@m13v/s4l 1.7.5-rc.2 → 1.7.5-rc.21

package/scripts/snapshot.py

@@ -291,6 +291,40 @@ def _x_status():
     return val
 
 
+# ---- Reddit status (setup_reddit_auth.py status), cached --------------------
+# Mirrors _x_status for the optional Reddit platform. The reddit status command
+# is deliberately CHEAP (reddit_session cookie presence over CDP or on-disk
+# profile check; it never navigates the shared harness tab), so polling it on
+# the same TTL as X is safe.
+_reddit_cache = {"at": 0.0, "val": None}
+
+
+def _reddit_status():
+    now = time.time()
+    if _reddit_cache["val"] is not None and now - _reddit_cache["at"] < _X_TTL:
+        return _reddit_cache["val"]
+    val = {"connected": False, "state": "", "username": None}
+    if _runtime_ready():
+        try:
+            py = os.environ.get("S4L_PYTHON") or sys.executable or "python3"
+            res = subprocess.run(
+                [py, os.path.join(_repo_dir(), "scripts", "setup_reddit_auth.py"), "status"],
+                capture_output=True, text=True, timeout=90,
+            )
+            parsed = json.loads("\n".join(res.stdout.strip().splitlines()[-50:]))
+            val = {
+                "connected": bool(parsed.get("connected")),
+                "state": parsed.get("state") or "",
+                "username": parsed.get("username"),
+            }
+        except Exception:
+            val = {"connected": False, "state": "status_unavailable", "username": None}
+    else:
+        val = {"connected": False, "state": "runtime_not_ready", "username": None}
+    _reddit_cache.update(at=now, val=val)
+    return val
+
+
 # ---- version (resolveVersion + latest release + semver), cached ------------
 # Latest-version SOURCE = GitHub releases/latest first, npm only as a fallback.
 # This mirrors mcp/src/version.ts::latestPublishedVersion and is load-bearing:
@@ -658,13 +692,46 @@ def _onboarding_live(live_status):
     # list. Mirror onboarding-ledger.cjs publicSnapshot() ordering via MILESTONES.
     order = ["environment_checked", "runtime_ready", "x_connected", "profile_scanned",
              "mode_chosen", "project_ready", "topics_seeded", "tasks_scheduled"]
+    # Optional reddit milestones render only once touched; they never gate
+    # completion (mirror of onboarding-ledger.cjs OPTIONAL_MILESTONES).
+    optional = ["reddit_connected", "reddit_verified"]
+
+    def _st(mid):
+        rec = ms.get(mid) if isinstance(ms, dict) else None
+        st = (rec or {}).get("status", "pending")
+        return live_status.get(mid, st)
+
+    # Any-of platform completion (mirror of onboarding-ledger.cjs
+    # milestoneSatisfied): a required X milestone also counts when its Reddit
+    # counterpart is complete, and profile_scanned (an X-account scan) is
+    # required only while X is the connected platform.
+    def _satisfied(mid):
+        if _st(mid) == "complete":
+            return True
+        if mid == "x_connected":
+            return _st("reddit_connected") == "complete"
+        if mid == "profile_scanned":
+            return _st("x_connected") != "complete" and _st("reddit_connected") == "complete"
+        return False
+
     out = []
     if isinstance(ms, dict):
         for mid in order:
+            # Omit a pristine-pending required row that the other platform
+            # satisfies (reddit-only install), same as the ledger snapshot.
+            if _st(mid) == "pending" and _satisfied(mid):
+                continue
             rec = dict(ms.get(mid) or {"status": "pending", "attempts": 0})
             rec["id"] = mid
-            if mid in live_status:
-                rec["status"] = live_status[mid]
+            rec["status"] = _st(mid)
+            out.append(rec)
+        for mid in optional:
+            if _st(mid) == "pending":
+                continue
+            rec = dict(ms.get(mid) or {"status": "pending", "attempts": 0})
+            rec["id"] = mid
+            rec["status"] = _st(mid)
+            rec["optional"] = True
             out.append(rec)
     elif isinstance(ms, list):
         for rec in ms:
@@ -674,7 +741,21 @@ def _onboarding_live(live_status):
             out.append(rec)
     result = dict(led)
     result["milestones"] = out
-    result["complete"] = bool(out) and all(m.get("status") == "complete" for m in out)
+    if isinstance(ms, dict):
+        result["complete"] = all(_satisfied(mid) for mid in order)
+    else:
+        result["complete"] = bool(out) and all(m.get("status") == "complete" for m in out)
+    # Blocker suppression (mirror of onboarding-ledger.cjs publicSnapshot): a
+    # blocker on an optional reddit milestone (failed reddit attempt on an X
+    # box) or on a milestone the other platform satisfies (failed X attempt on
+    # a reddit-only box) must not flag attention on the dashboard.
+    blocker = result.get("current_blocker")
+    if isinstance(blocker, dict):
+        bmid = blocker.get("milestone")
+        if bmid in optional:
+            result["current_blocker"] = None
+        elif isinstance(ms, dict) and bmid in order and _satisfied(bmid):
+            result["current_blocker"] = None
     return result
 
