@m13v/s4l 1.7.1-rc.2 → 1.7.1-rc.21

package/scripts/feedback_digest.py

@@ -2,18 +2,28 @@
 """Feedback digest: distill human card decisions into learned_preferences.
 
 The scheduled half of the review-events feedback loop (see
-scripts/learned_preferences.py for the full loop). Per run:
+scripts/learned_preferences.py for the full loop). learned_preferences is a
+SINGLE install-wide block (2026-07-08), not one per project: events are
+still fetched and prompted per project (that's where the candidates/cards
+came from), but every project's digest writes into the same shared block, on
+the theory that what a reviewer is actually correcting (voice, quality bar,
+author-quality signals) is a fact about them, not about one product's
+audience. main() runs learned_preferences.migrate_to_global() once per tick
+(idempotent) to fold any pre-existing per-project blocks into the shared one.
+
+Per run:
 
   1. GET /api/v1/review-events?counts=true — which (project, platform) pairs
      have unprocessed events. The API scopes to this installation, so a
      customer box only ever digests its own user's decisions.
   2. For each project that exists in the local config.json: fetch the
-     unprocessed events, build a conservative digest prompt (current block +
-     events + approval counter-evidence), run Claude headless via
+     unprocessed events, build a conservative digest prompt (current shared
+     block + events + approval counter-evidence), run Claude headless via
      run_claude.sh (script_tag feedback-digest, cost-tracked like every other
      pipeline Claude call).
   3. Apply the returned mutation plan through
-     learned_preferences.apply_mutations() (whitelist, flock, backup, atomic).
+     learned_preferences.apply_mutations() (whitelist, flock, backup, atomic)
+     into the shared block.
   4. PATCH the events processed (processed_batch=digest-<ts>) so they are
      never digested twice. Events are marked processed even when the plan is
      "no changes" — a considered no-op is a completed digestion, not a retry.
@@ -180,9 +190,11 @@ def build_prompt(project: dict, events: list[dict], overall_events: list[dict] |
             f"{notes}"
         )
 
-    return f"""You maintain the learned_preferences block for the project "{project.get('name')}" in a social-posting pipeline. The block distills the user's own approve/reject decisions on draft cards into short standing preferences that steer future thread selection and drafting. It is SOFT guidance read by the drafting model, not a filter.
+    return f"""You maintain the SINGLE, install-wide learned_preferences block for this social-posting pipeline (shared across every configured project, not just "{project.get('name')}"). It distills the user's own approve/reject decisions on draft cards into short standing preferences that steer future thread selection and drafting across ALL projects. It is SOFT guidance read by the drafting model, not a filter.
+
+The events below all happened to come from project "{project.get('name')}"'s cards, but since the block is shared, only propose an entry that generalizes to a human reviewer's standing taste or quality bar (voice, tone, structural habits, author-quality signals, what counts as a good vs bad reply) — NOT something that is true only because of this one product's specific audience, niche, or content angle (e.g. "prefers accounts studying for nursing boards" belongs to one product's ICP, not to every project this reviewer runs). When the evidence is really project-specific, prefer NO change over forcing it into the shared block.
 
-CURRENT learned_preferences:
+CURRENT learned_preferences (shared by every project):
 {json.dumps({k: block[k] for k in ("audience_avoid", "audience_prefer", "thread_avoid", "draft_style_notes")}, indent=2)}
 
 CURRENT voice.never: {json.dumps(voice_never)}
@@ -203,6 +215,7 @@ Propose changes to the block. RULES, in priority order:
 5. bad_draft events feed draft_style_notes (or, ONLY for a clearly recurring phrasing complaint, voice_never_add / guardrails_do_not_add; use those sparingly, they touch curated fields).
 6. Each entry: one sentence, under 200 characters, plain language, no em dashes, no hashtags, understandable a month from now without these events.
 7. Respect the cap: at most {lp.MAX_ENTRIES_PER_LIST} entries per list. If a list is full, fold the new signal into an existing entry via remove+add.
+8. Scope check (this block is shared across every project): before proposing an entry, ask whether it would still make sense read from a totally different product's cards. If it only makes sense for "{project.get('name')}" specifically, don't add it.
 
