@m13v/s4l 1.6.203-rc.21 → 1.6.203-rc.22

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.6.203-rc.21",
-  "installedAt": "2026-07-06T21:53:47.458Z"
+  "version": "1.6.203-rc.22",
+  "installedAt": "2026-07-06T22:16:22.489Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.6.203-rc.21",
+  "version": "1.6.203-rc.22",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -303,13 +303,27 @@ def _details_lines(d):
     # merge_review_queue.py from scripts/active_experiments.py. Rendered
     # generically so every future experiment surfaces here with no card change.
     # 'lane' reads as a scenario, not an A/B arm, so it gets its own label.
+    # Each arm carries its meaning from the DESCRIPTIONS registry in
+    # active_experiments.py (scripts/ is on sys.path via s4l_state's
+    # S4L_REPO_DIR insertion); the reviewer needs what the variant DOES, not
+    # just its name. Unknown arms fall back to the bare name.
     exps = d.get("experiments") or {}
+    if exps:
+        try:
+            from active_experiments import describe as _exp_describe
+        except Exception:
+            def _exp_describe(_name, _variant):
+                return None
     for name in sorted(exps):
         label = (
             "Lane" if name == "lane"
             else f"Experiment {str(name).replace('_', ' ')}"
         )
-        lines.append(f"{label}: {exps[name]}")
+        line = f"{label}: {exps[name]}"
+        exp_desc = _exp_describe(name, exps[name])
+        if exp_desc:
+            line += f" ({exp_desc})"
+        lines.append(line)
     topic = (d.get("search_topic") or "").strip()
     if topic:
         lines.append(f"Found via search: {topic}")

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.6.203-rc.21",
+  "version": "1.6.203-rc.22",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.6.203-rc.21",
+  "version": "1.6.203-rc.22",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/active_experiments.py

@@ -32,6 +32,45 @@ import sys
 
 ENV_PREFIX = "S4L_EXP_"
 
+# What each arm MEANS, for humans reviewing cards: the details popover shows
+# this next to the bare variant name (s4l_card._details_lines calls
+# describe()). Keyed experiment name -> variant -> short description; one
+# sentence, the popover wraps at ~300px. A missing entry degrades to the bare
+# variant name, so unknown or future arms need no code change to render.
+# Keep draft_prompt entries in sync with bin/server.js
+# DRAFT_PROMPT_VARIANT_DEFS and the arm strings in run-twitter-cycle.sh.
+DESCRIPTIONS = {
+    "draft_prompt": {
+        "treatment_v2": (
+            "skeleton ban: forbids the concede-then-reverse "
+            '"easy X / hard Y" structure and forces varied entry points'
+        ),
+        "control_v2": (
+            "current draft directive (style + product pivot), no structure ban"
+        ),
+        # v1 arms (decoupled-product-pivot) retired 2026-07-06; kept so any
+        # straggler card from an old plan still explains itself.
+        "treatment": "v1, retired: product pivot decoupled from the reply",
+        "control": "v1, retired: original draft directive",
+    },
+    "lane": {
+        "personal_brand": (
+            "organic persona lane: first-hand voice, no product, no link, no CTA"
+        ),
+        "promotion": (
+            "product lane: routes to the matched project and may carry a link"
+        ),
+    },
+}
+
+
+def describe(name, variant):
+    """Human-readable meaning of an arm, or None when unknown."""
+    try:
+        return DESCRIPTIONS.get(str(name), {}).get(str(variant))
+    except Exception:
+        return None
+
 # Experiments/scenarios that predate the S4L_EXP_ convention, keyed by env
 # var. Order matters where two vars map to one name: later entries win, so
 # S4L_CYCLE_LANE (the wrapper's authoritative per-cycle lane tag) overrides

package/scripts/claude_job.py

@@ -637,6 +637,9 @@ def cmd_provider(ns) -> int:
 