 
@@ -694,7 +775,11 @@ def compute() -> dict:
     if persona is not None and flags.get("personal_brand"):
         projects = projects + [persona]
     any_ready = any(p["ready"] for p in projects)
-    setup_complete = rt_ready and any_ready and bool(x["connected"])
+    # Any-of platform completion (2026-07-15): setup is complete with AT LEAST
+    # ONE platform connected. X stays the default suggestion; a reddit-only
+    # install must not read "not set up" forever.
+    reddit = _reddit_status()
+    setup_complete = rt_ready and any_ready and (bool(x["connected"]) or bool(reddit["connected"]))
 
     installed = _resolve_version()
     channel = _channel()
@@ -708,6 +793,10 @@ def compute() -> dict:
         "project_ready": "complete" if any_ready else "pending",
         "tasks_scheduled": "complete" if schedule_state == "ok" else "pending",
     }
+    # Live reddit overlay only when connected: never force a pending overlay
+    # onto a ledger-complete reddit milestone from a transient status miss.
+    if reddit["connected"]:
+        live_status["reddit_connected"] = "complete"
 
     return {
         "projects": projects,
@@ -716,6 +805,9 @@ def compute() -> dict:
         "x_connected": bool(x["connected"]),
         "x_state": x["state"] or "",
         "x_handle": x["handle"],
+        "reddit_connected": bool(reddit["connected"]),
+        "reddit_state": reddit["state"] or "",
+        "reddit_username": reddit["username"],
         "autopilot_on": _autopilot_on(),
         "autopilot_stalled": setup_complete and _autopilot_stalled(),
         "schedule_state": schedule_state,

package/scripts/stats.py

@@ -36,24 +36,30 @@ from http_api import api_get, api_post, api_patch, load_env
 def _http_list_reddit_active_posts():
     """Walk /api/v1/posts in pages and return rows for the Reddit refresh job.
 
-    The /api/v1/posts GET caps a single page at 500. Sort by id ASC so we can
-    page deterministically; we re-issue with an increasing id cursor until the
-    server returns a short page. We need scan_no_change_count, posted_at,
-    engagement_updated_at, deletion_detect_count, upvotes, comments_count.
+    The /api/v1/posts GET caps a single page at 500. 2026-07-14 fix: the old
+    version broke after the FIRST page on the (long-stale) assumption that the
+    active-post count was "well under 500" — with ~12k active reddit rows that
+    silently pinned Step 2 to the oldest 500 rows forever, so recent posts
+    never got deletion-detected. The API has no id cursor, but `since` filters
+    posted_at >= X, so we page by an ascending posted_at cursor: `since` is
+    inclusive, the boundary row re-appears on the next page and is deduped via
+    seen_ids. We need scan_no_change_count, posted_at, engagement_updated_at,
+    deletion_detect_count, upvotes, comments_count.
     """
     out = []
     seen_ids = set()
-    cursor_since = None  # unused for id-asc paging
-    last_seen_id = 0
+    cursor = None  # ISO posted_at of the newest row seen so far
     while True:
         query = {
             "platform": "reddit",
             "status": "active",
             "has_our_url": "true",
-            "order_by": "id",
+            "order_by": "posted_at",
             "order_dir": "asc",
             "limit": 500,
         }
+        if cursor:
+            query["since"] = cursor
         resp = api_get("/api/v1/posts", query=query)
         rows = ((resp or {}).get("data") or {}).get("posts") or []
         new_rows = [r for r in rows if r.get("id") and r["id"] not in seen_ids]
@@ -62,12 +68,10 @@ def _http_list_reddit_active_posts():
         for r in new_rows:
             seen_ids.add(r["id"])
             out.append(r)
-            if r["id"] > last_seen_id:
-                last_seen_id = r["id"]
-        # Without a server-side cursor, we get the same first 500 every call.
-        # Break to avoid an infinite loop; the typical Reddit active-post count
-        # is well under 500 so one page covers it.
-        break
+        stamps = [r.get("posted_at") for r in new_rows if r.get("posted_at")]
+        if len(rows) < 500 or not stamps:
+            break
+        cursor = max(stamps)
     return out
 
