@m13v/s4l 1.7.2-rc.9 → 1.7.3

package/scripts/_process_li_notifs.py

@@ -0,0 +1,91 @@
+import json, re, urllib.parse
+
+NOTIFS = "/tmp/li_notifs.json"
+CID = "/Users/matthewdi/.claude/projects/-/f0a4ef0d-11f2-4618-85e2-bf62ad39cea2/tool-results/brzcccx3h.txt"
+PAIRS = "/Users/matthewdi/.claude/projects/-/f0a4ef0d-11f2-4618-85e2-bf62ad39cea2/tool-results/bu0y0bphg.txt"
+POSTS = "/Users/matthewdi/.claude/projects/-/f0a4ef0d-11f2-4618-85e2-bf62ad39cea2/tool-results/bnb5ginhc.txt"
+
+def load_lines(p):
+    out=[]
+    for ln in open(p, encoding="utf-8", errors="replace"):
+        ln=ln.rstrip("\n")
+        # skip persisted-output wrapper lines
+        if not ln or ln.startswith("<") or ln.startswith("Output too large") or ln.startswith("Preview") or ln.startswith("..."):
+            continue
+        out.append(ln)
+    return out
+
+comment_ids = set(load_lines(CID))
+pairs = set(load_lines(PAIRS))
+posts = load_lines(POSTS)
+
+# activity number -> post id
+post_by_act = {}
+for ln in posts:
+    if "|" not in ln: continue
+    pid, url = ln.split("|",1)
+    for m in re.findall(r"urn:li:(?:activity|share|ugcPost):(\d+)", url):
+        post_by_act[m]=pid
+
+# config projects search_topics
+cfg = json.load(open("/Users/matthewdi/social-autoposter/config.json"))
+projtopics = []
+for pr in cfg.get("projects",[]):
+    projtopics.append((pr["name"], [t.lower() for t in pr.get("search_topics",[])]))
+
+EXCLUDED = {"louis030195","louis3195"}
+OWN = {"matthew diakonov","m13v"}
+
+def match_project(snippet):
+    s = snippet.lower()
+    best=None; bestscore=0
+    for name, topics in projtopics:
+        score=0
+        for t in topics:
+            if t and t in s:
+                score+=1
+        if score>bestscore:
+            bestscore=score; best=name
+    return best or "S4L"
+
+data = json.load(open(NOTIFS))
+decisions=[]
+for d in data:
+    href = d["href"]
+    dec = urllib.parse.unquote(href)
+    m = re.search(r"urn:li:activity:(\d+)", dec)
+    activity_id = m.group(1) if m else None
+    comment_urn = d["comment_urn"]
+    author = d["author"]
+    a_low = author.lower().strip()
+    rec = dict(author=author, activity_id=activity_id, comment_urn=comment_urn,
+               snippet=d["snippet"], href=href, type=d["type"])
+    if not comment_urn or not activity_id:
+        rec["decision"]="no_comment_urn"; decisions.append(rec); continue
+    if a_low in OWN:
+        rec["decision"]="own_account"; decisions.append(rec); continue
+    if a_low in EXCLUDED or any(x in a_low for x in EXCLUDED):
+        rec["decision"]="excluded_author"; decisions.append(rec); continue
+    if comment_urn in comment_ids:
+        rec["decision"]="already_tracked"; decisions.append(rec); continue
+    our_url = "https://www.linkedin.com/feed/update/urn:li:activity:%s/" % activity_id
+    apk = author + "|||" + our_url
+    if apk in pairs:
+        rec["decision"]="author_already_engaged"; decisions.append(rec); continue
+    # match post
+    pid = post_by_act.get(activity_id)
+    rec["post_id"]=pid
+    rec["project"]=match_project(d["snippet"])
+    rec["decision"]="INSERT"
+    decisions.append(rec)
+
+json.dump(decisions, open("/tmp/li_decisions.json","w"))
+# summary
+from collections import Counter
+c=Counter(r["decision"] for r in decisions)
+print("TOTAL", len(decisions))
+for k,v in c.items(): print(k,v)
+print("---INSERTS---")
+for i,r in enumerate(decisions):
+    if r["decision"]=="INSERT":
+        print(i, r["author"], "| act", r["activity_id"], "| post", r.get("post_id"), "| proj", r["project"])

