@geoly-ai/social-hub-cli 0.3.18 → 0.3.20

package/skills/reddit-strategy-shared/references/context-contract.md

@@ -12,7 +12,8 @@ Full-flow strategy work must collect or confirm:
 - Deliverable type and volume
 - Delivery target: Feishu folder/doc link, local Markdown only, or both
 - Whether strict A/B testing is required
-- If A/B is required: single test variable, A/B group symmetry, and whether external comments are excluded from the main A/B sample
+- If A/B is required: single test variable, A/B group symmetry, and whether external comments are excluded from the main A/B sample (**default: excluded** — external comments are supplementary observation only; readout rule in `reddit-phase-planning/references/phase4-planning.md` Phase 4.0.5)
+- Contract pricing unit: whether the contract is priced in 「量」(a unit that bundles posts and self-comments, e.g. 1 post + 3 self-comments = 1 unit — posts and comments are not the same cost unit and are never simply summed) or in direct post/comment counts; plus the total allowance and the confirmation source (Phase 4.0.0.0 blocks the quantity plan until this is confirmed; never assume an example ratio)
 - Whether competitor mentions are allowed
 - Review mode when content is generated: ContentOnly if the final publishing account is not selected; AccountBound only after the real account and approved brand context are known
 - Brief approval mode: client review first, internal confirmation only, or unknown
@@ -24,19 +25,40 @@ Full-flow strategy work must collect or confirm:
 
 ## Startup Prerequisites
 
-For full-flow projects, read the shared contracts first, then read these restored prerequisite files before Phase 0:
-
-- `reddit-strategy-prerequisites-read.md`
-- `reddit-strategy-reuse-playbook.md`
-- `reddit-sop-v2-universal.md`
-- `reddit-master-canvas-agent-prompt-template.md`
-
-These files are required background references for full-flow projects, not the source of current conflict resolution. If they conflict with `evidence-policy.md`, `safety-rules.md`, `handoff-schemas.md`, or this context contract, the shared matrix contracts win.
+For full-flow projects, read the shared contracts (`routing.md`, `evidence-policy.md`,
+`context-contract.md`, `handoff-schemas.md`, `safety-rules.md`) — **and nothing else** before Phase 0.
+
+**Phase-scoped contracts (read on entering the phase that consumes them, not at startup):**
+
+| Contract | Read before | Owner / consumers |
+|---|---|---|
+| `references/content-type-routing-contract.md` | Phase 4 Brief structure routing | brief / writing / rewrite / delivery |
+| `references/content-diversity-contract.md` | Phase 4 Brief baseline + fingerprint | brief / writing / rewrite / delivery |
+| `references/subreddit-research-profile.md` (SRP) | Phase 0.5 step 0.5.5, and any compliance / brief / planning step that consumes subreddit-level conclusions | research produces; compliance / planning / brief consume |
+| `reddit-phase-planning/references/scheduling-decision-procedure.md` (D1–D7) | Phase 4.0.0.4 board quantity planning | planning owns; brief reads `memory/phase4-排期决策台账.md`, not the procedure |
+
+Keeping these out of the startup read is deliberate: the startup budget is the five
+shared contracts above. Loading a phase contract early is not a gate failure, but
+skipping it when its phase starts is.
+
+> **⛔ 那四份 prerequisite 文件已归档，agent 不得读取。**
+> `reddit-strategy-prerequisites-read.md` / `reddit-strategy-reuse-playbook.md` /
+> `reddit-sop-v2-universal.md` / `reddit-master-canvas-agent-prompt-template.md` 已移入
+> `references/prerequisites/archive/`（`AgentReadPolicy: DoNotRead`）。
+>
+> **为什么**：这四份共 1,994 行，占全流程强制阅读量的 80%，而它们自己声明
+> `LegacyStatus: Superseded`、"Do not execute any gate, schema, or structure rule found in them"
+> —— 同时其中的规则又与 active 文件里的硬规则**逐条重复**。一份"声明不作数、内容却一致"的
+> 文本进入上下文，模型无从区分哪句该执行，只会稀释真正的门禁。
+>
+> 需要人工查阅历史背景时见 `references/prerequisites/README.md`（该 README 可读、非必读，
+> 只做转发与真空登记）。**active 文档不得再要求 agent 读取 archive 内容，引用即 gate failure。**
 
