@m13v/s4l 1.6.203-rc.8 → 1.6.203

package/mcp/dist/index.js

@@ -156,22 +156,6 @@ function pipelinePath() {
 function launchdPath() {
     return [...ownedBinDirs(), LAUNCHD_PATH].join(":");
 }
-// Brand rename 2026-07-03 (SAPS_ -> S4L_): duplicate every S4L_* key under its
-// legacy SAPS_* name when emitting env into child processes / plists, so an
-// old pipeline-script version still on disk during a partial update keeps
-// resolving its env. Never overwrites an explicitly-set legacy key. Remove
-// once no pre-rename scripts remain in the field.
-function withSapsEnvCompat(env) {
-    const out = { ...env };
-    for (const [k, v] of Object.entries(env)) {
-        if (k.startsWith("S4L_")) {
-            const legacy = "SAPS_" + k.slice(4);
-            if (!(legacy in out))
-                out[legacy] = v;
-        }
-    }
-    return out;
-}
 function plistXml(opts) {
     const args = opts.programArgs.map((a) => `\t\t<string>${a}</string>`).join("\n");
     const schedule = opts.keepAlive
@@ -187,10 +171,8 @@ function plistXml(opts) {
         : "";
     // Caller-supplied env (e.g. the queue kicker's DRAFT_ONLY / S4L_CLAUDE_PROVIDER).
     // Rendered after the baked-in vars so a caller can also override S4L_STATE_DIR.
-    // Dual-named (S4L_* + legacy SAPS_*) so a freshly-written plist still works
-    // with any pre-rename script version on disk during a partial update.
     const extraEnv = opts.extraEnv
-        ? Object.entries(withSapsEnvCompat(opts.extraEnv))
+        ? Object.entries(opts.extraEnv)
             .map(([k, v]) => `\n\t\t<key>${k}</key>\n\t\t<string>${v}</string>`)
             .join("")
         : "";
@@ -217,11 +199,7 @@ ${schedule}
 \t\t<string>${os.homedir()}</string>
 \t\t<key>S4L_REPO_DIR</key>
 \t\t<string>${repoDir()}</string>
-\t\t<key>SAPS_REPO_DIR</key>
-\t\t<string>${repoDir()}</string>
 \t\t<key>S4L_PYTHON</key>
-\t\t<string>${resolvePython()}</string>
-\t\t<key>SAPS_PYTHON</key>
 \t\t<string>${resolvePython()}</string>${chromeEnv}${extraEnv}
 \t</dict>
 \t<key>RunAtLoad</key>
@@ -408,8 +386,8 @@ function toolActivityLabel(name, args) {
     const fallback = TOOL_ACTIVITY[name];
     if (!fallback)
         return null;
-    const override = typeof args?.__saps_activity_label === "string"
-        ? args.__saps_activity_label.replace(/\s+/g, " ").trim().slice(0, 80)
+    const override = typeof args?.__s4l_activity_label === "string"
+        ? args.__s4l_activity_label.replace(/\s+/g, " ").trim().slice(0, 80)
         : "";
     return override || fallback;
 }
@@ -572,7 +550,7 @@ async function ensureOverlayWatch() {
     try {
         await run("bash", ["skill/run-overlay-watch.sh"], {
             timeoutMs: 20_000,
-            env: withSapsEnvCompat({
+            env: ({
                 S4L_PYTHON: resolvePython(),
                 S4L_LOG_DIR: path.join(repoDir(), "skill", "logs"),
                 TWITTER_CDP_URL: process.env.TWITTER_CDP_URL || "http://127.0.0.1:9555",
@@ -655,7 +633,7 @@ async function produceDrafts(project, onProgress) {
     // (switched in onLine below). Cleared before every return.
     writeActivity("scanning", "scanning X");
     const res = await run("bash", ["skill/run-twitter-cycle.sh"], {
-        env: withSapsEnvCompat(env),
+        env: env,
         timeoutMs: 900_000, // scan+draft can take several minutes
         // Fan every cycle line out to THREE sinks so progress is never a black box:
         //   1. draft_cycle-mcp.log  — the stable, documented, host-independent file.