     job_id = uuid.uuid4().hex
     created = time.time()
+    # Cycle batch id (run-twitter-cycle.sh exports BATCH_ID) so every provider.log
+    # line correlates to the cycle's own twitter-cycle-<batch>.log. '-' when off-cycle.
+    batch = (os.environ.get("BATCH_ID") or os.environ.get("SA_CYCLE_ID") or "-").strip() or "-"
     _ensure_dirs(qtype)
     _sweep_stale()  # clear leftovers from prior timed-out producers before enqueuing
     job = {
@@ -652,7 +655,7 @@ def cmd_provider(ns) -> int:
     pending_path = os.path.join(pending_dir(qtype), fname)
     running_path = os.path.join(running_dir(), fname)
     _atomic_write(pending_path, job)
-    _plog(f"enqueued {qtype} job {job_id}; waiting for a scheduled task (timeout {ns.timeout}s)")
+    _plog(f"enqueued {qtype} job {job_id} batch={batch}; waiting for a scheduled task (timeout {ns.timeout}s)")
     # Narrate the (multi-minute) block to the menu bar. The launchd draft lane has
     # no other activity writer, so without this the box looks idle while it works.
     # Cleared by run-draft-and-publish.sh's exit trap at cycle end (and by the
@@ -712,6 +715,16 @@ def cmd_provider(ns) -> int:
             # A worker drained this job -> the autopilot is alive; clear any latched
             # stall so the menu bar / dashboard / Sentry watcher recover.
             _mark_drain_success()
+            # Success-consume event: the SILENT gap that made an orphaned result
+            # (worker wrote it, producer died before consuming) indistinguishable
+            # from a healthy one. A result file only survives in result/ if it was
+            # NEVER consumed (we os.remove above), so "consumed" here + a surviving
+            # file = the orphan signature the salvage reconciler keys on.
+            try:
+                _ncand = len(obj.get("candidates")) if isinstance(obj, dict) and isinstance(obj.get("candidates"), list) else "?"
+            except Exception:
+                _ncand = "?"
+            _plog(f"consumed result for job {job_id} batch={batch} ({qtype}); {_ncand} candidates -> producer assembles the plan")
             return 0
         time.sleep(POLL_INTERVAL_S)
 
@@ -731,7 +744,7 @@ def cmd_provider(ns) -> int:
     # (no pending file exists between cycles, so an instantaneous queue check would
     # flicker the ⚠ off). Cleared only when a draft actually drains.
     _bump_drain_timeout()
-    _plog(f"timed out after {ns.timeout}s waiting for job {job_id} ({qtype}); removed the job")
+    _plog(f"timed out after {ns.timeout}s waiting for job {job_id} batch={batch} ({qtype}); removed the job")
     return 79  # mirror run_claude.sh's "blocked, skip cleanly" exit code
 
 