 **v2.12.25 legacy scope (binding).** `reddit-strategy-reuse-playbook.md` and
 `reddit-sop-v2-universal.md` are marked `LegacyStatus: Superseded` /
-`UseAsWritingGate: No` / `UseAsPlanningGate: No`. Read them for background only.
-Never take from them: post structure, opening-sentence form, title formulas,
+`UseAsWritingGate: No` / `UseAsPlanningGate: No`, and they are now under
+`prerequisites/archive/` with `AgentReadPolicy: DoNotRead` — **agents do not read
+them at all** (human historical reference only). Never take from them: post structure, opening-sentence form, title formulas,
 per-paragraph format checklists, or the execution-table schema. Their
 four-paragraph body structure, title-formula section, format-prohibition
 checklist, and 14-field table were **deleted** in v2.12.25. The replacements are:
@@ -61,6 +83,7 @@ Use `memory/` as the working truth store:
 - `phase2-缺口分析.md`
 - `phase3-master-canvas摘要.md`
 - `phase4-board-quantity-plan.md`
+- `phase4-排期决策台账.md`
 - `phase4-sku-基准表.md`
 - `phase4-执行表.md`
 - `phase4-external-post-audit.md`
@@ -88,6 +111,17 @@ Use `memory/` as the working truth store:
 - Phase 2 must write `phase2-缺口分析.md`.
 - Phase 3 must write `phase3-master-canvas摘要.md` and confirm all 21 Master Canvas boards.
 - Phase 4.0.0 must write `phase4-board-quantity-plan.md` and `phase4-sku-基准表.md`.
+- Phase 4.0.0.4 must run the D1–D7 scheduling decision procedure
+  (`reddit-phase-planning/references/scheduling-decision-procedure.md`) and write
+  `phase4-排期决策台账.md`: one row per planned post keyed by execution-table `Key`, all 9 fields
+  present, including `ProposedFlair` (the execution table has no flair column). Owner:
+  `reddit-phase-planning`. `reddit-phase-brief` reads it to verify and lock `AssignedFlair`;
+  a missing ledger or `ProposedFlair` is a `BlockingGap` back to planning, not a licence for the
+  Brief to pick its own flair.
+- Phase 0.5 step 0.5.5 must produce one `SubredditResearchProfile`
+  (`references/subreddit-research-profile.md`) per passing subreddit alongside
+  `phase0.5-board-analysis.md`; boards with no SRP are declared `SRPMode: Fallback` downstream,
+  which is **not** the same as `confidence: Insufficient`.
 - Phase 4.0 must write `phase4-执行表.md`; if external comment URLs exist, EPA results must be recorded in `phase4-external-post-audit.md` or as an `外部核验` control column.
 - Phase 4.0.6 must write `phase4-SKU品牌词映射.md` and `phase4-撰写批次map.md`.
 - Phase 4 Brief must write `phase4-内容排期表.md` and `phase4-撰写brief.md`; writing cannot start until the required Brief approval phrase is present.

