@m13v/s4l 1.7.4-rc.4 → 1.7.4

package/skill/lock.sh

@@ -121,18 +121,42 @@ if [ -z "${_SA_LOCK_DIRS+x}" ]; then
       # is defect "owner=OTHER" (wipes a live peer's lock -> double-hold).
       if _sa_we_own_lock "$d"; then
         _sa_lock_event trap_rm "$_lname" "$(_sa_lock_owner_tag "$d")"
-        echo "[lock] trap-released $_lname pid=$$ at $(date +%H:%M:%S)" >&2
+        echo "[lock] trap-released $_lname pid=$$ at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
         rm -rf "$d"
       else
         _sa_lock_event trap_rm_skipped "$_lname" "$(_sa_lock_owner_tag "$d")"
-        echo "[lock] trap-release SKIPPED $_lname pid=$$ (not owner) at $(date +%H:%M:%S)" >&2
+        echo "[lock] trap-release SKIPPED $_lname pid=$$ (not owner) at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
       fi
     done
     for t in ${_SA_LOCK_TICKETS[@]+"${_SA_LOCK_TICKETS[@]}"}; do
       rm -f "$t"
     done
   }
-  trap _sa_release_locks EXIT INT TERM HUP
+  trap _sa_release_locks EXIT
+  # 2026-07-12: INT/TERM/HUP release locks AND EXIT, instead of sharing the
+  # plain EXIT handler. Scenario this fixes (observed 2026-07-12 12:02:09,
+  # engage-dm-replies.sh pid 72465): a stray signal fired the old combined
+  # trap, which released BOTH held locks and then RESUMED the script (bash
+  # continues after a trapped signal when the handler doesn't exit). The run
+  # kept driving the shared twitter Chrome without its twitter-browser lock,
+  # the twitter cycle legitimately acquired the freed lock and navigated the
+  # same tab mid-send, and all 3 send-dm attempts died with
+  # thread_url_redirected ("shared-tab drift", human_dm_replies id 100045).
+  # A signaled run must never continue lock-protected work: log WHICH signal
+  # hit (the old single-line event gave no clue), clean up once, exit 128+N.
+  # Scripts that install their own combined traps after sourcing this file
+  # (e.g. run-twitter-cycle.sh's _sa_combined_exit) still override these.
+  _sa_exit_on_signal() {
+    local _sig="$1" _code="$2"
+    _sa_lock_event signal_exit "-" "signal=$_sig"
+    echo "[lock] caught SIG${_sig} pid=$$; releasing locks and exiting $_code at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
+    _sa_release_locks
+    trap - EXIT
+    exit "$_code"
+  }
+  trap '_sa_exit_on_signal INT 130' INT
+  trap '_sa_exit_on_signal TERM 143' TERM
+  trap '_sa_exit_on_signal HUP 129' HUP
 fi
 
 acquire_lock() {
@@ -223,7 +247,7 @@ acquire_lock() {
           [ "$_existing" != "$ticket_file" ] && _new_t+=("$_existing")
         done
         _SA_LOCK_TICKETS=(${_new_t[@]+"${_new_t[@]}"})
-        echo "[lock] acquired $name pid=$$ at $(date +%H:%M:%S) waited=${waited}s" >&2
+        echo "[lock] acquired $name pid=$$ at $(date -u +%Y-%m-%dT%H:%M:%SZ) waited=${waited}s" >&2
         _sa_lock_event acquired "$name" "waited=${waited}s"
         break
       fi
@@ -670,10 +694,10 @@ release_lock() {
   if _sa_we_own_lock "$lock_dir"; then
     _sa_lock_event release "$name" "$(_sa_lock_owner_tag "$lock_dir")"
     rm -rf "$lock_dir"
-    echo "[lock] released $name pid=$$ at $(date +%H:%M:%S)" >&2
+    echo "[lock] released $name pid=$$ at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
   else
     _sa_lock_event release_skipped "$name" "$(_sa_lock_owner_tag "$lock_dir")"
-    echo "[lock] release SKIPPED $name pid=$$ (not owner) at $(date +%H:%M:%S)" >&2
+    echo "[lock] release SKIPPED $name pid=$$ (not owner) at $(date -u +%Y-%m-%dT%H:%M:%SZ)" >&2
   fi
   # Rebuild the lock stack without this entry so the EXIT trap doesn't try to
   # rm it again (harmless, but keeps the stack honest if release_lock is paired

package/skill/precompute-stats.sh

@@ -31,5 +31,5 @@ python3 "$REPO_DIR/scripts/precompute_dashboard_stats.py"
 EXIT_CODE=$?
 RUN_ELAPSED=$(( $(date +%s) - RUN_START ))
 
-echo "[$(date +%H:%M:%S)] === done in ${RUN_ELAPSED}s (exit=${EXIT_CODE}) ==="
+echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] === done in ${RUN_ELAPSED}s (exit=${EXIT_CODE}) ==="
 exit "$EXIT_CODE"

package/skill/refresh-instagram-tokens.sh

@@ -19,7 +19,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/refresh-instagram-tokens-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 log "=== refresh-instagram-tokens fire: $(date) ==="
 