package/scripts/relay_provider_log.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""relay_provider_log.py — ship the queue producer/consumer log to Cloud Logging.
+
+claude_job.py writes the queue handoff lifecycle (enqueue / claim / consumed /
+timed out, plus [salvage] orphan events) to <state>/claude-queue/provider.log — a
+LOCAL file that is invisible remotely. This tails it incrementally (byte offset in
+provider-relay-state.json, flock single-flight) and POSTs new lines through the
+SAME relay lane the pipeline logs use (bin/server.js /api/v1/installations/logs),
+tagged context="queue-provider", so a stranded/orphaned batch on any box is
+queryable in Cloud Logging instead of only on the box.
+
+Query:
+  gcloud logging read 'jsonPayload.install_id="<uuid>" AND jsonPayload.context="queue-provider"' --project=s4l-app-prod
+
+Forward-only baseline: the first run records the current EOF and ships NOTHING
+(no backfill flood); `--from-start` overrides. Best-effort everywhere: an
+unreadable file or a failed POST just retries next run.
+
+Usage:
+    python3 scripts/relay_provider_log.py [--max-lines 500] [--from-start] [--dry-run]
+"""
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.request
+from datetime import datetime, timezone
+
+STATE_DIR = os.path.expanduser(os.environ.get("S4L_STATE_DIR", "~/.social-autoposter-mcp"))
+PROVIDER_LOG = os.path.join(STATE_DIR, "claude-queue", "provider.log")
+STATE_PATH = os.path.join(STATE_DIR, "provider-relay-state.json")
+LOCK_PATH = os.path.join(STATE_DIR, "provider-relay.lock")
+
+LOG_BASE = (os.environ.get("AUTOPOSTER_LOG_BASE") or "https://app.s4l.ai").rstrip("/")
+POST_BATCH = 200        # relay accepts 1-200 lines per POST
+MAX_LINE = 7500         # relay caps at 8192; leave headroom for the envelope
+CONTEXT = "queue-provider"
+LOG_TYPE = "client-pipeline"
+
+
+def _install_header():
+    ident = os.path.join(os.path.dirname(os.path.abspath(__file__)), "identity.py")
+    if not os.path.exists(ident):
+        return None
+    try:
+        out = subprocess.run([sys.executable, ident, "header"],
+                             capture_output=True, text=True, timeout=15)
+        h = (out.stdout or "").strip()
+        return h if out.returncode == 0 and h else None
+    except Exception:
+        return None
+
+
+def _post(lines, header):
+    body = json.dumps({"lines": lines}).encode("utf-8")
+    req = urllib.request.Request(
+        f"{LOG_BASE}/api/v1/installations/logs",
+        data=body,
+        headers={"X-Installation": header, "Content-Type": "application/json"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            return 200 <= resp.status < 300
+    except Exception as e:
+        print(f"[provider-relay] POST failed: {e}", file=sys.stderr)
+        return False
+
+
+def _load_state():
+    try:
+        with open(STATE_PATH) as f:
+            return json.load(f)
+    except Exception:
+        return {}
+
+
+def _save_state(state):
+    try:
+        os.makedirs(STATE_DIR, exist_ok=True)
+        tmp = STATE_PATH + ".tmp"
+        with open(tmp, "w") as f:
+            json.dump(state, f)
+        os.replace(tmp, STATE_PATH)
+    except Exception:
+        pass
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--max-lines", type=int, default=500,
+                    help="cap on lines shipped this run (remainder ships next run)")
+    ap.add_argument("--from-start", action="store_true",
+                    help="ship from the start of the file, overriding the forward-only baseline")
+    ap.add_argument("--dry-run", action="store_true")
+    ns = ap.parse_args()
+
+    if not os.path.exists(PROVIDER_LOG):
+        return 0
+
+    # Single-flight: skip silently if another run holds the lock.
+    lock_fd = None
+    if not ns.dry_run:
+        try:
+            import fcntl
+            os.makedirs(STATE_DIR, exist_ok=True)
+            lock_fd = open(LOCK_PATH, "w")
+            fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except Exception:
+            return 0  # another instance is running
+
+    state = _load_state()
+    try:
+        size = os.path.getsize(PROVIDER_LOG)
+    except OSError:
+        return 0
+    offset = state.get("offset")
+    inode = state.get("inode")
+    try:
+        cur_inode = os.stat(PROVIDER_LOG).st_ino
+    except OSError:
+        cur_inode = None
+
+    # First run (or rotated/truncated file): baseline forward-only unless --from-start.
+    if ns.from_start:
+        offset = 0
+    elif offset is None or inode != cur_inode or offset > size:
+        _save_state({"offset": size, "inode": cur_inode})
+        return 0
+
+    try:
+        with open(PROVIDER_LOG, "r", errors="replace") as f:
