicit and timeout cleanup, owner-qualified account deletion, and provider deletion readback.
+- Added Option 1 and private-Mac browser runtime boundaries with collision-resistant tenant namespaces, per-owner concurrency ceilings, bounded sessions, explicit and timeout cleanup, owner-qualified account deletion, and provider deletion readback.
 - Added an owner-controlled Personal Assistant that brings SMS/MMS, Gmail, Google Calendar, Zoom, browser work, reminders, and Memory context packets into one governed workflow with immutable plans, approval checkpoints, spend limits, and durable receipts.
 - Added Twilio number discovery, owned-number attachment, purchase and registration previews, Messaging Service readiness, signed inbound and delivery webhooks, safe MMS ingestion, deterministic opt-out handling, single and reviewed bulk messaging, and reconciliation for unknown provider outcomes.
 - Added immutable, revisioned Memory context packets with source and attachment provenance, Gmail full-message imports, MMS media metadata, lifecycle controls, and readback verification against the selected vault.
@@ -719,7 +776,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Made `maxQuestions` an explicit target count rather than a traversal-depth control, with separate discovery and material-completeness diagnostics.
 - Preserved complete People Also Ask, AI Overview, and organic-result link provenance in JSON, structured MCP output, and CSV while classifying plain links and Google redirect links explicitly.
 - Resolved opaque Google `/goto` targets through bounded concurrent manual-redirect requests with active-browser interception as a fallback, without following publisher destinations and without dropping unresolved material.
-- Aligned the bounded PAA production-provider canary with the public `maxQuestions` contract and made Bright Data the default test provider.
+- Aligned the bounded PAA production-provider canary with the public `maxQuestions` contract and made Option 2 the default test provider.
 
 ### Fixed
 
@@ -927,7 +984,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 - Added portable `harvest_paa_start` and `harvest_paa_status` tools for durable long-running PAA research, with stable idempotency recovery, progress, attempt provenance, completeness, billing state, and bounded provider telemetry.
 - Added progressive PAA checkpoints that preserve and merge the best unique rows across browser retries and stale-job recovery instead of losing already captured questions when a provider session or caller is interrupted.
-- Added exact Bright Data browser-session identity, sanitized Session Logs enrichment, disconnect attribution, bandwidth usage telemetry, and retryable reconciliation without making provider telemetry a prerequisite for result delivery.
+- Added exact Option 2 browser-session identity, sanitized Session Logs enrichment, disconnect attribution, bandwidth usage telemetry, and retryable reconciliation without making provider telemetry a prerequisite for result delivery.
 
 ### Changed
 
@@ -1660,7 +1717,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Changed
 
-- PAA browser work now uses Kernel's co-located Playwright execution with stealth mode's default managed proxy and native browser metadata. Location is expressed only through Google UULE, CAPTCHA solver waiting is capped at 60 seconds, and a fresh session is allowed once only when no useful data was captured.
+- PAA browser work now uses Option 1's co-located Playwright execution with stealth mode's default managed proxy and native browser metadata. Location is expressed only through Google UULE, CAPTCHA solver waiting is capped at 60 seconds, and a fresh session is allowed once only when no useful data was captured.
 - PAA invocations stop browser work at 250 seconds inside the 280-second application budget, reserving 30 seconds for persistence, cleanup, and settlement. The legacy cron worker no longer claims Inngest-owned PAA jobs.
 
