@m13v/s4l 1.7.1-rc.2 → 1.7.1-rc.21

package/scripts/link_tail.py

@@ -13,6 +13,15 @@ Haiku) that:
   4. Writes 1 short bridge sentence that names a concrete benefit and
      ends with the URL — no period after, no "click here".
 
+APPEND-ONLY, deterministically (2026-07-07): the model is asked for the
+bridge sentence ONLY, never the full reply. main() concatenates it onto the
+UNMODIFIED reply_text in Python, so the model's output is never substituted
+for the drafted reply, only appended after it — it cannot rewrite the
+drafted body no matter what it returns. The bridge prompt also embeds the
+matched project's learned_preferences (draft_style_notes / edit_examples,
+same as the main drafting prompt) so human-review feedback reaches the
+bridge sentence too, not just the initial draft.
+
 Why not Haiku: bridge writing requires reading two pieces of context (thread
 + our reply) and producing language that doesn't read as bolted-on. The
 cheap model fails this; tested via the existing studyly Twitter dataset
@@ -54,6 +63,9 @@ import sys
 import time
 from pathlib import Path
 
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import learned_preferences  # noqa: E402
+
 REPO_DIR = os.path.expanduser("~/social-autoposter")
 RUN_CLAUDE_SH = os.path.join(REPO_DIR, "scripts", "run_claude.sh")
 CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
@@ -68,6 +80,16 @@ URL_WEIGHT = 23
 TWITTER_TEXT_BUDGET = TWEET_LIMIT - URL_WEIGHT  # 257 chars for everything but the URL
 _URL_RE = re.compile(r"https?://\S+")
 
+# The model is asked for the BRIDGE SENTENCE ONLY, never a rewrite of the
+# already-drafted reply (see build_prompt / main). These bound that sentence:
+# below MIN_BRIDGE_CHARS of budget there's no room to say anything meaningful
+# before the URL, so main() skips the Claude call and falls straight to a
+# mechanical concat; above MAX_BRIDGE_CHARS the model has ignored the
+# "sentence only" contract and is attempting a full rewrite, so the quality
+# gate rejects it as a structural violation, not a phrasing nitpick.
+MIN_BRIDGE_CHARS = 20
+MAX_BRIDGE_CHARS = 400
+
 
 def x_weighted_len(text: str) -> int:
     """Character count the way X computes it: every URL counts as 23."""
@@ -115,28 +137,42 @@ def enforce_budget(text: str, link_url: str,
     return _trim_to_chars(text, limit), True
 
 
-def resolve_voice_relationship(project: str) -> str:
-    """Look up the matched project's `voice_relationship` field in config.json.
-
-    Returns "first_party" or "third_party". Defaults to "first_party" if the
-    project is missing or the field is absent, matching the historical
-    pre-2026-05-27 behavior so we never silently mute first-party voice.
-    The link_tail subprocess runs with --disallowed-tools that bans Read/Glob,
-    so the value must be resolved here in Python rather than inside the prompt.
+def _load_project_entry(project: str) -> dict:
+    """Load the matched project's raw config.json entry (case-insensitive
+    name match), or {} if config.json is unreadable or the project is
+    missing. Shared by voice_relationship + learned_preferences lookups so
+    both read config.json once via the same path. The link_tail subprocess
+    runs with --disallowed-tools that bans Read/Glob/MCP, so these values
+    must be resolved here in Python and handed to the prompt as plain text.
     """
     try:
         with open(CONFIG_PATH, "r") as f:
             cfg = json.load(f)
     except Exception:
-        return "first_party"
+        return {}
     name_lc = (project or "").lower()
     for p in cfg.get("projects", []):
         if (p.get("name") or "").lower() == name_lc:
-            val = (p.get("voice_relationship") or "").strip().lower()
-            if val in ("first_party", "third_party"):
-                return val
-            return "first_party"
-    return "first_party"
+            return p
+    return {}
+
+
+def resolve_voice_relationship(project_entry: dict) -> str:
+    """Returns "first_party" or "third_party" from the project's
+    `voice_relationship` field. Defaults to "first_party" if the field is
+    absent, matching the historical pre-2026-05-27 behavior so we never
+    silently mute first-party voice."""
+    val = (project_entry.get("voice_relationship") or "").strip().lower()
+    return val if val in ("first_party", "third_party") else "first_party"
+
+
+def resolve_learned_preferences_block(project_entry: dict) -> str:
+    """Render this project's learned_preferences (draft_style_notes,
+    edit_examples, audience/thread avoid-prefer) via the shared
+    learned_preferences.prompt_block() renderer — the same text the main
+    drafting prompt embeds. Empty string when the block is disabled or has
+    no entries yet."""
+    return learned_preferences.prompt_block(project_entry)
 
