docs(mcp): add 10-agent research on scene-save workflow

10 parallel research agents (R1-R10) investigated whether MCP can save
scenes as saveable entities that the user later opens in the editor —
rather than injecting via a dev-only window.__pascalScene hook.

Key findings:
- Editor is already backend-agnostic via onLoad/onSave callbacks (R2,R7)
- Current persistence is localStorage-only, single key (R1)
- Zero dynamic routes and no backend code yet — env declared (R4,R5)
- File import exists as "Load Build" but lacks Zod validation (R6)
- MCP-written scenes load cleanly into the editor today (R6, Casa del
  Sol test already proved this)
- Best path: filesystem-handoff this week, Supabase in weeks 2-4,
  Supabase Realtime for live mode in Q2. Skip Yjs for now. (R8)
- 4-5 weeks to private beta, 10-14 to GA (R9)
- 10 high-value ideas ranked; "photo -> scene" is the unblocker (R10)

SYNTHESIS.md pulls all 10 reports together with the recommended
implementation plan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/mcp/test-reports/research/R5-backend.md

@@ -0,0 +1,40 @@
+# R5 — Backend / Supabase
+
+## TL;DR
+**Infrastructure declared, ZERO backend code.** `env.mjs` lists Supabase + Postgres + BetterAuth + Resend secrets as REQUIRED, the privacy policy claims scene data is stored in Supabase, `turbo.json` invalidates cache on those secrets — but the repo contains **no Supabase client, no schema, no migrations, no scene CRUD API**.
+
+## Evidence
+
+### Declared infra
+- `apps/editor/env.mjs:18–19` — `POSTGRES_URL`, `SUPABASE_SERVICE_ROLE_KEY` (server-only, `.min(1)`)
+- `env.mjs:12–14` — `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `GOOGLE_CLIENT_*`
+- `env.mjs:27–31` — `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`
+- `turbo.json:9–20` — same vars listed as build-cache keys
+- `apps/editor/app/privacy/page.tsx:95–97` — "Your data is stored using Supabase (PostgreSQL database)"
+- `.gitignore:22–24` — references `supabase/.branches/`, `supabase/.temp/` dirs (not present)
+
+### What's absent
+- Zero `createClient(` / `import.*supabase` matches across `apps/editor/**` and `packages/**`
+- Zero `.sql` schema files
+- Zero `drizzle/` / `prisma/` / `migrations/` directories
+- Zero server actions (`'use server'` grep returns nothing)
+- Zero API routes other than `/api/health` (returns `{ status: 'ok' }`)
+
+## API surface today
+| Route | Method | Purpose | Auth |
+|---|---|---|---|
+| `/api/health` | GET | Liveness | none |
+
+## Required to enable MCP → cloud scene
+1. Provision a Supabase project (or alternative Postgres).
+2. Schema: `projects`, `scenes` (id, project_id, name, data jsonb, version, thumbnail_url, created_at, updated_at, owner_id), `scene_versions` (for history).
+3. Supabase client singletons:
+   - `apps/editor/lib/supabase-browser.ts` (uses `ANON_KEY`)
+   - `apps/editor/lib/supabase-server.ts` (uses `SERVICE_ROLE_KEY` in server components / API routes)
+4. Auth via BetterAuth + Google OAuth (env is there, unused).
+5. API routes: `POST/GET/PUT/DELETE /api/projects/[id]/scenes/[sceneId]`.
+6. RLS policies: scene rows readable only by owner + collaborators.
+7. `SceneBridge` in MCP gets optional `persistenceAdapter: SupabaseAdapter` — replaces the in-memory store with a writeback to Supabase.
+
+## Verdict
+Groundwork is in place (env vars, privacy policy, turbo cache keys) but **every line of actual backend code is missing**. This is a greenfield opportunity: the team clearly planned for Supabase but hasn't implemented it yet.