reachweaver init                         local DB initialization
reachweaver doctor                       check account mapping / missing env names
reachweaver credentials-audit [--history FILE] [--json]  offline credential hygiene: names only, never values; exit 1 on findings
reachweaver workspace [--json]  read-only: what lives in this folder (config, database, approval ledger, archive) and what does not (credentials, the installed skill); database integrity, ledger consistency, credential NAMES missing here, attachment files missing, changed or outside the folder, a secrets file sitting in it; exit 1 when copying would not work (docs/MOVING.md)
reachweaver workspace --init [DIR]  create the one-folder layout (config/, state/, media/, logs/, marker file, README, secrets.env.example); never overwrites or moves existing files
reachweaver workspace --gather [--apply]  copy attachments of unsent posts that live outside media/ into media/ (hash-verified) and point the records at the copies; dry run unless --apply
reachweaver workspace --repair [--apply]  after copying the folder to a new computer: find attachments again in media/ by size and SHA-256 and fix the recorded paths; approval hashes stay identical; dry run unless --apply
reachweaver --home DIR ...  global option: use this workspace folder (default: the nearest folder with a .reachweaver-workspace file at or above the current one)
reachweaver media-relink --from OLD_FOLDER --to NEW_FOLDER [--apply] [--json]  after moving the workspace: point recorded attachment paths of unsent posts at the new folder, only for files whose SHA-256 still matches and only if the approval hash stays identical; dry run unless --apply
reachweaver journal [--post-id ID] [--status S]... [--all-statuses] [--platform P] [--account ID] [--since DATE] [--until DATE] [--limit N] [--no-by-hand] [--verify-files] [--format table|json|markdown|csv] [--out FILE]  read-only: what was posted, when, where, with which metadata (text, approver, link, audit timeline) and files (path, SHA-256, still on disk?); includes `mark-shared` records; the database is opened read-only (docs/JOURNAL.md)
reachweaver archive [filters as journal] [--out DIR] [--copy-files] [--json]  write a private folder (0700/0600): one sub-folder per post with post.txt, meta.json and, with --copy-files, hash-verified copies of the attached files, plus index.md/index.csv; only ever adds, never overwrites; sends nothing
reachweaver repeat-check (--post-id ID | --platform P [--account ID] [--text T | --file F] [--image F]... [--video F] [--link URL]...) [--days N] [--json]  read-only: has this platform already received the same video file, image file, wording or link (stored posts plus `mark-shared` records)? exit 1 only for a repeat that would block approval; never carries earlier text (docs/REPEAT-GUARD.md)
reachweaver mark-shared --platform P [--account ID] [--text T | --file F] [--image F]... [--video F] [--link URL]... [--url U] [--at ISO] [--note N]  record material you posted by hand so later drafts are checked against it; local ledger only, posts nothing
reachweaver approve POST_ID ... [--allow-repeat]  refuses a blocking repeat (same video/image file or identical wording already shared by this account on this platform) unless --allow-repeat, which records a `repeat_override` audit event
reachweaver connect [--guide] [--account ID] [--json]  experimental: offline status table of your accounts (credential variable names only); --guide walks through them one at a time with you at a terminal, one read-only identity check per account you confirm; takes no secret, never posts
reachweaver draft --account X --text Y [--optout F]   create a reviewable draft; refused if it @-mentions an opted-out handle/domain
reachweaver draft --account X --file F    create draft from UTF-8 file
reachweaver draft --account X --file F --reply-to ITEM [--online] [--override-flagged LABEL]
                                          #17 (owner-approved 2026-10-09; gated off): reply draft under your own published Bluesky/Mastodon post; plan only without --online; sending blocked by the capability registry (`reachweaver_reply_adapter: none`)
reachweaver list [--status STATUS]        display post statuses
reachweaver check POST_ID [--optout F]    draft lint, including opt-out mentions