 RUN_START=$(date +%s)

package/skill/refresh-twitter-following.sh

@@ -16,7 +16,7 @@ set -uo pipefail
 LOG_DIR="$HOME/social-autoposter/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/refresh-twitter-following-$(date +%Y-%m-%d_%H%M%S).log"
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 REPO_DIR="$HOME/social-autoposter"
 

package/skill/run-generate-daily-style.sh

@@ -36,7 +36,7 @@ if [ -f "$REPO_DIR/.env" ]; then
   set +a
 fi
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 log "starting daily human-style synthesizer"
 

package/skill/run-instagram-daily.sh

@@ -36,7 +36,7 @@ if [ -f "$REPO_DIR/.env" ]; then
   set +a
 fi
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 # Run accounting for dashboard Job History (Post Threads · Instagram).
 # Each exit site updates POSTED_CT / SKIPPED_CT / FAILED_CT; the EXIT trap

package/skill/run-instagram-render.sh

@@ -43,7 +43,7 @@ if [ -f "$REPO_DIR/.env" ]; then
   set +a
 fi
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 # Run accounting for dashboard Job History (Render · Instagram). Matches the
 # pattern in run-instagram-daily.sh / run-twitter-threads.sh / run-reddit-threads.sh:

package/skill/run-linkedin-launchd.sh

@@ -40,7 +40,7 @@ mkdir -p "$LOG_DIR"
 # State: ~/.claude/social-autoposter/linkedin.killswitch
 # Clear: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear
 if [ -f "$HOME/.claude/social-autoposter/linkedin.killswitch" ]; then
-    echo "[$(date +%H:%M:%S)] LINKEDIN_KILLSWITCH active. Skipping run-linkedin." \
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] LINKEDIN_KILLSWITCH active. Skipping run-linkedin." \
         >> "$LOG_DIR/launchd-linkedin-stderr.log"
     exit 0
 fi

package/skill/run-linkedin-unipile.sh

@@ -45,7 +45,7 @@ SOCIAL_ID=""
 REPLY_TO=""
 DO_POST=0
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 while [ $# -gt 0 ]; do
     case "$1" in

package/skill/run-linkedin.sh

@@ -85,7 +85,7 @@ LINKEDIN_BACKEND="${LINKEDIN_BACKEND:-browser}"
 # Clear: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear
 # Only gates the browser backend — UniPile has no headed session to compromise.
 if [ "$LINKEDIN_BACKEND" = "browser" ] && [ -f "$HOME/.claude/social-autoposter/linkedin.killswitch" ]; then
-    echo "[$(date +%H:%M:%S)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
     echo "  Re-auth LinkedIn in harness Chrome, then: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear"
     exit 0
 fi

package/skill/run-reddit-search.sh

@@ -43,7 +43,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/run-reddit-search-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 log "=== Reddit Search Post Run: $(date) ==="
 
@@ -88,7 +88,7 @@ _parse_post_results() {
         # Bug observed 2026-05-08: a leaked "[14:57:04] Post phase: ..." line
         # produced "TOTAL_POSTED + [14:57:04]: syntax error" and `set -e` aborted
         # the script BEFORE the discover lane ran.
-        echo "[$(date +%H:%M:%S)] Post phase: exit code $rc; counting as failed." >> "$LOG_FILE"
+        echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Post phase: exit code $rc; counting as failed." >> "$LOG_FILE"
         echo "0 1"
     fi
 }

package/skill/run-reddit-threads.sh

@@ -33,7 +33,7 @@ RUN_START_EPOCH=$(date +%s)
 # calls added in 5e41d96 (2026-05-10) fall through to macOS /usr/bin/log,
 # which barfs `Unknown subcommand` and ERR-traps the run at exit=64 before
 # the browser lease is ever acquired (silent kill since 2026-05-10).
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 # Diagnostic: log the failing line and command before set -e kills the script.
 # Without this, silent deaths (e.g., Claude exits non-zero inside the $() below)

package/skill/run-twitter-cycle.sh

@@ -56,6 +56,7 @@ ulimit -n 4096 2>/dev/null || true
 # below (sourced libs + child scripts inherit it), so this one line fixes the
 # whole cycle's repo resolution on a bare .mcpb install.
 REPO_DIR="${S4L_REPO_DIR:-$HOME/social-autoposter}"
+export REPO_DIR
 SKILL_FILE="$REPO_DIR/SKILL.md"
 LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
@@ -173,7 +174,7 @@ if [ -f "$REPO_DIR/.env" ]; then
     set +a
 fi
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 log "=== Twitter Cycle (batch=$BATCH_ID): $(date) ==="
 log "Logic=D (no-ripen + 1h freshness + 2k_view_cap; experiment concluded 2026-05-31); discover_freshness=${FRESHNESS_HOURS_DISCOVER}h"
@@ -502,7 +503,7 @@ python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase p
 _PJ_ERR="$(mktemp)"
 PROJECTS_JSON=$(python3 - 2>"$_PJ_ERR" <<'PY'
 import json, os, subprocess, sys
-REPO = os.path.expanduser('~/social-autoposter')
+REPO = os.path.expanduser(os.environ.get('S4L_REPO_DIR') or os.environ.get('REPO_DIR') or '~/social-autoposter')
 sys.path.insert(0, os.path.join(REPO, 'scripts'))
 import project_excludes as pe
 