 # Paths to the Claude Code CLI in order of preference. run_claude.sh resolves
 # `claude` from PATH; we fall back to a direct nvm path if PATH lookup fails
@@ -169,17 +205,28 @@ def resolve_claude_cli() -> str:
 
 def build_prompt(*, reply_text: str, link_url: str, thread_text: str,
                  project: str, platform: str,
-                 voice_relationship: str = "first_party") -> str:
-    """Compose the one-shot prompt for the bridge sentence.
-
-    Kept tight on purpose: the model gets only the four pieces of context it
-    needs, plus a precise output contract. No tools, no MCP, no file access.
+                 voice_relationship: str = "first_party",
+                 learned_prefs_block: str = "",
+                 bridge_budget: int | None = None) -> str:
+    """Compose the one-shot prompt for the bridge sentence ONLY.
+
+    The model is never asked to reproduce or rewrite the reply already
+    drafted; it's shown that text for context and told explicitly not to
+    repeat it. main() appends whatever comes back to the UNMODIFIED
+    reply_text in Python afterward — the model's output is never substituted
+    for the drafted reply, only concatenated after it, so it structurally
+    cannot rewrite the drafted body regardless of what it outputs.
 
     `voice_relationship` ("first_party" | "third_party") is resolved by the
     caller from config.json and selects the example sentences + voice rule
     embedded in the prompt. third_party projects (Agora, Runner, Podlog,
     studyly, NightOwl, PieLine as of 2026-05-27) MUST be referred to in
     third-person; first_party projects own the "we ship / we built" voice.
+
+    `learned_prefs_block` is the project's rendered learned_preferences
+    (learned_preferences.prompt_block()), the same distilled human-review
+    feedback the main drafting prompt treats as mandatory; empty when the
+    project has no notes yet.
     """
     if voice_relationship == "third_party":
         voice_rule = (
@@ -209,27 +256,35 @@ def build_prompt(*, reply_text: str, link_url: str, thread_text: str,
             f"  - \"we ship the same recall-on-revisit pattern in {project}, scores against a 4-axis rubric, {link_url}\""
         )
 
-    # X-specific hard length budget. Pass the agent the current body length AND
-    # the budget so it self-fits by compressing the body, keeping the link at
-    # the end. Other platforms (reddit/linkedin) have far larger ceilings, so we
-    # add no tight cap there.
+    # X-specific hard length budget. The reply's body is FIXED (never resized
+    # by the model); only the bridge sentence's own budget matters, computed
+    # by the caller from how much room the already-drafted body leaves.
+    # Other platforms (reddit/linkedin) have far larger ceilings, so we add
+    # no tight cap there.
     length_rule = ""
-    if platform == "twitter":
-        body_len = len(reply_text or "")
+    if platform == "twitter" and bridge_budget is not None:
         length_rule = (
-            f"HARD LENGTH LIMIT (X counts EVERY link as exactly 23 characters, "
-            f"no matter how long it looks):\n"
-            f"- The entire final reply must be \u2264 {TWEET_LIMIT} characters with "
-            f"the URL counted as {URL_WEIGHT}. That means everything EXCEPT the "
-            f"URL must total \u2264 {TWITTER_TEXT_BUDGET} characters.\n"
-            f"- The drafted body is currently {body_len} characters. If body + "
-            f"bridge would exceed {TWITTER_TEXT_BUDGET} chars of text, COMPRESS "
-            f"the body to make room: tighten wording, drop the weakest clause, "
-            f"but keep the single strongest claim and keep the URL at the very "
-            f"end. Never drop or move the link.\n"
+            f"HARD LENGTH LIMIT for YOUR SENTENCE ONLY (X counts EVERY link as "
+            f"exactly {URL_WEIGHT} characters, no matter how long it looks; "
+            f"that's already reserved below):\n"
+            f"- Everything you write BEFORE the URL must be \u2264 {max(bridge_budget, 0)} "
+            f"characters. The reply above is fixed length; you are not resizing "
+            f"it, only adding a short sentence after it.\n"
         )
 
