shotops-mcp 0.5.0 → 0.6.1

package/README.md

@@ -1,15 +1,21 @@
 # shotops-mcp
 
-A hosted-ready **MCP server** that turns app screenshots into styled 3D App Store mockups,
-emits a `fastlane deliver`-ready bundle, and reads your saved ShotOps look — for agents
-(ChatGPT / Claude Code / Cursor / CI). It runs over the same `@engine` render spine the Studio web app
-and the `mockup-mcp` CLI use, driving headless Chromium (Playwright).
+A hosted-ready **MCP server** that makes the marketing screenshots an app store listing needs.
+Give it the raw screen captures from an app and it composites each one into a styled 3D device
+mockup, lays them out as a screenshot strip, sets your headlines over them, and hands back the
+panels as PNGs plus a `fastlane deliver`-ready bundle. Captions are held per locale, so one strip
+ships in every language you list in. It renders at App Store panel sizes and bundles for fastlane
+deliver, so a Google Play listing reuses the designs rather than the exact files. Designs save as
+reusable **looks** and editable **projects**, so the next release matches the last one.
+
+Built for agents (ChatGPT / Claude Code / Cursor / CI). It runs over the same `@engine` render
+spine the Studio web app and the `mockup-mcp` CLI use, driving headless Chromium (Playwright).
 
 Ships as **two tiers, one engine**: a free `npx shotops-mcp` **local stdio server** that
 renders on your own machine with no account (see [Local (free tier)](#local-free-tier---npx-shotops-mcp)
-below), and a **hosted** server on Fly.io with an account, saved looks, and share links (see
-[Hosted (Fly.io)](#hosted-flyio) below, or the public
-[`/connect`](https://storeframe-studio.vercel.app/connect) page in the studio app).
+below), and a **hosted** server on Vercel with an account, saved looks, and share links (see
+[Hosted](#hosted) below, or the public
+[`/connect`](https://shotops.dev/connect) page in the studio app).
 
 ## Zero-custody
 
@@ -24,37 +30,66 @@ share links) — nothing that could reach a store on your behalf.
 