 OUTPUT: a single JSON object, nothing else. Schema:
 {{"changes": {{"audience_avoid": {{"add": [], "remove": []}}, "audience_prefer": {{"add": [], "remove": []}}, "thread_avoid": {{"add": [], "remove": []}}, "draft_style_notes": {{"add": [], "remove": []}}}}, "voice_never_add": [], "guardrails_do_not_add": [], "block_authors": [{{"handle": "somehandle", "reason": "one short sentence citing the evidence"}}], "rationale": "one short sentence"}}
@@ -463,6 +476,21 @@ def main() -> int:
         log("another digest run holds the lock; exiting")
         return 0
 
+    # One-time, idempotent move from per-project learned_preferences to the
+    # single learned_preferences_global block (2026-07-08). Runs on every
+    # digest tick everywhere (this operator's box AND every customer install,
+    # since this file ships in the same release); a config already migrated
+    # (no project carries the old key) is a fast no-op. Skipped in --dry-run
+    # since that mode promises to change nothing.
+    if not args.dry_run:
+        try:
+            mig = lp.migrate_to_global()
+            if mig.get("migrated"):
+                log(f"learned_preferences migrated to global: projects={mig.get('projects_merged')} "
+                    f"excluded={len(mig.get('excluded') or [])} dropped_at_cap={len(mig.get('dropped_at_cap') or [])}")
+        except Exception as e:
+            log(f"learned_preferences migration error (non-fatal): {e}")
+
     cfg = load_config()
     by_name = {p.get("name"): p for p in (cfg.get("projects") or [])}
 

package/scripts/get-latest-staging-mcpb.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Print (or download) the permanent download link for the latest S4L staging
+# release (.mcpb).
+#
+# Usage:
+#   bash scripts/get-latest-staging-mcpb.sh [--download] [--channel]
+#
+# Options:
+#   --download    Download the .mcpb to the current directory (instead of
+#                 just printing the URL)
+#   --channel     After downloading, opt this machine into the staging
+#                 channel (delegates to scripts/s4l_channel.py, the single
+#                 source of truth for the channel marker)
+#
+# The link below is a FIXED URL, not a live GitHub API lookup: every
+# `bash scripts/release-mcpb.sh --staging` run mirrors its .mcpb onto a
+# separate, non-version-tagged release ("staging-latest") so this exact URL
+# always serves whatever's newest — see scripts/release-mcpb.sh step 7b. That
+# means this script needs zero network calls to resolve anything; it only
+# hits the network when actually downloading.
+
+set -euo pipefail
+
+STAGING_MCPB_URL="https://github.com/m13v/s4l/releases/download/staging-latest/social-autoposter.mcpb"
+
+DO_DOWNLOAD=0
+DO_CHANNEL=0
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --download) DO_DOWNLOAD=1; shift ;;
+    --channel) DO_CHANNEL=1; shift ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+if [ "$DO_DOWNLOAD" -eq 0 ]; then
+  echo "$STAGING_MCPB_URL"
+  exit 0
+fi
+
+FILENAME="social-autoposter-staging.mcpb"
+echo "Downloading $FILENAME from $STAGING_MCPB_URL" >&2
+curl -fL "$STAGING_MCPB_URL" -o "$FILENAME"
+echo "$FILENAME"
+
+if [ "$DO_CHANNEL" -eq 1 ]; then
+  REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  python3 "$REPO_ROOT/scripts/s4l_channel.py" set staging >&2
+fi

package/scripts/harness_overlay.py

@@ -43,6 +43,7 @@ import os
 import re
 import signal
 import sys
+import threading
 import time
 from pathlib import Path
 