-    return f"""You are writing the FINAL bridge sentence that folds a product link into a social media reply we already drafted. This is a one-shot task. Output ONLY the bridge sentence (no preamble, no explanation, no quotes).
+    learned_prefs_section = ""
+    if learned_prefs_block:
+        learned_prefs_section = (
+            learned_prefs_block.strip() + "\n"
+            "The draft_style_notes / edit_examples entries above are MANDATORY "
+            "for how you phrase your bridge sentence, same as they are for the "
+            "original draft; on conflict they override the example sentences "
+            "below. The audience/thread avoid-prefer entries are about "
+            "candidate judging, already applied earlier in the pipeline \u2014 not "
+            "your job here.\n"
+        )
+
+    return f"""You are writing ONLY the bridge sentence that gets APPENDED after a social media reply we already drafted (shown below). This is a one-shot task. Output ONLY the bridge sentence itself: no preamble, no explanation, no quotes, and do NOT repeat, paraphrase, or rewrite any part of the reply below \u2014 it is already final and will be appended before your output automatically, verbatim.
 
 PLATFORM: {platform}
 PROJECT: {project}
@@ -237,33 +292,32 @@ LANDING PAGE URL: {link_url}
 
 {voice_rule}
 
+{learned_prefs_section}
+
 {length_rule}
 
 ORIGINAL THREAD WE ARE REPLYING TO:
 {thread_text}
 
-REPLY WE ALREADY DRAFTED (its last sentence is what your bridge will REPLACE / EXTEND):
+REPLY ALREADY DRAFTED (fixed, DO NOT repeat or modify \u2014 your sentence is appended after this automatically):
 {reply_text}
 
 YOUR TASK:
-Rewrite the reply so the LAST sentence is a 1-sentence (≤ 22 words) bridge that:
-  1. References the SINGLE strongest specific claim, mechanism, or detail from the existing reply (e.g. "rephrasing on revisit", "a 4-axis rubric", "200ms p95", "automatic distractor scoring") — pick ONE concrete thing, not a category.
-  2. Names a CONCRETE PRODUCT MECHANISM that delivers it (verb + noun, inferred from the URL slug + project context). Do NOT say "a tool for this", "something that helps", "made this for it" — those are banned.
+Write ONE bridge sentence (\u2264 22 words) that:
+  1. References the SINGLE strongest specific claim, mechanism, or detail from the reply above (e.g. "rephrasing on revisit", "a 4-axis rubric", "200ms p95", "automatic distractor scoring") \u2014 pick ONE concrete thing, not a category.
+  2. Names a CONCRETE PRODUCT MECHANISM that delivers it (verb + noun, inferred from the URL slug + project context). Do NOT say "a tool for this", "something that helps", "made this for it" \u2014 those are banned.
   3. Ends with the URL exactly as given. No period after. No "click here", "check it out", "give it a try".
-  4. Reads in the voice of the reply (lowercase if reply is lowercase, casual if reply is casual).
+  4. Reads in the voice of the reply above (lowercase if reply is lowercase, casual if reply is casual).
   5. Obeys the VOICE RELATIONSHIP rule above. This rule overrides any default phrasing instinct.
-
-REPLACEMENT RULE:
-- If the reply has a clear empathy/advice body, KEEP that body verbatim and append the bridge as a new sentence (separated by a single space).
-- If the reply already trails off with weak filler, REPLACE just the trailing weak portion with the bridge.
+  6. Obeys the LEARNED PREFERENCES above when present. This rule overrides the example sentences below on conflict.
 
 OUTPUT FORMAT (strict):
-Output the FULL FINAL REPLY TEXT (body + bridge sentence ending in URL) on a single line. Nothing else. No JSON, no markdown, no quotes.
+Output ONLY your bridge sentence, ending in the URL, on a single line. Nothing else: no JSON, no markdown, no quotes, and absolutely none of the reply text shown above.
 
-Example bridge sentences (do NOT copy verbatim — these are FORM examples, voice-matched to this project):
+Example bridge sentences (do NOT copy verbatim \u2014 these are FORM examples, voice-matched to this project):
 {example_block}
 
-Write the final reply now."""
+Write the bridge sentence now."""
 
 
 def _unwrap_queue_envelope(text: str) -> str:
@@ -411,52 +465,51 @@ THIRD_PARTY_VOICE_VIOLATIONS = (
 )
 
 
-def passes_quality_gate(final_text: str, link_url: str,
+def passes_quality_gate(bridge: str, link_url: str,
                         voice_relationship: str = "first_party",
-                        limit: int | None = None
                         ) -> tuple[bool, str]:
     """Return (passes, reason_if_not).
 