 | Tool | What it does | Key inputs |
 |------|--------------|------------|
-| `render_strip` | Render screenshots into mocked-up per-panel PNGs | `screenshots`, `panelPresetId?`, `clip?`, `style?` **+** `look?` (they compose) / `useSavedLook?`, `project?`, `version?`, `locale?`, `preview?`, `output?` |
-| `emit_bundle` | `render_strip` (or pre-rendered `panels` — refs or local `{ path }`) + a `fastlane deliver` zip (+ optional share link) | `screenshots` or `panels`, `bundleId`, `clip?`, `locale?`, `locales?` (multi-locale bundle), `projectName?`, `share?`, `output?` (+ the same styling params) |
-| `save_project` | Save the strip as an editable Studio project (structure + look only — does NOT render, so it never hits the render timeout); returns `projectId` + an `openUrl` | `screenshots`, `project?` (update in place; omit to create), `projectName?`, `panelPresetId?`, `style?` / `look?` / `useSavedLook?`, `version?`, `locale?`, `sourceDir?` |
-| `read_look` | Return a project's saved ShotOps look (styling only), with its latest version, the held version, and the `versions` history | `project?` (default: your most recently edited project) |
-| `read_project` | Return a project's FULL current state as an opaque `ProjectFile` — frame order, per-locale caption words, locale list, styling. Answers *"what did the designer change?"* (remember `updatedAt`, re-read later) | `project?` (default: your most recently edited project) |
-| `render_project` | Re-render a SAVED project with your OWN raw screenshots, matched to its shots **by filename** — the project supplies frame order, captions + styling, so the result reproduces the designer's strip | `project?`, `screenshots` (a FLAT list, each with its original filename as `name`), `locale?`, `preview?`, `output?` |
+| `render_strip` | Preferred focused render: turn raw screenshots into mocked-up per-panel PNGs without creating or updating a project | `screenshots`, `panelPresetId?`, `clip?`, `style?` **+** `look?` (they compose) / `useSavedLook?`, `project?`, `version?`, `locale?`, `preview?`, `output?` |
+| `emit_bundle` | `render_strip` (or pre-rendered `panels` — refs or local `{ path }`, or a saved `project`'s own screenshots) + a `fastlane deliver` zip (+ optional share link) | `screenshots` or `panels` or `project` (bundles what that project holds), `bundleId`, `clip?`, `outputs?` (target devices — one bundle for several sizes; omit and a `project`'s saved outputs are used), `locale?`, `locales?` (multi-locale bundle), `projectName?`, `share?`, `output?` (+ the same styling params) |
+| `save_project` | Save the strip as an editable Studio project (structure + look only — does NOT render, so it never hits the render timeout); always returns an `openUrl`. Authenticated saves also return `projectId`; unsigned local saves return a seven-day pending claim the user owns after opening the link and signing in | `screenshots`, `project?` (update in place only when explicitly targeted and authenticated; omit to create a new project or pending claim), `projectName?`, `outputs?`, `panelPresetId?`, `style?` / `look?` / `useSavedLook?`, `version?`, `locale?`, `sourceDir?` |
+| `read_look` | Return a project's saved ShotOps look (styling only), with its latest version, the held version, the `versions` history, and the `layout` template it is composed on (derived from its values, never stored) | `project?` (default: your most recently edited project) |
+| `read_project` | Return a project's FULL current state as an opaque `ProjectFile` — frame order, per-locale caption words, locale list, styling — plus the derived `layout` and a `screenshots.cells` report for every shot × target-family × locale. Each cell says whether pixels resolve, where they resolved from, and which axes inherited | `project?` (default: your most recently edited project) |
+| `render_project` | Render a SAVED project. By default it renders the screenshots **the project already holds** — pass none at all, no upload needed — into **every supported device the project targets**. Pixels resolve independently for each device family + locale through the shared manifest; genuine fallback is reported in `shots[].inherited` and `note` | `project?`, `screenshots?` (**optional** — omit to use what the project holds; else a FLAT list matched by original `name`, with optional `variant: { family?, locale? }` per cell), `outputs?` (override the project's saved devices for this call), `locale?`, `preview?`, `output?` |
 | `save_look` | Persist a composed look on a project (styling only — appends a new version) | `look`, `project?`, `sourceName?` |
 | `hold_look` | Hold which saved version agents render by default (replaces pinning) — the version must exist (`read_look` `versions`) | `version`, `project?` |
 | `release_look` | Clear the held version — agents Follow latest (render the newest saved look) | `project?` |
-| `describe_look` | The styling field catalog + defaults, for authoring from scratch | *(none)* |
-| `request_screenshot_upload` | Mint signed upload slots for real screenshots | `count` (1–10), `names?`, `locale?` (a per-locale batch tag) |
-| `import_screenshot` | Import a PNG attached in ChatGPT and return a render-ready ref | `file`, `name?`, `locale?` |
+| `describe_look` | Five named design presets, two named layout templates, the user-intake script, and the full styling field catalog + defaults | *(none)* |
+| `request_screenshot_upload` | Mint signed upload slots for real screenshots; every returned slot carries its semantic screenshot `variant` | `count` (1–10), `names?`, `family?`, `locale?` |
+| `import_screenshot` | Get screenshots INTO ShotOps — several per call, each from one named source (`{ url }`, `{ file }`, or local-stdio `{ path }`), returning a render-ready ref per entry in input order | `screenshots` (1–10 source entries), `file?` (the ChatGPT top-level attachment), `name?`, `locale?` |
 | `delete_assets` | Permanently delete private uploaded screenshots, rendered panels, or generated bundles owned by the signed-in account | `refs` (1–50 ShotOps refs) |
 