 ### Fixed
@@ -1896,7 +1953,7 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ### Changed
 
-- `maps_search` now applies a transport ladder across its retry attempts so it can recover from Google soft-blocks instead of only retrying the same way. The first attempt is unchanged (Kernel's default stealth ISP proxy, direct navigation). Subsequent retries switch to direct egress and arrive at Google through a cross-site redirect (the combination that measurably clears blocks a cold navigation triggers); the final escalation attempt uses direct egress without the redirect and accepts any egress country. This only affects the `proxyMode: 'none'` default path and only its retries — a first-attempt success behaves exactly as before.
+- `maps_search` now applies a transport ladder across its retry attempts so it can recover from Google soft-blocks instead of only retrying the same way. The first attempt is unchanged (Option 1's default stealth ISP proxy, direct navigation). Subsequent retries switch to direct egress and arrive at Google through a cross-site redirect (the combination that measurably clears blocks a cold navigation triggers); the final escalation attempt uses direct egress without the redirect and accepts any egress country. This only affects the `proxyMode: 'none'` default path and only its retries — a first-attempt success behaves exactly as before.
 
 ## [0.32.1] - 2026-07-22
 
@@ -2143,7 +2200,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.95.1...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.96.0...HEAD
+[0.95.2]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.95.1...v0.95.2
 [0.95.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.95.0...v0.95.1
 [0.95.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.94.4...v0.95.0
 [0.94.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.94.3...v0.94.4
@@ -2311,3 +2369,4 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 [0.89.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.89.2...v0.89.3
 [0.89.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.89.3...v0.89.4
 [0.89.5]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.89.4...v0.89.5
+[0.96.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.95.2...v0.96.0

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.95.1`, SHA-256 `4b1befb5ded4ed33edd098c1b1853a8c000d10e009cffc3b773ccf54481e0987`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.96.0`, SHA-256 `72fd074fb10f0d4dc4bbf7d0dff35b45f7fa228bba3aa201185e7e036791cefa`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -266,14 +266,14 @@ Check `pagination.requestedPages`, `pagination.capturedPages`, and `pagination.p
 - `facebook_video_transcribe` — transcribe an organic Facebook reel, video, watch, post, or share URL, including `fb.watch` links. The tool renders the page, extracts the best matching public Facebook CDN MP4 URL, then returns transcript text, timestamped chunks, selected quality, video metadata, and the extracted MP4 URL for follow-up download.
 - `instagram_profile_content` — discover Instagram profile grid content links for a handle or profile URL, optionally through a saved hosted browser `profile` for authenticated access. Returns collected post/reel/tv URLs, profile counts, type counts, shortcodes, browser details, pagination attempts, stop reason, and limitations.
 - `instagram_media_download` — extract and download one Instagram post/reel/tv URL, optionally through a saved hosted browser `profile` for authenticated access. Returns text/caption, image URL/downloads, selected video/audio MP4 tracks, optional muxed MP4 when `ffmpeg` is available, optional transcript, and browser details.
-- `maps_search` — search Google's localized local-results list for multiple business/profile candidates. Use for GMB/GBP prospect lists, competitors, categories, and anything needing more than the Google 3-pack. It opens the rendered business card, reads the profile dialog, then closes it before continuing to the next ranked card. Set `includeServices: true` to return services and areas served without collecting review cards. `maxResults` defaults to 10 and is capped at 50.