@@ -810,6 +788,16 @@ function parsePostCandidateResults(stdout) {
             upsert(m[1], "skipped", "empty_reply_text");
             continue;
         }
+        m = /\[post\] candidate (\d+) log_post\.py did not return post_id/.exec(line);
+        if (m) {
+            // The reply IS live on X; only the posts-row INSERT failed (e.g. the
+            // 2026-07-06 draft_prompt_variant validation 400). Mark the card POSTED
+            // so the drain never re-attempts a live reply — re-posting slams into
+            // X's duplicate guard at best and double-posts at worst. The missing
+            // posts row is recoverable from the post-*.log (reply_url + final_text).
+            upsert(m[1], "posted", "log_post_no_id");
+            continue;
+        }
         m = /\[post\] candidate (\d+) crashed:/.exec(line);
         if (m)
             upsert(m[1], "failed", "exception");
@@ -845,7 +833,7 @@ async function ensurePostingHandle() {
     try {
         await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
             timeoutMs: 60_000,
-            env: withSapsEnvCompat({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
+            env: ({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
         });
     }
     catch {
@@ -864,7 +852,7 @@ async function ensureTwitterBrowserForPost() {
         env.BH_CHROME_BIN = chrome;
     return run("bash", ["-lc", ". skill/lib/twitter-backend.sh && ensure_twitter_browser_for_backend"], {
         timeoutMs: 90_000,
-        env: withSapsEnvCompat(env),
+        env: env,
         onLine: (line) => {
             const t = line.replace(/\s+$/, "");
             if (t.trim())
@@ -940,7 +928,7 @@ async function postApproved(batchId, plan) {
             }
             return await runPython("scripts/twitter_post_plan.py", ["--plan", planPath(approvedBatch)], {
                 timeoutMs: 900_000,
-                env: withSapsEnvCompat({
+                env: ({
                     S4L_SKIP_CAMPAIGN_SUFFIX: "1",
                     // Manual approval is an EXCEPTION to the tail-link A/B. The cron pipeline
                     // runs TWITTER_TAIL_LINK_RATE=0.9 (from .env) so ~10% of autopilot posts
@@ -1202,7 +1190,7 @@ async function seedSearchQueriesForProject(project, rawQueries) {
         };
     }
     try {
-        const qfile = path.join(os.tmpdir(), `saps-queries-${project}-${Date.now()}.json`);
+        const qfile = path.join(os.tmpdir(), `s4l-queries-${project}-${Date.now()}.json`);
         fs.writeFileSync(qfile, JSON.stringify({ queries: agentQueries.map((q) => ({ query: q, topic: "" })) }));
         seedInFlight.set(project, Date.now());
         // Fire-and-forget: runPython keeps the output on the repo.ts tee (so the
@@ -1247,7 +1235,7 @@ async function seedSearchQueriesForProject(project, rawQueries) {
 // ---- engagement_mode: choose personal-brand vs product (setup-time) --------
 // Part of onboarding: AFTER X connect + profile_scan, BEFORE product config, the
 // agent asks the user which mode they want and calls this. It persists the mode
-// (scripts/saps_mode.py, the single source of truth the cycle reads) and
+// (scripts/s4l_mode.py, the single source of truth the cycle reads) and
 // provisions the persona project (grounded in the profile scan), then the agent
 // continues to product setup — a product is always configured regardless of mode.
 tool("engagement_mode", {
@@ -1323,7 +1311,7 @@ tool("engagement_mode", {
 }, async (args) => {
     const action = args.action || "get";
     const readFlags = async () => {
-        const cur = await runPython("scripts/saps_mode.py", ["flags"], { timeoutMs: 15_000 });
+        const cur = await runPython("scripts/s4l_mode.py", ["flags"], { timeoutMs: 15_000 });
         try {
             const f = JSON.parse((cur.stdout || "").trim());
             return { personal_brand: !!f.personal_brand, promotion: !!f.promotion };
@@ -1339,11 +1327,11 @@ tool("engagement_mode", {
         return jsonContent({ flags, mode, persona: persona ? persona.name : null });
     }
     // Lightweight flip of ONE lane (the dashboard/menu-bar quick toggle): just
-    // rewrite mode.json via saps_mode.py — NO persona provisioning. Mirrors the
+    // rewrite mode.json via s4l_mode.py — NO persona provisioning. Mirrors the
     // menu bar's pure-local _toggle_lane so flipping from either surface is cheap.