-- **`panelPresetId`** — App Store size: `r69` (default, 6.9″ iPhone 1290×2796), `r65`, `r55`,
-  `ipad13`, `ipad129`. This enum is a hand-kept copy of `mockup-engine/appstore.ts`'s
-  `PANEL_PRESETS` (see `shotops-mcp/src/schemas.ts`'s `PANEL_PRESET_IDS`/`PANEL_DIMENSIONS`)
-  — when Apple revises required sizes, add the preset in the engine first, then mirror it
-  here.
+- **`panelPresetId`** — App Store size: `r69` (default, 6.9″ iPhone 1290×2796), `r65`, `r55`.
+  **iPhone sizes only** — the iPad presets are deliberately not offered, because no iPad device
+  model exists yet and rendering one would put an iPhone body in an iPad-shaped canvas. The
+  accepted set is `RENDERABLE_PANEL_PRESET_IDS` in `shotops-mcp/src/panelCatalog.ts`, a subset of
+  the hand-kept `PANEL_PRESET_IDS` copy of `mockup-engine/appstore.ts`'s `PANEL_PRESETS` — when
+  Apple revises required sizes, add the preset in the engine first, then mirror it here.
 - **`style`** — the structured styling input (call `describe_look` for the full catalog):
-  `{ shotLook?, background?, captions? }`. `shotLook` is **one device for every phone**; `captions`
-  is one entry PER PANEL in slot order — each entry is EITHER a single caption object OR an **array
-  of caption layers** stacked on that panel (headline + subline + …). Each layer's `text` (and a
-  single caption's `subtitle`) is per-RENDER input (never stored — a look carries styling only).
-  Captions auto-layout above the device so they never collide with the phone.
+  `{ layout?, shotLook?, background?, captions? }`. `shotLook` is **one device for every phone**;
+  `captions` is one entry PER PANEL in slot order — each entry is EITHER a single caption object OR
+  an **array of caption layers** stacked on that panel (headline + subline + …). Each layer's
+  `text` (and a single caption's `subtitle`) is per-RENDER input (never stored — a look carries
+  styling only). Captions auto-layout in a band at the top of the panel, and the device does NOT
+  move to make room.
+- **`style.layout`** — the panel **composition** in one word: `"standard"` or `"bleed"`. It settles
+  the headline's reserved region *and* the device size + position together, which is three numbers
+  that are not independent of each other. `standard` (the shipped default) puts the whole device
+  under a 2-line region — about 36 characters — and crops nothing; `bleed` reserves 4 lines (~72
+  characters) and runs the device 10% off the bottom edge. The region is **reserved, not fitted**:
+  it is held at full size whether or not the headline fills it, which is what makes every panel in
+  a swiped set land on the same line. **Precedence** — the template expands *first*, then any
+  `shotLook.phoneHeight`/`hOffset`/`vOffset` or `captions[].sizePt`/`maxWidth` you also pass
+  **overrides** it (`{ layout: "bleed", shotLook: { vOffset: "45" } }` is "bleed, but a bit lower").
+  A pure macro: nothing stores the template id, so `save_project` persists the expanded values and
+  `read_look` returns them unchanged. **The id is not lost, though — it is DERIVED back:**
+  `read_project` and `read_look` both return a `layout` report read out of the values themselves, so
+  it can never go stale the way a stored id would. When a template was nudged, it reports the near
+  miss instead of just failing to match:
+
+  ```jsonc
+  { "layout": "bleed" }                                    // every panel agrees
+  { "layout": null, "closestLayout": "bleed",              // on Bleed, with one adjustment
+    "differs": { "vOffset": { "is": "45", "template": "38" } } }
+  { "layout": null, "closestLayout": null }                // nothing close
+  ```
+
+  It also answers per panel (`layout.panels["panel-1"]`), because a strip may mix compositions and a
+  multi-device panel whose devices were dragged apart is honestly on no template at all. If you set
+  placement by hand with no `layout`, the response `note` names the template that would have produced
+  it — templates are the main road, raw fields are how you nudge one.
 - **`look`** — a ShotOps look JSON exactly as `read_look` returns it, but you can also
-  hand-author one: it gives each panel its **own** device (`shots[]`, tint/tilt/size per panel),
-  which `style.shotLook` can't. **Validated** — unknown keys are rejected (a typo won't silently
-  render wrong). Omit for default styling.
+  hand-author one: it gives each screenshot/device its **own** styling through `shots[]`, including
+  two differently coloured devices in one panel. `shots[]` is flattened in panel order; repeat the
+  same `panelId` for devices sharing a panel. This is what `style.shotLook` can't do. **Validated**
+  — unknown keys are rejected (a typo won't silently render wrong). Omit for default styling.
 - **`style` + `look` compose** — every real App Store strip needs BOTH a different device per
-  panel AND captions, so pass them **together**: the `look` supplies the per-panel devices +
+  shot AND captions, so pass them **together**: the `look` supplies the per-device styling +
   background, `style.captions` supplies the words, in one render. (Alone, `style` styles every
   phone identically. If you pass `style.shotLook`/`style.background` *alongside* a `look`, the look
   wins and the result carries a note.) Also composes with `useSavedLook`/`version`.
@@ -93,8 +128,11 @@ variants** instead of one image:
   `fastlane/screenshots/<locale>/` folder per listed locale — `fastlane deliver` uploads every
   locale in a single run. A single-entry list behaves exactly like `locale`; omitting `locales`
   is the unchanged single-locale bundle.
-- `request_screenshot_upload({ count, names, locale })` tags a batch of upload slots with the
-  locale it's for (echoed back — bookkeeping only; refs are locale-agnostic).
+- `request_screenshot_upload({ count, names, family?, locale? })` returns each slot as
+  `{ ref, uploadUrl, name?, variant }`. For `render_project`, pass that `variant` through beside
+  the ref: it is the device-family + locale cell the screenshot overrides, not a bookkeeping tag.
+  Each `name` must exactly match the saved shot's original filename (`frameName`); the filename
+  chooses the shot while `variant` chooses that shot's device-family + locale cell.
 