package/skills/reddit-strategy-shared/references/evidence-policy.md

@@ -70,3 +70,142 @@ Use this file to resolve conflicts between Reddit strategy sources. If older pla
 - The next phase may start only when the response shows `readyForNextSkill=true` and `blockingIssues=[]`. Missing fields / blocking issues must be resolved. If the user explicitly accepts a partial handoff, the waiver MUST be written back to Hub (re-run `handoff-create` with the waiver recorded in the payload, e.g. `weeklyReportWaiver` or an explicit `partialAcceptedBy` field) so the new handoff itself becomes ready — local bypass without a Hub-persisted waiver is NOT allowed.
 - Standalone single-skill runs are encouraged but not required to persist handoffs.
 - Local `memory/*.md` files remain the working copy for one release cycle (dual-write); each memory file SHOULD record the associated Hub `runId`(s) and handoff id for traceability. Do not delete local memory in this release.
+
+---
+
+# 证据门（Gates）
+
+本节把上面的来源分层与冲突消解落成**可检查的门禁**。门禁编号是稳定标识，下游 skill 引用时用编号
+（如 `G3`），不要复述规则正文——复述会分叉。
+
+## G3 · URL 存活状态三字段
+
+**规则.** 任何产出中出现的 Reddit URL，只要它**被当作证据**（支撑某个结论、被列为对标帖、被引用为
+样本或先例），就必须**可追溯到一次真实采集记录**，并带齐存活状态三字段
+（**观测时刻 + 核验时刻 + 当前状态**）：
+
+```yaml
+ObservedAt:           # 三字段之一（必填）：这条 URL 被真实采集到的时刻
+ArchivedObservedAt:   # ObservedAt 在归档来源（如 Arctic）上的具体形态；
+                      # live-only 来源填 null 并注明，不得为了凑字段编一个归档时刻
+LastVerifiedAt:       # 三字段之二（必填）：最近一次状态核验时刻
+CurrentStatus:        # 三字段之三（必填）：Live | Removed | Deleted | Unknown
+EvidenceRef:          # 指回采集记录（run / evidence / sample）——「可追溯」的落点
+```
+
+**适用面（避免过宽）：**
+
+| URL 类型 | 是否受 G3 约束 |
+|---|---|
+| **证据 URL**（支撑结论、对标帖、样本、先例） | **受约束**，三字段齐全 |
+| **导航/参考 URL**（板块首页、规则页链接等纯导航，不作为结论依据） | 不受约束 |
+| **历史研究样本** | 受约束，但**允许 `CurrentStatus: Removed`**（历史存在过是有效事实） |
+| **当期排期用 URL**（排期对标帖、要去回复的外部评论） | 受约束，且必须 `CurrentStatus: Live` |
+
+**`Live` 的定义不等于「每次都直连 Reddit」。** Hub-First 允许新鲜缓存直接消费、零 Reddit 请求
+（`reddit-voc-volume/references/hub-first.md` L1）。因此：
+
+> `CurrentStatus: Live` = **Hub 当前状态记录仍在 freshness window 内**，或经过一次明确的 live probe。
+
+没有新鲜状态记录时 → `Unknown` → **hold**，不得把 stale 或 `failed` 当成 `Live`。这条与 Hub-First
+的缓存优先原则不冲突：G3 要求的是「有新鲜的状态事实」，不是「必须重新请求」。
+
+**数量不足时诚实少给，禁止补齐。** 需要 10 条对标帖只核到 6 条 → 给 6 条 + 记缺口，
+**不得**用未核验、编造、或从别处凑来的 URL 补到 10。
+
+**与既有枚举的映射（G3 是消费口径，不是新建的存储枚举）：**
+
+| 既有来源 | 既有取值 | 映射到 `CurrentStatus` |
+|---|---|---|
+| 帖子/评论存活观测（`packages/contracts/src/reddit-post-survival.ts`） | `alive` / `dead` / `unknown` / `unsupported` | `Live` / `Removed`\|`Deleted`（按来源给出的删除类型）/ `Unknown` / `Unknown` |
+
+**`subreddit_evidence` 的 `available` / `not_visible` / `failed` 不参与本映射。** 那是**板块证据
+页面/项目**的可见性，与某条帖子 URL 的存活是两个正交的轴：rules 页不可见推不出任何帖子被移除。
+把 `not_visible` 映射成 `CurrentStatus: Removed` 是类型错误，禁止。
+
+来源未区分「版主移除」与「作者自删」时，**不得猜**——填 `Removed` 或 `Deleted` 之一都是编造，
+应填 `Unknown` 并在 note 说明。**「作者账号已注销」是正交属性**，不等于帖子被删，不得映射成
+`Deleted`。存活状态出现 `dead → alive` 这类冲突时按既有约定交人工，G3 不静默翻转。
+
+**保留既有语义：** `failed` ≠「不存在」；只有页面明确显示不存在（`not_visible`）才是负证据。
+采集时点的 `_removed` 标记只反映采集时点，不等于当前状态——当前状态看 `LastVerifiedAt` +
+`CurrentStatus`。
+
+**失败后果.** 缺字段或 `CurrentStatus: Unknown` 的证据 URL → 从该结论的证据集中剔除；
+若剔除后结论失去支撑 → `BlockingGap`。
+
+## G5 · 来源职责矩阵
+
+上面的 Source Layers 表已经写清了**每层是什么**；G5 补的是**每层能支撑什么结论、不能支撑什么**。
+来源类型 × 结论类型是一个合法矩阵，越界即证据不成立——**不是「弱证据」，是「无证据」**。
+
+| 来源 | 可支撑 | **不可支撑** |
+|---|---|---|
+| `eclickkb` / 品牌 KB | SKU、规格、价格、产品事实 | subreddit 帖型可行性、板块风格、合规裁决、禁用话术清单 |
+| 客户约束材料（info sheet / 合同 / 书面确认） | 禁用话术、优先 SKU、竞品提及许可、目标市场、交付量 | 产品规格真值、版规、板块分布 |
+| KG markdown（`kg-reddit-check`） | positioning、场景、叙事方向 | 产品规格、版规、板块分布 |
+| Hub **帖子样本**（hot-posts / 历史帖 / 全窗口采样） | SRP 的帖子分布、内容类型、互动样本、标题风格 | 版规结论、发布放行（**样本 ≠ 规则证据**；规则证据见下一行，它是有效的**原始**规则来源） |
+| Hub `rules`/`wiki`/`about`/`submit_text`/`pinned`/`flair` 原始证据 | compliance 的**输入** | 直接宣布「允许 / 禁止」（那是 compliance 的裁决） |
+| `reddit-subreddit-compliance` 输出 | 板块 eligibility、risk、账号门槛 | 产品事实、价格、规格 |
+| SRP（`references/subreddit-research-profile.md`，`Verified` 也只是必要输入） | 板块整体分布、进入方式的证据、风险信号 | 发布放行、单 flair 写作规格 |
+| baseline 卡 | 单 flair 写作基线与风格门 | 独立发布放行、板块总体占比 |
+| 帖子级分类（`content_classification_runs`） | 帖子级内容类型事实、SRP `contentTypes` 的原料 | 版规结论、发布放行 |
+| 人工标注（`subreddit_post_annotations`） | 帖子对板块/品牌的 1–5 分**人工评价** | content type taxonomy、写作基线、发布放行 |
+| approved `subreddit_style_profiles` | 审核门 soft enrich（tone/taboo） | SRP 总体统计、合规裁决 |
+
+**典型越界（必须拦）：** 据品牌语料库/KB 宣布「所有帖子内容类型和板块安排均与语料库无冲突」。
+品牌 KB 里没有 subreddit 版规，也没有板块分布——它**结构上**无法支撑这个结论。正确路径是
+compliance（裁决）+ SRP（分布证据）。
+
+**检查点命名.** 引用时用 `G5-<来源>×<结论>` 越界的形式描述，不要引用尚不存在的 validator 脚本；
+runtime 校验属于后续变更。
+
+## G6 · fail-closed 的适用面与例外
+
+**核心区分：证据要求 ≠ 采集通道。** 采集通道可以降级，证据要求不可以。混淆这两者就是那类
+「eclickkb 超时了，先用能拿到的 SKU 文档继续」——恢复后发现价格与时效冲突、已进排期的卖点全线返工。
+
+### 两段式判定
+
+**第一段：结论属于哪类？**
+
+| 结论类型 | 处理 |
+|---|---|
+| 合规结论（能不能发、发什么受限） | **fail-closed** |
+| URL 真实性 / 存活状态 | **fail-closed**（见 G3） |
+| 数字、规格、价格、时效 | **fail-closed** |
+| 品牌位置依据（`BrandEntryMode` 等结构决策的依据） | **fail-closed** |
+
+fail-closed 的含义是：证据拿不到就**拦截**，输出 `Unknown` / `BlockingGap` / `Hold`。
+**不得「先用能拿到的继续」**，不得用相邻来源顶替（那会同时违反 G5）。
+
+**表里没列的结论不是「随便放行」，也不是「一律拦截」。** 普通定性研究结论（板块氛围、讨论方向、
+风格观察等）按证据强度**降级表述**即可：标 `claimScope: SampleOnly` 或整体 `Provisional`，
+说明样本口径，不进入 fail-closed 拦截；但它们同样不得升格去支撑上表四类结论。
+
+**第二段：采集通道怎么走？**
+
+采集通道**允许受控降级，不拦截**：Hub cache（L1）→ Hub 派发（L2）→ Emergency Acquisition（L3）
+→ 回灌（L4），见 `reddit-voc-volume/references/hub-first.md`；429 走 Emergency Acquisition + 回灌。降级必须标
+`provenance` 与 `fallbackReason`。
+
+**通道全部失败时回到第一段**：证据缺失 → 按结论类型 fail-closed，输出 `Unknown` / `BlockingGap` /
+`Hold`。通道降级用尽**不构成**放行理由。
+
+**超时不是失败，也不是「无数据 / 无规则」。** 超时是**中间态**：输出 pending，并按 Hub-First 继续
+往下一级通道走（L2 超时后仍可进 L3 Emergency Acquisition）。**在 fallback 走完之前不得下结论**，
+也不得把 pending 当成「查过了、没有」。
+
+**G3/G5/G6 的 `Unknown` / `BlockingGap` / `Hold` 是流程与证据状态，不是 claim 状态。**
+进入可发布文本的实质性 claim 仍然一律走本文件上半部分的 `ClaimEvidenceStatus`
+三态（`Cited` / `ExternallyVerified` / `Inferred`）——门禁状态不替代、也不放宽那三态。
+
+### 有意 fail-open：不得改
+
+已批准的板块画像用于**审核门 soft enrich** 时，现有实现**有意 fail-open**（画像查询/渲染异常时审核
+继续，软维度由服务端剔除；见 `packages/review-engine/src/context/review-context-provider.ts`
+`loadSubredditStyleProfile` 的注释）。**保持不动。**
+
+该 fail-open 的适用面**仅限 style-profile soft enrich**，**不适用于** SRP、compliance、URL 真实性、
+产品事实证据——那些一律按第一段 fail-closed。persona / brand enrich 同样仍是 fail-closed
+（它们影响 block 语义）。