+    Validates the model-written BRIDGE SENTENCE ALONE. reply_text is trusted,
+    already-vetted content that this function never sees and never judges —
+    the append-only contract means reply_text can't fail this gate, only the
+    newly generated bridge can.
+
     Hard rules:
       - must contain link_url
       - must end with link_url (allow trailing whitespace, nothing else)
       - must NOT contain banned phrases
-      - must not be shorter than reply text would have been (silly model fail)
+      - must not be wildly longer than a sentence (MAX_BRIDGE_CHARS): the
+        model ignored the "bridge sentence only" contract and is attempting
+        a full rewrite — a structural violation, not a phrasing nitpick
       - on third_party projects, must NOT use first-person-plural product
         ownership phrases ("we ship", "we built", "our product", ...). The
-        link_tail prompt now selects voice-matched examples but the model can
+        link_tail prompt selects voice-matched examples but the model can
         still drift; on violation we fall back to the mechanical concat so
         the post still ships without impersonating the client (root cause of
         the 2026-05-27 Agora OODAO incident).
     """
-    if not final_text:
+    if not bridge:
         return (False, "empty")
-    if link_url not in final_text:
+    if link_url not in bridge:
         return (False, "no_url")
     # Trailing-URL check (nothing meaningful after URL, optional ./! is fine
     # to strip; but our prompt forbids trailing period — so just check no
     # alphanumeric content follows).
-    tail = final_text.split(link_url, 1)[1].strip()
+    tail = bridge.split(link_url, 1)[1].strip()
     if tail and re.search(r"[A-Za-z0-9]", tail):
         return (False, f"content_after_url: {tail[:40]!r}")
-    lower = final_text.lower()
+    lower = bridge.lower()
     for phrase in BANNED_PHRASES:
         if phrase in lower:
             return (False, f"banned_phrase: {phrase!r}")
     if voice_relationship == "third_party":
         for rx in THIRD_PARTY_VOICE_VIOLATIONS:
-            m = rx.search(final_text)
+            m = rx.search(bridge)
             if m:
                 return (False, f"third_party_voice_violation: {m.group(0)!r}")
-    # Length sanity: model returning a 5-word stub is a fail.
-    if len(final_text.split()) < 8:
-        return (False, "too_short")
-    # Upper-length backstop (twitter): X-weighted length must fit the cap. The
-    # caller trims the body to fit BEFORE the gate, so this should only trip on
-    # a degenerate trim; on trip we fall back to the (also budget-enforced)
-    # mechanical concat.
-    if limit is not None and x_weighted_len(final_text) > limit:
-        return (False, f"too_long:{x_weighted_len(final_text)}>{limit}")
+    if len(bridge) > MAX_BRIDGE_CHARS:
+        return (False, f"bridge_too_long:{len(bridge)}>{MAX_BRIDGE_CHARS}")
     return (True, "")
 
 
@@ -530,14 +583,43 @@ def main() -> int:
         print(json.dumps(out), flush=True)
         return 0
 
-    voice_relationship = args.voice_relationship or resolve_voice_relationship(args.project)
+    project_entry = _load_project_entry(args.project)
+    voice_relationship = args.voice_relationship or resolve_voice_relationship(project_entry)
+    learned_prefs_block = resolve_learned_preferences_block(project_entry)
     # Length cap is X-specific; reddit/linkedin pass None (no tail trim).
     limit = TWEET_LIMIT if args.platform == "twitter" else None
+
+    # Deterministic no-room guard: if the already-drafted reply alone leaves
+    # no meaningful space for a bridge sentence before the (flat-weighted)
+    # URL, skip the Claude call outright — a squeezed-in fragment is worse
+    # than no bridge — and fall back to the mechanical concat like any other
+    # failure path.
+    bridge_budget = None
+    if limit is not None:
+        bridge_budget = limit - URL_WEIGHT - 1 - x_weighted_len(reply_text)
+        if bridge_budget < MIN_BRIDGE_CHARS:
+            fb_text, fb_trim = enforce_budget(
+                mechanical_fallback(reply_text, link_url), link_url, limit)
+            out = {
+                "ok": True,
+                "text": fb_text,
+                "tail": link_url,
+                "model_call_ok": False,
+                "fallback_used": True,
+                "budget_trimmed": fb_trim,
+                "error": f"no_room_for_bridge:{bridge_budget}",
+                "elapsed_sec": 0.0,
+            }
+            print(json.dumps(out), flush=True)
+            return 0
+
     prompt = build_prompt(
         reply_text=reply_text, link_url=link_url,
         thread_text=(args.thread_text or "").strip()[:2000],
         project=args.project, platform=args.platform,
         voice_relationship=voice_relationship,
+        learned_prefs_block=learned_prefs_block,
+        bridge_budget=bridge_budget,
     )
 