     if (action === "toggle") {
         const lane = args.lane === "promotion" ? "promotion" : "personal_brand";
-        const res = await runPython("scripts/saps_mode.py", ["toggle", lane], { timeoutMs: 15_000 });
+        const res = await runPython("scripts/s4l_mode.py", ["toggle", lane], { timeoutMs: 15_000 });
         if (res.code !== 0) {
             const tail = (res.stderr || res.stdout).trim().split("\n").slice(-1)[0] || "unknown error";
             return textContent(`Could not switch lane: ${tail}`);
@@ -1373,16 +1361,16 @@ tool("engagement_mode", {
     }
     const mode = personalBrand ? "personal_brand" : "promotion";
     recordOnboardingAttempt("mode_chosen", { personal_brand: personalBrand, promotion });
-    const setRes = await runPython("scripts/saps_mode.py", ["set-flags", personalBrand ? "1" : "0", promotion ? "1" : "0"], { timeoutMs: 15_000 });
+    const setRes = await runPython("scripts/s4l_mode.py", ["set-flags", personalBrand ? "1" : "0", promotion ? "1" : "0"], { timeoutMs: 15_000 });
     if (setRes.code !== 0) {
         const tail = (setRes.stderr || setRes.stdout).trim().split("\n").slice(-1)[0] || "unknown error";
         blockOnboardingMilestone("mode_chosen", "mode_set_failed", tail, { personal_brand: personalBrand, promotion });
         return textContent(`Couldn't save the engagement lanes: ${tail}`);
     }
-    // NOTE (2026-07-06): the autopilot flag (mode.json {"autopilot": true} —
+    // NOTE (2026-07-06): the draft-only flag (mode.json {"draft_only": false} —
     // promotion cycles POST autonomously instead of drafting cards) is
     // DELIBERATELY NOT exposed on this tool or any user surface. It is an
-    // operator-only switch, set via `scripts/saps_mode.py autopilot on|off`.
+    // operator-only switch, set via `scripts/s4l_mode.py draft-only on|off`.
     // run-draft-and-publish.sh reads it per cycle. Do not add a tool param,
     // menubar toggle, or onboarding step for it.
     // Provision the persona (grounded from the scan when supplied) regardless of
@@ -2502,7 +2490,7 @@ async function autopilotLoaded() {
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
 const QUEUE_WORKER_PROMPT_VERSION = 7; // v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-const QUEUE_WORKER_PROMPT_MARKER = "saps_queue_worker_prompt_version";
+const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -2519,7 +2507,7 @@ function scheduledTaskSkillPath(taskId) {
 // The queue dir the worker reads/writes. MUST equal what the launchd kicker sets
 // (kickerEnv below) and what claude_job.py uses, so both ends meet on one path.
 function queueDir() {
-    return path.join(sapsStateDir(), "claude-queue");
+    return path.join(s4lStateDir(), "claude-queue");
 }
 // A draft job left unclaimed in pending/ this long (ms) means no scheduled-task
 // routine is draining the queue — the worker would claim within a minute if it
@@ -2614,7 +2602,7 @@ function queueWorkerCwd() {
 function queueWorkerBody(spec) {
     const py = resolvePython();
     const job = path.join(repoDir(), "scripts", "claude_job.py");
-    const sd = sapsStateDir();
+    const sd = s4lStateDir();
     const outDir = queueDir();
     return [
         `You are the S4L queue worker. Run ONE iteration, then STOP.`,
@@ -2774,13 +2762,6 @@ function queueWorkerAllowedTools() {
         "mcp__S4L__project_config",
         "mcp__S4L__get_stats",
         "mcp__S4L__dashboard",
-        // Legacy "SAPS" protocol-name namespace (pre-2026-07 brand rename): old
-        // registrations still resolve tool ids under it, keep the allow-rules.