reachweaver approve POST_ID [--approver NAME] [--optout F]  approve one post; binds its payload hash and a fresh per-approval nonce (wave 9 item 1: the first send consumes it in an append-only, hash-chained approval-ledger.jsonl next to the database, so a restored older approval of the same post is refused with approval_replay_reapproval_required before any request; approvals made before the upgrade must be re-approved once); refused on an opt-out mention
reachweaver approve POST_ID --verify-identity --online  opt-in (wave 9 item 2): one read-only connect-check identity request, then bind a fingerprint of the verified account entry (account id, platform, handle/server/ids; no token or response stored) under tag approval/id-1; a failed check approves nothing; a later send whose account entry no longer matches is BLOCKED before any request (approval_identity_mismatch_reapproval_required). Binds WHICH account, not WHO approved
reachweaver unapprove POST_ID            revoke approval (not published)
reachweaver media-attach POST_ID --file IMG (--alt TEXT | --alt-file F) [--focus x,y] [--optout F] [--rights-confirmed --license ID --created-by owner|tool|third_party [--attribution T] [--tool N] [--rights-source-url URL] [--alt-translation LANG=TEXT]...]  (#48 draft: optional bound rights record)  add one PNG/JPEG/WebP with required alt text to a Mastodon DRAFT (warns if the image carries EXIF GPS data; never strips it); approval binds its SHA-256, MIME, alt and focus; offline, never uploads (#13, owner-approved 2026-10-09; disabled until a live receipt: live image send is registry-refused, docs/SECURITY-REVIEW-PROPOSAL-13-mastodon-media.md)
reachweaver media-detach POST_ID         remove every attachment from a draft (local files untouched)
reachweaver schedule POST_ID --at ISO8601 set UTC due time
reachweaver video-attach POST_ID --file V.mp4 [--mode creator_inbox|direct_post] [--privacy-level L --commercial C] [--allow-comment] [--allow-duet] [--allow-stitch] [--aigc]  offline: bind one MP4 to a TikTok draft; approve binds its SHA-256; never uploads (issue #23, owner-approved 2026-10-09; disabled until a live receipt; docs/TIKTOK.md)
reachweaver video-detach POST_ID         offline: remove the video from a TikTok draft
reachweaver calendar-plan --account ID --timezone TZ --start D [--days 14] [--slot Wed@16:00]... [--audience-activity FILE [--audience-top-hours 5] [--audience-max-age-days 90]] [--apply]  propose audience-local slots (advisory); --audience-activity uses your own exported hour-of-week activity with per-slot provenance; [--explore-share F --explore-slot Sat@11:00...] sends floor(F x posts) posts (F at most 0.5, default 0 = off) to your explore times, labelled role=explore, never randomized (docs/CALENDAR-PLANNER.md)
reachweaver calendar-gaps --account ID --timezone TZ [--start D] [--days 14] [--slot Wed@16:00]... [--tolerance-minutes 90] [--max-per-day 2] [--min-spacing-hours 20] [--timing-source S --timing-metric M --timing-denominator views|impressions] [--json]  # read-only: empty and overloaded slots in the local queue; never schedules (issue #9)
reachweaver cancel POST_ID               cancel only before delivery
reachweaver publish [--limit N] [--optout F]  show eligible work and which posts the opt-out list would block; no network
reachweaver publish --live               send only with env opt-in; opt-out mentions are BLOCKED before any claim
reachweaver publish --live --scheduled-only --max-lateness-minutes 180    guarded unattended sweep; owner setup only
reachweaver publish --live --max-per-24h 2 --min-gap-minutes 60          conservative account attempt caps; config/caps.json can only tighten them; a provider 429 cools the account down (never resends)
reachweaver publish [--live] --log-json [--log-file PATH]  one redacted JSON line per worker decision (fixed event/reason codes, no post text, secrets or URL queries) to stderr or an appended 0600 file; observational only, an unusable PATH refuses the run before any work (docs/WORKER-OPERATIONS.md)
reachweaver queue-health [--stale-minutes 30]  offline overdue/unknown outcome diagnostics
reachweaver health [--json] [--stale-minutes 30]  offline per-account readiness: adapter, registry age, credential NAMES, LinkedIn version/expiry, Postiz, queue, 24h budget, pause, live opt-in; ok|attention|blocked, exit 1 when blocked
reachweaver dead-letter [--json]          read-only needs_review grouped by sanitized error code, age + reconcile steps; never retries
reachweaver ops-metrics [--format json|prometheus] [--since 24h] [--optout F] [--out FILE]  read-only counts (claims, publishes, failures by send class, cooldowns, pause, dead letters, stale sending, oldest due age); Prometheus textfile output, written atomically; labels are account ids, platform and fixed codes only (docs/WORKER-OPERATIONS.md#operational-metrics-and-alerting-issue-26)