package/scripts/feedback_digest.py

@@ -203,7 +203,7 @@ CURRENT content_guardrails.do_not: {json.dumps(guard_do_not)}
 NEW REVIEW EVENTS since the last digest ({len(rejected)} rejected, {len(no_reason)} of the rejects without a stated reason, {len(approved)} approved, {len(loved)} of the approvals loved):
 {ev_lines}{overall_block}
 
-Categories: wrong_author = the thread's author/audience was a bad fit; off_topic = the thread itself was a bad fit; bad_draft = thread was fine but the written reply was off; other = see the note. "no_reason_given" means the user rejected without picking a category or typing a note: the rejection itself is real, but WHY is your inference from the author/thread/draft context alone, so treat it as weak evidence. It can corroborate a pattern that reasoned events already show, but a no_reason_given reject never justifies a new entry or an author block on its own, and 2+ of them agreeing still only justify an entry when the shared pattern in their context is unmistakable. "edited_before_approving" with an ORIGINAL/REWROTE pair means the user hand-corrected our draft before posting: the rewrite is a direct statement of the voice they want. Diff the pair; when 2+ edits show the same correction (a phrase type removed, a structure replaced, tone shifted, length cut), distill that recurring pattern into draft_style_notes. Ignore edit content that is lead-specific or cosmetic (typo fixes, one-off facts); learn only what generalizes. "user_checked=profile_click" means the user opened the author's profile before deciding (a strong author-quality signal even without a note). "[approved+loved]" means the user picked a stronger emoji in the approve row ("this was a really good one"; approve_level_N in interactions carries the strength, 3 = best of the best): strong positive evidence for audience_prefer and thread selection, worth roughly two plain approvals.
+Categories: wrong_author = the thread's author/audience was a bad fit; off_topic = the thread itself was a bad fit; bad_draft = thread was fine but the written reply was off; other = see the note. "no_reason_given" means the user rejected without picking a category or typing a note: the rejection itself is real, but WHY is your inference from the author/thread/draft context alone, so treat it as weak evidence. It can corroborate a pattern that reasoned events already show, but a no_reason_given reject never justifies a new entry or an author block on its own, and 2+ of them agreeing still only justify an entry when the shared pattern in their context is unmistakable. "edited_before_approving" with an ORIGINAL/REWROTE pair means the user hand-corrected our draft before posting: the rewrite is a direct statement of the voice they want. Diff the pair; when 2+ edits show the same correction (a phrase type removed, a structure replaced, tone shifted, length cut), distill that recurring pattern into draft_style_notes. Ignore edit content that is lead-specific or cosmetic (typo fixes, one-off facts); learn only what generalizes. "user_checked=profile_click" means the user opened the author's profile before deciding (a strong author-quality signal even without a note). "[approved+loved]" means the user picked the heart in the approve row ("this was a really good one"; approve_level_N in interactions carries the strength, 2 = best of the best): strong positive evidence for audience_prefer and thread selection, worth roughly two plain approvals.
 
 You can also block SPECIFIC authors via the plan's block_authors list. A block is a permanent hard exclusion of that one handle from all future thread selection, so it is YOUR judgment call, never automatic. Block when the evidence is strong: a wrong_author reject IS a direct human statement about that author (especially with profile_click), and the author context (author_followers, their post, found_via_topic) or the user's note confirms the account itself was the problem rather than the topic. Do NOT block when the reject looks topic-driven (off_topic/bad_draft on a reasonable account) or when you are unsure; the generalizable TYPE entry in audience_avoid is the softer tool for that.
 

package/scripts/merge_review_queue.py

@@ -19,6 +19,15 @@ Usage:
 
 State dir (for review-request.json) honors $S4L_STATE_DIR; the review-queue plan
 lives in $S4L_TMP_DIR or /tmp (matching the MCP's planPath()).
+
+LEDGER SEMANTICS (read this before counting anything in review-queue.json):
+the queue is APPEND-FOREVER — handled candidates are never removed, they are
+flag-stamped in place (posted / terminal+terminal_reason / post_failed /
+approved). "Not posted" is therefore NOT "awaiting review"; in an old queue
+most rows are retired. The canonical classifier is
+mcp/menubar/s4l_state.py::candidate_state(); the honest pending-cards count is
+its awaiting_review bucket, mirrored into review-request.json's .count here at
+merge time.
 """
 
 from __future__ import annotations
@@ -129,16 +138,47 @@ STATS_KEYS = (
 )
 
 
-def _enrich_with_stats(cands: list) -> int:
-    """Stamp a `stats` sidecar onto plan candidates that lack one, from the
-    twitter_candidates rows the discovery pipeline already wrote. ONE listing
-    call (/api/v1/twitter-candidates?tweet_urls=...) covers the whole queue.
-    Best-effort: any failure (offline box, missing identity, API error) leaves
-    candidates unstamped and NEVER blocks card delivery. Returns count stamped."""
-    want = [c for c in cands if not c.get("stats") and not c.get("posted") and _thread_url(c)]
-    if not want:
-        return 0
-    urls = sorted({_thread_url(c) for c in want})[:500]
+def _sync_with_backend(cands: list) -> tuple[int, int]:
+    """One bulk /api/v1/twitter-candidates lookup for every still-open candidate
+    (not posted, not terminal), used for two things:
+
+      - stamp the discovery-time `stats` sidecar the card renders (candidates
+        that already have one are left alone), same as the old
+        _enrich_with_stats this replaces.
+      - notice when the backend has ALREADY retired a candidate this plan
+        still thinks is 'pending' (most commonly the Phase 0 freshness gate
+        flipping status='expired' after FRESHNESS_HOURS — see
+        skill/run-twitter-cycle.sh) and mark it terminal here too, same as a
+        human "discard all pending" would. Without this, a card can sit in
+        the review queue as an approvable draft long after the backend has
+        moved on; approving it later silently no-ops (post_drafts returns
+        posted:0, no browser ever launches, no post-*.log — see the
+        2026-07-09 "approved 3 cards, nothing posted" investigation).
+
+    Runs on EVERY merge (every cycle), not just once per candidate, so status
+    drift after the initial stamp is still caught while a card is still
+    pending. Best-effort: any API failure leaves every candidate untouched
+    (fail open, same as before). Returns (stamped_count, pruned_count).
+
+    APPROVED cards are exempt from the prune: an approval is a settled human
+    decision awaiting its serialized post, and stamping terminal on it makes
+    post_drafts refuse it as already-decided (posted:0). That exact race ate
+    2 of 3 approvals on 2026-07-10 (approved 04:30:02Z, merge stamped
+    backend_status_expired 04:32:33Z, poster refused both). The freshness
+    gate exists to stop stale UNDECIDED drafts from burning review attention;
+    once a human has said "post it", the only honest gate left is the
+    poster's own at-post-time tweet_unavailable check."""
+    pending = [
+        c
+        for c in cands
+        if not c.get("posted")
+        and not c.get("terminal")
+        and not c.get("approved")
+        and _thread_url(c)
+    ]
+    if not pending:
+        return 0, 0
+    urls = sorted({_thread_url(c) for c in pending})[:500]
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         from http_api import api_get
@@ -149,17 +189,24 @@ def _enrich_with_stats(cands: list) -> int:
         )
         rows = (resp.get("data") or {}).get("candidates") or []
     except BaseException as e:  # http_api raises SystemExit on terminal failure
-        print(f"[merge_review_queue] stats enrichment skipped: {e}", file=sys.stderr)
-        return 0
+        print(f"[merge_review_queue] backend sync skipped: {e}", file=sys.stderr)
+        return 0, 0
     by_url = {str(r.get("tweet_url")): r for r in rows if r.get("tweet_url")}
     stamped = 0
-    for c in want:
+    pruned = 0
+    for c in pending:
         row = by_url.get(_thread_url(c))
         if not row:
             continue
-        c["stats"] = {k: row.get(k) for k in STATS_KEYS}
-        stamped += 1
-    return stamped
+        if not c.get("stats"):
+            c["stats"] = {k: row.get(k) for k in STATS_KEYS}
+            stamped += 1
+        status = row.get("status")
+        if status and status != "pending":
+            c["terminal"] = True
+            c["discard_reason"] = f"backend_status_{status}"
+            pruned += 1
+    return stamped, pruned
 