 
@@ -441,6 +445,26 @@ def fetch_reddit_json(url, user_agent, max_retries=2, timeout=15):
     (success AND error) into _reddit_rate_state so the caller can pace.
     On 429, honors Retry-After (capped to 120s) and retries.
     """
+    # 2026-07-14 transport fix: Reddit started 403-blocking plain urllib on
+    # *.json (2026-05-28), which silently killed this scan (every poll came
+    # back as an HTML block page -> 'empty'/'error', zero rows patched since).
+    # Route through the logged-in harness browser first, the same transport
+    # reddit_tools._do_request has used since 2026-05-29 (the replies pass in
+    # this file already goes through it via batch_fetch_info and kept working).
+    # urllib below stays as the fallback; REDDIT_FETCH_BACKEND=urllib forces it.
+    if os.environ.get("REDDIT_FETCH_BACKEND", "harness").lower() != "urllib":
+        try:
+            from reddit_browser_fetch import browser_get_json
+            body, code = browser_get_json(url)
+            if code == 200 and body:
+                try:
+                    return ("ok", json.loads(body))
+                except Exception:
+                    pass  # non-JSON body -> fall through to urllib
+            elif code == 404:
+                return ("not_found", None)
+        except Exception:
+            pass
     req = urllib.request.Request(url, headers={"User-Agent": user_agent})
     for attempt in range(max_retries + 1):
         try:

package/scripts/test_no_silent_fallbacks.py

@@ -0,0 +1,281 @@
+#!/usr/bin/env python3
+"""Regression test for two recurring bug classes documented across many past
+incidents (X handle -> hardcoded "m13v_" impersonation, DEFAULT_ACCOUNTS,
+bare "python3" reply/post subprocess call sites that lack Playwright on a
+fresh install): a missing config value silently substituting a plausible
+(but wrong, or crash-prone) default instead of failing loudly.
+
+Two checks:
+
+1. check_no_bare_playwright_subprocess() -- static scan of scripts/*.py and
+   seo/*.py for `subprocess.run/check_output/check_call/Popen(["python3", ...])`
+   call sites whose target script imports playwright. A script that needs
+   Playwright must be launched via the pinned interpreter
+   (`PYTHON = os.environ.get("S4L_PYTHON") or sys.executable`, see
+   scripts/twitter_post_plan.py:131), never the literal "python3" -- bare
+   "python3" resolves to the caller's system Python on PATH, which has no
+   Playwright on a fresh install, and the subprocess dies silently
+   (no_reply_json / no_such_module errors surfaced only in production,
+   see bug_twitter_reply_bare_python3_no_playwright.md).
+
+2. check_account_resolver_hard_fails() -- account_resolver.resolve()/require()
+   must return None / raise on missing config, never fall back to a real
+   person's handle (the "m13v_" / DEFAULT_ACCOUNTS impersonation bug, see
+   bug_twitter_handle_scrape_brittle_m13v_fallback.md and
+   bug_multitenant_no_install_scoping_account_fallback.md).
+
+Run:
+    python3 scripts/test_no_silent_fallbacks.py
+Exit 0 = all pass; non-zero with FAIL lines otherwise.
+"""
+from __future__ import annotations
+
+import ast
+import os
+import sys
+
+REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SCAN_DIRS = [os.path.join(REPO_ROOT, "scripts"), os.path.join(REPO_ROOT, "seo")]
+SUBPROCESS_FUNCS = {"run", "check_output", "check_call", "Popen", "call"}
+
+# file:line entries explicitly reviewed and confirmed safe to leave as bare
+# "python3" (target does not import playwright, or the target path could not
+# be resolved statically and was hand-verified). Every entry must carry a
+# one-line reason -- this is a reviewed exception list, not a way to silence
+# noise.
+ALLOWLIST = {
+    # e.g. "scripts/some_script.py:42": "targets log_run.py, no playwright import",
+}
+
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    print(f"{'PASS' if cond else 'FAIL'}  {name}" + (f"  -- {detail}" if detail else ""))
+    if not cond:
+        FAILS.append(name)
+
+
+# ---------------------------------------------------------------------------
+# Check 1: bare "python3" spawning a playwright-dependent script
+# ---------------------------------------------------------------------------
+
+def _imports_playwright(tree):
+    """True iff the AST contains a real `import playwright[...]` or
+    `from playwright[...] import ...` statement, anywhere in the file
+    (module-level or nested inside a function). Deliberately AST-based, not
+    a substring search on the source text -- several scripts (engage_reddit.py,
+    post_reddit.py, twitter_post_plan.py) contain the STRING "import
+    playwright" as a `python -c "import playwright"` preflight-check
+    argument without ever importing it in their own process; a text search
+    misclassifies those as playwright-dependent."""
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            if any(alias.name == "playwright" or alias.name.startswith("playwright.") for alias in node.names):
+                return True
+        elif isinstance(node, ast.ImportFrom):
+            if node.module and (node.module == "playwright" or node.module.startswith("playwright.")):
+                return True
+    return False
+
+
+def _find_playwright_dependent_scripts():
+    """Basename -> True for every scanned .py file that actually imports
+    playwright (module-level or inside a function -- either way the
+    interpreter running that file needs Playwright installed)."""
+    dependent = set()
+    for d in SCAN_DIRS:
+        if not os.path.isdir(d):
+            continue
+        for name in os.listdir(d):
+            if not name.endswith(".py"):
+                continue
+            path = os.path.join(d, name)
+            try:
+                with open(path, "r", encoding="utf-8") as f:
+                    src = f.read()
+                tree = ast.parse(src, filename=path)
+            except (OSError, SyntaxError):
+                continue
+            if _imports_playwright(tree):
+                dependent.add(name)
+    return dependent
+
+
+def _const_str(node, literals, file_path):
+    """Best-effort static string resolution: literals, known module-level
+    names, `__file__` (resolved to the real path of the file being scanned),
+    and os.path.join/expanduser/dirname/abspath of resolvable parts -- this
+    covers the repo's common `REPO_DIR = os.path.dirname(os.path.dirname(
+    os.path.abspath(__file__)))` idiom. Not full data-flow analysis --
+    anything else resolves to None and is reported separately, never
+    silently treated as safe."""
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return node.value
+    if isinstance(node, ast.Name):
+        if node.id == "__file__":
+            return file_path
+        return literals.get(node.id)
+    if isinstance(node, ast.Call):
+        func = node.func
+        if isinstance(func, ast.Attribute) and func.attr == "join" and node.args:
+            parts = [_const_str(a, literals, file_path) for a in node.args]
+            if all(p is not None for p in parts):
+                return os.path.join(*parts)
+        if isinstance(func, ast.Attribute) and func.attr in ("expanduser", "dirname", "abspath", "normpath") and len(node.args) == 1:
+            inner = _const_str(node.args[0], literals, file_path)
+            if inner is not None:
+                if func.attr == "expanduser":
+                    return os.path.expanduser(inner)
+                if func.attr == "dirname":
+                    return os.path.dirname(inner)
+                if func.attr == "abspath":
+                    return os.path.abspath(inner)
+                if func.attr == "normpath":
+                    return os.path.normpath(inner)
+    return None
+
+
+def _resolve_module_literals(tree, file_path):
+    literals = {}
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign) and len(node.targets) == 1 and isinstance(node.targets[0], ast.Name):
+            val = _const_str(node.value, literals, file_path)
+            if val is not None:
+                literals[node.targets[0].id] = val
+    return literals
+
+
+def _scan_file(path, playwright_scripts, fails, notes):
+    with open(path, "r", encoding="utf-8") as f:
+        src = f.read()
+    try:
+        tree = ast.parse(src, filename=path)
+    except SyntaxError:
+        return
+    literals = _resolve_module_literals(tree, path)
+    rel = os.path.relpath(path, REPO_ROOT)
+
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        func = node.func
+        is_subprocess_call = (
+            isinstance(func, ast.Attribute)
+            and func.attr in SUBPROCESS_FUNCS
+            and isinstance(func.value, ast.Name)
+            and func.value.id == "subprocess"
+        )
+        if not is_subprocess_call or not node.args:
+            continue
+        first_arg = node.args[0]
+        if not isinstance(first_arg, ast.List) or not first_arg.elts:
+            continue
+        interp = first_arg.elts[0]
+        if not (isinstance(interp, ast.Constant) and interp.value in ("python3", "python")):
+            continue
+        if len(first_arg.elts) < 2:
+            continue
+
+        key = f"{rel}:{node.lineno}"
+        if key in ALLOWLIST:
+            continue
+
+        target = _const_str(first_arg.elts[1], literals, path)
+        if target is None:
+            notes.append((key, "target script path not statically resolvable -- review manually"))
+            continue
+
+        basename = os.path.basename(target)
+        if basename in playwright_scripts:
+            fails.append((key, f'spawns {basename} (imports playwright) via bare "{interp.value}"'))
+
+
+def check_no_bare_playwright_subprocess():
+    playwright_scripts = _find_playwright_dependent_scripts()
+    fails, notes = [], []
+    for d in SCAN_DIRS:
+        if not os.path.isdir(d):
+            continue
+        for name in sorted(os.listdir(d)):
+            if name.endswith(".py"):
+                _scan_file(os.path.join(d, name), playwright_scripts, fails, notes)
+
+    print(
+        f"  scanned {sum(1 for d in SCAN_DIRS for _ in os.listdir(d) if _.endswith('.py')) if all(os.path.isdir(d) for d in SCAN_DIRS) else '?'} "
+        f"files; {len(playwright_scripts)} playwright-dependent scripts: {', '.join(sorted(playwright_scripts))}"
+    )
+    for key, reason in notes:
+        print(f"  NOTE  {key}  -- {reason}")
+
+    check("no bare-python3 subprocess call targets a playwright-dependent script", not fails,
+          f"{len(fails)} violation(s)" if fails else "")
+    for key, reason in fails:
+        print(f"        FAIL  {key}  -- {reason}")
+    if fails:
+        print(
+            '        fix: route through PYTHON = os.environ.get("S4L_PYTHON") or sys.executable '
+            "instead of the literal \"python3\" (pattern: scripts/twitter_post_plan.py:131)"
+        )
+
+
+# ---------------------------------------------------------------------------
+# Check 2: account_resolver must hard-fail, never impersonate
+# ---------------------------------------------------------------------------
+
+def check_account_resolver_hard_fails():
+    sys.path.insert(0, os.path.join(REPO_ROOT, "scripts"))
+    import account_resolver  # noqa: E402
+
+    saved_load_config = account_resolver._load_config
+    saved_env = dict(os.environ)
+    try:
+        # Strip every account-related env var + simulate an empty config.json
+        # (no accounts section at all -- the "fresh install, nothing
+        # configured yet" state).
+        for k in list(os.environ):
+            if k.startswith("AUTOPOSTER_"):
+                del os.environ[k]
+        account_resolver._load_config = lambda: {}
+
+        for platform in ("twitter", "reddit", "linkedin", "github", "moltbook"):
+            result = account_resolver.resolve(platform)
+            check(f'resolve("{platform}") with no config returns None (not a hardcoded fallback)',
+                  result is None, f"got {result!r}")
+
+        raised = False
+        try:
+            account_resolver.require("twitter")
+        except RuntimeError:
+            raised = True
+        check('require("twitter") with no config raises RuntimeError (hard-fail, never impersonate)', raised)
+
+        # Positive case: a real configured value still resolves correctly,
+        # so this test can't be satisfied by breaking resolve() outright.
+        account_resolver._load_config = lambda: {"accounts": {"twitter": {"handle": "@some_handle"}}}
+        result = account_resolver.resolve("twitter")
+        check('resolve("twitter") returns the configured handle when config IS present',
+              result == "some_handle", f"got {result!r}")
+    finally:
+        account_resolver._load_config = saved_load_config
+        os.environ.clear()
+        os.environ.update(saved_env)
+
+
+def main():
+    print("-- check 1: no bare-python3 subprocess spawning a playwright-dependent script --")
+    check_no_bare_playwright_subprocess()
+    print("-- check 2: account_resolver hard-fails instead of impersonating --")
+    check_account_resolver_hard_fails()
+
+    if FAILS:
+        print(f"\n{len(FAILS)} FAILURE(S):")
+        for name in FAILS:
+            print(f"  - {name}")
+        return 1
+    print("\nALL PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/trigger_promo_lane_test.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# One-shot promotion-lane test trigger for the LOCAL S4L install (operator tool).
+#
+# Purpose: verify the promotion-lane prep prompt (size + structure) without
+# hand-running the twitter cycle. It flips mode.json to promotion-only via
+# s4l_mode.py (byte-for-byte what the menubar toggle writes), lets the
+# PRODUCTION launchd kicker start the next cycle on its own, restores the
+# original mode.json the moment that promotion cycle has started (the driver
+# reads mode.json once, at cycle start), then waits for the cycle's
+# [prep_prompt_snapshot] line and prints the size plus content verification.
+#
+# Guarantees:
+#   - never runs the cycle itself (launchd stays the only driver)
+#   - never touches the installed package; only mode.json state
+#   - aborts if draft-only is OFF (a promo test must not auto-post)
+#   - restores mode.json on ANY exit (trap), exposure window = one cycle start
+set -euo pipefail
+
+STATE="${S4L_STATE_DIR:-$HOME/.social-autoposter-mcp}"
+PKG="$STATE/repo/package"
+PY="$STATE/runtime/.venv/bin/python3"
+LOGS="$PKG/skill/logs"
+MODE="$STATE/mode.json"
+
+BACKUP=$(mktemp -t s4l_mode_backup_XXXXXX)
+cp "$MODE" "$BACKUP"
+RESTORED=0
+restore() {
+    if [ "$RESTORED" = "0" ] && [ -f "$BACKUP" ]; then
+        cp "$BACKUP" "$MODE"
+        RESTORED=1
+        echo "[trigger] mode.json restored to original"
+    fi
+    rm -f "$BACKUP"
+}
+trap restore EXIT
+
+PERSONA=$(S4L_STATE_DIR="$STATE" "$PY" "$PKG/scripts/s4l_mode.py" persona-name 2>/dev/null || echo "")
+if [ "$(S4L_STATE_DIR="$STATE" "$PY" "$PKG/scripts/s4l_mode.py" draft-only)" != "1" ]; then
+    echo "[trigger] ABORT: draft-only is OFF; a promotion test cycle could auto-post"
+    exit 1
+fi
+
+MARKER=$(mktemp -t s4l_promo_marker_XXXXXX)
+echo "[trigger] saved mode.json; flipping to promotion-only (persona project: ${PERSONA:-none})"
+S4L_STATE_DIR="$STATE" "$PY" "$PKG/scripts/s4l_mode.py" set promotion >/dev/null
+
+DEADLINE=$(( $(date +%s) + 2400 ))
+PROMO_LOG=""
+echo "[trigger] waiting for the launchd kicker to start a promotion cycle (up to 40 min)..."
+while [ -z "$PROMO_LOG" ]; do
+    if [ "$(date +%s)" -gt "$DEADLINE" ]; then
+        echo "[trigger] TIMEOUT: no promotion cycle started"
+        exit 1
+    fi
+    for f in $(find "$LOGS" -name 'twitter-cycle-*.log' -newer "$MARKER" 2>/dev/null); do
+        sel=$(grep -m1 'Selected projects:' "$f" 2>/dev/null | sed 's/.*Selected projects: //') || true
+        [ -z "$sel" ] && continue
+        if [ -n "$PERSONA" ] && [ "$sel" = "$PERSONA" ]; then
+            continue   # persona cycle that raced the flip; keep waiting
+        fi
+        PROMO_LOG="$f"
+        break
+    done
+    sleep 10
+done
+echo "[trigger] promotion cycle started: $(basename "$PROMO_LOG") (Selected projects: $sel)"
+restore   # the running cycle already read the mode; put the toggle back NOW
+
+until grep -q 'prep_prompt_snapshot' "$PROMO_LOG" 2>/dev/null; do
+    if [ "$(date +%s)" -gt "$DEADLINE" ]; then
+        echo "[trigger] TIMEOUT waiting for prep_prompt_snapshot; cycle tail:"
+        tail -5 "$PROMO_LOG"
+        exit 1
+    fi
+    sleep 10
+done
+
+LINE=$(grep -m1 'prep_prompt_snapshot' "$PROMO_LOG")
+echo "[trigger] $LINE"
+SNAP=$(echo "$LINE" | sed 's/.*path=//')
+if [ -f "$SNAP" ]; then
+    echo "[trigger] verification of $SNAP:"
+    echo "  bytes                 = $(wc -c < "$SNAP" | tr -d ' ')"
+    echo "  history occurrences   = $(grep -c '"history"' "$SNAP" || true)"
+    echo "  prefs blocks          = $(grep -c '"draft_style_notes"' "$SNAP" || true) (must be 1)"
+    echo "  global prefs line     = $(grep -c 'Global learned preferences' "$SNAP" || true) (must be 1)"
+    echo "  projects in routing   = $(grep -c '"voice_relationship"' "$SNAP" || true)"
+    echo "  ops keys leaked       = $(grep -cE '"posthog"|"onboarded_at"|"web_chat"|"seo_author"' "$SNAP" || true) (must be 0)"
+fi
+echo "[trigger] done"