reachweaver ops-summary [--json] [--since 24h] [--stale-minutes 30] [--optout F] [--now T]  one redacted read-only report: overall readiness, per-account adapter/budget/queue, dead letters, ops-metrics totals; exit 1 when blocked (docs/WORKER-OPERATIONS.md#one-page-operations-summary-issue-26)
reachweaver start [--json]               experimental, read-only: look at your accounts file, database and queue and print the exact next command to run; runs nothing and never creates the database
reachweaver ui [--port N] [--open] [--optout F]  experimental, read-only local dashboard on 127.0.0.1 (overview, queue, post review sheets, accounts, channel research); cannot approve, schedule, pause or publish; the URL carries a per-run token (docs/DASHBOARD.md)
reachweaver completion {bash,zsh}        experimental: print a Tab-completion script for commands, options and fixed choices; reads no database and runs nothing
reachweaver privacy-status [--policy F]   offline DB perms/size/row counts/oldest records/retention config
reachweaver data-export [--out FILE]      redacted JSON export of local DB (new 0600 file)
reachweaver data-purge [--policy F] [--apply]  retention plan (dry run); --apply purges local rows only
reachweaver pause / resume               emergency publishing switch
reachweaver disconnect --account ID     #38 (draft): stop publishing to one account on this installation (tighten-only, local; lists the credential variable names and revocation steps, revokes nothing itself)
reachweaver reconnect --account ID      #38 (draft): lift it; human-only (interactive terminal plus a fresh challenge typed on /dev/tty)
reachweaver approval-mode [--confirmation tty_hash_prefix|off] [--require-key] [--require-identity]  #7 D6/D7 and wave 9 item 2 (--require-identity: plain approve is refused and approvals without a stored identity are not sent; tighten-only, no command removes it): show or tighten approval safeguards; opt-in terminal + typed hash prefix for approve and publish --live; keyed HMAC binding with REACHWEAVER_APPROVAL_SECRET (docs/SECURITY-REVIEW-PROPOSAL-7-d6-d7.md)
reachweaver reconcile POST_ID --published --remote-id ID [--remote-url URL]
reachweaver reconcile POST_ID --not-published  manual outcome review
reachweaver reconcile POST_ID ... --force      also reconcile a post still 'sending' that was claimed <15 min ago (a send may be in flight; check the native account first)
reachweaver metrics POST_ID --observed-at ISO8601 --source native-export --views 100 [--likes suppressed] [--window-start T --window-end T]
reachweaver import-metrics --csv FILE     import normalized snapshots, all rows or none; cells: count, empty/unknown, suppressed, not_available, delayed, estimated:N; optional window_start/window_end (docs/ATTRIBUTION.md#2a-bis-metric-value-status-privacy-thresholds-and-report-formats-issue-15)
reachweaver report [--format json|markdown|csv]  exact values only, per-metric coverage + status counts, estimates listed separately; null/unknown (never 0) at zero coverage; CSV formula cells neutralised
reachweaver metrics-fetch --online [--account ID] [--post-id ID] [--max-posts N] [--dry-run]  read-only GET of PUBLIC Bluesky/Mastodon counters for published posts; stops on 429; not private analytics (docs/ATTRIBUTION.md#2b-read-only-public-counter-polling-metrics-fetch)
reachweaver campaign-check --file F --brand B [--json] [--optout F] [--history-db DB [--history-days N] [--history-window-days W] [--history-max-posts K]]  offline schema/source/account checks; @-mention of an opted-out handle is an error; --history-db adds read-only repetition/frequency warnings against the same account's local posts (docs/CLAIM-GROUNDING.md#posting-history)
reachweaver claims-check CAMPAIGN --brand B [--json] [--optout F]    lexical grounding of figures/claims/feature claims vs declared evidence; not truth verification (docs/CLAIM-GROUNDING.md)
reachweaver campaign-preview --file F --brand B [--accounts A] [--utm] [--optout F] [--history-db DB [--history-days N] [--history-window-days W] [--history-max-posts K]] [--json|--markdown]  per-channel exact text, length budget, facets, capability, evidence, rule-based confidence; threads/carousel outlines; never stages (docs/CAMPAIGN-PREVIEW.md)
reachweaver campaign-export --file F --brand B --out DIR [--optout F]  manual-ready draft package