+            f.seek(offset)
+            chunk = f.read(2_000_000)  # bounded read
+            new_offset = f.tell()
+    except Exception:
+        return 0
+
+    raw_lines = [ln for ln in chunk.split("\n") if ln.strip()]
+    if not raw_lines:
+        _save_state({"offset": new_offset, "inode": cur_inode})
+        return 0
+
+    raw_lines = raw_lines[: ns.max_lines]
+    now_iso = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
+    records = [{
+        "logType": LOG_TYPE,
+        "context": CONTEXT,
+        "stream": "stdout",
+        "client_ts": now_iso,
+        "message": ln[:MAX_LINE],
+    } for ln in raw_lines]
+
+    if ns.dry_run:
+        for r in records[:20]:
+            print(f"[provider-relay] (dry-run) {r['message'][:140]}")
+        print(f"[provider-relay] (dry-run) would ship {len(records)} line(s)")
+        return 0
+
+    header = _install_header()
+    if not header:
+        print("[provider-relay] no X-Installation header; skipping", file=sys.stderr)
+        return 0
+
+    shipped = 0
+    for i in range(0, len(records), POST_BATCH):
+        batch = records[i:i + POST_BATCH]
+        if _post(batch, header):
+            shipped += len(batch)
+        else:
+            break  # stop on failure; retry from the saved offset next run
+
+    # Only advance the offset by what we actually shipped, so a mid-run POST failure
+    # re-ships the un-acked tail next run instead of dropping it.
+    if shipped >= len(raw_lines):
+        # Shipped everything we read (and possibly capped by max_lines == read count).
+        _save_state({"offset": new_offset, "inode": cur_inode})
+    elif shipped > 0:
+        # Shipped only a prefix; advance past exactly those lines (+ their newlines).
+        partial = "\n".join(raw_lines[:shipped]) + "\n"
+        _save_state({"offset": offset + len(partial.encode("utf-8")), "inode": cur_inode})
+    print(f"[provider-relay] shipped {shipped}/{len(records)} provider.log line(s)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/salvage_orphaned_prep_results.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""salvage_orphaned_prep_results.py — recover twitter-prep drafts that were
+stranded when the PRODUCER cycle died after the worker wrote its result but before
+consuming it.
+
+Mechanism: a producer (claude_job.py) that consumes a result os.remove()s it, so
+any file that SURVIVES in claude-queue/result/ past the producer's max wait is
+orphaned — the worker's drafts exist but were never turned into a plan / merged
+into review cards. This scans for such files and merges their candidates into the
+review queue via merge_review_queue.py, then renames them .salvaged so they are
+not re-processed.
+
+Safe by construction:
+  - Only touches results OLDER than the queue timeout (default + buffer), so no
+    live producer can still be polling for that job_id.
+  - merge_review_queue.py dedupes by (thread_url), so a re-run or an overlap with a
+    late-arriving producer cannot create duplicate cards.
+  - Best-effort: any single failure is logged and skipped; never raises.
+
+Degradation vs a normal cycle: salvaged candidates skip the cycle's post-provider
+top-N selection (so MORE cards, which is fine) and lack the tail-link / experiments
+arm stamp that run-twitter-cycle.sh's plan writer adds after the provider returns.
+The reply text itself is complete. A salvaged card is strictly better than a lost
+draft.
+
+Usage:
+    python3 scripts/salvage_orphaned_prep_results.py            # automated (safe age gate)
+    python3 scripts/salvage_orphaned_prep_results.py --age-min 5 --dry-run
+"""
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+from datetime import datetime, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+
+try:
+    from claude_job import result_dir, DEFAULT_TIMEOUT_S, _plog  # reuse exact dir + provider.log writer
+except Exception:  # standalone fallbacks
+    DEFAULT_TIMEOUT_S = int(os.environ.get("S4L_CLAUDE_QUEUE_TIMEOUT", "1800"))
+
+    def _state_dir():
+        return os.environ.get("S4L_STATE_DIR") or os.path.join(os.path.expanduser("~"), ".social-autoposter-mcp")
+
+    def result_dir():
+        return os.path.join(_state_dir(), "claude-queue", "result")
+
+    def _plog(msg):
+        try:
+            p = os.path.join(_state_dir(), "claude-queue", "provider.log")
+            with open(p, "a") as f:
+                ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+                f.write(f"{ts} pid={os.getpid()} {msg}\n")
+        except Exception:
+            pass
+
+
+def _is_prep_result(obj):
+    """True iff obj looks like a twitter-prep result (candidates with reply_text)."""
+    if not isinstance(obj, dict):