package/skills/reddit-strategy-shared/references/handoff-schemas.md

@@ -20,6 +20,15 @@ Required:
 - `GeolyTopicId`
 - `Phase16Status`
 - `EvidenceGaps`
+- `SubredditResearchProfiles` — every SRP that could be produced, one per passing subreddit;
+  a subreddit without one is listed explicitly with its reason, never silently omitted (contract:
+  `references/subreddit-research-profile.md`; produced by `reddit-phase-research` step 0.5.5 per S1–S9,
+  handed over with `memory/phase0.5-board-analysis.md`). Each profile must name its
+  `Confidence` and `AllowedUses` in `RequiredFieldsProvided` (SRP §12).
+  `Confidence: Insufficient` is a `BlockingGap` / `ReadyForNextPhase: No` — never a "use it for now".
+  A board with **no** SRP is not an error by itself; it is declared downstream as `SRPMode: Fallback`
+  (see `reddit-phase-planning/references/scheduling-decision-procedure.md` §0.1) — do not confuse it
+  with `Insufficient`.
 
 ## Compliance Output
 
@@ -37,15 +46,60 @@ Required:
 - `NeedsVerificationCandidates`
 - `NotRecommended`
 - `MissingEvidence`
+- `EvidenceGatheredAt`
+- `EvidenceValidUntil`
 
 `AboutPageEvidenceStatus=NeedsAcquisition` is required when `reddit-voc-volume about-page` reports `about_page_empty_rendered_content`; downstream skills must not treat that as `NotVisible`.
 
+**Compliance evidence is a point-in-time snapshot, and this handoff carries the
+time it was taken — not a standing clearance.** A batch is scheduled and
+delivered after this report is written, and rules and pinned posts change in
+between, so the report must say how old it is.
+
+- `EvidenceGatheredAt` / `EvidenceValidUntil` are **batch-level worst-case
+  scalars**, defined precisely so a single pair is checkable: `EvidenceGatheredAt`
+  is the **earliest** gathering time among the delivery-required evidence items,
+  and `EvidenceValidUntil` is the **earliest** validity horizon among them. The
+  delivery-required items are `RulesEvidenceStatus` / `PinnedEvidenceStatus` /
+  `BotBannerEvidenceStatus` / `InstalledAppsStatus` / `AboutPageEvidenceStatus`.
+  Per-item timestamps may also be recorded, and must be when the items differ
+  enough that one worst-case pair would hide a stale item.
+- **`Unknown` is not fresh.** If any delivery-required item has an unknown
+  gathering time or no declared horizon, the batch cannot be cleared on these
+  scalars: it is re-gathered and re-judged before delivery proceeds.
+- **Expired evidence is re-gathered and re-judged; it is never carried forward.**
+  A stale rules snapshot is `NeedsAcquisition`, and the affected rows hold. Soft
+  style judgements may degrade gracefully when a source is missing; a compliance
+  judgement may not — "we could not check" is not "it is allowed".
+- `reddit-delivery-check` re-checks freshness **at delivery** against this
+  handoff. A single check at compliance time does not satisfy the gate.
+
+**A timestamp only re-opens a question; it never answers one.** Freshness applies
+to *gathered evidence*. It does not apply to a permission that was never
+adjudicated in the first place: where brand/vendor participation or a disclosure
+requirement has no recorded human decision, it stays in `MissingEvidence` and the
+rows hold, and no expiry or refresh converts that into a clearance.
+
+**Two Gate 0 questions have no modelled answer and must not be presented as
+decided:** whether the board permits brand or vendor participation at all, and
+whether a disclosure is required. Neither is derivable from a style profile's
+brand-friendliness note (that is a cultural description) nor from raw collected
+evidence (that is unadjudicated material). Where a batch depends on either, the
+answer belongs in `MissingEvidence`, the affected rows carry the corresponding
+`PostRisk` / `CommentRisk`, and clearance is a human decision recorded by the
+user. Do not add a field that makes an unadjudicated question look answered.
+
 ## Planning To Brief
 
 Required:
 