     started = time.time()
@@ -562,16 +644,9 @@ def main() -> int:
         print(json.dumps(out), flush=True)
         return 0
 
-    cleaned = clean_output(raw)
-    # Trim the body to fit BEFORE the gate so a good model bridge is preserved
-    # (we trim the body, never the link) instead of being thrown away for being
-    # a few chars over. No-op on non-twitter (limit is None).
-    budget_trimmed = False
-    if limit is not None:
-        cleaned, budget_trimmed = enforce_budget(cleaned, link_url, limit)
-    passes, reason = passes_quality_gate(cleaned, link_url,
-                                         voice_relationship=voice_relationship,
-                                         limit=limit)
+    bridge = clean_output(raw)
+    passes, reason = passes_quality_gate(bridge, link_url,
+                                         voice_relationship=voice_relationship)
     if not passes:
         fb_text, fb_trim = enforce_budget(
             mechanical_fallback(reply_text, link_url), link_url,
@@ -590,23 +665,24 @@ def main() -> int:
         print(json.dumps(out), flush=True)
         return 0
 
-    # Successful path: extract the bridge tail (everything after the original
-    # reply body's prefix, OR the last sentence containing the URL).
-    tail = ""
-    # Heuristic: the bridge is the last sentence in cleaned. Split on ". " or
-    # "! " or "? "; take the last chunk.
-    chunks = re.split(r"(?<=[.!?])\s+", cleaned)
-    for c in reversed(chunks):
-        if link_url in c:
-            tail = c.strip()
-            break
-    if not tail:
-        tail = cleaned
+    # Successful path: append the model-written bridge to the UNMODIFIED
+    # reply_text. This is the deterministic append-only guarantee — the
+    # model's output was validated above as a standalone sentence and is
+    # never substituted for reply_text, only concatenated after it.
+    final_text = f"{reply_text.rstrip()} {bridge}".strip()
+    budget_trimmed = False
+    if limit is not None:
+        # Belt-and-suspenders: should be a no-op given the bridge_budget
+        # precheck above, unless the model ignored the length rule. Trims
+        # from the END of the pre-URL text (the model's own bridge, appended
+        # last), so a well-behaved reply_text is only touched in the
+        # degenerate case where reply_text alone already exceeds the limit.
+        final_text, budget_trimmed = enforce_budget(final_text, link_url, limit)
 
     out = {
         "ok": True,
-        "text": cleaned,
-        "tail": tail,
+        "text": final_text,
+        "tail": bridge,
         "model_call_ok": True,
         "fallback_used": False,
         "budget_trimmed": budget_trimmed,