 **Recommended multi-locale flow — render per locale, then compose once.** Caption text is
 per-render input, so this is also the only way to get per-locale *captions* into one bundle,
@@ -154,25 +192,50 @@ context budget (or get silently truncated by a file-read tool) long before rende
 
 **Upload out-of-band instead:**
 
-In ChatGPT, attach the PNG and call `import_screenshot` once per file. ChatGPT supplies the
-temporary file parameter; ShotOps downloads and stores it server-to-server, then returns
-the same `{ ref }` used by the render tools. In other hosted MCP clients, use the signed-slot
-flow below:
+**`import_screenshot` moves them all in one call.** Each entry of `screenshots` names exactly
+one source, and you get one result per entry, in the order you sent them:
+
+```jsonc
+{ "screenshots": [
+  { "url": "https://example.com/01_home.png", "name": "01_home.png" },  // this server fetches it
+  { "path": "/abs/02_stats.png" },                                       // local stdio server ONLY
+  { "file": { "download_url": "…", "file_id": "…" } }                    // a ChatGPT attachment
+] }
+```
 
-1. Call `request_screenshot_upload({ count: N })` — returns `N` `{ ref, uploadUrl }` slots
+Two sources in one entry is rejected (split them into two entries). A failed entry reports its
+own `error` and never cancels the others — re-import just that one. In ChatGPT the attachment
+arrives as the top-level `file` parameter instead of an array entry, because the Apps SDK cannot
+fill a file parameter nested inside an array; you can pass both in the same call.
+
+`{ url }` and `{ file }` need the hosted server (it stores the fetched PNG under your account);
+`{ path }` needs the local stdio server (the hosted server never reads a caller-supplied
+filesystem path — that would be an LFI hole). Each refusal names the door that IS open on your
+tier. When the screenshots are only on the user's machine and you are on the hosted server, there
+is no URL to give, so use the signed-slot flow below:
+
+1. Call `request_screenshot_upload({ count: N, names?, family?, locale? })` — returns `N`
+   `{ ref, uploadUrl, name?, variant }` slots
    under your own private prefix, plus a copy-paste `curl -T` example.
 2. `curl -T screenshot.png "<uploadUrl>"` each screenshot directly (bytes never touch this
    conversation).
 3. Pass `{ "ref": "<ref>" }` — not inline base64 — as that screenshot's entry in
-   `render_strip`/`emit_bundle`'s `screenshots` array.
+   `render_strip`/`emit_bundle`'s `screenshots` array. For `render_project`, also pass the slot's
+   `name` and `variant`; `name` must exactly match the saved shot's original filename, and legacy
+   entries without a variant remain the base/fallback cell.
 
 `screenshots` entries accept these shapes: an inline base64 string (small payloads only —
-inline is capped and returns a clear "payload too large" error above ~8MB decoded, pointing
+inline is capped and returns a clear "payload too large" error above 3MB decoded, pointing
 you back at this flow), `{ ref }` from step 1, `{ url }` (an https URL this server fetches
 itself: image/png, no redirects, ~20MB cap), `{ path }` (local stdio server only — see below),
 or `{ "locales": { "<locale>": <any of those> } }` for per-locale variants (see
 [Per-locale screenshots](#per-locale-screenshots--multi-locale-bundles) above).
 
+Every raw PNG is automatically palette-optimized before rendering (TinyPNG-style, locally inside
+ShotOps): dimensions and transparency are preserved, and an already-smaller PNG is left byte-for-byte
+unchanged. This happens after the input reaches the MCP, so it does **not** raise the inline request
+cap — use the ref/upload flow for a large source file.
+
 **Output** works the same way in reverse: `render_strip`/`emit_bundle` take an `output` field
 — `"inline"` (base64), `"urls"` (uploaded under your own prefix, short-lived signed download
 URLs), or omit for auto (inline under ~200KB total, `urls` above). Use `"urls"` for
@@ -224,7 +287,7 @@ is entered in the Platform dashboard. Set it on the hosted server as
 `OPENAI_APPS_CHALLENGE_TOKEN`; the server then returns that exact value from
 `/.well-known/openai-apps-challenge`. With no token configured, the route returns 404.
 The server also exposes a synthetic, non-user PNG at
-`/review-fixtures/sample-app-screen.png` so reviewers can reproduce attachment and URL-input
+`/review-fixtures/sample-app-screen-v2.png` so reviewers can reproduce attachment and URL-input
 tests without private fixture data or third-party hosting.
 