+        return False
+    cands = obj.get("candidates")
+    if not isinstance(cands, list) or not cands:
+        return False
+    c0 = cands[0]
+    return isinstance(c0, dict) and "reply_text" in c0 and ("candidate_url" in c0 or "candidate_id" in c0)
+
+
+def main():
+    ap = argparse.ArgumentParser(description="Merge orphaned twitter-prep results into the review queue.")
+    ap.add_argument("--age-min", type=float, default=(DEFAULT_TIMEOUT_S / 60.0 + 5),
+                    help="only salvage results older than this many minutes "
+                         "(default = queue timeout + 5, so no live producer is still polling)")
+    ap.add_argument("--max-age-hours", type=float,
+                    default=float(os.environ.get("S4L_SALVAGE_MAX_AGE_HOURS", "6")),
+                    help="do NOT salvage results older than this (stale threads not worth carding); "
+                         "they are renamed .stale so they stop being rescanned")
+    ap.add_argument("--repo-dir", default=os.environ.get("S4L_REPO_DIR") or os.path.dirname(HERE))
+    ap.add_argument("--dry-run", action="store_true")
+    ns = ap.parse_args()
+
+    rdir = result_dir()
+    if not os.path.isdir(rdir):
+        return 0
+    merge = os.path.join(ns.repo_dir, "scripts", "merge_review_queue.py")
+    now = time.time()
+    young_cutoff = now - ns.age_min * 60.0
+    stale_cutoff = now - ns.max_age_hours * 3600.0
+    scanned = salvaged = skipped = stale = 0
+
+    for name in sorted(os.listdir(rdir)):
+        if not name.endswith(".json"):
+            continue  # skip already-handled .salvaged / .skipped / .stale
+        path = os.path.join(rdir, name)
+        try:
+            st = os.stat(path)
+        except OSError:
+            continue
+        if st.st_mtime > young_cutoff:
+            continue  # too fresh: a producer may still be polling for this job
+        if st.st_mtime < stale_cutoff:
+            # too old: the threads have moved on; retire it so we stop rescanning.
+            stale += 1
+            if not ns.dry_run:
+                try:
+                    os.rename(path, path + ".stale")
+                except OSError:
+                    pass
+            continue
+        scanned += 1
+        job_id = name[:-5]
+        try:
+            with open(path) as f:
+                d = json.load(f)
+        except Exception:
+            continue
+        obj = d.get("result") if isinstance(d, dict) else None
+        if obj is None and isinstance(d, dict) and "candidates" in d:
+            obj = d
+        if not _is_prep_result(obj):
+            skipped += 1
+            if not ns.dry_run:
+                try:
+                    os.rename(path, path + ".skipped")
+                except OSError:
+                    pass
+            continue
+
+        n = len(obj["candidates"])
+        age_min = (now - st.st_mtime) / 60.0
+        _plog(f"[salvage] ORPHAN prep result job {job_id}: producer never consumed it "
+              f"({n} drafts, {age_min:.0f}m old) -> merging into review queue")
+        if ns.dry_run:
+            print(f"[salvage] (dry-run) would merge {n} drafts from job {job_id} ({age_min:.0f}m old)")
+            continue
+
+        plan_path = os.path.join("/tmp", f"salvage_plan_{job_id}.json")
+        plan = {
+            "candidates": obj["candidates"],
+            "created_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "salvaged_from_job": job_id,
+        }
+        try:
+            with open(plan_path, "w") as f:
+                json.dump(plan, f)
+        except Exception as e:
+            _plog(f"[salvage] job {job_id}: could not write plan: {e}")
+            continue
+
+        try:
+            r = subprocess.run([sys.executable, merge, "--plan", plan_path],
+                               capture_output=True, text=True, timeout=180)
+        except Exception as e:
+            _plog(f"[salvage] job {job_id}: merge subprocess errored: {e}")
+            continue
+
+        if r.returncode == 0:
+            salvaged += 1
+            try:
+                os.rename(path, path + ".salvaged")
+            except OSError:
+                pass
+            _plog(f"[salvage] job {job_id}: merged {n} orphaned drafts into review queue")
+            print(f"[salvage] recovered {n} orphaned drafts from job {job_id}")
+        else:
+            _plog(f"[salvage] job {job_id}: merge failed rc={r.returncode}: {(r.stderr or '')[:200]}")
+
+    if scanned or stale:
+        print(f"[salvage] scanned={scanned} salvaged={salvaged} skipped_nonprep={skipped} retired_stale={stale}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skill/run-draft-and-publish.sh

