@@ -58,6 +58,7 @@ on:
       - 'tests/test_oc3_diagnostic_console.py'
       - 'tests/test_publication_manual_handoff.py'
       - 'tests/test_oc4_inactivity.py'
+      - 'tests/test_oc41_diagnostic_polish.py'
       - 'tests/test_v071_integration.py'
       - 'tests/test_v071_http_smoke.py'
       - 'tests/test_v071_ui_update.py'
@@ -123,6 +124,7 @@ on:
       - 'tests/test_oc3_diagnostic_console.py'
       - 'tests/test_publication_manual_handoff.py'
       - 'tests/test_oc4_inactivity.py'
+      - 'tests/test_oc41_diagnostic_polish.py'
       - 'tests/test_v071_integration.py'
       - 'tests/test_v071_http_smoke.py'
       - 'tests/test_v071_ui_update.py'
 
@@ -2,7 +2,7 @@
 
 **Last reviewed:** October 30, 2026 (America/Los_Angeles)  
 **Canonical repo:** `merberg-ai/bob-openclaw-moltbook`, `main`  
-**Operator-tested deployed baseline:** `v0.7.6-oc3-console1` (OC0–OC3 operator-accepted Oct 30, 2026; publication bugfix candidate awaiting acceptance)  
+**Operator-tested deployed baseline:** `v0.7.6-oc4-investigator1` (installed Oct 30, 2026; functionally working with identified telemetry/presentation gaps addressed by OC4.1 candidate)  
 **Status:** FM3 complete; **FM4/FM5 on hold** until operator's other issues and new feature are handled. **CH1 remains planned only, not implemented or installed.**  
 **Deployment contract:** future implementation through `bobctl update` with verified private backup, installed-module import checks, reversible release and short live acceptance. A Git commit alone never changes the running Activity Manager.
 
@@ -12,7 +12,7 @@
 | --- | --- | --- |
 | Personality (PM1) and Memory (PM2) | Implemented / operator-tested | Maintain existing explicit memory recall and owner review boundaries |
 | **Friends (FM1–FM3.2d)** | **All FM3 phases complete, operator-accepted**; final release `v0.7.5-fm32d-focus1`, PR #38, 537 CI tests | **HOLD** until unrelated issues and separate requested feature are addressed. Then resume **FM4.1 evidence-linked Social Memory Timeline**, later FM5 only with explicit approval. See [Friends roadmap & resumption handoff](docs/FRIENDS-ROADMAP-AND-HANDOFF.md) |
-| **Operations Center: activity / automation / console / inactivity investigation** | **OC0–OC3 operator-accepted; publication fix merged but not live-confirmed; OC4 candidate** | `v0.7.6-oc4-investigator1` implements safe read-only Why no activity?, approval/rejection distinctions and bounded publisher skip traces. Install/accept the preceding `v0.7.6-pubfix-manual1` first. See [OC4 release notes](docs/V076-OC4-INACTIVITY.md) and [Operations Center roadmap](docs/OPERATIONS-CENTER-ROADMAP.md) |
+| **Operations Center: activity / automation / console / inactivity investigation** | **OC0–OC4 installed and operator-smoke-tested; OC4.1 polish candidate** | `v0.7.6-oc41-polish1` distinguishes historical vs verified manual-handoff subset, adds dated source evidence/last activity and read-only systemd next-trigger fallback. [OC4.1 release notes](docs/V076-OC41-DIAGNOSTIC-POLISH.md); FM4/FM5 still held. |
 | Logs & Diagnostics | Installed / operator-tested | Reuse existing bounded redacted journal, job, event and checkpoint collectors rather than duplicate raw logging |
 | **Direct Bob Chat (CH1)** | **Planned here, not started** | Gateway compatibility spike, then authenticated LAN chat UI |
 | Fresh-host installer | Deferred | Keep current WSL/Windows startup, services and updater intact |
@@ -21,7 +21,7 @@
 
 **Owner request (Oct 30, 2026):** The Overview gauges show 2/10 comment attempts, 0/6 automatic, 0/4 originals and six queued manual comments, but reveal too little about the reason for inactivity. Owner wants a compact live-truthful **“Bob right now”** card directly below gauges, a centralized **Automation** section with controls/status/last action/next actual run for automatable features, a terminal-styled **read-only sanitized Console** showing useful Ollama/OpenClaw/Gateway/system/worker diagnostics, and a reliable one-view **“Why no activity?”** explanation. All pages must be compact and mobile-friendly.
 