reachweaver youtube-attach POST_ID --file CLIP.mp4 --title T --made-for-kids yes|no --category-id N [--privacy private|unlisted|public] [--tag T]...  #22 (owner-approved 2026-10-09; disabled until a live receipt): bind one local MP4 + upload fields to a YouTube draft; offline; live upload stays registry-blocked (docs/YOUTUBE.md)
reachweaver youtube-detach POST_ID         #22: remove the video from a YouTube draft; offline
reachweaver youtube-analytics [--account ID] [--post-id ID]  #22: read-only sampling report over stored metric snapshots of published YouTube videos; labels exact / sampled / suppressed / delayed / not_available / unknown, never invents a view count, fetches nothing (docs/YOUTUBE.md#analytics-sampling-report)
reachweaver manual-export --platform threads|instagram|facebook|youtube|tiktok|<any other manual_only id> --variant F [--media MANIFEST] [--account-meta F] --out DIR [--json]  creator-ready package + checklist; other manual_only destinations get a generic package (limits unknown unless a registry records them; human-only ones get a write-it-yourself notes form); never sends (docs/MANUAL-EXPORT.md)
reachweaver manual-export-batch --file BATCH.json --out DIR [--json]  1-25 manual-export items preflighted as a whole (one blocking error writes nothing), one package folder each plus a manifest with the SHA-256 of every exact-text file; human-only destinations refused; an item's `at` is advisory, never scheduled (docs/MANUAL-EXPORT.md#batch-of-manual-packages)
reachweaver delivery-options [--platform ID] [--json]  offline route per distribution-registry channel: official API adapter (the four mock-tested ones), manual package, human-only notes form or unsupported, with the exact manual-export command; connects, posts and schedules nothing
reachweaver campaign-stage --file F --brand B [--optout F]    idempotently create draft posts only
reachweaver experiment-evaluate --file F       analyze paired native metrics; no causal claim
reachweaver experiment-preregister PLAN --out FILE  validate a 2-3 arm growth plan, write a NEW hashed record (docs/GROWTH-EXPERIMENTS.md)
reachweaver experiment-verify PLAN --hash H     detect post-hoc plan edits by recomputing the sha256 plan_hash
reachweaver experiment-readout --prereg FILE --posts MAP.json [--hash H] [--attribution ATTR.json] [--json]  read-only: verify hash, map arms to posts, label + design + flags; non-causal; --attribution (saved attribution-report --json) supplies docs_visits/repo_stars_utm per post, unknown never 0
reachweaver experiment-next --results FILE [--json]  offline: next dimension from prior classified results; keeps negative results
reachweaver experiment-simulate --seed S --pairs N --lift L --noise X [--trials T] [--json]  offline SIMULATED label distribution; never stored
reachweaver timing-evaluate --account ID --timezone TZ --source S --metric M --denominator views|impressions [--age-hours 168] [--tolerance-hours 24] [--min-posts-per-slot 3] [--campaign C] [--since D] [--until D] [--stratify format|campaign]  read-only matched-age daypart medians; per-stratum readouts; too little data -> cold_start pointer to calendar-plan's generic baseline, never a winner (docs/TIMING-EVALUATION.md)
reachweaver baseline-eval --account ID --timezone TZ (--source S --metric M --denominator views|impressions | --attribution ATTR.json --outcome docs_visits|repo_stars_utm) --since D --until D [--slot [explore:|exploit:]Wed@16:00]... [--campaign-arm [explore:|exploit:]C]... [--readout FILE]... [--min-posts 5] [--resamples 2000] [--confidence 0.95] [--seed 16] [--json]  read-only: vs calendar-plan's generic baseline; seeded bootstrap CI, Holm-Bonferroni, correlational vs randomized, insufficient_data not 0 (docs/TIMING-EVALUATION.md)
reachweaver pilot-report --log FILE.csv [--min-weeks N] [--json]  offline per-arm field-pilot log readout; blank = unknown; descriptive, refuses arms under N ISO weeks (docs/FIELD-PILOT-PROTOCOL.md)
reachweaver schema-validate --type TYPE FILE   offline canonical schema check, versions 1.0, 1.1 and 1.2 (docs/SCHEMAS.md)
reachweaver schema-export [--out FILE] [--type T]  read-only: local DB rows as validated canonical JSON lines (current schema version) (new 0600 file or stdout); unmapped rows listed with reasons; never mints Approvals (docs/ADR-0003-CANONICAL-CONTRACTS.md)