package/scripts/mark_event.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""Bracket a HOST-NATIVE tool call (create_scheduled_task, list_scheduled_tasks,
+update_scheduled_task) with an explicit start/end marker.
+
+WHY THIS EXISTS: those tools run entirely inside the Claude Desktop host
+process, invisible to S4L's own tool-call telemetry (which only sees our own
+MCP tools, e.g. queue_setup). During the Karol 2026-07-07 update-orphan
+incident, create_scheduled_task and list_scheduled_tasks each silently hung
+for 35-56 minutes with zero signal anywhere except manually reading gaps
+between transcript message timestamps after the fact. This script is meant to
+be run by the AGENT (via Bash), bracketing exactly those calls, per the
+instructions baked into REARM_PROMPT / DIAGNOSE_PROMPT_TEMPLATE
+(mcp/menubar/s4l_menubar.py) and the dashboard panel's copy (mcp/panel/panel.ts).
+
+Usage:
+  mark_event.py start <tool_name>   # call immediately BEFORE the host tool call
+  mark_event.py end <tool_name>     # call immediately AFTER it returns
+
+State: one small JSON file per tool_name under
+~/.social-autoposter-mcp/host-tool-calls/<tool_name>.json. 'start' writes it;
+'end' reads + removes it and computes the elapsed duration. A mismatched or
+missing start on 'end' still reports (duration unknown) rather than silently
+no-op'ing, so a broken bracket is itself visible in the log line.
+
+Best-effort end to end: never raises, never blocks the caller, exits 0 always
+(a failure here must not stop the actual scheduled-task registration).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import time
+
+# Only page/record when the call was slow enough to matter — routine
+# sub-second calls shouldn't generate a Sentry event on every re-arm. 120s
+# matches the "consecutive check" cadence used elsewhere in this codebase
+# (e.g. autopilot_stall_watch.py's launchd interval).
+SLOW_THRESHOLD_S = 120.0
+
+
+def _state_dir() -> str:
+    return os.path.join(os.path.expanduser("~"), ".social-autoposter-mcp", "host-tool-calls")
+
+
+def _state_path(tool_name: str) -> str:
+    safe = "".join(c if (c.isalnum() or c in "-_") else "_" for c in tool_name)
+    return os.path.join(_state_dir(), f"{safe}.json")
+
+
+def _report(message: str, level: str, tags: dict, extra: dict | None = None) -> None:
+    try:
+        repo = os.environ.get("S4L_REPO_DIR")
+        if repo:
+            scripts_dir = os.path.join(repo, "scripts")
+            if scripts_dir not in sys.path:
+                sys.path.insert(0, scripts_dir)
+        else:
+            # No S4L_REPO_DIR in this chat turn's env — fall back to this
+            # script's own directory, which IS scripts/ (sentry_init lives
+            # right next to it).
+            here = os.path.dirname(os.path.abspath(__file__))
+            if here not in sys.path:
+                sys.path.insert(0, here)
+        import sentry_init
+
+        sentry_init.init()
+        sentry_init.capture_message(message, level=level, tags=tags, extra=extra)
+        sentry_init.flush()
+    except Exception:
+        pass
+
+
+def cmd_start(tool_name: str) -> int:
+    try:
+        os.makedirs(_state_dir(), exist_ok=True)
+        tmp = f"{_state_path(tool_name)}.tmp.{os.getpid()}"
+        with open(tmp, "w") as f:
+            json.dump({"tool_name": tool_name, "started_at": time.time()}, f)
+        os.replace(tmp, _state_path(tool_name))
+    except Exception as e:
+        sys.stderr.write(f"[mark-event] start write failed for {tool_name}: {e}\n")
+    sys.stderr.write(f"[mark-event] host tool call started: {tool_name}\n")
+    return 0
+
+
+def cmd_end(tool_name: str) -> int:
+    started_at = None
+    try:
+        with open(_state_path(tool_name)) as f:
+            started_at = (json.load(f) or {}).get("started_at")
+    except Exception:
+        pass
+    try:
+        os.remove(_state_path(tool_name))
+    except Exception:
+        pass
+
+    duration = (time.time() - started_at) if started_at else None
+    if duration is not None:
+        sys.stderr.write(f"[mark-event] host tool call finished: {tool_name} took {duration:.1f}s\n")
+        if duration > SLOW_THRESHOLD_S:
+            _report(
+                f"S4L host tool call was slow: {tool_name} took {duration:.1f}s",
+                level="warning",
+                tags={"component": "host_tool_timing", "tool_name": tool_name},
+                extra={"duration_seconds": round(duration, 1)},
+            )
+    else:
+        sys.stderr.write(f"[mark-event] host tool call finished: {tool_name} (no matching start)\n")
+    return 0
+
+
+def main() -> int:
+    if len(sys.argv) != 3 or sys.argv[1] not in ("start", "end"):
+        sys.stderr.write("usage: mark_event.py start|end <tool_name>\n")
+        return 0  # never a hard failure for the calling agent
+    action, tool_name = sys.argv[1], sys.argv[2]
+    return cmd_start(tool_name) if action == "start" else cmd_end(tool_name)
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except Exception as e:
+        sys.stderr.write(f"[mark-event] unexpected error: {e}\n")
+        sys.exit(0)

