Address persona review: link data-handling, add event example

- Link the data-sensitivity section to Security and the DPA for
  encryption, retention, and processing rather than restating them.
- Clarify that browser-activity categories produce far more events than
  operational ones, and that captured events are replayable via stream
  resume (not a separate query API).
- Add a sample event envelope and document the 1 MB truncation behavior on
  the streaming page so pipeline builders know what to expect.
- Reword "three shapes" to "three ways to configure it".

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Sayan-

browsers/telemetry/categories.mdx

@@ -9,7 +9,7 @@ For the full payload schema of any event type, see the [Stream telemetry events]
 
 ## Browser activity
 
-These categories report what's happening in the page. Capturing any of them attaches a Chrome DevTools Protocol (CDP) collector to the session, so enable only the ones you need. None are in the default set.
+These categories report what's happening in the page. Capturing any of them attaches a Chrome DevTools Protocol (CDP) collector to the session and produces far more events than the operational categories, so enable only the ones you need. None are in the default set.
 
 | Category | Captures | Event types |
 | --- | --- | --- |
@@ -51,7 +51,7 @@ Telemetry is off by default, and the [default set](#operational) carries operati
 | `screenshot` | A full rendered image of the page - the broadest exposure, capturing anything visible on screen. |
 | `control`, `connection`, `system`, `captcha`, `monitor` | Session metadata only (control calls, connection and health events). No page content. |
 
-Captured events are stored and retrievable through the API, so this sensitivity applies to the data at rest, not just the live stream. Treat captured telemetry - and anywhere you forward or store it - with the same care as the underlying content.
+Captured events are persisted and can be replayed by [resuming the stream](/browsers/telemetry/streaming#resuming-after-a-disconnect), so this sensitivity applies to the data at rest, not just the live stream. Treat captured telemetry - and anywhere you forward or store it - with the same care as the underlying content. For how Kernel encrypts, retains, and processes data overall, see [Security](/security) and the [Data Processing Addendum](/dpa).
 
 Some exposure is reduced for you automatically: input into sensitive fields such as passwords is suppressed (`interaction_key` isn't emitted for them, and `interaction_click` omits the element text). Beyond that, because selection is opt-in, the most effective control is to capture only the categories you need - enable `network`, `console`, `page`, `interaction`, or `screenshot` deliberately, and prefer the operational categories when you only need session health.
 

browsers/telemetry/overview.mdx

@@ -13,7 +13,7 @@ Selection is **opt-in**. A session captures a category only if you explicitly tu
 
 ## Enabling telemetry
 
-You configure telemetry when you [create a browser](/introduction/create) (and can change it later on update). There are exactly three shapes.
+You configure telemetry when you [create a browser](/introduction/create) (and can change it later on update). There are three ways to configure it.
 
 ### Enable the default set
 

browsers/telemetry/streaming.mdx

@@ -3,7 +3,21 @@ title: "Stream Telemetry"
 description: "Consume a session's live telemetry stream from the SDK, CLI, or raw SSE"
 ---
 
-Once a session has telemetry [enabled](/browsers/telemetry/overview), you can stream its events in real time. The stream stays open until the session terminates, and each event is wrapped in an envelope with a monotonic `seq` number you can use to reconnect without gaps.
+Once a session has telemetry [enabled](/browsers/telemetry/overview), you can stream its events in real time. The stream stays open until the session terminates, and each event is wrapped in an envelope with a monotonic `seq` number you can use to reconnect without gaps:
+
+```json
+{
+  "seq": 42,
+  "event": {
+    "ts": 1746123456789000,
+    "type": "network_response",
+    "category": "network",
+    "data": { "method": "GET", "url": "https://example.com/api", "status": 200 }
+  }
+}
+```
+
+The `data` payload differs per event type; see the [API reference](https://kernel.sh/docs/api-reference/browser-telemetry/stream-telemetry-events-via-sse) for each type's schema. An event whose payload exceeds 1 MB is dropped and the envelope is flagged `truncated: true`.
 
 ## Via SDK