+- `maps_search` — search Google's localized local-results list for multiple business/profile candidates. Use for GMB/GBP prospect lists, competitors, categories, and anything needing more than the Google 3-pack. Ordinary search uses the local-results feed; `websiteUrl` may be null and `profileDetailsStatus: "not_requested"` means no profile dialog was opened. Use `maps_place_intel` selectively to hydrate businesses that need complete website or profile data; this is separately billed. Set `includeServices: true` to open profiles for services and areas served where available. `maxResults` defaults to 10 and is capped at 50.
 - `maps_place_intel` — hydrate one known/named Google Maps business with profile details, entity IDs/CID, services, service areas, review aggregates/cards, and optional photos. Set `includeImages:true`, choose `imageScope:"owner"` or `"all"`, and tune `maxImages`; results include a recoverable run ID, field status, ownership evidence, and an owner-scoped ZIP readable with `archive_read`. Use `maps_place_status` to read saved results and `maps_place_resume` to explicitly retry a partial run.
 - `directory_workflow` — build city-by-city directory/prospecting datasets from Census place selection plus localized Google business searches. Use it for requests like "all cities over 100k population in Tennessee, then get 20 roofers from Maps." Supply the business category, state, and market limits; MCP Scraper manages search transport and retry behavior internally. The saved CSV includes `source_location`, `result_position`, `business_name`, `review_stars`, `review_count`, `category`, `address`, `phone`, `hours_status`, `website_url`, `directions_url`, `place_url`, `cid`, `cid_decimal`, Census population, and ZIP groups.
 - `workflow_list` — list higher-level workflow IDs plus AI-facing recipes for market analysis, ICP research, forum/review acquisition, brand design briefings, CRO audits, positioning briefs, content gaps, and AI search visibility audits.
 - `workflow_suggest` — route a high-level business goal to the right workflow/tool chain before spending credits.
 - `workflow_run` — run hosted workflows such as `agent-packet`, `local-competitive-audit`, `map-comparison`, `serp-comparison`, `paa-expansion-brief`, and `ai-overview-language`; returns run metadata, summary, and artifact IDs.
 - `workflow_status` — reopen a workflow run and list its current status and artifacts.
-- `workflow_artifact_read` — pull generated workflow artifacts such as `evidence.json`, CSVs, Markdown briefs, and reports back into MCP context.
+- `workflow_artifact_read` — read available workflow artifacts such as `evidence.json`, CSVs, Markdown briefs, and reports. Temporary file-backed artifacts may become unavailable and return 410.
 - `editorial_reading_room_guide` — load the reusable editorial workflow, 100-article content contract, image/provenance rules, or compact example before turning dense supplied material into a reading surface.
 - `create_editorial_reading_room` — render up to 100 fully authored, source-grounded articles into one self-contained mobile-first HTML reading room with contents, navigation, search, jump links, progress, text sizing, evening mode, structured card/hero images, Markdown body images, collection/article Open Graph images, and visible provenance. Static files emit collection social metadata and update article metadata in-browser; crawler-perfect article unfurls require a host that renders article-specific head tags. Hosted clients receive a private seven-day artifact; local stdio clients receive an openable file under the MCP Scraper output directory.
 - `renew_editorial_reading_room_download` — issue a fresh signed URL for an unexpired private reading-room artifact.
@@ -345,16 +345,18 @@ Google Search Console exposes eight bounded reads and eight gated property and s
 
