docs: update handoff with MCP fixes and favicon suppressor

docs/HANDOFF-agent-setup.md

@@ -153,6 +153,28 @@ hits).
 **To verify:** Open browser console after deploy — zero CORS errors from
 `og-image-3.png`.
 
+### 13. MCP Server Fixes
+
+**Code changes in `src/index.ts`:**
+
+1. **Auto-title junk removed** (`create_element` handler) — no longer auto-injects "Title"/"Text here" on containers when `text` is provided. Card layout still works via explicit `title`+`subtitle` params.
+
+2. **X-Tenant-Id header scoped to local** — `canvasHeaders()` sends `X-Tenant-Id` only when `EXPRESS_SERVER_URL` is unset (local canvas). Remote canvases use default tenant routing.
+
+3. **Skip local canvas server** — `startCanvasServer()` is skipped entirely when `EXPRESS_SERVER_URL` points to a remote host. Prevents port conflicts.
+
+4. **MCP process stability** — `stdin.on('close')` handler uses `setTimeout(shutdown, 1000)` instead of immediate `process.exit(0)`. Prevents crash on transient disconnects during CodeWhale init.
+
+**MCP config (`~/.codewhale/mcp.json`):**
+- Server registered as `excalidraw` with stdio transport
+- Points to `https://excalidraw.forkless.com` (production)
+- Uses `/tmp/excalidraw-mcp.db` for local DB (separate from production)
+
+**Known issue:** Auto-title junk still appears when production canvas runs old Docker image. The fix is in `main` but the container must be redeployed. Until then, delete stray `_title`/`_subtitle` elements via API.
+
+### 14. Favicon Suppressor
+`frontend/index.html` — added `<link rel="icon" href="data:,">` to prevent 404 on `/favicon.ico`. Combined with the fetch interceptor (section 12), the console is now clean of network errors.
+
 ---
 
 ## What Still Needs Work
@@ -168,6 +190,15 @@ key, the connection drops. Consider:
 Only `:latest` and `:$sha` are pushed. Version tags (`v*`) trigger is in
 the workflow but untested.
 
+### 3. Production Container Needs Redeploy
+The auto-title fix (section 13) is committed and the Docker image is built,
+but the running container at `excalidraw.forkless.com` still runs the old
+image. Until redeployed, elements created via REST API batch will have
+stray `_title`/`_subtitle` junk elements. Delete them via:
+```bash
+curl -s https://excalidraw.forkless.com/api/elements | python3 -c "import sys,json;d=json.load(sys.stdin);[print(e['id']) for e in d['elements'] if e.get('text') in ('Title','Text here')]" | xargs -I{} curl -s -X DELETE "https://excalidraw.forkless.com/api/elements/{}"
+```
+
 ---
 
 ## Credentials & Access