@@ -882,6 +883,33 @@ print(cd//60, cons, cd, max(0, now-fs))' "$_GATE_FILE" "$_NOW" 2>/dev/null || ec
     release_lock "twitter-browser" 2>/dev/null || true
     exit 1
 fi
+# Probe-error guard (2026-07-12, S4L-4H): output lacking a "gated" verdict
+# means the probe CRASHED (typically the CDP attach failed or timed out on a
+# wedged Chrome) rather than returning a clean bill. The old code logged
+# 'Pre-flight access OK: {"success": false, ...}' and marched a wedged browser
+# into the scan. Heal once (ensure_twitter_browser_for_backend now does a real
+# CDP readiness check and restarts a wedged harness Chrome), re-probe, and end
+# the cycle if there is still no verdict.
+if [ -z "$_ACCESS_OUT" ] || ! printf '%s' "$_ACCESS_OUT" | grep -q '"gated"'; then
+    log "  Pre-flight access probe FAILED (no verdict; browser not driveable): $(printf '%s' "$_ACCESS_OUT" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//')"
+    echo "twitter_cdp_wedge: access_probe_no_verdict" >&2
+    ensure_twitter_browser_for_backend || true
+    _ACCESS_OUT=$(TWITTER_CDP_URL="${TWITTER_CDP_URL:-http://127.0.0.1:9555}" \
+        python3 "$REPO_DIR/scripts/twitter_access_check.py" --session-probe --wait-ms 12000 2>/dev/null)
+    if [ -z "$_ACCESS_OUT" ] || ! printf '%s' "$_ACCESS_OUT" | grep -q '"gated"'; then
+        log "  Pre-flight access probe still has no verdict after harness heal; ending cycle."
+        echo "twitter_batches: ended $BATCH_ID"
+        release_lock "twitter-browser" 2>/dev/null || true
+        exit 1
+    fi
+    if printf '%s' "$_ACCESS_OUT" | grep -q '"gated": *true'; then
+        log "  Recovered probe reports an access gate; ending cycle (backoff engages on the next firing)."
+        echo "twitter_batches: ended $BATCH_ID"
+        release_lock "twitter-browser" 2>/dev/null || true
+        exit 1
+    fi
+    log "  Access probe recovered after harness heal."
+fi
 # Probe came back clean. If a backoff marker exists we were gated: record the
 # recovery (how long the gate lasted, since first_seen) BEFORE deleting it, so
 # the lift event + duration survive in the log even though the marker is gone.
@@ -977,7 +1005,8 @@ if [ "$SCAN_ATTEMPT" -gt 1 ]; then
     rm -f "$UNIVERSE_EXHAUSTED_MARKER"
     PROJECTS_JSON=$(python3 - "$PROJECTS_JSON" "$TRIED_TOPICS_JSON" "$UNIVERSE_EXHAUSTED_MARKER" <<'PY' 2>>"$LOG_FILE"
 import json, os, sys
-sys.path.insert(0, os.path.expanduser('~/social-autoposter/scripts'))
+REPO = os.path.expanduser(os.environ.get('S4L_REPO_DIR') or os.environ.get('REPO_DIR') or '~/social-autoposter')
+sys.path.insert(0, os.path.join(REPO, 'scripts'))
 from pick_search_topic import pick_topic_for_project, PickerError, UniverseExhaustedError
 
 projects = json.loads(sys.argv[1] or '[]')
@@ -1349,7 +1378,8 @@ fi
 # search_attempts log so a Phase 1 abort still leaves the marks behind.
 python3 - "$PROJECTS_JSON" <<'PY' 2>&1 | tee -a "$LOG_FILE" || true
 import json, os, sys
-sys.path.insert(0, os.path.expanduser('~/social-autoposter/scripts'))
+REPO = os.path.expanduser(os.environ.get('S4L_REPO_DIR') or os.environ.get('REPO_DIR') or '~/social-autoposter')
+sys.path.insert(0, os.path.join(REPO, 'scripts'))
 import project_excludes as pe
 projects = json.loads(sys.argv[1] or '[]')
 total = 0
@@ -1643,9 +1673,10 @@ done <<< "$CANDIDATES"
 