@@ -306,6 +307,21 @@ class Harness:
                 ctx.add_init_script(script)
             except Exception:
                 pass
+            # The overlay shares this CDP session with the real twitter-harness
+            # automation. When x.com throws up a native JS dialog, both clients'
+            # Playwright drivers race to auto-dismiss it (the default behavior
+            # when no listener is registered); the loser gets a
+            # "Page.handleJavaScriptDialog: No dialog is showing" protocol error
+            # that is an UNCAUGHT rejection in the Node driver, killing that
+            # whole driver process. A no-op listener opts this connection out of
+            # the race entirely (dialog handling stays the automation's job);
+            # once the driver's default-dismiss is suppressed here, evaluate()
+            # calls on the affected page resume normally as soon as the other
+            # side clears the dialog.
+            try:
+                ctx.on("dialog", lambda dialog: None)
+            except Exception:
+                pass
 
     def paint(self, title: str, reassure: str, status: str) -> int:
         """Paint/refresh the overlay on every live page. Returns pages touched."""
@@ -473,11 +489,40 @@ def cmd_watch(interval: float = 2.0) -> int:
     # Treat SIGTERM (launchd unload, `kill`) like Ctrl-C so the overlay is
     # cleared on the way out instead of lingering until the next navigation.
     signal.signal(signal.SIGTERM, lambda *_: (_ for _ in ()).throw(KeyboardInterrupt()))
+
+    # Hard watchdog: a wedged CDP call (e.g. a page whose JS is paused on a
+    # native dialog) can block the loop body indefinitely without ever raising,
+    # so the normal try/except reconnect logic below never gets a chance to
+    # run. That let a past incident spin a full core for ~3.5 hours with the
+    # overlay silently stuck instead of failing loudly. A background thread
+    # that self-terminates the process if the main loop hasn't ticked in too
+    # long is the only thing that reliably fires even when the main thread is
+    # stuck inside a blocking Playwright/CDP call; os._exit() skips Python-level
+    # cleanup on purpose since a stuck process can't be trusted to run it
+    # either. launchd's KeepAlive relaunches a clean instance immediately.
+    WATCHDOG_MAX_STALL_SEC = 60.0
+    _last_tick = {"t": time.time()}
+
+    def _watchdog() -> None:
+        while True:
+            time.sleep(10)
+            stalled = time.time() - _last_tick["t"]
+            if stalled > WATCHDOG_MAX_STALL_SEC:
+                print(
+                    f"[watchdog] loop stalled {stalled:.0f}s (>{WATCHDOG_MAX_STALL_SEC:.0f}s); "
+                    "self-terminating for a clean launchd restart",
+                    file=sys.stderr,
+                )
+                os._exit(1)
+
+    threading.Thread(target=_watchdog, daemon=True).start()
+
     last_status = None
     h: Harness | None = None
     registered = False
     try:
         while True:
+            _last_tick["t"] = time.time()
             # Never let status computation (log globbing/stat, all racing against
             # live log rotation) kill the watcher; fall back to a neutral status.
             try:

package/scripts/identity.py

@@ -328,6 +328,32 @@ def get_identity_header(refresh: bool = False) -> str:
     return base64.b64encode(raw).decode("ascii")
 