 - `memory/phase4-sku-基准表.md`
-- `memory/phase4-board-quantity-plan.md`
+- `memory/phase4-board-quantity-plan.md` with the declared `SRPMode` per board and the user-locked
+  `LockedPlanID` / `LockedBy` / `LockedAt` (D6)
+- `memory/phase4-排期决策台账.md` — the per-post scheduling decision ledger from the D1–D7 procedure
+  (`reddit-phase-planning/references/scheduling-decision-procedure.md`), keyed by execution-table `Key`,
+  with all 9 fields present. It is the **only** landing place for `ProposedFlair` (the execution table
+  has no flair column); `reddit-phase-brief` reads it to verify and lock `AssignedFlair`
 - `memory/phase4-执行表.md`
 - `memory/phase4-external-post-audit.md` when external comment URLs exist, or an execution-table EPA status summary
 - `memory/phase4-SKU品牌词映射.md`
@@ -70,7 +124,13 @@ Required:
 - `memory/phase4-brand-risk-review.md` for any batch with brand-word rows, PGC rows, comparison/review language, external links, product claims, prior negative signals, or subreddit sensitivity; otherwise an explicit low-risk waiver from `reddit-brand-risk-response`
 - `memory/phase4-叙事指纹索引.md` exists as a fixed table with the schema header (`WindowCount`, `WindowDays`, `WindowScope`, `WindowSort`, `BaselineMaxAgeDays`, `HashSchemaVersion`, `IndexRevision`), and has exactly one active `Planned` row for every briefed post Key
 - a valid `SampleSetID` (flair-level subreddit baseline, 5–10 recent real posts, word-count median + IQR, with `AcquiredAt` / `ValidUntil`) for every target subreddit in the batch, recording flair coverage (`BaselineScope` / `BaselineFlair` / `FlairCoverageStatus`); missing or expired baseline, or `FlairCoverageStatus: Insufficient`, is a `BlockingGap`
-- every post Brief row carries the nine `LockedFingerprintFields` (`ContentFunction`, `StructureFamily`, `OpeningMove`, `EvidenceShape`, `BrandEntryMode`, `CaveatMode`, `EndingMode`, `LengthBand`, `AnchorSlot`), the two `PrewritingControlFields` (`AssignedFlair` non-empty; `PostingTrigger` from the controlled five values satisfying the `PostingTrigger × BrandEntryMode` cross-constraint), and the four `TraceFields` (`SampleSetID`, `RecentCollisionCheck`, `MappingRuleID`, `MappingVersion`)
+- every main-post Brief row's `AssignedFlair` was **verified against the ledger's `ProposedFlair`**, not re-chosen: `FlairVerificationStatus` is `Verified` or `FallbackAssigned` (the latter only for `ProposedFlair: Unknown(NoSRP)`); `Rejected` is a `BlockingGap` back to `reddit-phase-planning` D2
+- every post Brief row carries the nine `LockedFingerprintFields` (`ContentFunction`, `StructureFamily`, `OpeningMove`, `EvidenceShape`, `BrandEntryMode`, `CaveatMode`, `EndingMode`, `LengthBand`, `AnchorSlot`), the three `PrewritingControlFields` (`AssignedFlair` non-empty; `PostingTrigger` from the controlled five values satisfying the `PostingTrigger × BrandEntryMode` cross-constraint; `PersonaCardRef` non-empty with its `PersonaCardVersion` / `PersonaCardHash`), and the four `TraceFields` (`SampleSetID`, `RecentCollisionCheck`, `MappingRuleID`, `MappingVersion`)
+- `PersonaCardRef` is required for **main-post rows only** (contract:
+  `references/persona-card-contract.md`). Self-comments, external comments, and
+  titles carry `N/A`. The Card is authored by `reddit-phase-brief`; a row whose
+  Card is missing is a `BlockingGap` back to Brief, never a Card the writer
+  supplies
 - every post Brief row carries a `Routing Decision` block with the five candidate-narrowing steps, `MatchedPredicate`, `SelectedStructureFamily`, and `CollisionRepairPath`
 - `RecentCollisionCheck` is `Pass` (or `Exception` with an approved `ExceptionRef`) for every row
 - `brief_approval_mode`
@@ -120,6 +180,9 @@ MappingRuleID:                # when a client prototype applies
 StructureFamily:
 AssignedFlair:                # PrewritingControlField; non-empty; NoFlairAvailable/NoFlairRequired for flairless boards
 PostingTrigger:               # PrewritingControlField; controlled 5 values; not in the collision triple
+PersonaCardRef:               # PrewritingControlField; Brief-assigned, post-only
+PersonaCardVersion:           # integer; a change invalidates prior boundary checks
+PersonaCardHash:              # sha256 of the assigned Card; rewrite preserves, never edits
 OpeningMove:
 EvidenceShape:
 BrandEntryMode:
@@ -137,6 +200,7 @@ DraftHash:                    # PENDING until the post-review recompute
 