 ## Connect Claude Code
@@ -254,23 +317,23 @@ unzip shotops-appstore-upload.zip -d upload && cd upload
 fastlane deliver        # signs in as YOU, previews, uploads screenshots to a draft — never submits
 ```
 
-## Hosted (Fly.io)
+## Hosted
 
 The server also runs hosted, 24/7-reachable (scale-to-zero when idle), at:
 
 ```
-https://shotops-mcp.fly.dev/mcp
+https://shotops.dev/mcp
 ```
 
 Nothing to install — point any MCP client at that URL with your `Authorization: Bearer
 shotops_…` header, same as local dev, just swap the base URL:
 
 ```bash
-claude mcp add --transport http shotops https://shotops-mcp.fly.dev/mcp \
+claude mcp add --transport http shotops https://shotops.dev/mcp \
   --header "Authorization: Bearer shotops_…"
 ```
 
-The public [`/connect`](https://storeframe-studio.vercel.app/connect) page in the studio
+The public [`/connect`](https://shotops.dev/connect) page in the studio
 app has the same instructions for Cursor/CI, plus a link to where to create a token — it's
 the one place an external agent user (not a repo collaborator) can find the connect story,
 since this repo is private.
@@ -288,7 +351,7 @@ since this repo is private.
 - **Verify after any deploy** — a green `flyctl deploy` isn't proof the server answers MCP
   calls:
   ```bash
-  node verify-mcp.mjs https://shotops-mcp.fly.dev/mcp <a-real-shotops_-token>
+  node verify-mcp.mjs https://shotops.dev/mcp <a-real-shotops_-token>
   ```
   Exercises `tools/list`, `read_look`, `emit_bundle` (asserts the zip unzips to
   README/Deliverfile/screenshots), and asserts no-token / bad-token both get `401`.
@@ -299,11 +362,19 @@ since this repo is private.
   server at runtime. Vite is build/parity tooling only and is pruned from production
   dependencies; the Docker build context still includes `mockup-engine` so the harness can
   bundle the shared engine + GLB.
-- **VM size is `shared-cpu-2x` (2 vCPU / 2GB), not `shared-cpu-1x`** (found live, Phase 10):
-  Chromium's software WebGL render (no GPU on Fly's shared tier) is CPU-heavy enough that on
+- **VM size is `shared-cpu-2x` with 4GB — and BOTH numbers are load-bearing for different
+  reasons.** The **memory** was raised 2gb → 4gb on 2026-07-26 (#134): a grouped multi-panel
+  `render_strip` drove `chrome-headless` to ~1.4gb resident, the kernel OOM-killed it, and the
+  server went unhealthy for minutes — `verify-mcp.mjs` could not run to completion at 2gb and now
+  does. The **2 vCPUs** are the older finding below; don't conflate them, and don't cut either.
+- **Why 2 vCPU and not `shared-cpu-1x`** (found live, Phase 10):
+  Chromium's software WebGL render (no GPU on the hosted tier) is CPU-heavy enough that on
   a single shared vCPU it can starve the whole process — health checks stop responding,
-  SIGTERM/SIGINT get ignored, and Fly force-kills the VM ("Virtual machine exited abruptly")
-  mid-render. On 2 vCPUs the same 3-panel real-screenshot render completes in ~8s. Don't
+  SIGTERM/SIGINT get ignored, and the platform force-kills the machine
+  mid-render. **`Virtual machine exited abruptly` has TWO causes and they look identical in the
+  logs:** on 1 vCPU it is this CPU starvation; on 2 vCPU under load it was the #134 OOM, i.e.
+  MEMORY, fixed by the `4gb` above (`docs/reference/ops-runbook.md` carries that half). Check
+  which resource ran out before reaching for either fix. On 2 vCPUs the same 3-panel real-screenshot render completes in ~8s. Don't
   drop back to `shared-cpu-1x` to save cost — a render-triggering tool call is expected to
   occasionally saturate a whole core, and 1x has no second core to keep the process alive
   while that happens. Client callers (agents, `verify-mcp.mjs`) should still set a generous
@@ -314,7 +385,7 @@ since this repo is private.
 ## Local (free tier) — `npx shotops-mcp`
 
 The SAME server also runs as a **local stdio MCP**, entirely on your own machine — no URL, no
-account, no Fly cost, and no render-timeout ceiling (the hosted server's one real limit — see
+account, no hosted cost, and no render-timeout ceiling (the hosted server's one real limit — see
 "Ops" above). It's the same `registerTools`/render engine as the hosted server; only the
 transport and a few account-shaped tools differ.
 
@@ -347,17 +418,23 @@ produce `output: "urls"` refs. After rendering, pass the on-disk PNGs straight t
 { "bundleId": "com.acme.app", "panels": [{ "path": "/abs/panel-01.png" }, { "path": "/abs/panel-02.png" }] }
 ```
 