reachweaver engagement-fetch [--online --out FILE] [--account ID] [--post-id ID] [--max-posts N] [--depth N] [--max-replies N] [--quotes [--max-quotes N]]  read-only, unauthenticated GET of PUBLIC replies (and, with --quotes, Bluesky quote posts) to your published Bluesky/Mastodon posts into a NEW 0600 engagement-triage export; plan only without --online; redacted; stops on 429; never replies or writes the DB (docs/ENGAGEMENT.md#fetching-replies-engagement-fetch)
reachweaver engagement-triage EXPORT.json [--docs-map F] [--out F.md|F.json] [--issues-dir DIR] [--optout F] [--json]  offline comment triage; reply/issue DRAFTS only, no send path; no draft for opted-out authors (docs/ENGAGEMENT.md)
reachweaver engagement-queue EXPORT.json [--docs-map F] [--optout F] [--now ISO] [--sla LABEL=HOURS] [--json]  offline aging/SLA review queue (overdue first); read-only, no database, no send path; SLA hours are owner-adjustable defaults
reachweaver utm-link URL --platform P --campaign C [--content POST_ID] [--allow-origin O...] [--sources CONFIG]  canonical UTM link; refuses private source repo URLs
reachweaver attribution-report --analytics CSV [--github-traffic JSON]... [--json]  read-only UTM/referrer join
reachweaver seo-destinations --briefs FILE --type release|paper|product|docs [--project P]  landing page + conflicts
reachweaver weekly-digest --out FILE.md [suggest input flags] [--include-db] [--limit N]  suggest + local report as one private (0600) Markdown file; new file only, local only, never sent (docs/NEXT-ACTIONS.md)
reachweaver seo-content-check FILE.json [--name NAME]... [--online [--allow-origin O...]] [--json]  discoverability checks on post texts you supply (length, alt text, hashtags, UTM link, name spelling, cross-platform duplicates; --online adds link-preview checks); every finding labelled official/repo_policy/hypothesis; read-only, exit 2 on errors
reachweaver landing-check --briefs FILE [--campaign CAMPAIGN.json] [--online] [--allow-origin O...] [--json]  canonical URL/CTA/UTM checks; --online: status, redirects, rel=canonical, Open Graph, noindex, lang, lexical claim phrases (docs/SEO-INTEGRATION.md)
reachweaver link-health [--status approved --status scheduled --status published] [--account ID] [--campaign C] [--online [--allow-origin O...]] [--max-links 25] [--json]  # read-only: broken, redirected or preview-less links in your stored posts; offline unless --online; robots.txt first (issue #10)
reachweaver media-check MANIFEST [--json]      offline media headers/limits/alt text/captions/rights; never uploads
reachweaver media-attach POST_ID --url HTTPS_URL (--alt T | --alt-file F) --online  Instagram draft: one owner-hosted JPEG URL; one read-only GET; SHA-256 + URL bound at approval (#20, owner-approved 2026-10-09; disabled until a live receipt)
reachweaver media-detach POST_ID               offline: remove a draft's image attachments
reachweaver media-storyboard --campaign CAMPAIGN.json --out NEW_DIR [--duration S] [--aspect 9:16] [--video-targets T...] [--image-targets T...] [--locale L] [--fit cover|contain] [--safe-zones F] [--json]  offline storyboard + SRT skeleton + alt-text placeholders + image specs + media manifest; generates no media (docs/MEDIA-ASSETS.md)
reachweaver media-storyboard --check STORYBOARD.json [--safe-zones F] [--json]  re-check edited text/focal boxes against crop and UI-overlay safe areas, subtitle timing and placeholders
reachweaver sources-scan --config F [--online] [--allow-private] [--state S] [--top N] [--json]  rank opt-in GitHub/feed/changelog/DOI signals; research only
reachweaver signal-brief --scan SCAN.json --signal-id ID --brand B --out CAMPAIGN.json [--accounts A] [--objective O] [--allow-duplicate] [--json]  NEW 0600 campaign scaffold + .brief.md from one signal; placeholders block staging; no copy generated (docs/SOURCES.md)
reachweaver capabilities [--platform P] [--json] [--max-age-days 120]  offline capability/API-approval registry (docs/PLATFORMS.md)
reachweaver distribution-plan --region R --goal G [--limit N] [--date D --timezone TZ] [--json]  offline worldwide channel hypotheses; never schedules or posts
reachweaver postiz-check --account ID --online [--post-id ID]  read-only Postiz integration listing / job lookup; never posts (docs/POSTIZ.md)

Field pilot and release playbook (issue #27 slice): FIELD-PILOT-PROTOCOL.md is a preregistration template for comparing a manual workflow, a conventional scheduler and ReachWeaver on one owned project and two authorized networks; copy examples/pilot-log.template.csv (header only) and read it with pilot-report. RELEASE-PLAYBOOK.md walks a release through every existing command and human gate. No pilot has been run and there are no pilot results.