-**Implementation status:** **OC0–OC3 operator-accepted** including Console. The approved-auto manual publication repair **`v0.7.6-pubfix-manual1` is merged but awaits live operator confirmation**. **OC4 investigator candidate `v0.7.6-oc4-investigator1`** is built on top and pending CI/merge/live acceptance. See [OC4 notes](docs/V076-OC4-INACTIVITY.md) and [Operations Center roadmap](docs/OPERATIONS-CENTER-ROADMAP.md). OC4 never queues a draft; it reads bounded sources and explains skip reasons. The new **Moltbook Experience Digest (MD1)** remains a later separately approved initiative, not part of OC4. Build from existing `bob_overview`, `bob_live_status`, `bob_job_tracking`, `bob_diagnostic_logs`, `bob_activity_limits`; preserve queue and publishing protections. Only add automation toggles through exact, independently authorized handlers. **Original posts remain owner-requested/approved** unless separately redesigned; empty original budget is not proof of failure. “Earliest possible next” is a rate-limit eligibility clock, not a real scheduled run.
+**Implementation status:** **OC0–OC4 installed and functionally smoke-tested**, including publication fix `v0.7.6-pubfix-manual1` and the new `/investigate` page. Operator's actual OC4 screenshot confirms work but exposed historical counts without age qualifiers, undated policy labels and unavailable systemd next trigger. **OC4.1 `v0.7.6-oc41-polish1` is a diagnostic-only candidate, not installed**; see [OC4.1 release notes](docs/V076-OC41-DIAGNOSTIC-POLISH.md) and [Operations Center roadmap](docs/OPERATIONS-CENTER-ROADMAP.md). No new publishing authority. Moltbook Experience Digest (MD1) is still a separate planned bridge. Build from existing `bob_overview`, `bob_live_status`, `bob_job_tracking`, `bob_diagnostic_logs`, `bob_activity_limits`; preserve queue and publishing protections. Only add automation toggles through exact, independently authorized handlers. **Original posts remain owner-requested/approved** unless separately redesigned; empty original budget is not proof of failure. “Earliest possible next” is a rate-limit eligibility clock, not a real scheduled run.
 
 **User preference:** no sprawling command-marathon; one `bobctl update` per small code release, with CI first and a concise mobile/LAN acceptance. Keep FM4/FM5 paused until the Operations Center and other operator-reported issues are addressed.
 
@@ -34,7 +34,7 @@
 
 **Resume Friends at FM4.1** only after the operator lifts the hold: a small private, source-verifiable, per-agent **Social Memory Timeline** distinguishing actual saved observations, Bob's tentative ideas and owner-reviewed records. Start with read-only evidence linked from FM1/FM2 and existing FM3.2a–d data, timestamps and corruption checks; do not silently write to PM2 memory or `SOUL.md`, change Scout priorities or authorize outreach. FM4.2 can add revisable impressions and owner corrections; FM4.3 can add explicitly enabled bounded recall. FM5.1 independent exploration and FM5.2 separately approved public interactions remain further off. Full architecture, rules, acceptance and copyable kickoff: [docs/FRIENDS-ROADMAP-AND-HANDOFF.md](docs/FRIENDS-ROADMAP-AND-HANDOFF.md).
 
-**Future versioning:** the last operator-confirmed installed release is `v0.7.6-oc3-console1`. Publication fix candidate upgrades from OC3 to `v0.7.6-pubfix-manual1`; this is not an installed baseline until operator acceptance. OC4 must be built on the latest accepted installed version. Future updates must preserve the exact release chain.
+**Future versioning:** last operator-confirmed working installed release is `v0.7.6-oc4-investigator1`. OC4.1 candidate's manifest `from` must be exactly `v0.7.6-oc4-investigator1`; GitHub merge alone never changes the host. Preserve guarded incremental `bobctl update` and backup/rollback.
 
 ---
 
 
@@ -3,7 +3,7 @@
 **Planning checkpoint:** October 30, 2026 (America/Los_Angeles).  
 **Priority:** Owner-requested visibility, unified automation control, and safe diagnostic console **before** resuming Friends Manager FM4.1 / FM5.  
 **Last operator-tested release:** `v0.7.5-fm32d-focus1`, final FM3 acceptance PASS.  
-**Implementation status:** **OC0–OC3 operator-accepted** through `v0.7.6-oc3-console1` (Oct 30, 2026); **publication fix** `v0.7.6-pubfix-manual1` merged but still awaiting operator confirmation. **OC4 code candidate** `v0.7.6-oc4-investigator1` builds on the publication fix and awaits CI/merge/live acceptance. No new posting or agent permissions.  
+**Implementation status:** **OC0–OC4 installed and operator-smoke-tested**, including publication fix and `v0.7.6-oc4-investigator1`, October 30, 2026. The screenshot confirmed useful classifications but exposed confusing historical aggregation, missing source times, and unreported systemd trigger. **OC4.1 candidate** `v0.7.6-oc41-polish1` implements read-only clarity fixes, pending operator acceptance. No new posting or agent permissions.  
 **Principle:** First explain existing inactivity accurately; do not increase autonomous posting merely to move a gauge.
 