-**What's different locally, and why:** every tool that needs an ACCOUNT to read or persist to —
-`read_look` / `save_look` / `save_project` / `read_project` / `render_project` / share links —
-has nothing to talk to in local mode by default, so they cleanly no-op with a "sign in" message.
-`render_strip` / `emit_bundle` are otherwise **fully functional** — you lose nothing on rendering
-itself, only on persistence, which is exactly the free/paid line:
+**Saving without a token:** a new `save_project` made from local `{ path }` PNGs creates a private
+**pending claim**. It uploads only that saved project's byte-free record and raw source PNGs,
+returns `status: "pending_claim"` plus `claimId` and `openUrl`, and deliberately returns no
+`projectId` yet. Give the `openUrl` to the user: after one Google sign-in they own the project,
+with its screenshots, and the link expires after 7 days. An existing `project` cannot be updated
+without the token that owns it. Non-path inputs are refused rather than creating a blank claim.
+
+Ordinary `render_strip` / `emit_bundle` calls still upload **nothing** and work fully. Other
+account reads/writes (`read_look`, `save_look`, `read_project`, `render_project`, share links)
+still need a token or hosted connection. A token-backed local `render_project` reads the cloud
+manifest through the Studio control plane, downloads only the resolved cells, and renders locally:
 
-| | Local (free, `npx shotops-mcp`) | Hosted (Fly, `shotops_…` token) |
+| | Local (free, `npx shotops-mcp`) | Hosted (`shotops_…` token) |
 |---|---|---|
-| Render compute | **your machine** ($0, no timeout) | our Fly machine |
+| Render compute | **your machine** ($0, no timeout) | our servers |
 | Auth | none (the process runs as you) | account + API token |
-| Saved looks / editable projects / project read+re-render / share links | opt-in via a token (below) — share links still need a direct hosted connection | ✅ |
+| Saved looks / editable projects / project read+re-render / share links | new project: pending claim; existing/account state: token (below); share links: hosted | ✅ |
 | Screenshot input | local `{ path }` off disk | `request_screenshot_upload` → `{ ref }` |
 
 ### Optional: bridge a local render into your hosted account
@@ -365,8 +442,8 @@ itself, only on persistence, which is exactly the free/paid line:
 Pass a personal ShotOps API token (Studio → account menu → **API tokens** — the same
 `shotops_…` token the hosted server takes as a bearer) and `save_project` / `read_look` /
 `save_look` / `read_project` / `render_project` start working too — **rendering still happens
-locally and for free; only the small saved-project JSON (structure + look, never screenshot
-bytes) goes to your account:**
+locally and for free.** A deliberate save also uploads its local source PNGs privately so the
+project reopens with screenshots on another device; normal renders and exports never upload:
 
 ```bash
 SHOTOPS_TOKEN=shotops_… claude mcp add shotops -- npx -y shotops-mcp
@@ -411,7 +488,7 @@ shotops-mcp/
   vite.harness.config.mjs  the STATIC harness build (local mode's publish prerequisite) → harness-dist/
   build.mjs         esbuild bundle of src/local.ts (+ @engine/@api inlined) → dist/local.js
   Dockerfile        hosted image — Playwright's Chromium base + this repo's 3 npm installs
-  fly.toml          Fly app config (scale-to-zero, /health check) — deploy from repo root
+  fly.toml          Fly app config — ROLLBACK ONLY since the Vercel cutover; see #68
   verify-mcp.mjs    post-deploy smoke test — real MCP round-trip against a hosted URL
   verify-mcp-local.ts  local stdio smoke test (tsx src/local.ts, in-repo)
   static-parity.ts  pixel-diffs the static-serve render against the Vite-dev render (must be 0)