 ALL_PROJECTS_JSON=$(python3 -c "
 import json, os, sys
-sys.path.insert(0, os.path.expanduser('~/social-autoposter/scripts'))
+repo_dir = os.path.expanduser(os.environ.get('S4L_REPO_DIR') or os.environ.get('REPO_DIR') or '~/social-autoposter')
+sys.path.insert(0, os.path.join(repo_dir, 'scripts'))
 import learned_preferences as lp
-config = json.load(open(os.path.expanduser('~/social-autoposter/config.json')))
+config = json.load(open(os.path.join(repo_dir, 'config.json')))
 projects = config.get('projects', [])
 # learned_preferences is a SINGLE install-wide block since 2026-07-08 (see
 # scripts/learned_preferences.py), not one per project. Computed once here
@@ -1725,12 +1756,33 @@ log "Engagement style assigned: mode=$PICKED_MODE style=${PICKED_STYLE:-(invent)
 # are actually different (a same-name pair defeats the whole point); INVENT
 # mode on either side is accepted immediately since an invented name is
 # definitionally distinct from a pinned one. This is orthogonal to the
-# treatment_v2/control_v2 draft-prompt A/B below (that varies WORDING of the
+# treatment_v3/control_v3 draft-prompt A/B below (that varies WORDING of the
 # directive for the whole cycle; this varies STYLE per draft slot), so neither
 # experiment disturbs the other.
 STYLE_ASSIGN_FILE_B=$(mktemp -t s4l_twitter_assign_b_XXXXXX.json)
-for _style_b_attempt in 1 2 3; do
-    s4l_pick_style twitter posting "$STYLE_ASSIGN_FILE_B" >/dev/null 2>&1 || true
+# --- Draft-B exploration source (2026-07-11) ---------------------------------
+# Style B is now the EXPLORE slot: it trials the newest human_derived styles
+# and post-2026-07-10 inventions (least-used first) instead of drawing a
+# second scored pick from the same proven pool as Style A. This is the
+# distribution channel for the standalone invent_styles.py job: the card
+# pick + the posted draft's engagement write a new style's first real score,
+# and winners graduate into the Draft-A pool via the normal sampler. NOTHING
+# is invented here (pick_exploration_style never returns mode=invent). On an
+# empty pool or API failure we fall back to the legacy second scored pick so
+# dual-draft cards never break. The source tag rides the S4L_EXP_ convention:
+# active_experiments.collect() auto-stamps it onto every plan candidate and
+# the review card's details-eye renders it with zero card-side code.
+DRAFT_B_SOURCE=$(python3 -c "
+import json, sys
+sys.path.insert(0, '$REPO_DIR/scripts')
+from engagement_styles import pick_exploration_style
+a = pick_exploration_style('twitter', context='posting', exclude={'$PICKED_STYLE'})
+if a and a.get('style'):
+    with open('$STYLE_ASSIGN_FILE_B', 'w') as f:
+        json.dump(a, f)
+    print(a.get('source') or '')
+" 2>/dev/null || echo "")
+if [ -n "$DRAFT_B_SOURCE" ]; then
     PICKED_STYLE_B=$(python3 -c "
 import json
 try:
@@ -1740,7 +1792,22 @@ try:
 except Exception:
     print('')
 " 2>/dev/null)
-    PICKED_MODE_B=$(python3 -c "
+    PICKED_MODE_B="use"
+fi
+if [ -z "${PICKED_STYLE_B:-}" ]; then
+    DRAFT_B_SOURCE="scored_fallback"
+    for _style_b_attempt in 1 2 3; do
+        s4l_pick_style twitter posting "$STYLE_ASSIGN_FILE_B" >/dev/null 2>&1 || true
+        PICKED_STYLE_B=$(python3 -c "
+import json
+try:
+    with open('$STYLE_ASSIGN_FILE_B') as f:
+        d = json.load(f)
+    print(d.get('style') or '')
+except Exception:
+    print('')
+" 2>/dev/null)
+        PICKED_MODE_B=$(python3 -c "
 import json
 try:
     with open('$STYLE_ASSIGN_FILE_B') as f:
@@ -1749,44 +1816,52 @@ try:
 except Exception:
     print('use')
 " 2>/dev/null)
-    if [ "$PICKED_MODE" = "invent" ] || [ "$PICKED_MODE_B" = "invent" ] || [ "$PICKED_STYLE_B" != "$PICKED_STYLE" ]; then
-        break
-    fi
-done
-log "Engagement style B assigned: mode=$PICKED_MODE_B style=${PICKED_STYLE_B:-(invent)}"
+        if [ "$PICKED_MODE" = "invent" ] || [ "$PICKED_MODE_B" = "invent" ] || [ "$PICKED_STYLE_B" != "$PICKED_STYLE" ]; then
+            break
+        fi
+    done
+fi
+export S4L_EXP_DRAFT_B_SOURCE="$DRAFT_B_SOURCE"
+log "Engagement style B assigned: mode=$PICKED_MODE_B style=${PICKED_STYLE_B:-(invent)} source=$DRAFT_B_SOURCE"
 