 
+# Our own infra: operator Mac, mk0r E2B sandbox fleet, MacStadium remote QA boxes.
+# Single source of truth for "is this install actually a customer", consumed by
+# active_users.py (customer-roster dedupe) and autopilot_stall_watch.py (stall-page
+# severity), so the two lists can't drift apart. "71522" was the MacStadium box
+# retired by the 2026-07-06 hardware swap (ticket #10904); "71732" is its
+# replacement, both listed since the old box's hostname could still appear in
+# historical data.
+INTERNAL_EMAILS = {"i@m13v.com", "agent@mk0r.com", "matt@mediar.ai"}
+INTERNAL_HOSTNAME_SUBSTR = ("e2b.local", "71522", "71732")
+INTERNAL_HARDWARE_UUIDS = {"07CB793D-6E32-5EF8-82E2-7CDEABD47FBC"}
+
+
+def is_internal_install(ident: dict | None = None) -> bool:
+    """True when this install is our own infra (staging/QA/dev), not a real
+    customer. Local-only (no DB), so it works on shipped .mcpb installs too."""
+    ident = ident if ident is not None else get_identity()
+    if (ident.get("git_email") or "").strip().lower() in INTERNAL_EMAILS:
+        return True
+    hostname = ident.get("hostname") or ""
+    if any(sub in hostname for sub in INTERNAL_HOSTNAME_SUBSTR):
+        return True
+    if (ident.get("hardware_uuid") or "") in INTERNAL_HARDWARE_UUIDS:
+        return True
+    return False
+
+
 def main():
     cmd = sys.argv[1] if len(sys.argv) > 1 else "show"
     if cmd == "show":

package/scripts/learned_preferences.py

@@ -1,39 +1,54 @@
 #!/usr/bin/env python3
-"""Per-project learned_preferences: the agent-owned config block distilled from
-human card decisions (review_events).
+"""learned_preferences: the agent-owned config block distilled from human
+card decisions (review_events).
+
+**Single install-wide block (2026-07-08).** Earlier this lived once PER
+PROJECT. In practice every entry ever learned was a fact about the human
+reviewer (their voice, their quality bar, their reviewing habits), never
+about one product's audience specifically, so a multi-project install (every
+install gets at least a persona project plus, usually, a product project)
+just relearned the same reviewer-level facts independently in each project.
+Consolidated into ONE top-level `learned_preferences_global` block so a
+correction made anywhere reaches every project's drafting/judging prompt.
+migrate_to_global() performs the one-time move from the old per-project
+shape and runs automatically (idempotent) from feedback_digest.py.
 
 The feedback loop:
   1. The menubar review card ships every approve/reject (with reason chips,
      free-text note, link-click interactions, dwell) to /api/v1/review-events.
   2. scripts/feedback_digest.py (scheduled) claims unprocessed events per
      project and asks Claude for a conservative mutation plan.
-  3. apply_mutations() here writes that plan into config.json under the
-     project's `learned_preferences` block, whitelist-enforced, with flock +
+  3. apply_mutations() here writes that plan into config.json's single
+     `learned_preferences_global` block, whitelist-enforced, with flock +
      backup + atomic replace.
   4. Enforcement is SOFT (prompt-level, never a deterministic filter): the
      twitter prep prompt embeds every project entry verbatim via
-     ALL_PROJECTS_JSON, so the block (with its self-describing _instruction)
-     reaches the judging/drafting model automatically. prompt_block() renders
-     the same content for prompts that want an explicit section.
+     ALL_PROJECTS_JSON (each project dict is stamped with the same global
+     block at prompt-build time), so the block (with its self-describing
+     _instruction) reaches the judging/drafting model automatically.
+     prompt_block() renders the same content for callers that want an
+     explicit section instead of the raw embed.
 
-Block shape (inside a config.json project entry):
+Block shape (config.json top-level key `learned_preferences_global`):
 
-  "learned_preferences": {
+  "learned_preferences_global": {
     "_instruction": "<how the drafting model should apply this block>",
     "enabled": true,
     "audience_avoid":    ["crypto/web3-native authors ..."],
     "audience_prefer":   [],
     "thread_avoid":      ["engagement-bait question threads ..."],
     "draft_style_notes": [],
+    "edit_examples":     [{"original", "final", "ts"}],
     "updated_at": "...",
     "history": [{"ts", "change", "rationale", "source_events": [ids]}]
   }
 
-WHITELIST: this module writes ONLY learned_preferences plus (append-only)
-voice.never and content_guardrails.do_not. Nothing else in a project entry is
-touchable through this path; unknown keys in a mutation plan are dropped and
-counted, never applied. Facts (content_angle, links, identity fields) are
-deliberately unreachable so a bad digest can never poison grounding.
+WHITELIST: this module writes ONLY learned_preferences_global plus
+(append-only, still per-project) voice.never and content_guardrails.do_not.
+Nothing else in a project entry is touchable through this path; unknown keys
+in a mutation plan are dropped and counted, never applied. Facts
+(content_angle, links, identity fields) are deliberately unreachable so a
+bad digest can never poison grounding.
 """
 from __future__ import annotations
 
@@ -41,6 +56,7 @@ import datetime
 import fcntl
 import json
 import os
+import re
 import shutil
 import sys
 from pathlib import Path
@@ -137,14 +153,40 @@ def normalized(block) -> dict:
     return out
 
 
-def get_block(project_cfg) -> dict:
-    return normalized((project_cfg or {}).get("learned_preferences"))
+def get_global_block(cfg: dict | None = None, cfg_path: str | None = None) -> dict:
+    """Load + normalize the single install-wide learned_preferences block.
+
+    If `cfg` (an already-parsed config.json dict) isn't supplied, reads
+    config.json fresh from disk — the same "re-read on every call" pattern
+    already used elsewhere (e.g. link_tail.py's project loader), so callers
+    that only ever had a single project's dict slice (not the whole config)
+    can still reach the global block with no signature change on their end.
+    """
+    if cfg is None:
+        try:
+            cfg = json.loads(Path(cfg_path or config_path()).read_text())
+        except Exception:
+            cfg = {}
+    return normalized(cfg.get("learned_preferences_global"))
+
+
+def get_block(project_cfg=None) -> dict:
+    """Back-compat shim (2026-07-08): learned_preferences is now a SINGLE
+    install-wide block, not one per project — see module docstring.
+    `project_cfg` is accepted but ignored; kept so every existing caller
+    (post_reddit.py, engage_reddit.py, post_github.py, engage_github.py,
+    link_tail.py — 4 of those 5 files are chflags-uchg locked) needs zero
+    changes. Callers that already have the full parsed config in scope
+    should call get_global_block(cfg) directly instead (apply_mutations and
+    record_edit_examples below do)."""
+    return get_global_block()
 
 
-def prompt_block(project_cfg) -> str:
+def prompt_block(project_cfg=None) -> str:
     """Explicit prompt section for callers that don't embed the raw project
     JSON (mirrors the engagement_styles STYLES_BLOCK pattern). Empty string
-    when the block is disabled or has no entries."""
+    when the block is disabled or has no entries. `project_cfg` is accepted
+    but ignored (see get_block())."""
     b = get_block(project_cfg)
     if not b["enabled"]:
         return ""
@@ -190,12 +232,16 @@ def _validate_add_list(raw, cap=MAX_ENTRIES_PER_LIST):
 
 def record_edit_examples(project_name: str, pairs, cfg_path: str | None = None) -> dict:
     """Deterministically record (original, final) card-edit pairs as few-shot
-    examples in the project's learned_preferences.edit_examples (newest first,
-    capped at MAX_EDIT_EXAMPLES). This is CODE-owned, not part of the digest
-    LLM's mutation plan: an edit the user made IS the ground truth, no judgment
-    call needed to keep it (mirrors the s4l-email inbox repo, which injects
-    the last 5 human-edited drafts into every draft prompt). Same flock +
-    backup + atomic-replace mechanics as apply_mutations().
+    examples in the single learned_preferences_global.edit_examples (newest
+    first, capped at MAX_EDIT_EXAMPLES). This is CODE-owned, not part of the
+    digest LLM's mutation plan: an edit the user made IS the ground truth, no
+    judgment call needed to keep it (mirrors the s4l-email inbox repo, which
+    injects the last 5 human-edited drafts into every draft prompt). Same
+    flock + backup + atomic-replace mechanics as apply_mutations().
+
+    `project_name` is validated against config.json (catches a caller typo)
+    but no longer selects a per-project block to write into — every project's
+    edits feed the same global few-shot pool (2026-07-08).
 