package/scripts/memory_snapshot.py

@@ -604,6 +604,7 @@ def build_snapshot(top_n: int) -> dict[str, Any]:
         "repo_dir": str(REPO_DIR),
         "claude_desktop_version": claude_desktop_version(),
         "reaper": reaper_status(),
+        "menubar": menubar_status(),
         "memory": parse_vm_stat(),
         "process_count": len(rows),
         "top_rss": [
@@ -696,7 +697,9 @@ def build_summary() -> dict[str, Any]:
         "app_version": _app_version(),
         "claude_desktop_version": claude_desktop_version(),
         "reaper": reaper_status(),
+        "menubar": menubar_status(),
         "twitter_cycle": twitter_cycle_status(),
+        "draft_publish": draft_publish_wrapper_status(),
         "process_count": len(rows),
         "mem": {
             "total_mb": total,
@@ -765,6 +768,39 @@ def claude_desktop_version() -> str | None:
     return None
 
 
+def menubar_status() -> dict[str, Any] | None:
+    """Last status-item visibility probe written by s4l_menubar._icon_watch_tick(),
+    or None. A live menubar PROCESS says nothing about whether macOS is drawing
+    its icon (2026-07-07: a customer's menubar ran ~25 min icon-less after a
+    reboot and support had no remote signal). Carrying this on the heartbeat
+    makes "process up, icon hidden" diagnosable centrally. age_sec doubles as a
+    process-liveness hint: the menubar rewrites the file every ~60s, so a stale
+    file means the menubar itself is down."""
+    path = (
+        Path(os.environ.get("S4L_STATE_DIR", str(Path.home() / ".social-autoposter-mcp")))
+        / "menubar-state.json"
+    )
+    try:
+        if not path.exists():
+            return None
+        ds = json.loads(path.read_text())
+        age = None
+        try:
+            age = round(time.time() - path.stat().st_mtime, 1)
+        except OSError:
+            pass
+        return {
+            "age_sec": age,  # >150s means the menubar process itself is likely dead
+            "pid": ds.get("pid"),
+            "uptime_sec": ds.get("uptime_sec"),
+            "statusitem_on_screen": ds.get("statusitem_on_screen"),
+            "statusitem_visible_pref": ds.get("statusitem_visible_pref"),
+            "hidden_for_sec": ds.get("hidden_for_sec"),
+        }
+    except Exception:
+        return None
+
+
 def reaper_status() -> dict[str, Any] | None:
     """Last cycle written by reap_stale_claude_sessions.py::write_status(), or None.
 
@@ -836,6 +872,32 @@ def twitter_cycle_status() -> dict[str, Any] | None:
         return None
 
 
+def draft_publish_wrapper_status() -> dict[str, Any] | None:
+    """Tail of run-draft-and-publish.sh's launchd stderr log.
+
+    run-twitter-cycle.sh's OWN log (see twitter_cycle_status above) only shows
+    that a cycle drafted; it says nothing about whether those drafts actually
+    became review cards. That decision happens one level up, in the
+    [run-draft-and-publish]/[merge_review_queue] lines this wrapper prints to
+    its own stderr (draft-only on/off, posting-defer skips, merge success/
+    failure/count). Those lines land in a real file via the launchd plist's
+    StandardErrorPath, but nothing centrally tailed them, which blinded the
+    2026-07-08 Karol investigation to whether merges were succeeding even
+    though the inner cycle log looked healthy. Best-effort."""
+    try:
+        p = REPO_DIR / "skill" / "logs" / "launchd-twitter-cycle-stderr.log"
+        if not p.exists():
+            return None
+        lines = [ln.strip() for ln in _tail_lines(p, 16) if ln.strip()]
+        return {
+            "log": p.name,
+            "age_sec": round(time.time() - p.stat().st_mtime, 1),
+            "last_lines": [ln[:200] for ln in lines[-8:]],
+        }
+    except Exception:
+        return None
+
+
 def _tail_lines(path: Path, n: int, approx_line_bytes: int = 4096) -> list[str]:
     """Return the last `n` lines of a possibly-large file without reading it all.
     Reads a bounded tail window (n * approx_line_bytes) from the end. Best-effort."""

package/scripts/pick_twitter_thread_target.py

@@ -154,7 +154,7 @@ def main():
         sys.exit(3)
 
     project_recents = recent_angles_by_project(ctx.get("project_angles"))
-    candidates = build_candidates(config, project_recents)
+    candidates, _ = build_candidates(config, project_recents)
     recent_project_counts = ctx.get("recent_posts_by_project") or {}
 
     if args.show_all: