Session replay for loopover-ui — sampled, masked, exception-linked

[JSONbored]

Part of epic #8286 (Phase 3 — Depth).

• Blocked by the web-analytics sub-issue (PostHog web analytics behind the first-party /stats proxy (Umami replacement, parallel-run) #8293) — replay rides the shared posthog-js init + first-party proxy it establishes.

Scope

Session replay for loopover-ui, mirroring JSONbored/metagraphed#7787's shipped shape:

• Sampled (start conservative; sampling rate documented), with a billing limit set before enabling.
• Privacy-tuned masking: all inputs masked by default; the operator UI renders repo names, config contents, review text, and tokens-adjacent settings panels — audit the panels and mask/block the sensitive containers explicitly (metagraphed masked specific manager components in the same pass; loopover's equivalents include the settings/config panels and anything rendering .loopover.yml contents).
• Exception-linked: replays attached to captured $exception events so an error links to its session.
• Only active where posthog-js is already active (same gate; no replay for unconfigured builds).
• Canvas/iframe/network payload capture stays off unless a real need is documented.

Boundaries

• No replay on self-host operator deployments by default — this is for the loopover-operated UI deploy; the opt-in posture question for self-hosters is documented, defaulting to off.

Resources

• https://posthog.com/docs/session-replay/privacy
• feat(ui): add PostHog session replay with masking and sampling metagraphed#7787

[linear-code]

JSO-5740

[JSONbored]

Gardening pass note (Pass 3, strategic epic health check): this issue's blocker, #8293 (PostHog web analytics, parallel-run), closed 2026-07-31 — no follow-up recorded on this issue since. Session replay work is now unblocked. Part of epic #8286 (PostHog consolidation); stays maintainer-only.