 
 def main() -> int:
@@ -255,9 +302,15 @@ def main() -> int:
         merged.append(c)
         added += 1
 
-    stamped = _enrich_with_stats(merged)
+    stamped, pruned = _sync_with_backend(merged)
     if stamped:
         print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
+    if pruned:
+        print(
+            f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
+            "backend (expired/etc.) before they were reviewed",
+            file=sys.stderr,
+        )
 
     plan_obj = {"candidates": merged}
     if plan_created_at:
@@ -274,15 +327,28 @@ def main() -> int:
         _atomic_write(dst, plan_obj)
         ensure_store_symlink()
 
-        # Refresh the review-request marker the menu bar polls (count = pending, not posted).
-        pending = len([c for c in merged if not c.get("posted")])
+        # Refresh the review-request marker the menu bar polls. count = cards
+        # actually awaiting review (mirrors s4l_state.candidate_state()'s
+        # awaiting_review bucket): approved-unposted and post_failed rows are
+        # settled decisions, counting them inflated the badge and misled every
+        # human/agent reading the marker.
+        pending_count = len(
+            [
+                c
+                for c in merged
+                if not c.get("posted")
+                and not c.get("terminal")
+                and not c.get("post_failed")
+                and not c.get("approved")
+            ]
+        )
         project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
         _atomic_write(
             review_request_path(),
             {
                 "batch_id": REVIEW_QUEUE_ID,
                 "project": project,
-                "count": pending,
+                "count": pending_count,
                 "plan_path": dst,
                 "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
             },
@@ -306,7 +372,7 @@ def main() -> int:
 
     print(
         f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
-        f"({pending} pending total) from {os.path.basename(src)}",
+        f"({pending_count} pending total) from {os.path.basename(src)}",
         file=sys.stderr,
     )
     # Clean up the consumed batch plan so /tmp doesn't fill with orphans.

package/scripts/pick_project.py

@@ -74,10 +74,17 @@ def recent_posts_by_project(platform=None, days=RECENT_WINDOW_DAYS):
 
 
 def _eligible_pool(config, platform=None, exclude=None):
-    """Projects eligible for selection: enabled, weight>0, platform-compatible."""
+    """Projects eligible for selection: enabled, weight>0, non-persona,
+    platform-compatible.
+
+    Persona entries (`persona: true`) are structurally excluded: they run ONLY
+    via the personal_brand lane's force-inject (s4l_mode.persona_name), never
+    via this promotion lottery, regardless of their `enabled` flag.
+    """
     pool = [
         p for p in config.get("projects", [])
         if p.get("enabled", True) and p.get("weight", 0) > 0
+        and p.get("persona") is not True
     ]
     if exclude:
         excluded = {n.lower() for n in exclude}
@@ -122,8 +129,10 @@ def pick_project(config, platform=None, exclude=None):
         return picks[0]
     if exclude:
         return None
-    # No eligible project at all: legacy fallback to any project in config.
-    projects = config.get("projects", [])
+    # No eligible project at all: legacy fallback to any non-persona project.
+    projects = [
+        p for p in config.get("projects", []) if p.get("persona") is not True
+    ]
     return random.choice(projects) if projects else None
 
 

package/scripts/release-mcpb.sh

@@ -460,7 +460,21 @@ if [[ "$DO_NPM" == "1" ]]; then
          fs.writeFileSync(p, JSON.stringify(j,null,2)+'\n');
          console.log('  temp copy renamed to $S4L_ALIAS_PKG@'+j.version+' (repo package.json untouched)');
        " \
-       && ( cd "$S4L_PUB_DIR/package" && npm publish --access=public ${NPM_TAG_ARGS[@]+"${NPM_TAG_ARGS[@]}"} ); then
+       && (
+            # The registry's large-upload path flakes (TLS bad record mac / EPIPE)
+            # often enough that one attempt let the alias lane silently drift for
+            # three rc's (rc.16/21/22, caught 2026-07-10). Retry, and between
+            # attempts check whether the upload actually landed despite the
+            # client-side error (EPIPE can be a false negative).
+            cd "$S4L_PUB_DIR/package" || exit 1
+            for _try in 1 2 3; do
+              npm publish --access=public ${NPM_TAG_ARGS[@]+"${NPM_TAG_ARGS[@]}"} && exit 0
+              sleep 3
+              [[ "$(curl -s -o /dev/null -w '%{http_code}' "$S4L_ALIAS_URL")" == "200" ]] && exit 0
+              echo "  dual-publish attempt $_try/3 failed" >&2
+            done
+            exit 1
+          ); then
       for _ in 1 2 3 4 5; do
         sleep 2
         [[ "$(curl -s -o /dev/null -w '%{http_code}' "$S4L_ALIAS_URL")" == "200" ]] && break

package/scripts/s4l_mode.py

@@ -58,14 +58,15 @@ Usage:
     s4l_mode.py split               # print the personal-brand share (0.0-1.0)
     s4l_mode.py split <value>       # set it; accepts 70, 70%, or 0.7
 
-Draft-only (2026-07-06): a third, independent flag in mode.json, DEFAULT ON.
-While ON (the normal state), every cycle stops before posting and its drafts
-become review cards. When an OPERATOR turns it off, run-draft-and-publish.sh
-runs promotion-lane cycles with DRAFT_ONLY=0 so they POST autonomously (the
-rolling virality bar is the quality gate). Persona-lane cycles ALWAYS stay
-draft-only (review cards) regardless. Deliberately NOT exposed on any user
-surface (no MCP tool param, no menubar toggle): this CLI and mode.json are the
-only way to flip it.
+Draft-only (2026-07-06, single global switch as of 2026-07-08): a third,
+independent flag in mode.json, DEFAULT ON. While ON (the normal state), every
+cycle stops before posting and its drafts become review cards. When an
+OPERATOR turns it off, run-draft-and-publish.sh runs EVERY lane (promotion AND
+personal_brand) with DRAFT_ONLY=0 so they POST autonomously (promotion
+additionally runs behind the rolling virality bar). This applies uniformly
+across lanes; persona-lane cycles do NOT stay draft-only when the flag is off.
+Deliberately NOT exposed on any user surface (no MCP tool param, no menubar
+toggle): this CLI and mode.json are the only way to flip it.
 `env` additionally exports S4L_CYCLE_LANE=<lane> for both lanes so the wrapper
 knows which lane this cycle is without re-deriving it.
 

package/scripts/schedule_state.py

@@ -38,6 +38,12 @@ States:
                now correctly resolves to 'missing' (below), since the account
                scoping means an orphaned OTHER account's registry is never
                consulted for the active account's health.
+               DIAGNOSTIC-ONLY for the menu bar ⚠ since 2026-07-09: under the
+               wedge the tick can skip 70-90% of fires while the queue still
+               drains every job (jobs arrive ~every 8 min vs 60 fires/hr), so
+               a point-in-time lastRunAt check flip-flops against a healthy
+               pipeline. The menu bar alarms on queue latency instead and
+               renders 'stalled' as a plain detail line via tick_stats().
   'missing'  — the ACTIVE account has no registry with a complete worker set
                (deleted / never scheduled / orphaned by an account switch)
                -> the dashboard offers "Set up draft schedule". Consumers
@@ -270,6 +276,53 @@ def _detail(glob_pattern: str | None = None) -> dict:
     return {"glob": patterns, "registries": regs}
 
 
+def tick_stats(window_s: int = 3600, glob_pattern: str | None = None) -> dict:
+    """Diagnostic tick-level stats for the active account's worker set: how many
+    per-minute fires the host SKIPPED inside the last window_s (the registry's
+    recordedSkips ledger — under the Desktop warm-session wedge these carry
+    reason per_task_limit) plus the age of the newest successful run. Powers the
+    menu bar's non-alarm "scheduler degraded" detail line when compute() returns
+    'stalled'. NEVER a health verdict on its own: a box skipping 80% of ticks
+    can still drain every job (jobs arrive ~every 8 min vs 60 fires/hr), which
+    is exactly why tick staleness stopped driving the attention ⚠ (2026-07-09).
+    Same account scoping as compute(); pass glob_pattern only for tests."""
+    patterns = [glob_pattern] if glob_pattern is not None else _active_registry_glob_patterns()
+    now = time.time()
+    skips = 0
+    last_skip_epoch = None
+    newest_epoch = None
+    for pattern in patterns:
+        for f in glob.glob(pattern):
+            try:
+                with open(f) as fh:
+                    d = json.load(fh)
+            except Exception:
+                continue
+            by_id = {t.get("id"): t for t in (d.get("scheduledTasks") or [])}
+            recs = _registry_worker_recs(by_id)
+            if recs is None:
+                continue
+            epochs = [_iso_to_epoch(r.get("lastRunAt")) for r in recs]
+            e = max([x for x in epochs if x is not None], default=None)
+            if e is not None and (newest_epoch is None or e > newest_epoch):
+                newest_epoch = e
+            recorded = d.get("recordedSkips") or {}
+            for tid in WORKER_TASK_IDS:
+                for s in recorded.get(tid) or []:
+                    at = _ms_to_epoch((s or {}).get("at"))
+                    if at is None or (now - at) > window_s:
+                        continue
+                    skips += 1
+                    if last_skip_epoch is None or at > last_skip_epoch:
+                        last_skip_epoch = at
+    return {
+        "skips_in_window": skips,
+        "window_s": window_s,
+        "last_run_age_s": int(now - newest_epoch) if newest_epoch is not None else None,
+        "last_skip_age_s": int(now - last_skip_epoch) if last_skip_epoch is not None else None,
+    }
+
+
 def main() -> int:
     out = {}
     try:

package/scripts/twitter_post_plan.py

@@ -43,12 +43,59 @@ import json
 import os
 import random
 import re
+import signal
 import subprocess
 import sys
 import time
 from datetime import datetime, timezone
 from pathlib import Path
 
+
+def _neuter_stream(stream) -> None:
+    """Point a dead pipe's fd at /dev/null so later writes (including the
+    interpreter-shutdown flush) can't raise BrokenPipeError again."""
+    try:
+        devnull = os.open(os.devnull, os.O_WRONLY)
+        os.dup2(devnull, stream.fileno())
+        os.close(devnull)
+    except Exception:
+        pass
+
+
+_builtin_print = print
+
+
+def print(*args, **kwargs):  # noqa: A001 -- deliberate builtins.print shadow
+    # When the parent (cycle shell tree or MCP server) is killed mid-batch, our
+    # stdout/stderr pipes close and the next print raises BrokenPipeError. The
+    # old behavior unwound through excepthook (Sentry S4L-8), killing the batch
+    # BETWEEN posting a reply and recording it — which is how live tweets ended
+    # up unlogged and candidates re-feedable. Output to a dead parent is
+    # worthless; the bookkeeping (log_post, update_candidate, audit JSONL) is
+    # not. Swallow the error, neuter the fds, keep going.
+    try:
+        _builtin_print(*args, **kwargs)
+    except BrokenPipeError:
+        _neuter_stream(sys.stdout)
+        _neuter_stream(sys.stderr)
+
+
+# Graceful SIGTERM: the MCP post_drafts timeout (and anything else that asks
+# nicely before SIGKILL) sends SIGTERM. Dying instantly reopens the same
+# posted-but-unrecorded window as the broken pipe, so instead flag the loop to
+# stop at the next candidate boundary: current candidate finishes its
+# bookkeeping, the summary and audit line still get written, exit stays 0.
+_terminate_requested = False
+
+
+def _on_sigterm(signum, frame):
+    global _terminate_requested
+    _terminate_requested = True
+    print("[post] SIGTERM received; stopping after current candidate", flush=True)
+
+
+signal.signal(signal.SIGTERM, _on_sigterm)
+
 # This pipeline ONLY posts (never scans), so mark every twitter_browser.py reply
 # subprocess it spawns as the high-priority "post" lock role. run_subprocess
 # inherits this process env, so the child twitter_browser.py reads S4L_LOCK_ROLE
@@ -1150,6 +1197,10 @@ def main() -> int:
 
     try:
         for _idx, c in enumerate(candidates, start=1):
+            if _terminate_requested:
+                print(f"[post] stopping early on SIGTERM: {_idx - 1}/{_total} "
+                      f"candidates processed, posted={posted}", flush=True)
+                break
             # Live per-post status for the S4L menu bar. LEAD with `posted` (the
             # REAL count of replies that actually landed), not `_idx` (the loop
             # position). _idx races through already-posted / deleted cards as instant
@@ -1224,6 +1275,22 @@ def main() -> int:
                 "reason": reason or "",
                 "our_url": c.get("our_url") or "",
             })
+            # Per-candidate durable record: the run-level audit at the bottom of
+            # main() is lost if this process is SIGKILLed mid-batch (browser-lock
+            # hijack), leaving no local trace of what already posted. Separate
+            # file from post-results.jsonl on purpose: that one is run-level and
+            # the menu bar/dashboard parse it; don't mix schemas.
+            try:
+                _prog_path = os.path.join(
+                    REPO_DIR, "skill", "logs", "post-candidates.jsonl")
+                with open(_prog_path, "a", encoding="utf-8") as _pf:
+                    _pf.write(json.dumps({
+                        "at": datetime.now(timezone.utc).isoformat(),
+                        "plan": plan_path.name,
+                        **candidate_results[-1],
+                    }) + "\n")
+            except Exception:
+                pass
     finally:
         _clear_activity()
         # Release the batch hold so the next scan/post can take the browser

package/skill/run-draft-and-publish.sh

@@ -11,9 +11,10 @@
 #     review-queue cards the menu bar shows. Without this merge the cycle's
 #     plan would sit in a /tmp batch file nobody reads.
 #   - draft-only OFF (operator opt-out via `s4l_mode.py draft-only off`,
-#     promotion-lane cycles only): DRAFT_ONLY=0 — the cycle posts its top-1
-#     pick autonomously, gated by the rolling virality bar. Persona cycles
-#     keep making cards either way.
+#     single global switch across EVERY lane as of 2026-07-08): DRAFT_ONLY=0
+#     — the cycle posts its top-1 pick autonomously; promotion additionally
+#     gated by the rolling virality bar. Persona cycles also post
+#     autonomously when the flag is off; they no longer stay draft-only.
 set -uo pipefail
 
 # SAPS_->S4L_ env mirror (brand rename 2026-07-03): old plists/tasks still