 **Not required for `Comment` / `Reply` / `Title`:** `PrimaryPostType`,
 `StructureFamily`, `SampleSetID`, `AnchorSlot`, `RecentCollisionCheck`,
+`PersonaCardRef` / `PersonaCardVersion` / `PersonaCardHash`,
 `DraftHash` from a fingerprint row. These artifacts carry no fingerprint row
 (`WindowScope: PostOnly`); they still need Hub review and `FinalDraftSha256`,
 and the fabricated-human-signal rules still apply to them.
@@ -153,6 +217,14 @@ Rules:
 - Rewrite may not reorder sections, add a failed attempt, add a question ending, add a caveat, add a community-observation line, move the brand mention, change `AnchorSlot`, or change any of the nine `LockedFingerprintFields`.
 - Rewrite must **preserve `PostingTrigger`** for `ArtifactType: Post`: a body edit that changes the post's real-world trigger (or that breaks the `PostingTrigger × BrandEntryMode` cross-constraint) is out of allowance — flag it instead of applying, so the finished body still re-derives to the `Planned` `PostingTrigger`.
 - Hub `optimized` output that changes a protected structure field may not be adopted wholesale; record `HubStructureConflictStatus: None | Escalated` (see `content-review-gate.md` §3.1). `Escalated` holds the draft and routes to `reddit-phase-brief`.
+- Rewrite **preserves `PersonaCardRef` / `PersonaCardVersion` / `PersonaCardHash`
+  unchanged** and may not author, extend, or reinterpret a Card
+  (`references/persona-card-contract.md`). Repairing a claim so that it stops
+  contradicting the assigned Card is in allowance — it is the existing
+  `FactualExpression` duty, since an unauthorised firsthand claim is an
+  unsupported claim. Needing a *wider* boundary than the Card grants is not:
+  return `PersonaCardConflict: Yes` with the contradicting phrase and route to
+  `reddit-phase-brief` for a new Card version.
 - `reddit-content-rewrite` does **not** own `memory/phase4-叙事指纹索引.md`. When its edits change the body, it returns `FingerprintSyncRequired: Yes` / `FingerprintSyncStatus: PendingWritingOwner`; `reddit-content-writing` (the index owner) performs the re-review and hash write-back.
 
 ## Brand Risk To Writing
@@ -183,13 +255,26 @@ Required:
 - `memory/content-review-log.md`
 - `memory/phase4-叙事指纹索引.md` has exactly one active `Final` row for every delivered **main-post** Key (`WindowScope: PostOnly`; comments and external comments need no fingerprint row, only Hub `FinalDraftSha256`)
 - each `Final` row's `DraftHash` equals the `FinalDraftSha256` in `memory/content-review-log.md` and a recomputation from the delivered text using `HashSchemaVersion: reddit-final-draft-sha256-v1`
-- all nine `LockedFingerprintFields` of a delivered post match the Brief's `Planned` values, and the two `PrewritingControlFields` match too: `AssignedFlair` equals the Brief value (and the baseline flair coverage it was written against), and the delivered body's re-derived `PostingTrigger` equals the `Planned` value while satisfying the `PostingTrigger × BrandEntryMode` cross-constraint
+- all nine `LockedFingerprintFields` of a delivered post match the Brief's `Planned` values, and the three `PrewritingControlFields` match too: `AssignedFlair` equals the Brief value (and the baseline flair coverage it was written against), the delivered body's re-derived `PostingTrigger` equals the `Planned` value while satisfying the `PostingTrigger × BrandEntryMode` cross-constraint, and `PersonaCardRef` / `PersonaCardVersion` / `PersonaCardHash` equal the Brief's assigned Card with `PersonaCardSelfCheck: Pass` recorded against that same version
 - no delivered post Key collides with any other Key in the rolling window unless an approved `ExceptionRef` exists
 - every post/comment to be delivered has Hub `executionStatus=completed` and `verdict=pass`
 - final delivery rows have `ReviewMode: AccountBound` and a real `accountId`
 - ContentOnly rows may hand off to account selection with `AccountBindingStatus: Pending`, but cannot be marked `ReadyForDelivery: Yes`
 - no delivered row has unresolved `brandFitReviewRequired` or blocking `accountCandidateFeedback`
 - Hub review feedback was applied to the exact final draft
+- every dimension the Hub result reports as `not_assessed` is carried through as
+  NotAssessed, with its `notAssessedReason` — never as a low score, a passing
+  score, or a partial check, and never averaged. Scores are compared only within
+  the same `applicabilitySignature`; the semantics are in
+  `references/content-review-gate.md` and are not restated per row
+- compliance evidence is still fresh **as of delivery**, re-checked against the
+  Compliance Output handoff; evidence that expired since that report holds the
+  affected rows
+- when `AcceptanceProfile: NativeCopy` was selected, `NativeCopyProfileStatus` is
+  recorded. While it is `Unavailable(ServerContractMissing)` no row may be marked
+  `ReadyForDelivery: Yes` under that profile, and the profile may not be silently
+  downgraded to `Default` to release the batch
+  (`references/native-copy-profile.md`)
 - single Feishu draft document exists when Feishu delivery was selected
 - `memory/phase5-交付清单.md` is written at delivery
 