-# --- Draft-prompt A/B: decouple product pivot (2026-06-29) -------------------
+# --- Draft-prompt A/B: style-as-form (v3, 2026-07-10) ------------------------
 # Per-CYCLE arm (the prep session drafts the whole batch from ONE prompt, so
 # assignment is at cycle granularity, not per post; the whole batch shares it).
-#   control   = the current draft directive verbatim.
-#   treatment = v2 (2026-07-06): bans the concede-then-reverse antithesis skeleton
-#               ('X is the easy part, the hard part is Y', "not X it's Y", etc.) in
-#               ANY form and forces varied entry points. v1 (2026-06-29) only
-#               forbade pivoting to the PRODUCT, which the model satisfied while
-#               keeping the skeleton (measured: treatment 30% ~= control 28% on
-#               857 local replies), so v2 bans the STRUCTURE, not just the product
-#               tail. The SAME skeleton ban is also added to the personal_brand
-#               directive below (which overrides both arms), so the persona lane
-#               (e.g. customer personal-brand accounts like Karol) gets it too.
-#               Product still mentioned only when genuinely relevant.
+#   control_v3   = the plain draft directive (v2's control text verbatim).
+#   treatment_v3 = style-as-FORM package: the assigned engagement style is the
+#                  binding FORM of the draft (defining move + per-style length +
+#                  end-of-block self-check, rendered arm-aware by
+#                  engagement_styles.get_assigned_style_prompt, which reads
+#                  S4L_DRAFT_PROMPT_VARIANT at render time IN this cycle
+#                  process), PLUS the two-layer learned_preferences contract
+#                  (style owns form, preferences own voice inside it; the old
+#                  'overrides on conflict' phrasing made the model treat the
+#                  style as optional), PLUS the v2 skeleton ban carried over.
+#   History: v1 (2026-06-29) decoupled the product pivot; the model kept the
+#   skeleton (30% ~= 28% on 857 replies). v2 (2026-07-06) banned the
+#   concede-then-reverse STRUCTURE. v3 (2026-07-10) replaces v2's treatment
+#   wholesale: drafts converged in shape regardless of assigned style, so v3
+#   makes the style block load-bearing instead of only banning one skeleton.
 # The arm is stamped onto every post this cycle via S4L_DRAFT_PROMPT_VARIANT
 # (read by twitter_post_plan.py -> log_post.py -> posts.draft_prompt_variant),
 # mirroring the tail_link_variant plumbing. Split tunable via
 # TWITTER_DRAFT_PROMPT_AB_RATE = fraction of cycles assigned to 'treatment'.
 # CODE DEFAULT 0.5 = 50/50 EVERYWHERE (2026-07-06): every install runs a real
-# holdback so treatment (skeleton-ban, v2) can always be measured against the old
-# control prompt. The old default of 1 (100% treatment) was changed because it
+# holdback so treatment can always be measured against the plain control
+# prompt. The old default of 1 (100% treatment) was changed because it
 # silently dropped the control arm whenever the .env pin did not propagate to the
 # running env (the installed-package driver reads its OWN .env, not the source
 # tree's), leaving no control data. Robustly defaulting to 0.5 in code, not via an
 # .env override, prevents that. The dashboard reads the SAME var with the SAME
 # default (bin/server.js), so display and routing never diverge.
 DRAFT_PROMPT_AB_RATE="${TWITTER_DRAFT_PROMPT_AB_RATE:-0.5}"
-# Arm VALUE versioned to '..._v2' on 2026-07-06 to RESET the experiment. The old
-# 'treatment'/'control' rows (v1, decoupled-product-pivot) are retired: they stay
-# in the DB under their old labels but the dashboard now counts only the '_v2'
-# arms, so the v2 skeleton-ban experiment starts fresh from zero. Bump this suffix
-# again on any future reset (keep bin/server.js DRAFT_PROMPT_VARIANT_DEFS in sync).
+# Arm VALUE versioned to '..._v3' on 2026-07-10 to RESET the experiment. The old
+# v1/v2 rows stay in the DB under their old labels but the dashboard now counts
+# only the '_v3' arms, so the style-as-form experiment starts fresh from zero.
+# Bump this suffix again on any future reset (keep bin/server.js
+# DRAFT_PROMPT_VARIANT_DEFS, scripts/active_experiments.py DESCRIPTIONS, and the
+# treatment_v3 gate in scripts/engagement_styles.py get_assigned_style_prompt in
+# sync).
 S4L_DRAFT_PROMPT_VARIANT=$(python3 -c "
 import random
 try:
@@ -1794,34 +1869,42 @@ try:
 except Exception:
     rate = 0.5
 rate = min(1.0, max(0.0, rate))
-print('treatment_v2' if random.random() < rate else 'control_v2')
-" 2>/dev/null || echo treatment_v2)
+print('treatment_v3' if random.random() < rate else 'control_v3')
+" 2>/dev/null || echo treatment_v3)
 export S4L_DRAFT_PROMPT_VARIANT
 log "Draft-prompt A/B arm: $S4L_DRAFT_PROMPT_VARIANT (rate=$DRAFT_PROMPT_AB_RATE)"
-if [ "$S4L_DRAFT_PROMPT_VARIANT" = "treatment_v2" ]; then
-    DRAFT_DIRECTIVE="Otherwise: draft a direct, natural reply that stands on its own as a useful contribution to the thread. Mention the matched project only when it is genuinely the most relevant thing to say, and state it plainly in one clause; most replies will not need it. Do NOT use the concede-then-reverse skeleton in ANY form. Banned openings include: 'X is the easy part/half/win, the hard part is Y'; 'X was never the [thing], it's Y'; 'X isn't the [problem], it's Y'; 'the real/actual/harder part is Y'; 'what actually breaks/ships/matters is Y'; 'the part nobody says/shows is Y'; 'X is solved, Y is what breaks'. If your draft contains that concede-then-reverse pivot, rewrite it from a different entry point. This rule OVERRIDES the assigned style's example when that example uses the skeleton: keep the style's intent, not its shape. Instead lead with substance from ONE entry point, and vary the entry point across replies: a concrete first-hand specific or number; a direct answer to the exact question asked; one sharp opinion with no hedge; a genuine question that moves the thread forward; or a relevant pointer. No warm-up framing sentence before the substance. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling, do not apply any other length rule here. NEVER em dashes. Apply the matched project's \`voice\` block from ALL_PROJECTS_JSON: follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The matched project's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory: follow every learned_preferences.draft_style_notes entry when writing (it overrides the engagement style's structural template on conflict), and treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
+if [ "$S4L_DRAFT_PROMPT_VARIANT" = "treatment_v3" ]; then
+    DRAFT_DIRECTIVE="Otherwise: draft a direct, natural reply that stands on its own as a useful contribution to the thread. Mention the matched project only when it is genuinely the most relevant thing to say, and state it plainly in one clause; most replies will not need it. THE ASSIGNED ENGAGEMENT STYLE IS THE FORM OF THIS DRAFT, not a flavor hint: the style block above defines the draft's structure, defining move, and length. Commit to that form BEFORE writing, and run the style block's self-check before returning the draft. Do NOT use the concede-then-reverse skeleton in ANY form. Banned openings include: 'X is the easy part/half/win, the hard part is Y'; 'X was never the [thing], it's Y'; 'X isn't the [problem], it's Y'; 'the real/actual/harder part is Y'; 'what actually breaks/ships/matters is Y'; 'the part nobody says/shows is Y'; 'X is solved, Y is what breaks'. If your draft contains that concede-then-reverse pivot, rewrite it from a different entry point. This ban OVERRIDES the assigned style's example when that example uses the skeleton: keep the style's defining move, express it without the skeleton. Lead with substance from ONE entry point and vary the entry point across replies: a concrete first-hand specific or number; a direct answer to the exact question asked; one sharp opinion with no hedge; a genuine question that moves the thread forward; or a relevant pointer. No warm-up framing sentence before the substance. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling, do not apply any other length rule here. NEVER em dashes. Apply the matched project's \`voice\` block from ALL_PROJECTS_JSON: follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The matched project's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory, and it works TOGETHER with the engagement style on different layers: the style owns the FORM (structure, defining move, length) and learned_preferences.draft_style_notes own the voice, wording, and content choices INSIDE that form. When a preference seems to conflict with the style, keep the style's structure and satisfy the preference within it; never drop the style's defining move to satisfy a wording note. Treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