-        "mcp__SAPS__queue_setup",
-        "mcp__SAPS__post_drafts",
-        "mcp__SAPS__project_config",
-        "mcp__SAPS__get_stats",
-        "mcp__SAPS__dashboard",
     ];
 }
 // Merge a list of allow-rules into ~/.claude/settings.json. Returns count added.
@@ -2911,7 +2892,7 @@ function ensureWorkerFolderTrusted() {
 // S4L_COWORK_MCP=0.
 function ensureCoworkMcpRegistered() {
     try {
-        if ((process.env.S4L_COWORK_MCP ?? process.env.SAPS_COWORK_MCP) === "0")
+        if ((process.env.S4L_COWORK_MCP) === "0")
             return;
         const home = process.env.HOME || os.homedir();
         const cfgPath = path.join(home, ".claude.json");
@@ -2958,11 +2939,11 @@ function ensureCoworkMcpRegistered() {
 // `claude -p` steps route through the job queue (S4L_CLAUDE_PROVIDER=queue) for
 // the scheduled-task workers to service. The per-cycle DRAFT_ONLY value is NOT
 // baked here anymore: run-draft-and-publish.sh decides it from mode.json
-// (autopilot flag, 2026-07-06) — draft cycles stop before posting and merge into
-// review cards; autopilot promotion cycles post autonomously behind the virality
-// bar. The DRAFT_ONLY=1 below is only the safe baseline an OLD wrapper (which
+// (draft-only flag, 2026-07-06) — while draft-only is ON (default) cycles stop
+// before posting and merge into review cards; with draft-only OFF (operator
+// opt-out) promotion cycles post autonomously behind the virality bar. The DRAFT_ONLY=1 below is only the safe baseline an OLD wrapper (which
 // never overrides it) inherits.
-// 60s tick (2026-07-06): parity with the retired claude -p autopilot plist.
+// 60s tick (2026-07-06): parity with the retired claude -p twitter-cycle plist.
 // The preflight slot gate (max-1) makes this safe — a tick that fires while a
 // cycle is still running skips in milliseconds — so the effective cadence is
 // back-to-back ~10-min cycles with ≤1 min idle, not one cycle per minute.
@@ -2971,23 +2952,19 @@ function kickerEnv() {
     return {
         DRAFT_ONLY: "1",
         S4L_CLAUDE_PROVIDER: "queue",
-        S4L_STATE_DIR: sapsStateDir(),
+        S4L_STATE_DIR: s4lStateDir(),
         TWITTER_PAGE_GEN_RATE: "0",
         // Thread-media context for the drafter (2026-07-06): parity with the
-        // retired CLI autopilot plist. Without it the prep step drafts blind to
+        // retired CLI twitter-cycle plist. Without it the prep step drafts blind to
         // images in the candidate threads.
         S4L_TWITTER_CAPTURE_MEDIA: "1",
         // NOTE: TWITTER_TAIL_LINK_RATE is deliberately NOT set here (2026-07-06).
-        // The persona lane exports =0 per cycle via saps_mode.py env (link-free
+        // The persona lane exports =0 per cycle via s4l_mode.py env (link-free
         // organic replies); promotion cycles keep the script's own default so
-        // autopilot posts carry the project link per the A/B gate, and card posts
+        // draft-only-OFF posts carry the project link per the A/B gate, and card posts
         // still force =1.0 inside post_drafts.
-        // Rolling virality bar percentile (2026-07-03): applies to BOTH lanes in
-        // the cycle script — below-bar picks never become review cards, and in
-        // autopilot mode never post. p0.95 (not the script's 0.97 default) keeps
-        // volume useful while cutting bottom-of-pool drafts; cold start
-        // (sample_count < 200) still shows brand-new installs every draft.
-        S4L_TWITTER_VIRALITY_PCTILE: "0.95",
+        // Virality bar percentile is NOT set here: it is hardcoded to 0.90 in
+        // skill/run-twitter-cycle.sh (single source of truth, no env dependency).