package/skills/reddit-strategy-shared/references/native-copy-profile.md

@@ -0,0 +1,207 @@
+# Native Copy Acceptance Profile
+
+An **optional overlay** for clients who commission a stricter native-copy
+standard than the matrix default.
+
+```markdown
+AcceptanceProfile: Default | NativeCopy
+```
+
+`Default` is the standing behaviour of every skill in this matrix and is what
+runs when the field is absent. **Nothing in this file changes `Default`.** Every
+rule here applies only while `AcceptanceProfile: NativeCopy` is selected for the
+batch.
+
+This separation is the whole point of the file. A brand-mention ceiling, a
+required question ending, or a fixed output format folded into the default layer
+would impose one client's house voice on every brand — which is precisely what
+`reddit-content-rewrite` was redefined as a constraint-preserving repairer to
+prevent. Keep client strictness in the overlay.
+
+## 1. Current status: `Unavailable`
+
+**`NativeCopyProfileStatus: Unavailable(ServerContractMissing)`.**
+
+The profile requires the server to state, per review, which scope was requested,
+which was resolved, and whether the declaration was honoured or inferred. Social
+Hub does not expose that today — there is no scope field on the review request
+and no scope receipt on the response.
+
+While the status is `Unavailable`:
+
+- Planning, Brief, Persona Cards, drafting, and the local self-checks below all
+  run normally.
+- Hub review runs normally, under `Default` semantics, and its verdict is read
+  exactly as `references/content-review-gate.md` describes.
+- **No row may be marked `ReadyForDelivery: Yes` under this profile.** Report
+  `NativeCopyProfileStatus: Unavailable(ServerContractMissing)` and name the
+  missing capability.
+- **Never silently fall back to `Default` and call the result a profile pass.**
+  Fail closed: a client who commissioned the stricter standard must not be handed
+  a delivery that was measured against the looser one. Equally, never strip
+  fields to make a call succeed and then treat the result as satisfying the
+  profile — a request that had to be weakened to be accepted did not verify what
+  it was supposed to verify.
+
+Selecting `NativeCopy` is therefore useful now for the writing-side discipline it
+imposes, and cannot yet produce a delivery. That is intended, not a defect.
+
+## 2. Review scope: local intent only
+
+The four quadrants — account-bound vs persona-less, managed brand vs organic —
+are real and the planner should be explicit about which one a batch is written
+for. Record that as **intent**:
+
+```markdown
+LocalReviewIntent:
+  accountBinding: account_bound | persona_less
+  brandTreatment: managed_brand | organic
+HubReviewScopeStatus: Unavailable(ServerContractMissing)
+```
+
+`LocalReviewIntent` is a planner declaration in matrix memory. It is **not** sent
+to Hub, and it is **not** a claim about how Hub actually resolved the review.
+
+Two disciplines follow from writing it down:
+
+- **"Managed brand" means a managed brand context, not a brand string in the
+  body.** A batch does not become `organic` by omitting the brand context from
+  the review call. If the content is written for a managed brand, the intent is
+  `managed_brand` regardless of what the request carries.
+- **Omitting an account is a decision, not an accident.** `persona_less` must be
+  a recorded choice. "We forgot to resolve the publishing account" and "this is
+  deliberately content-only work" produce identical review calls, so the
+  distinction only exists if the planner states it.
+
+Do not invent or report a server-side scope status. When Hub later echoes a real
+scope and the source of that scope, record what it returns; until then
+`HubReviewScopeStatus` is `Unavailable(ServerContractMissing)` and the matrix
+makes no claim about which quadrant the server believed it was reviewing.
+
+## 3. Tightenings that are in scope
+
+**Each tightening is applied by exactly the stage named below, and the split is
+not cosmetic.** Structural tightenings touch locked fingerprint fields, so only
+`reddit-phase-brief` may apply them, at assignment. Register tightenings are about
+how the prose reads, so the writer observes them while producing the first draft.
+
+`reddit-content-rewrite` applies **neither kind**: it may not add a structural
+constraint (that would change a locked field after the collision check) and it may
+not newly impose or escalate a register rule (that would be house-voice
+normalisation of a draft it was asked only to repair).
+
+| Tightening                     | Owner stage                      | Rule                                                                                                                                            |
+| ------------------------------ | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Brand-mention ceiling          | `reddit-phase-brief` (placement) | A per-post ceiling may be set for the batch. It constrains `BrandEntryMode` / placement **at assignment**, and never becomes a global default    |
+| Restricted `EndingMode` set    | `reddit-phase-brief`             | The profile may narrow the *allowed set* the Brief picks from. See §4                                                                            |
+| PDP / spec-speak language      | `reddit-content-writing`         | Avoid product-page register and specification recitation where the account's `knowledgeAccess` does not support it                               |
+| Fake-Reddit-English            | `reddit-content-writing`         | No slang, emoji, or broken grammar added to *seem* native. This is the existing fabricated-signal red line, stated in the other direction        |
+| Full official product names    | `reddit-content-writing`         | Only against an explicitly maintained, approved list of forbidden strings. Never inferred from an SKU or model name — see §6                     |
+
+**Scoring thresholds are out of scope.** A stricter numeric bar (a client's own
+100-point scale, a 90/80 two-tier gate) is **not** part of this train. It is not a
+tightening you may apply, and no local computation may produce a profile score, a
+profile pass, or delivery eligibility. If a client scale is useful for internal
+discussion, keep it as a non-delivery preview and label it as such. The
+authoritative verdict is Hub's, under `Default` semantics, read per
+`references/content-review-gate.md`.
+
+## 4. Endings are assigned, not appended
+
+A client requirement that posts end on a specific question is a constraint on
+**which `EndingMode` the Brief may assign**, not a licence to append a question
+to a finished draft.
+
+`EndingMode` is one of the nine `LockedFingerprintFields` and one of the three
+fields in the collision triple (`references/content-diversity-contract.md`). A
+writer or rewriter adding a question ending changes a locked field, bypasses
+structural pre-assignment, and voids the collision check that was run against the
+old value.
+
+So: the profile narrows the allowed set, `reddit-phase-brief` assigns from the
+narrowed set and runs the collision check on the result, and the writer preserves
+what was assigned. If the narrowed set leaves no collision-free option, that is a
+`BlockingGap` back to planning — not a reason to append.
+
+The same reasoning applies to every other tightening that touches a locked field:
+express it as a constraint on assignment, never as a post-hoc edit.
+
+## 5. Content-logic types stay separate
+
+A client taxonomy of content logic types — question, buying decision, personal
+story, ownership experience, show & tell, styling, quality check — may be recorded
+as a profile-local label:
+
+```markdown
+NativeCopyLogicType:            # profile-local label; optional
+```
+
+It **may not** be mapped onto, merged with, or substituted for `ContentFunction`.
+They are different taxonomies with different value sets, and routing already keys
+off `ContentFunction`; overloading it would corrupt live routing decisions for
+every non-profile batch.
+
+**The ownership / brand-review collision is real and must be handled at
+assignment.** `PostingTrigger: UnsolicitedTestimony` requires
+`BrandEntryMode: 不出现`, and conversely any `BrandEntryMode ≠ 不出现` forbids
+`UnsolicitedTestimony` (`references/content-diversity-contract.md`). A client
+category that is simultaneously "ownership testimony" and "names the brand" cannot
+be satisfied by both at once. Resolve it in the Brief by choosing which of the two
+the post actually is, and record the choice. Any mapping table that quietly places
+a brand-naming ownership post on `UnsolicitedTestimony` is a hard contradiction,
+not a preference to reconcile in the draft.
+
+## 6. What the profile explicitly does not get
+
+- **Forbidden product-name strings are maintained, never derived.** Approved
+  product facts (SKU, model name) cannot be recombined into an official
+  product-page title; attempting it produces both misses and false positives on
+  ordinary phrasing. Only an explicit, approved list of forbidden strings is
+  actionable, and a client who wants this enforcement has to supply and maintain
+  that list.
+- **No cross-post template detection exists server-side.** The rolling
+  fingerprint index is a matrix memory file. It is strong within one project's
+  memory and it is **not** a service-side gate: it does not span authors,
+  campaigns, or runs, and it cannot see a sibling batch. A client pattern
+  checklist may be used as supplementary observation against the existing
+  fingerprint fields; it must not be presented as a guarantee that no two posts
+  anywhere share a template, and it must not become a second fingerprint system
+  alongside the contract's.
+- **The brand-removal question is a diagnostic.** "Would this post still be worth
+  posting with the brand name deleted?" is a useful prompt for judging whether the
+  brand is the post's only payoff. It is not a mechanical rule: a vendor review, a
+  purchase-decision post, or a board that requires vendor identification is
+  legitimately incomplete without the brand. Ask whether the brand is the *sole*
+  payoff; never run a literal string deletion and fail the result.
+- **Exemplar phrases are not a phrase library.** Sampled community wording may be
+  read as analysis or as negative examples. Copying another user's wording into a
+  draft is forbidden by both this profile and the matrix's own red lines.
+- **No fixed output format.** A client's prescribed multi-section deliverable
+  format is not adopted. Its useful content maps onto existing handoff fields —
+  flagged risks into `BlockingGaps`, brand-mention reasoning into the Brief's
+  placement rationale. A second mandatory output shape layered over
+  `references/handoff-schemas.md` produces two contracts that disagree.
+- **No relaxation of the fabricated-signal rules.** Nothing in the profile
+  licenses invented experience, invented flaws, invented community history, or
+  deliberate typos. Where the profile and the matrix red lines overlap, they are
+  the same rule stated once — do not restate it as a second rule with its own
+  wording.
+
+## 7. Versioning
+
+The matrix package version, this profile, and the server's review semantics are
+**independent identifiers and are not kept in step**. Do not require them to
+match, and do not assert that a Hub response carries a particular review-semantics
+version.
+
+This profile has been authored against post-review `v4` and content-review `v5`
+semantics. That is a statement about what it was written for, not a runtime
+assertion: **never branch on a version string in a response.**
+
+The capability the profile is waiting on is a server-stated review scope —
+`review-scope.v1` in the plan's naming. When the server begins declaring its
+capabilities and echoing the scope it resolved, this section is what changes: the
+matrix will read that declaration and that scope, and `NativeCopyProfileStatus`
+will follow from whether the required capability is present. Until then the status
+stays `Unavailable(ServerContractMissing)`, and no skill infers the capability
+from a version string, a successful call, or the absence of an error.