 ## 1. User problem and what is known
@@ -158,6 +158,15 @@ Suggested distinct UI states:
 - **Acceptance:** one guarded `bobctl update` *after* publication fix accepted, browse Overview → Why no activity?, verify four cards and the schedule/eligibility distinction. See [V076-OC4-INACTIVITY.md](V076-OC4-INACTIVITY.md). **No test posting, no toggles.**
 - **Future:** optional copy/export sanitized summary and richer per-run skip instrumentation can be separately prioritized; neither is required for the read-only OC4 first pass. The **Moltbook Experience Digest** is a separate pending MD1/CH1/FM4 design in root [TODO.md](../TODO.md). FM4/FM5 remain paused.
 
+### OC4.1 diagnostic polish (release candidate, not operator-accepted yet)
+
+- **Baseline:** `v0.7.6-oc4-investigator1`, operator confirmed installed and functionally working but provided a screenshot of missing/incomplete metadata. Next `bobctl update` candidate: `v0.7.6-oc41-polish1`. Only two existing installed modules: `bob_inactivity.py` and `bob_operations_diagnostics.py`. No manager routes, publisher, original-post worker, SQLite schema, systemd mutation or new external permission.
+- **Historical label correctness:** up to 150 recent publication jobs, with observed UTC min/max source update dates, real last matching review-block time, and clear **historical** wording. At most 25 approved no-send blocked jobs are read-only rechecked using the same sealed-feed/digest and no-send validator as existing manual Publish action. Display verified subset count and up to three canonical run links to the existing owner review page, not new queue buttons. Verification does not bypass later age/rate/duplicate rules.
+- **Timer truth:** prefer fixed user-systemd timer `NextElapseUSecRealtime`, then read-only fixed-unit JSON `list-timers --all` fallback for each of the same two allowlisted timers. A blank/invalid result remains unknown, never a made-up scheduled publication.
+- **Recent event context:** Last activity & timing shows recorded Scout checkpoint, latest valid metadata-only publisher skip/evaluation, last send attempt, last API-acknowledged publication, next systemd trigger and separate policy eligibility. Undated static explanations say policy/historical summary, not "Time unavailable" as though an event timestamp was lost.
+- **Acceptance:** [V076-OC41-DIAGNOSTIC-POLISH.md](V076-OC41-DIAGNOSTIC-POLISH.md); one `bobctl update` and short mobile `/investigate` review. No test posting or setting toggles.
+- **After OC4.1:** Operations Center OC0–OC4.1 closes only after live acceptance. Pending independent idea: Moltbook Experience Digest (MD1), followed by separate authorization for CH1/FM4/FM5. Maintain hold.
+
 ## 4. Improvements that should NOT get mixed into first release
 
 - **Explicitly separate project idea:** owner-approved automatic original-post **draft creation cadence**, if desired later. It must *not* automatically publish; require opt-in, generation budgets, safety screening, content quality, source limits and manual approval. Existing 0 original attempts is not a failure.
@@ -172,6 +181,6 @@ Suggested distinct UI states:
 - Avoid 14-hour manual test sequences. Synthetic comprehensive CI plus a **single short owner smoke test** for each release, with exact pass/fail and rollback.
 - Real operator screenshot is the problem statement, **not proof** that current services have failed. To confirm a live cause, use existing `/system/status`, `/logs` (publisher/scout) and `/originals` without mutation.
 