@@ -26,6 +26,14 @@ EOF_ENV
 REPO_DIR="${S4L_REPO_DIR:-$(cd "$(dirname "$0")/.." && pwd)}"
 PY="${S4L_PYTHON:-python3}"
 
+# Salvage twitter-prep drafts orphaned when a producer cycle died after its worker
+# wrote the result but before consuming it (a consumed result is deleted, so a
+# surviving one in claude-queue/result/ = never consumed). Best-effort, dedup-safe
+# merge into the review queue; the default age gate only touches results past the
+# queue timeout, so no live producer is racing. Runs every tick so a dead
+# producer's drafts land within a cycle instead of being lost. Never blocks.
+"$PY" "$REPO_DIR/scripts/salvage_orphaned_prep_results.py" >/dev/null 2>&1 || true
+
 # Posting-defer gate (2026-07-06). Posting and scanning share ONE harness Chrome,
 # and the MCP poster SIGKILLs any scan holding the twitter-browser lock (it cannot
 # wait: an approved card must land while the user watches, and scans trap SIGTERM).

package/skill/run-twitter-cycle.sh

@@ -108,18 +108,18 @@ TW_ENGINE_PREFIX=""
 # ceiling drops that carry runway so aged-out junk expires instead of riding
 # ~80 cycles. Discovery is already capped at 1h (FRESHNESS_HOURS_DISCOVER).
 #
-# 2026-06-17 (per user request): DRAFT mode (DRAFT_ONLY=1, the MCP draft_cycle
-# tool) widens both freshness knobs to 24h so human review surfaces more (and
-# older) candidates. Autopilot is untouched: it keeps the experiment-concluded
-# 2h expire ceiling + 1h discovery window (variant D). The branch is on
-# DRAFT_ONLY, an external env var set by the draft_cycle tool, available here.
-# 2026-07-02 (first-run onboarding boost, per user request): the draft-mode
-# value accepts an env override, S4L_DRAFT_FRESHNESS_HOURS, so the kicker
-# wrapper (run-draft-and-publish.sh) can widen a brand-new user's FIRST draft
-# cycle to 48h and surface multiple review cards. Unset = the standard 24h
-# draft window. Autopilot (DRAFT_ONLY=0) ignores the override entirely.
-if [ "${DRAFT_ONLY:-0}" = "1" ]; then
-    FRESHNESS_HOURS="${S4L_DRAFT_FRESHNESS_HOURS:-24}"
+# 2026-07-06 (per user request): the wide draft window is SETUP-ONLY. The
+# original 2026-06-17 change made DRAFT_ONLY=1 default to 24h permanently,
+# so every steady-state draft-autopilot cycle kept surfacing day-old tweets.
+# Now the ONLY way draft mode widens is the explicit S4L_DRAFT_FRESHNESS_HOURS
+# env override, which run-draft-and-publish.sh exports solely while the
+# first-run-boost.json onboarding marker is live (consumed after the first
+# delivered batch, hard-expired after 24h). Once the marker is gone the env
+# is unset and draft cycles run the same experiment-concluded variant D
+# windows as autopilot: 2h expire ceiling + 1h discovery.
+# Autopilot (DRAFT_ONLY=0) ignores the override entirely, as before.
+if [ "${DRAFT_ONLY:-0}" = "1" ] && [ -n "${S4L_DRAFT_FRESHNESS_HOURS:-}" ]; then
+    FRESHNESS_HOURS="$S4L_DRAFT_FRESHNESS_HOURS"
 else
     FRESHNESS_HOURS=2
 fi
@@ -139,13 +139,13 @@ fi
 # other's still-pending rows. FRESHNESS_HOURS_DISCOVER (Phase 1 prompt +
 # since-rewrite hook) stays tightened to 1h, the winning D setting.
 TWITTER_CYCLE_VARIANT=D
-# DRAFT mode widens discovery to 24h by default; autopilot keeps the winning D
-# setting of 1h. S4L_DRAFT_FRESHNESS_HOURS (first-run onboarding boost, see the
-# FRESHNESS_HOURS branch above) can widen the draft-mode value further (48h on a
-# brand-new install's first cycle). The lean Phase 1 CDP scraper reads
-# FRESHNESS_HOURS_DISCOVER directly and honors any value.
-if [ "${DRAFT_ONLY:-0}" = "1" ]; then
-    FRESHNESS_HOURS_DISCOVER="${S4L_DRAFT_FRESHNESS_HOURS:-24}"
+# Discovery widens ONLY under the first-run onboarding boost (see the
+# FRESHNESS_HOURS branch above): S4L_DRAFT_FRESHNESS_HOURS set + DRAFT_ONLY=1.
+# Steady-state draft cycles keep the winning D setting of 1h, same as
+# autopilot. The lean Phase 1 CDP scraper reads FRESHNESS_HOURS_DISCOVER
+# directly and honors any value.
+if [ "${DRAFT_ONLY:-0}" = "1" ] && [ -n "${S4L_DRAFT_FRESHNESS_HOURS:-}" ]; then
+    FRESHNESS_HOURS_DISCOVER="$S4L_DRAFT_FRESHNESS_HOURS"
 else
     FRESHNESS_HOURS_DISCOVER=1
 fi