     };
 }
 async function ensureQueueKickerInstalled() {
@@ -3073,7 +3050,7 @@ async function ensureQueueKickerInstalled() {
                 // every later cycle runs the standard 24h + top-1 logic. Best-effort: a
                 // failed write just means a standard first cycle.
                 try {
-                    const stateDir = sapsStateDir();
+                    const stateDir = s4lStateDir();
                     fs.mkdirSync(stateDir, { recursive: true });
                     fs.writeFileSync(path.join(stateDir, "first-run-boost.json"), JSON.stringify({ created_at: new Date().toISOString() }) + "\n", "utf-8");
                 }
@@ -3205,7 +3182,7 @@ async function ensureStallWatchInstalled() {
     try {
         if (process.platform !== "darwin")
             return { ok: false, detail: "not macOS" };
-        if ((process.env.S4L_STALL_WATCH ?? process.env.SAPS_STALL_WATCH) === "0")
+        if ((process.env.S4L_STALL_WATCH) === "0")
             return { ok: false, detail: "disabled (S4L_STALL_WATCH=0)" };
         const logDir = path.join(repoDir(), "skill", "logs");
         try {
@@ -3254,7 +3231,7 @@ async function ensureMemorySnapshotInstalled() {
     try {
         if (process.platform !== "darwin")
             return { ok: false, detail: "not macOS" };
-        if ((process.env.S4L_MEMORY_SNAPSHOT ?? process.env.SAPS_MEMORY_SNAPSHOT) === "0")
+        if ((process.env.S4L_MEMORY_SNAPSHOT) === "0")
             return { ok: false, detail: "disabled (S4L_MEMORY_SNAPSHOT=0)" };
         const logDir = path.join(repoDir(), "skill", "logs");
         try {
@@ -3316,7 +3293,7 @@ async function ensureOverlayWatchInstalled() {
     try {
         if (process.platform !== "darwin")
             return { ok: false, detail: "not macOS" };
-        if ((process.env.S4L_OVERLAY_WATCH ?? process.env.SAPS_OVERLAY_WATCH) === "0")
+        if ((process.env.S4L_OVERLAY_WATCH) === "0")
             return { ok: false, detail: "disabled (S4L_OVERLAY_WATCH=0)" };
         const logDir = path.join(repoDir(), "skill", "logs");
         try {
@@ -3501,7 +3478,7 @@ async function healTopicsSeeded(snap) {
 // ---- dashboard localhost fallback -----------------------------------------
 // When the connected host doesn't support MCP Apps UI (Claude Code / Cowork
 // today), serve the SAME dist/panel.html from a loopback HTTP server. The page
-// detects it's running over HTTP (window.__SAPS_BRIDGE__) and routes every
+// detects it's running over HTTP (window.__S4L_BRIDGE__) and routes every
 // app.callServerTool through POST /tool/<name>, which replays the exact captured
 // handler in TOOL_HANDLERS. No pipeline or front-end logic is duplicated.
 // True if the host advertised it can render our ui:// HTML resource inline.
@@ -3521,7 +3498,7 @@ let localPanel = null;
 // minus the postMessage host (there's none over loopback).
 function widgetHtmlForHttp(file) {
     const html = fs.readFileSync(path.join(DIST_DIR, file), "utf-8");
-    const inject = `<script>window.__SAPS_BRIDGE__=${JSON.stringify("http")};</script>`;
+    const inject = `<script>window.__S4L_BRIDGE__=${JSON.stringify("http")};</script>`;
     if (html.includes("</head>"))
         return html.replace("</head>", inject + "</head>");
     return inject + html;
@@ -3607,7 +3584,7 @@ function startLocalPanel() {
         srv.on("error", reject);
         // Optional fixed port (S4L_PANEL_PORT) for deterministic addressing; default
         // is an OS-assigned ephemeral port.
-        const wantPort = Number(process.env.S4L_PANEL_PORT ?? process.env.SAPS_PANEL_PORT) || 0;
+        const wantPort = Number(process.env.S4L_PANEL_PORT) || 0;
         srv.listen(wantPort, "127.0.0.1", () => {
             const addr = srv.address();
             const port = typeof addr === "object" && addr ? addr.port : 0;
@@ -3635,29 +3612,28 @@ function writePanelUrl(url) {
     }
 }
 // The owned state dir, honoring S4L_STATE_DIR (matches menubar/s4l_state.py).
