TK-11383: correct two false claims in the IG fleet runbook

0e18a600680975532765da421136b56b600e4b57 · 2026-09-11 11:21:53 -0700 · Steve Abrams

Verified against the live Meta token and launchd, not assumed:

1. "Enrollment is self-healing" is FALSE. No LaunchAgent references
   build-registry.js; the only scheduled IG job (com.steve.dw-ig-link-drift)
   runs the read-only detector check-link-drift.js, which never writes
   accounts.json. A human must run build-registry.js after every link.

2. The "CRITICAL: new Page MUST land in the same Business portfolio or the
   shared token can't see it" warning is WRONG for this token and is retracted.
   debug_token reports type=USER, never-expiring, with pages_show_list, so it
   enumerates every Page Steve admins regardless of portfolio. Live
   counter-example: borninbeverlyhills (page 2548395878518829) is enrolled and
   postable today from NO portfolio. Portfolio placement stays preferred for
   permissions hygiene, and becomes mandatory again only under a SYSTEM-USER
   token.

No account, Page, registry or posting state was changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018Jc7e5vG4Jx68iXSYhwUiA

Files touched

M agents/instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md

Diff

commit 0e18a600680975532765da421136b56b600e4b57
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Sep 11 11:21:53 2026 -0700

    TK-11383: correct two false claims in the IG fleet runbook
    
    Verified against the live Meta token and launchd, not assumed:
    
    1. "Enrollment is self-healing" is FALSE. No LaunchAgent references
       build-registry.js; the only scheduled IG job (com.steve.dw-ig-link-drift)
       runs the read-only detector check-link-drift.js, which never writes
       accounts.json. A human must run build-registry.js after every link.
    
    2. The "CRITICAL: new Page MUST land in the same Business portfolio or the
       shared token can't see it" warning is WRONG for this token and is retracted.
       debug_token reports type=USER, never-expiring, with pages_show_list, so it
       enumerates every Page Steve admins regardless of portfolio. Live
       counter-example: borninbeverlyhills (page 2548395878518829) is enrolled and
       postable today from NO portfolio. Portfolio placement stays preferred for
       permissions hygiene, and becomes mandatory again only under a SYSTEM-USER
       token.
    
    No account, Page, registry or posting state was changed.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_018Jc7e5vG4Jx68iXSYhwUiA
---
 .../instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md   | 32 ++++++++++++++++------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/agents/instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md b/agents/instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md
index 288b1cc..750117f 100644
--- a/agents/instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md
+++ b/agents/instagram-agent/IG-FLEET-OPENCLAW-RUNBOOK.md
@@ -2,8 +2,13 @@
 
 **Method (Steve, 2026-08-12):** openclaw / portal-driver REAL Chrome drives create+link,
 paced a few/day, after Steve's ONE login. Source manifest: `build-manifest.json`.
-Enrollment is self-healing — after each batch, `node build-registry.js` picks up the
-newly-linked handles and the pre-staged `account-themes.json` gives day-one cadence.
+**Enrollment is NOT self-healing** (corrected 2026-09-11, TK-11383 — verified:
+`grep -rl build-registry ~/Library/LaunchAgents/` returns nothing, and the only scheduled
+IG job, `com.steve.dw-ig-link-drift`, runs the read-only DETECTOR `check-link-drift.js`,
+which never writes `accounts.json`). After each batch a HUMAN must run
+`node build-registry.js` to enroll the newly-linked handles; the pre-staged
+`account-themes.json` then gives day-one cadence. Treating enrollment as automatic is how
+@grassclothwallpaper sat linked-but-unenrolled for ~2 weeks.
 
 ## ⚠️ The ban vector (why this is phased, not bulk)
 Bulk IG-account signup under one Business Manager / one IP is the #1 trigger for Meta
@@ -47,14 +52,25 @@ via Graph API was deprecated in 2023 — neither is scriptable. Manifest: the
 - **beverlyandhillsdesigns, filthyrichlivingcom, nationalpaperhangers, protestdaily**
   — IG active but standalone (no Page). (1) IG app: switch to Business/Creator. (2)
   Professional dashboard -> "Connect or create a Facebook Page" -> Create new (name per
-  manifest). (3) **CRITICAL:** the new Page MUST land in the SAME Business portfolio
-  that holds the other 35, or the shared token can't see it and enrollment silently
-  fails — the likely reason these drifted out originally. (4) Assign the IG.
+  manifest). (3) Portfolio placement — **the old "MUST be in the SAME Business portfolio or
+  the shared token can't see it" warning is WRONG for this token and is RETRACTED**
+  (verified 2026-09-11, TK-11383): `debug_token` reports the shared token is type **USER**,
+  never-expiring, holding `pages_show_list`, so it enumerates every Page Steve admins
+  regardless of portfolio. Live counter-example: `borninbeverlyhills` (page
+  2548395878518829) is enrolled and postable TODAY while sitting in NO portfolio, and
+  "Designers Chat" (109985254012064) is likewise visible on the token from outside every
+  portfolio. Prefer the **Designer Wallcoverings** portfolio `214184499265528` (it holds
+  63 owned Pages incl. 33 of the 35 enrolled) for permissions hygiene — but a Page landing
+  outside it does NOT cause a silent enrollment failure, so this is no longer the
+  explanation for why these 5 drifted out. If the shared token is ever swapped for a
+  SYSTEM-USER token, portfolio membership becomes mandatory again. (4) Assign the IG.
   (protestdaily: link if wanted, but keep it OFF the auto-cadence — staged `skip`.)
 
-**After ANY link:** re-run `node build-registry.js` -> the handle auto-enrolls (fleet
-35->36...). The `/yoloforever` loop also catches it on its next pass. Do designerschat
-first — Path A is the fastest proof the flow works.
+**After ANY link:** a HUMAN must run `node build-registry.js` -> the handle enrolls (fleet
+35->36...). Nothing runs it on a schedule, so this step is mandatory, not incidental.
+Review its full proposed delta before applying — it rewrites the WHOLE posting registry and
+can enroll unrelated newly-linked accounts. Do designerschat first — Path A is the fastest
+proof the flow works.
 
 ## Phase 1 — ONE new-account pilot (watch 48-72h before scaling)
 Pick the safest material line: **silkwallpaper** (free handle, non-sensitive, sister-site

← ad63521 auto-data-snapshot: 2026-09-11T10:49:53 (1 data files) — age · back to Norma · auto-data-snapshot: 2026-09-11T11:23:31 (1 data files) — age a8c6b49 →