     pairs: iterable of {"original": str, "final": str} (ts optional).
     Returns {ok, recorded: int}.
@@ -230,7 +276,7 @@ def record_edit_examples(project_name: str, pairs, cfg_path: str | None = None)
         if proj is None:
             return {"ok": False, "error": "project not in config", "recorded": 0}
 
-        block = get_block(proj)
+        block = get_global_block(cfg)
         existing = block["edit_examples"]
         # Dedup on the final text (a retried digest re-records the same batch).
         seen = {e["final"] for e in existing}
@@ -245,9 +291,10 @@ def record_edit_examples(project_name: str, pairs, cfg_path: str | None = None)
                 "change": f"edit_examples recorded: {len(fresh)}",
                 "rationale": "user rewrote the draft on the review card",
                 "source_events": [],
+                "project": project_name,
             }
         ])[-MAX_HISTORY:]
-        proj["learned_preferences"] = block
+        cfg["learned_preferences_global"] = block
 
         stamp = _now_iso().replace(":", "-").replace(".", "-")
         try:
@@ -263,7 +310,8 @@ def record_edit_examples(project_name: str, pairs, cfg_path: str | None = None)
 
 
 def apply_mutations(project_name: str, plan: dict, source_event_ids=None, cfg_path: str | None = None) -> dict:
-    """Apply a digest mutation plan to config.json. Returns a summary dict:
+    """Apply a digest mutation plan to the single learned_preferences_global
+    block. Returns a summary dict:
     {ok, applied: [change strings], dropped: [reasons], project_found: bool}.
 
     plan shape (all optional):
@@ -271,6 +319,13 @@ def apply_mutations(project_name: str, plan: dict, source_event_ids=None, cfg_pa
        "voice_never_add": [...], "guardrails_do_not_add": [...],
        "rationale": "..."}
 
+    `project_name` is validated against config.json (catches a caller typo)
+    and recorded in the history entry's rationale, but no longer selects a
+    per-project block: every project's digest writes into the same global
+    block now (2026-07-08). `voice_never_add`/`guardrails_do_not_add` stay
+    per-project (proj['voice']/proj['content_guardrails']) since those are a
+    separate, narrower whitelist unrelated to this consolidation.
+
     flock on <config>.lock serializes against other writers (setup tools, a
     concurrent digest); backup + atomic replace mirrors mcp/src/setup.ts
     applySetup(). Unknown keys are DROPPED, never applied: the whitelist is
@@ -295,7 +350,7 @@ def apply_mutations(project_name: str, plan: dict, source_event_ids=None, cfg_pa
         if proj is None:
             return {"ok": False, "error": "project not in config", "applied": [], "dropped": [], "project_found": False}
 
-        block = get_block(proj)
+        block = get_global_block(cfg)
 
         for key, ops in changes.items():
             if key not in MANAGED_LISTS:
@@ -345,9 +400,10 @@ def apply_mutations(project_name: str, plan: dict, source_event_ids=None, cfg_pa
                 "change": "; ".join(applied)[:1000],
                 "rationale": rationale,
                 "source_events": list(source_event_ids or [])[:100],
+                "project": project_name,
             }
         ])[-MAX_HISTORY:]
-        proj["learned_preferences"] = block
+        cfg["learned_preferences_global"] = block
 
         # Backup + atomic replace (same shape as setup.ts applySetup).
         stamp = _now_iso().replace(":", "-").replace(".", "-")
@@ -363,19 +419,172 @@ def apply_mutations(project_name: str, plan: dict, source_event_ids=None, cfg_pa
     return {"ok": True, "applied": applied, "dropped": dropped, "project_found": True}
 
 
+# --- Per-project -> global migration (2026-07-08) -------------------------
+# Two categories of existing per-project draft_style_notes are EXCLUDED
+# (dropped, not carried forward) rather than merged into the new global
+# block, per explicit user instruction: notes that tell the drafter to
+# suppress/strip the trailing product link, and notes about avoiding a
+# trailing period/punctuation. The link-suppression notes directly
+# contradict the tail-link bridge feature (scripts/link_tail.py), whose
+# entire job is appending that link — when fed into the bridge prompt as a
+# MANDATORY learned preference they produced degraded output (e.g. a
+# duplicated discourse-marker artifact traced 2026-07-08). Everything else
+# (audience_avoid/prefer, thread_avoid, other draft_style_notes,
+# edit_examples, and each project's own history[]) is carried forward
+# verbatim — nothing else is dropped, and every excluded/dropped entry is
+# still recorded in the merged history for audit purposes.
+_LINK_SUPPRESSION_RE = re.compile(
+    r"do not (append|add)\b.{0,60}\b(link|url)\b"
+    r"|\b(link|url)\b.{0,60}\bdo not (append|add)\b"
+    r"|leave\b.{0,40}\bout\b.{0,40}\b(link|url|product url)\b"
+    r"|\b(link|url)\b.{0,60}\b(strip|remove)\b"
+    r"|\bstrip(s|ped)?\b.{0,60}\b(link|url)\b"
+    r"|let the copy stand alone"
+    r"|end (right after|on) the (sentence|product name)",
+    re.IGNORECASE,
+)
+_PUNCTUATION_SUPPRESSION_RE = re.compile(
+    r"\b(trailing|no|without a?|avoid|remove|do not (end|use))\b.{0,40}\b(period|dot|full stop|punctuation)\b",
+    re.IGNORECASE,
+)
+
+
+def _excluded_note_reason(text: str) -> str | None:
+    """Reason string if this draft_style_notes entry should be dropped
+    during migration (not carried into the global block), else None."""
+    if _LINK_SUPPRESSION_RE.search(text):
+        return "contradicts the tail-link bridge feature (link/url suppression note)"
+    if _PUNCTUATION_SUPPRESSION_RE.search(text):
+        return "trailing punctuation suppression note"
+    return None
+
+
+def migrate_to_global(cfg_path: str | None = None) -> dict:
+    """One-time, idempotent consolidation of every project's
+    learned_preferences into the single learned_preferences_global block,
+    then deletes the per-project key. Safe to call on every process start
+    (feedback_digest.py does): a config where no project carries a
+    `learned_preferences` key is already migrated and this is a cheap no-op.
+
+    Returns {ok, migrated: bool, projects_merged: [...], excluded: [...],
+    dropped_at_cap: [...]}.
+    """
+    cfg_path = cfg_path or config_path()
+    lock_path = cfg_path + ".lock"
+    Path(lock_path).parent.mkdir(parents=True, exist_ok=True)
+    with open(lock_path, "w") as lock_f:
+        fcntl.flock(lock_f, fcntl.LOCK_EX)
+        try:
+            cfg = json.loads(Path(cfg_path).read_text())
+        except Exception as e:
+            return {"ok": False, "error": f"config unreadable: {e}"}
+
+        projects = cfg.get("projects") or []
+        if not any(isinstance(p.get("learned_preferences"), dict) for p in projects):
+            return {"ok": True, "migrated": False, "projects_merged": [], "excluded": [], "dropped_at_cap": []}
+
+        global_block = normalized(cfg.get("learned_preferences_global"))
+        merged_history = list(global_block["history"])
+        excluded = []
+        dropped_at_cap = []
+        projects_merged = []
+
+        for proj in projects:
+            raw = proj.pop("learned_preferences", None)
+            if not isinstance(raw, dict):
+                continue
+            pname = proj.get("name", "?")
+            block = normalized(raw)
+            touched = False
+            for key in MANAGED_LISTS:
+                for v in block[key]:
+                    if key == "draft_style_notes":
+                        reason = _excluded_note_reason(v)
+                        if reason:
+                            excluded.append({"project": pname, "key": key, "value": v, "reason": reason})
+                            continue
+                    if v in global_block[key]:
+                        continue
+                    if len(global_block[key]) >= MAX_ENTRIES_PER_LIST:
+                        dropped_at_cap.append({"project": pname, "key": key, "value": v})
+                        continue
+                    global_block[key].append(v)
+                    touched = True
+            existing_finals = {e["final"] for e in global_block["edit_examples"]}
+            for e in block["edit_examples"]:
+                if e["final"] not in existing_finals:
+                    global_block["edit_examples"].append(e)
+                    existing_finals.add(e["final"])
+                    touched = True
+            for h in block["history"]:
+                merged_history.append({**h, "project": pname})
+                touched = True
+            if touched:
+                projects_merged.append(pname)
+
+        # Keep only the newest MAX_EDIT_EXAMPLES, most-recent ts first.
+        global_block["edit_examples"].sort(key=lambda e: e.get("ts") or "", reverse=True)
+        global_block["edit_examples"] = global_block["edit_examples"][:MAX_EDIT_EXAMPLES]
+
+        summary = f"migrated {len(projects_merged)} project block(s) into learned_preferences_global"
+        if excluded:
+            summary += f"; excluded {len(excluded)} note(s) (link/punctuation suppression)"
+        if dropped_at_cap:
+            summary += f"; {len(dropped_at_cap)} entrie(s) dropped at the {MAX_ENTRIES_PER_LIST}-per-list cap"
+        merged_history.append({
+            "ts": _now_iso(),
+            "change": summary,
+            "rationale": "learned_preferences is now a single install-wide block, not per-project "
+                         "(2026-07-08); every reviewer-level fact ever learned applied to the "
+                         "reviewer, not to one product's audience, so per-project storage just "
+                         "caused the same corrections to be relearned independently in every project.",
+            "source_events": [],
+            "excluded": excluded,
+            "dropped_at_cap": dropped_at_cap,
+        })
+        global_block["history"] = merged_history[-MAX_HISTORY:]
+        global_block["updated_at"] = _now_iso()
+        cfg["learned_preferences_global"] = global_block
+
+        stamp = _now_iso().replace(":", "-").replace(".", "-")
+        try:
+            if os.path.exists(cfg_path):
+                shutil.copyfile(cfg_path, f"{cfg_path}.bak-{stamp}")
+        except Exception:
+            pass
+        tmp = cfg_path + ".tmp"
+        Path(tmp).write_text(json.dumps(cfg, indent=2) + "\n")
+        os.replace(tmp, cfg_path)
+
+    return {
+        "ok": True, "migrated": True, "projects_merged": projects_merged,
+        "excluded": excluded, "dropped_at_cap": dropped_at_cap,
+    }
+
+
 if __name__ == "__main__":
     import argparse
 
     ap = argparse.ArgumentParser(description="Inspect/render learned_preferences")
-    ap.add_argument("command", choices=["show", "block"], help="show = raw JSON, block = prompt block")
-    ap.add_argument("project")
+    ap.add_argument("command", choices=["show", "block", "migrate"],
+                     help="show = raw JSON, block = prompt block, migrate = run migrate_to_global()")
+    ap.add_argument("project", nargs="?", help="unused for 'migrate'; kept for show/block back-compat")
     args = ap.parse_args()
+
+    if args.command == "migrate":
+        print(json.dumps(migrate_to_global(), indent=2))
+        sys.exit(0)
+
+    if not args.project:
+        print("show/block require a project name (used only to validate against config.json; "
+              "the rendered block is now global)", file=sys.stderr)
+        sys.exit(1)
     cfg = json.loads(Path(config_path()).read_text())
     proj = next((p for p in (cfg.get("projects") or []) if p.get("name") == args.project), None)
     if proj is None:
         print(f"project {args.project!r} not found", file=sys.stderr)
         sys.exit(1)
     if args.command == "show":
-        print(json.dumps(get_block(proj), indent=2))
+        print(json.dumps(get_global_block(cfg), indent=2))
     else:
         print(prompt_block(proj))