 For accurate annotated videos, do not guess annotation times from a script. Start the replay, navigate until each target is visible and stable, call `browser_replay_mark` for each callout, then stop the replay and pass the returned annotations to `browser_replay_annotate` with the returned `source_width` and `source_height`.
 
-For `search_serp`, callers provide a query and can reuse an `idempotencyKey` after an uncertain response. Light mode returns organic positions, URLs, titles, and descriptions. Unfiltered one-page full mode adds available same-page SERP features, including local results, discussions, videos, AI features, and on-page questions. Both modes default to one page; request `pages: 2` explicitly for a second page. Set `recency: "week"` or `recency: "month"` to apply Google's past-week or past-month filter. Filtered searches use Bright Data Browser API as the primary provider and return organic results only. A one-page filtered search costs 35 Credits. With `pages: 2`, the browser scrolls to Google's pagination control and clicks the native Page 2 link; two delivered pages cost 70 Credits. For unfiltered searches, Browser API is the last resort after the normal provider path fails; rich features are marked unsupported if it supplies the result. Full mode does not open result URLs, expand PAA questions, or fetch Maps business profiles. Unfiltered light mode costs 20 Credits per delivered page, or 35 Credits when a backup supplies it; full mode costs 35 Credits per delivered page. Two-page searches return organic results only. Location, language, device, and legacy optional-module fields remain accepted for compatibility but do not change ordinary searches. Other Google SERP and Maps tools retain their own regional inputs. MCP Scraper owns transport selection and bounded retries internally; implementation controls and receipts are not part of the public tool contract.
+For `search_serp`, callers provide a query and can reuse an `idempotencyKey` after an uncertain response. Light mode returns organic positions, URLs, titles, and descriptions. Unfiltered one-page full mode adds available same-page SERP features, including local results, discussions, videos, AI features, and on-page questions. Both modes default to one page; request `pages: 2` explicitly for a second page. Set `recency: "week"` or `recency: "month"` to apply Google's past-week or past-month filter. Filtered searches use Option 2 Browser API as the primary provider and return organic results only. A one-page filtered search costs 35 Credits. With `pages: 2`, the browser scrolls to Google's pagination control and clicks the native Page 2 link; two delivered pages cost 70 Credits. Unfiltered light searches use up to two primary-provider attempts followed by one SERP API fallback, with no browser recovery. Unknown execution outcomes stop retries. Both primary attempts retain the requested page count; the API fallback delivers one page and reports partial coverage for a two-page request. Unfiltered one-page full searches use the SERP API directly to preserve requested feature semantics. Full mode does not open result URLs, expand PAA questions, or fetch Maps business profiles. Unfiltered light mode costs 20 Credits per delivered page, or 35 Credits when a backup supplies it; full mode costs 35 Credits per delivered page. Two-page searches return organic results only. Location, language, device, and legacy optional-module fields remain accepted for compatibility but do not change ordinary searches. Other Google SERP and Maps tools retain their own regional inputs. MCP Scraper owns transport selection and bounded retries internally; implementation controls and receipts are not part of the public tool contract.
 
 The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both sections through one MCP server.
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 364 tools: 238 scraper, browser, workflow, billing, and connected-service tools plus 126 durable-memory tools. Personal Assistant tools and routes are retired from active builds; their source history and persisted data remain recoverable from the archived pre-retirement branch. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; durable SERP, PAA, and single-page extraction starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 367 tools: 241 scraper, browser, workflow, billing, and connected-service tools plus 126 durable-memory tools. Personal Assistant tools and routes are retired from active builds; their source history and persisted data remain recoverable from the archived pre-retirement branch. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; durable SERP, PAA, and single-page extraction starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
 For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone Memory service, not a second customer setup path. Existing direct Memory credentials remain compatible for one release, but all new customer setup uses the root endpoint and `MCP_SCRAPER_API_KEY`.
 
+The public REST registry in `src/api/public-rest-contract.ts` owns Maps search and directory run/status request and response schemas, headers, descriptions, and paths. Run `npm run contracts:rest` after changing one of those operations; `npm run contracts:rest:check` fails when the versioned artifact or the web docs projection is stale. The SDK imports `contracts/public-rest.v1.json`, projects it over its curated OpenAPI base, and regenerates Node and Python models together. Other public REST operations remain in that curated base until migrated.
+
 ## Resources
 
 The `mcp-scraper` NPX stdio server also exposes saved reports as MCP resources: `resources/list` returns the most recent Markdown reports from your output directory as `report://` URIs, and `resources/read` returns their content — so an MCP client can pull prior research into context without re-scraping or spending credits. The hosted endpoint does not expose resources (it saves no files).
@@ -366,8 +368,8 @@ The `mcp-scraper` NPX stdio server also exposes saved reports as MCP resources:
 - `MCP_SCRAPER_OUTPUT_DIR` is optional and defaults to `~/Downloads/mcp-scraper`.
 - `MCP_SCRAPER_SAVE_REPORTS=false` disables automatic Markdown report files.
 - `MCP_SCRAPER_KEY_PATH` is optional. When no API key env var is set, the server also reads `~/.mcp-scraper-key` for compatibility with older installs.
-- `BROWSER_AGENT_PROFILE_NAME` is optional and sets the default saved hosted browser profile for `mcp-scraper` stdio sessions. Aliases: `BROWSER_SERVICE_PROFILE_NAME`, `KERNEL_BROWSER_PROFILE_NAME`, `KERNEL_PROFILE_NAME`.
-- `BROWSER_AGENT_PROFILE_SAVE_CHANGES=true` is optional hosted setup behavior. It persists cookies and storage back to the named profile when `browser_close` deletes the hosted browser session. Aliases: `BROWSER_SERVICE_PROFILE_SAVE_CHANGES`, `KERNEL_BROWSER_PROFILE_SAVE_CHANGES`, `KERNEL_PROFILE_SAVE_CHANGES`.
+- `BROWSER_AGENT_PROFILE_NAME` is optional and sets the default saved hosted browser profile for `mcp-scraper` stdio sessions. Aliases: `BROWSER_SERVICE_PROFILE_NAME`, `Option 1_BROWSER_PROFILE_NAME`, `Option 1_PROFILE_NAME`.
+- `BROWSER_AGENT_PROFILE_SAVE_CHANGES=true` is optional hosted setup behavior. It persists cookies and storage back to the named profile when `browser_close` deletes the hosted browser session. Aliases: `BROWSER_SERVICE_PROFILE_SAVE_CHANGES`, `Option 1_BROWSER_PROFILE_SAVE_CHANGES`, `Option 1_PROFILE_SAVE_CHANGES`.
 
 Hosted operators can isolate authorization state in a dedicated Turso/libSQL database without changing the public MCP tool catalog or API-key authentication. The secured store uses atomic authorization-code exchange and refresh rotation, keyed secret lookup, bounded encrypted replay receipts, authority epochs, and fail-closed maintenance behavior. Production migration and rollback are controlled data moves, not ordinary mode flips; see [MCP OAuth operations](docs/operations/mcp-oauth-runbook.md). Existing client setup and reconnect behavior are unchanged in Phase 1.
 
@@ -408,4 +410,20 @@ The bundle runs `mcp-scraper` internally, so the user installs `MCP Scraper` onc
 
 ## Development
 
+Production deployments track `codex/mcp-ownership-tree` for the server, web app, Memory and scheduler. Their Vercel configurations admit this branch and disable automatic deployments from `main`. Before deploying server schema changes, run `npm run release:server:predeploy` against the production database. Customer request capture additionally requires `MCP_ANALYTICS_CAPTURE=1`; missing historical attribution stays unknown.
+
+See the [codebase layout and edit guide](docs/architecture/codebase-file-tree.md) for the populated tree, feature homes and compatibility entrypoints.
+
+Edit behavior in its domain under `src/`: `paa`, `google-search`, `reddit`, `maps`, `web-extraction`, `transcripts`, `site-audit`, `analytics`, `personal-assistant`, `twilio`, `gmail`, `integrations`, `commons`, `leads`, and the other named features.
+
+- `src/api/server.ts` assembles HTTP routes; handlers live in `src/api/routes/`.
+- `src/mcp/features/<feature>/` holds each feature's tool registrations, schemas, and formatting. `src/mcp/paa-mcp-server.ts` assembles the main server. Common MCP delivery and errors live in `src/mcp/shared/`.
+- Domain repositories keep their queries beside the behavior they serve. `src/platform/` owns shared database connections, core schema migrations, files, and HTTP plumbing.
+- `src/runtime/` holds shared execution, concurrency, maintenance, and provider-cost machinery. `src/browser/` and `src/providers/` hold vendor adapters.
+- `src/artifacts/` and `src/delivery/` own stored content, expiry, downloads, and delivery.
+- `bin/` and `api/` are terminal and hosted entrypoints; `apps/`, `packages/`, `ops/`, and `nango-integrations/` retain their separate product and provider code.
+
+Use `npm run typecheck`, `npm test`, and `npm run build` for ordinary changes. Tests requiring databases or live providers belong in `tests/integration/` or `tests/live/`.
+
+
 - [MCP Tool Quality Spec](docs/mcp-tool-quality-spec.md) defines the shipping bar for model-facing tool names, descriptions, schemas, structured outputs, errors, packaging, and deployment.