 else
     DRAFT_DIRECTIVE="Otherwise: draft a reply using the best engagement style. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling, do not apply any other length rule here. NEVER em dashes. Apply the matched project's \`voice\` block from ALL_PROJECTS_JSON: follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The matched project's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory: follow every learned_preferences.draft_style_notes entry when writing (it overrides the engagement style's structural template on conflict), and treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
 fi
-# Personal-brand lane (S4L_ACTIVE_LANE=personal_brand, set by saps_mode.py):
+# Personal-brand lane (S4L_ACTIVE_LANE=personal_brand, set by s4l_mode.py):
 # replace the product-framed directive entirely. This lane is pure organic
 # growth: no product, no link, no CTA. The reply must add real value grounded in
 # the persona's first-hand material (the PERSONA CORPUS block + the persona voice
 # block), not concede-and-agree filler. Replaces the product-framed promotion
-# directives above, but is itself arm-aware (see below): treatment_v2 adds the
-# skeleton ban, control_v2 does not, so the A/B runs in this lane too.
+# directives above, but is itself arm-aware (see below): treatment_v3 adds the
+# skeleton ban + the two-layer style/preferences contract, control_v3 keeps the
+# plain persona directive, so the A/B runs in this lane too.
 if [ "${S4L_ACTIVE_LANE:-}" = "personal_brand" ]; then
-    # Arm-aware skeleton ban in the persona lane (2026-07-06): treatment_v2 adds the
-    # concede-then-reverse ban clause; control_v2 keeps the plain persona directive.
-    # This makes the A/B measurable in the persona lane too. The arm is stamped onto
-    # the card + surfaced (active_experiments.py no longer drops draft_prompt for
-    # personal_brand), so persona cards now show treatment_v2 / control_v2.
-    if [ "$S4L_DRAFT_PROMPT_VARIANT" = "treatment_v2" ]; then
-        PERSONA_SKELETON_BAN=" Also do NOT use the concede-then-reverse skeleton in ANY form: banned openings include 'X is the easy part/half/win, the hard part is Y', 'X was never the [thing], it's Y', 'X isn't the [problem], it's Y', 'the real/actual/harder part is Y', 'what actually breaks/ships/matters is Y', 'the part nobody says/shows is Y', and 'X is solved, Y is what breaks'; if a draft has that pivot, rewrite it from one of the entry points above. This OVERRIDES the assigned style's example when that example uses the skeleton: keep the style's intent, not its shape."
+    # Arm-aware persona lane (v3, 2026-07-10): treatment_v3 adds the
+    # concede-then-reverse ban clause AND swaps the learned_preferences
+    # relation from 'overrides the style on conflict' to the two-layer
+    # contract (style owns form, preferences own voice inside it);
+    # control_v3 keeps the plain persona directive. The style block itself
+    # (STYLES_BLOCK, rendered in this process) is also arm-aware, so the
+    # persona lane gets the style-as-FORM block on treatment automatically.
+    # The arm is stamped onto the card + surfaced (active_experiments.py no
+    # longer drops draft_prompt for personal_brand), so persona cards show
+    # treatment_v3 / control_v3.
+    if [ "$S4L_DRAFT_PROMPT_VARIANT" = "treatment_v3" ]; then
+        PERSONA_SKELETON_BAN=" Also do NOT use the concede-then-reverse skeleton in ANY form: banned openings include 'X is the easy part/half/win, the hard part is Y', 'X was never the [thing], it's Y', 'X isn't the [problem], it's Y', 'the real/actual/harder part is Y', 'what actually breaks/ships/matters is Y', 'the part nobody says/shows is Y', and 'X is solved, Y is what breaks'; if a draft has that pivot, rewrite it from one of the entry points above. This ban OVERRIDES the assigned style's example when that example uses the skeleton: keep the style's defining move, express it without the skeleton."
+        PERSONA_PREFS_RELATION="(learned_preferences work TOGETHER with the engagement style on different layers: the style owns the FORM, structure, defining move, and length; draft_style_notes own the voice and wording INSIDE that form; on apparent conflict keep the style's structure and satisfy the preference within it)"
     else
         PERSONA_SKELETON_BAN=""
+        PERSONA_PREFS_RELATION="(it overrides the engagement style's structural template on conflict)"
     fi
-    DRAFT_DIRECTIVE="Otherwise: draft a reply that stands on its own as a genuinely useful contribution to THIS thread. Ground it in the persona's real, first-hand experience from the PERSONA CORPUS block below (specific projects, real numbers, sharp opinions, actual failures) and in the persona's \`voice\` block from ALL_PROJECTS_JSON. Add exactly ONE of: a concrete specific from that lived experience, a sharp non-obvious opinion, a useful pointer, or a question that genuinely moves the thread forward. NEVER generic agreement ('makes sense', 'this is spot on', 'great point', 'the nuance here is').${PERSONA_SKELETON_BAN} This is a personal account, not a brand: sound like a real person in the thread. If web search is available and the thread hinges on a current fact, verify it before drafting rather than guessing. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling. NEVER em dashes. Follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The persona's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory: follow every learned_preferences.draft_style_notes entry when writing (it overrides the engagement style's structural template on conflict), and treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
+    DRAFT_DIRECTIVE="Otherwise: draft a reply that stands on its own as a genuinely useful contribution to THIS thread. Ground it in the persona's real, first-hand experience from the PERSONA CORPUS block below (specific projects, real numbers, sharp opinions, actual failures) and in the persona's \`voice\` block from ALL_PROJECTS_JSON. Add exactly ONE of: a concrete specific from that lived experience, a sharp non-obvious opinion, a useful pointer, or a question that genuinely moves the thread forward. NEVER generic agreement ('makes sense', 'this is spot on', 'great point', 'the nuance here is').${PERSONA_SKELETON_BAN} This is a personal account, not a brand: sound like a real person in the thread. If web search is available and the thread hinges on a current fact, verify it before drafting rather than guessing. Length is governed ENTIRELY by the per-style LENGTH LIMIT in the style block above; obey that target and ceiling. NEVER em dashes. Follow voice.tone, never violate voice.never, mirror voice.examples / voice.examples_good when present. The persona's learned_preferences block in ALL_PROJECTS_JSON is distilled human review feedback and is MANDATORY, not advisory: follow every learned_preferences.draft_style_notes entry when writing ${PERSONA_PREFS_RELATION}, and treat learned_preferences.audience_avoid / thread_avoid matches as strong reasons to skip the candidate. Never violate content_guardrails.do_not."
 fi
 
 # 2026-07-10 anti-sameness: --no-project-sections strips the multi-project
@@ -2047,7 +2130,7 @@ All project configs: $ALL_PROJECTS_JSON
 
 ## PROJECT TOP PERFORMERS (query on demand, do NOT skip routing first)
 The feedback reports below carry a per-style exemplar only; project winners are no longer bulk-injected. AFTER you have decided which project a candidate's draft is for, you MAY pull that project's own recent winners (last 30 days, ranked by real click rate) when you are unsure how this product converts in replies:
-   python3 $REPO_DIR/scripts/top_performers.py --platform twitter --project 'PROJECT_NAME' --top 3 --brief
+   python3 $REPO_DIR/scripts/top_performers.py --platform twitter --project 'PROJECT_NAME' --top 3 --brief --invoked-by '$BATCH_ID'
 (PROJECT_NAME exactly as it appears in the candidate's 'Project match' / config.json.) Treat the results as evidence of which CLAIMS and ANGLES landed for that product, never as structural templates: do not copy their sentence shape, opener, or pivot wording. One call per project at most; skip the call entirely for projects you already queried this session.
 
 $RECENT_SELF_BLOCK
@@ -2156,6 +2239,27 @@ CRITICAL:
 # installs) treats --allowedTools as a one-value flag, so a space-separated second
 # tool would leak in as the prompt. On the box these flags ride through
 # claude_job.py; Desktop's own web search + the reworded prompt enable it there.
+# --- Prep-prompt snapshot (2026-07-11) ---------------------------------------
+# Persist the exact rendered PREP_PROMPT per batch so prompt-block presence is
+# verifiable after any release (grep the file), instead of reverse-engineering
+# it from package scripts. The queue's prompt-*.md files are transient work
+# files deleted on completion, and the generation trace deliberately carries
+# only the exemplar context, so this is the ONLY durable full-prompt record.
+# Local-only, newest 50 kept (file cleanup, not candidate-row retention; the
+# no-retention rule covers DB *_candidates rows). Never blocks the run.
+PREP_PROMPT_DIR="${S4L_STATE_DIR:-$HOME/.social-autoposter-mcp}/prep-prompts"
+if mkdir -p "$PREP_PROMPT_DIR" 2>/dev/null; then
+    _PP_FILE="$PREP_PROMPT_DIR/prep-prompt-$BATCH_ID.md"
+    if printf '%s' "$PREP_PROMPT" > "$_PP_FILE" 2>/dev/null; then
+        ls -t "$PREP_PROMPT_DIR"/prep-prompt-*.md 2>/dev/null | tail -n +51 | while IFS= read -r _pp_old; do
+            rm -f "$_pp_old"
+        done
+        log "[prep_prompt_snapshot] batch=$BATCH_ID bytes=$(wc -c < "$_PP_FILE" | tr -d ' ') path=$_PP_FILE"
+    else
+        log "WARN: prep-prompt snapshot write failed for batch=$BATCH_ID (non-fatal)"
+    fi
+fi
+
 PREP_OUTPUT=$(printf '%s' "$PREP_PROMPT" | "$REPO_DIR/scripts/run_claude.sh" "run-twitter-cycle-prep" --strict-mcp-config --mcp-config "$TW_MCP_CONFIG" --allowedTools WebSearch,WebFetch -p --output-format json --json-schema "$PREP_SCHEMA" 2>&1)
 