Campaign links and attribution (offline): utm-link builds deterministic, tracker-free UTM links. attribution-report joins your own analytics CSV and saved GitHub traffic JSON to local posts. It keeps exact UTM matches, domain-level referrer-only rows and unattributed rows separate, and never zero-fills or claims causation. seo-destinations reads a local export from the SEO repository and flags competing campaigns. landing-check checks that campaign CTAs point at a brief's canonical page and, only with --online, fetches each landing page (robots.txt honoured, redirects capped) to check its status, canonical link, social preview and claim wording. Each recorded per-platform metric definition carries the official source_url it was checked against and a verified_date. See attribution, a SYNTHETIC weekly report example and the SEO integration contract.

Use --db PATH and --accounts PATH as global options preceding the subcommand when needed. Dates must include a timezone offset. reachweaver publish without --live cannot send anything; even --live requires REACHWEAVER_ALLOW_LIVE=1 and REACHWEAVER_ENV=prod (checked before any account or credential is loaded), approved due posts, the right account configuration, and available credentials.

Account and credential hardening (issue #5, owner-approved 2026-10-09). load_accounts refuses two accounts whose env_prefix values are identical or overlap (one account's credential variable name equals or begins another's, over every adapter suffix and the Postiz key). Credentials come from environment variables or, on an unattended host, from systemd LoadCredential= files in $CREDENTIALS_DIRECTORY (absolute, not group/world-writable, no symlinks or FIFOs, at most 64 KiB, UTF-8); while that directory is set the environment is not consulted. doctor, health and credentials-audit show the credential source and REACHWEAVER_ENV, never a value. See account onboarding.

Public counter polling (issue #15 slice): metrics-fetch --online reads the public like, repost, reply and (Bluesky only, when present) bookmark counters of your own published Bluesky and Mastodon posts and stores one bluesky-public-api / mastodon-api snapshot per post. Bluesky uses the unauthenticated public AppView app.bsky.feed.getPosts (25 URIs per GET) and checks that the author DID matches the post URI. Mastodon uses an unauthenticated GET /api/v1/statuses/:id, retried once with {env_prefix}_TOKEN only on 401/404, and checks that the author is the configured handle. Views, impressions and clicks are not exposed and stay unknown (NULL), never 0. Requests run one at a time, at most 50 posts per run by default (200 maximum), and a 429 stops the run without retrying. --dry-run uses no network. This is not private analytics. See attribution, section 2b.

LinkedIn member posts (issue #14): a linkedin account needs person_id (the sub from /v2/userinfo) and a pinned linkedin_version (YYYYMM), with an optional non-secret authorization_expires_at. The token is read only from {env_prefix}_ACCESS_TOKEN. doctor warns offline when the version is 10+ months old or the token is within 7 days of expiry; connect-check --online and publish --live refuse a version 12+ months old, an expired token, a sub mismatch or any organization author before claiming the send. The receipt is the x-restli-id post URN. userinfo proves identity, not the w_member_social write scope. An opt-in "scope_check": "introspect" adds LinkedIn's read-only token introspection before the claim; it needs the app's {env_prefix}_CLIENT_ID and {env_prefix}_CLIENT_SECRET and was owner-approved 2026-10-09 (proposal). See LinkedIn onboarding.