-## 6. Handoff after OC4
+## 6. OC4.1 handoff, October 30, 2026
 
-> Last operator-confirmed baseline from this chat: `v0.7.6-oc3-console1`. The publication-fix `v0.7.6-pubfix-manual1` was merged and given to the operator, but **was not yet explicitly confirmed installed**. OC4 candidate `v0.7.6-oc4-investigator1` builds from that pubfix and must not be marked operator-tested before live validation. Read `docs/V076-PUBFIX-MANUAL-HANDOFF.md`, `docs/V076-OC4-INACTIVITY.md`, root `TODO.md` and `releases/current.json` on `main`. If operator accepts OC4, Operations Center OC0–OC4 is complete as scoped. Next user-requested idea is the private **Moltbook Experience Digest (MD1)** bridging verified Scout/publication/replies into real OpenClaw Gateway/CH1 chat, **not** autonomous memory editing. FM4/FM5 are still explicitly on hold and require owner's later authorization.
+> Last confirmed installed baseline: `v0.7.6-oc4-investigator1`. OC4.1 diagnostic-only candidate `v0.7.6-oc41-polish1` is built on that baseline but **not installed until the owner reports `bobctl update` success**. Read `docs/V076-OC41-DIAGNOSTIC-POLISH.md`, `docs/OPERATIONS-CENTER-ROADMAP.md`, root `TODO.md` and current `releases/current.json` on GitHub `main`. Validate source timestamps, historical vs verified handoff subset, rate policy vs systemd trigger, real last Scout/publisher evidence; keep publication logic, owner-review permissions, auth and security unchanged. After operator accepts, OC0–OC4.1 complete. Next possible project is **MD1 Moltbook Experience Digest**, not already implemented. FM4 and FM5 remain paused.
@@ -0,0 +1,32 @@
+# OC4.1: Why No Activity? Diagnostic Polish
+
+**Release candidate:** `v0.7.6-oc41-polish1` from last operator-accepted `v0.7.6-oc4-investigator1`.  
+**Status:** offline CI and live operator acceptance required. Repo merge does not install on the OMEN.  
+**Installed files:** `bob_inactivity.py`, `bob_operations_diagnostics.py`. Activity Manager restart only. **No new manager route, DB schema, new listener, automation, timer mutation, scheduler or publication permission.**
+
+## Why this increment
+
+User confirmed OC4 works on LAN but its screenshot exposed: "Time unavailable" on aggregate/policy findings; 11 approved and 9 rejected historical auto blocks shown as though currently actionable; and "Next systemd publisher trigger: Not reported" despite otherwise functioning publisher. Actual screenshot also contained a successfully API-acknowledged comment and a documented rate/budget skip, so none of these alone established a publisher outage.
+
+## Improvements
+
+- **History instead of today:** automatic-comment section explicitly says counts come from up to the **150 most recently updated jobs**, shows UTC earliest/latest update dates in that bounded sample, and reports last matching historical block time per approved/rejected/missing-decision classification. Unknown timestamps are labeled **Policy / historical summary**, not disguised as events.
+- **Owner-approved does not mean ready:** still distinguishes approved/rejected/mismatched review blocks using saved decision digest, but additionally verifies a *bounded subset of up to 25 approved never-sent jobs* against the existing **exact** read-only Scout source validator (`manual_recovery_allowed`). Displays "N of M inspected verified" separately from the historical approved count; at most three canonical run-ID links open the existing Scout review card, not an immediate publication action. Old or missing source checks fail closed; release does **not** auto-queue any job. Note: an approved old run may still fail age/target/duplicate checks later. An owner must explicitly queue publishing via the existing protected handler.
+- **Last activity snapshot:** one section for last Scout worker checkpoint (not a proof of completed session), last metadata-only publisher skip/evaluation, last recorded send attempt, latest API-acknowledged comment (not independent public-visibility proof), next actual systemd trigger and earliest policy-permitted time (not the same thing). Unknown fields remain labeled unknown.
+- **Timer fallback:** the two fixed allowlisted systemd user timers first use `NextElapseUSecRealtime`; only if it is missing, read their matching `systemctl --user list-timers --all --no-pager --output=json <fixed unit>` metadata. Parse an exact matching timer entry and only a plausible systemd-reported time. No shell, arbitrary unit, user command, monotonic-to-clock prediction or timer writes. When both read paths are silent, show **Not reported by systemd; check Automation / timer state** rather than promise the next run.
+
+## Safeguards
+
+All evidence stays on authenticated LAN. SQLite is fixed and read-only with bounded rows; no prompts, raw post/comment text, session transcripts, tokens or error details displayed. Existing publisher queue and original-post owner approvals, friend-targeting exclusions, cooldowns, stale selection claims and no-retry-on-uncertainty stay unchanged. Verified handoff counts are **not** proof a publication will succeed.
+
+Synthetic `tests/test_oc41_diagnostic_polish.py` covers valid/invalid systemd fallback, exact-unit selection, bad JSON/injection, bounded handoff verified vs unverified/unsafe job, real history date labels and UI source links. The entire old tests suite must remain green.
+
+## Operator smoke acceptance
+
+1. Run `bobctl update` in OpenClawLab; confirm `v0.7.6-oc4-investigator1` → `v0.7.6-oc41-polish1`, type `UPDATE`.
+2. On LAN open **Why no activity?**. Look for the Last activity & timing block, historical UTC range on Automatic comments, dated blocked-review findings, and the separate **verified handoff subset**.
+3. If available, check a verified manual-review link opens Scout; **do not click the actual manual Publish button** just to test.
+4. Check that **Next systemd publisher trigger** reports a systemd-provided time or clearly reports unavailable; policy-eligible timestamp remains distinct.
+5. Existing Overview, Automation, Console and normal queue protections should remain unchanged. No extra command marathon.
+
+**Next:** After OC4.1 acceptance, Operations Center OC0–OC4.1 is closed as scoped. Separate pending MD1 **Moltbook Experience Digest** in TODO.md, future CH1 Direct Bob Chat, and paused FM4/FM5 remain independent operator choices.