 echo "$PREP_OUTPUT" >> "$LOG_FILE"
@@ -2176,7 +2280,9 @@ POST_TOP_N="${S4L_TWITTER_POST_TOP_N:-1}"
 # --- ROLLING VIRALITY BAR (2026-07-02) --------------------------------------
 # Fetch THIS install's trailing-24h virality percentile so the parse step posts
 # the top-1 ONLY if it clears the bar. This holds the post rate near the target
-# (~20-30 / 8h) with NO hard cap: the bar is the Nth percentile of the install's
+# (~10 / day as of 2026-07-13 reach-recovery: p0.99 replayed against the prior
+# week's picks yields ~12/day vs ~91/day at the old p0.90) with NO hard cap:
+# the bar is the Nth percentile of the install's
 # OWN recent candidate pool (via /api/v1/twitter-candidates/virality-threshold),
 # so it self-calibrates to cadence and niche instead of being a fixed number.
 # The bar applies to BOTH lanes (2026-07-03, per user instruction): the
@@ -2188,15 +2294,17 @@ POST_TOP_N="${S4L_TWITTER_POST_TOP_N:-1}"
 #   - Cold start: sample_count < min, so a fresh pool posts ungated until it fills.
 #     (This is also what keeps brand-new installs seeing every draft card.)
 #   - Fetch failure: fail-open, never silence posting on a transient API blip.
-# Virality percentile is HARDCODED to 0.90 here: single source of truth, no env
+# Virality percentile is HARDCODED to 0.99 here (raised from 0.90 on 2026-07-13,
+# reach-recovery: quality over volume): single source of truth, no env
 # var, no fallback, one path (every install behaves identically regardless of how
 # its plist was generated). Sample floor S4L_TWITTER_VIRALITY_MIN_SAMPLE default 200.
-VIRALITY_THRESHOLD=$(S4L_VPCTILE="0.90" \
+VIRALITY_THRESHOLD=$(S4L_VPCTILE="0.99" \
     S4L_VMIN="${S4L_TWITTER_VIRALITY_MIN_SAMPLE:-200}" \
     S4L_SCRIPTS_DIR="$REPO_DIR/scripts" \
     python3 -c "
 import os, sys
-sys.path.insert(0, os.environ.get('S4L_SCRIPTS_DIR') or os.path.expanduser('~/social-autoposter/scripts'))
+_repo = os.path.expanduser(os.environ.get('S4L_REPO_DIR') or os.environ.get('REPO_DIR') or '~/social-autoposter')
+sys.path.insert(0, os.environ.get('S4L_SCRIPTS_DIR') or os.path.join(_repo, 'scripts'))
 from http_api import api_get
 try:
     r = api_get('/api/v1/twitter-candidates/virality-threshold',
@@ -2211,7 +2319,7 @@ except BaseException as e:
     sys.stderr.write(f'virality-bar fetch failed (bar OFF this cycle): {e}\n')
 " 2>>"$LOG_FILE" || echo "")
 if [ -n "$VIRALITY_THRESHOLD" ]; then
-    log "Virality bar ACTIVE: p0.90 = $VIRALITY_THRESHOLD (this install, trailing 24h); top-1 kept only if it clears the bar."
+    log "Virality bar ACTIVE: p0.99 = $VIRALITY_THRESHOLD (this install, trailing 24h); top-1 kept only if it clears the bar."
 else
     log "Virality bar OFF this cycle (cold-start/thin pool or fetch failed); top-1 kept ungated."
 fi
@@ -2364,6 +2472,33 @@ if [ "$PREP_PARSE_EXIT" -eq 0 ] && [ -f "$PLAN_FILE" ]; then
 fi
 log "Phase 2b-prep complete. plan_count=$PLAN_COUNT"
 
+# On-demand project-winners usage marker (2026-07-10). top_performers.py
+# appends a JSON line to the state-dir ledger on every --project call (the
+# draft prompt tells the model to pass --invoked-by "$BATCH_ID"). Count this
+# batch's lines and log a greppable marker so "did the drafting session
+# actually use the per-project query" is answerable from the cycle log alone.
+# Stderr-marker convention: format is load-bearing elsewhere; keep it stable.
+TP_ONDEMAND=$(python3 -c "
+import json, os, sys
+path = os.path.join(os.environ.get('S4L_STATE_DIR', os.path.expanduser('~/.social-autoposter-mcp')), 'top-performers-invocations.jsonl')
+n, projects = 0, []
+try:
+    for line in open(path):
+        try:
+            r = json.loads(line)
+        except Exception:
+            continue
+        if r.get('invoked_by') == '$BATCH_ID':
+            n += 1
+            p = r.get('project')
+            if p and p not in projects:
+                projects.append(p)
+except OSError:
+    pass
+print(f'{n} projects={projects}')
+" 2>/dev/null || echo "0 projects=[]")
+log "[project_top_performers] batch=$BATCH_ID on_demand_invocations=$TP_ONDEMAND"
+
 # twitter-browser lock was already released right after thread-media capture
 # (before the Claude drafting call above), since nothing from there through
 # Phase 2b-gen touches the browser. Phase 2b-post re-acquires unconditionally

package/skill/scan-instagram-replies.sh

@@ -16,7 +16,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/scan-instagram-replies-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 log "=== scan-instagram-replies fire: $(date) ==="
 
 RUN_START=$(date +%s)