Instagram single-image adapter (issue #20, owner-approved 2026-10-09; disabled until a live receipt): reachweaver/instagram.py implements the official container flow (POST /{ig-user-id}/media with image_url, caption and alt_text, status_code polls, media_publish, permalink receipt) with a GET /me identity check (user_id, username, professional account_type) and a read-only content_publishing_limit quota check before the claim. Instagram fetches the image from a public URL, so the owner hosts the JPEG; media-attach --url ... --online downloads it read-only and approval binds its SHA-256 and URL. A live send downloads it again before the claim and immediately before the container request, and refuses changed bytes. It is tested with mocked HTTP only and is unreachable: the capability registry keeps Instagram image api_gated with no adapter, so publish --live and connect-check --online refuse it before any credential read. It stays that way until Meta App Review, a supervised first live receipt and a reviewed registry change (proposal, guide). Use manual-export --platform instagram meanwhile.

TikTok video adapter (issue #23, owner-approved 2026-10-09; disabled until a live receipt): reachweaver/tiktok.py implements the official Content Posting API flow (init, chunked PUT upload, status polling) with a creator-inbox draft upload as the first mode: the creator finishes and posts the video in the TikTok app, so ReachWeaver records the upload as needs_review (tiktok_creator_inbox_delivered_not_public), never as published, until the owner reconciles the native video. Direct Post sits behind a second registry switch, with an explicit, bound privacy level that must appear in the creator's live privacy_level_options (never PUBLIC by default). video-attach binds the MP4's SHA-256 into the approval hash. Everything is mock-tested only and unreachable: the registry keeps reachweaver_video_inbox and reachweaver_video_direct_post off and policy.SUPPORTED_LIVE_VIDEO is empty (proposal, guide). Use manual-export --platform tiktok meanwhile.

YouTube upload adapter (issue #22, owner-approved 2026-10-09; disabled until a live receipt): reachweaver/youtube.py implements the official resumable videos.insert upload (session POST, 256 KB-multiple chunks, 308 Range checks, 201 receipt) with a channels.list?mine=true channel check before the claim. youtube-attach binds the MP4's SHA-256, title, tags, category, privacy (default private) and a required made-for-kids answer into the approval hash (binding tag reachweaver.storage.approval/video-1); the file is re-hashed before the claim and again while it streams. It is tested with mocked HTTP only and is unreachable: the registry keeps YouTube api_gated with no adapter and SUPPORTED_LIVE_VIDEO is empty, so publish --live refuses it before any credential read. Uploads from unverified Google API projects may be locked private (proposal, guide). Use manual-export --platform youtube meanwhile.

Threads text adapter (issue #19, owner-approved 2026-10-09; disabled until a live receipt): reachweaver/threads.py implements the official two-step text flow (container, status wait, publish, permalink receipt) with GET /me identity and a read-only threads_publishing_limit quota check before the claim. It is tested with mocked HTTP only and is unreachable: the capability registry keeps Threads api_gated with no adapter, so publish --live and connect-check --online refuse it before any credential read. It stays that way until the owner's Meta App Review, a supervised first live receipt and a reviewed registry change (proposal, guide). Use manual-export --platform threads meanwhile.

Facebook Page adapter (issue #21, owner-approved 2026-10-09; disabled until a live receipt): reachweaver/facebook.py posts text, plus a link taken from the approved text, to one configured Page via POST /{page-id}/feed (Graph API v25.0). Before the claim it checks that the token is a Page token for that exact Page (GET /me and GET /{page-id}). It is tested with mocked HTTP only and is unreachable: the capability registry keeps Facebook api_gated with no adapter, so publish --live and connect-check --online refuse it before any credential read. It stays that way until the owner's Meta App Review, a supervised first live receipt and a reviewed registry change (proposal, guide). Use manual-export --platform facebook meanwhile.

Interrupted or ambiguous send? The post remains in sending or needs_review, not automatically resent. Manually inspect the actual account and then reconcile. This avoids silently duplicating a post at the cost of requiring human follow-up.