package/skills/reddit-strategy-shared/references/path-conventions.md

@@ -53,6 +53,27 @@ same way:
 ~/.cursor/skills/reddit-strategy-shared/references/content-diversity-contract.md
 ```
 
+The SRP contract is a shared reference too (it is consumed by four phases, so it does
+not live in any one phase's `references/`):
+
+```text
+~/.cursor/skills/reddit-strategy-shared/references/subreddit-research-profile.md
+```
+
+The D1–D7 scheduling decision procedure is **planning-owned**, so it is read from that
+skill's own `references/` (and by that skill only — downstream reads its *output*,
+`memory/phase4-排期决策台账.md`):
+
+```text
+~/.cursor/skills/reddit-phase-planning/references/scheduling-decision-procedure.md
+```
+
+The archived legacy prerequisites are the one directory no agent may read:
+
+```text
+~/.cursor/skills/reddit-strategy-shared/references/prerequisites/archive/   # AgentReadPolicy: DoNotRead
+```
+
 ## Project Memory Paths
 
 Contracts are installed skill files; the data they govern is project-side.
@@ -62,12 +83,13 @@ an installed-skill path and never as an absolute user path:
 ```text
 memory/phase0-客户内容原型映射.md
 memory/phase4-叙事指纹索引.md
+memory/phase4-排期决策台账.md
 ```
 
-The two files above are **not** created by the installers. They are project
-prerequisites: `reddit-phase-planning` creates the prototype mapping in Phase 0,
-`reddit-phase-brief` seeds the fingerprint index with `Planned` rows, and
-`reddit-content-writing` owns it from drafting onward. A missing file is a
+The three files above are **not** created by the installers. They are project
+prerequisites: `reddit-phase-planning` creates the prototype mapping in Phase 0 and the
+scheduling decision ledger in Phase 4.0.0.4, `reddit-phase-brief` seeds the fingerprint
+index with `Planned` rows, and `reddit-content-writing` owns it from drafting onward. A missing file is a
 `BlockingGap`, not an empty history.
 
 ## Rule