-function sapsStateDir() {
+function s4lStateDir() {
     return (process.env.S4L_STATE_DIR ||
-        process.env.SAPS_STATE_DIR ||
         path.join(process.env.HOME || os.homedir(), ".social-autoposter-mcp"));
 }
 // Has the user explicitly chosen an engagement mode? mode.json is written by the
 // engagement_mode tool (setup) and the menu-bar toggle. Used to complete the
-// mode_chosen onboarding milestone. (Source of truth: scripts/saps_mode.py.)
+// mode_chosen onboarding milestone. (Source of truth: scripts/s4l_mode.py.)
 function modeChosen() {
     try {
-        return fs.existsSync(path.join(sapsStateDir(), "mode.json"));
+        return fs.existsSync(path.join(s4lStateDir(), "mode.json"));
     }
     catch {
         return false;
     }
 }
 // The current engagement lane flags, surfaced in the snapshot so the dashboard
-// AND menu bar read them from ONE place (mode.json, the same file saps_mode.py
-// writes). Mirrors saps_mode.py get_flags(): explicit flag keys win; else map a
+// AND menu bar read them from ONE place (mode.json, the same file s4l_mode.py
+// writes). Mirrors s4l_mode.py get_flags(): explicit flag keys win; else map a
 // legacy {"mode": ...} string; else default personal ON / promotion OFF.
 function currentFlags() {
     try {
-        const d = JSON.parse(fs.readFileSync(path.join(sapsStateDir(), "mode.json"), "utf-8"));
+        const d = JSON.parse(fs.readFileSync(path.join(s4lStateDir(), "mode.json"), "utf-8"));
         if ("personal_brand" in d || "promotion" in d) {
             return { personal_brand: !!d.personal_brand, promotion: !!d.promotion };
         }
@@ -3688,19 +3664,30 @@ function currentMode() {
 const POSTING_FLAG_TTL_MS = 45_000;
 let postingFlagHeartbeat = null;
 function postingFlagPath() {
-    return path.join(sapsStateDir(), "posting-active.json");
+    return path.join(s4lStateDir(), "posting-active.json");
 }
 function writePostingFlag() {
     try {
-        fs.mkdirSync(sapsStateDir(), { recursive: true });
+        fs.mkdirSync(s4lStateDir(), { recursive: true });
         fs.writeFileSync(postingFlagPath(), JSON.stringify({ pid: process.pid, expires_at: Date.now() + POSTING_FLAG_TTL_MS }) + "\n", "utf-8");
     }
-    catch {
-        /* best effort */
+    catch (e) {
+        // The 2026-06-23 saga flagged "posting-active.json never writes" as open,
+        // and this silent catch is why nobody could tell. Say it, both places.
+        console.error(`[post] posting-active flag write FAILED: ${String(e)}`);
+        logPostEvent(`posting_flag_write_failed err=${String(e)}`);
     }
 }
 function startPostingFlagHeartbeat() {
     writePostingFlag();
+    try {
+        if (!fs.existsSync(postingFlagPath())) {
+            logPostEvent(`posting_flag_missing_after_write path=${postingFlagPath()}`);
+        }
+    }
+    catch {
+        /* best effort */
+    }
     if (postingFlagHeartbeat)
         return;
     // Refresh well within the TTL so a long batch stays flagged, but a dead poster
@@ -3742,7 +3729,7 @@ let _activityLast = null;
 let _activityHb = null;
 function _writeActivityFile(state, label) {
     try {
-        const dir = sapsStateDir();
+        const dir = s4lStateDir();
         fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(path.join(dir, "activity.json"), JSON.stringify({ state, label, since: new Date().toISOString() }) + "\n", "utf-8");
     }
@@ -3776,7 +3763,7 @@ function clearActivity() {
         _activityHb = null;
     }
     try {
-        fs.rmSync(path.join(sapsStateDir(), "activity.json"), { force: true });
+        fs.rmSync(path.join(s4lStateDir(), "activity.json"), { force: true });
     }
     catch {
         /* best effort */
@@ -3789,7 +3776,7 @@ function clearActivity() {
 // Written atomically so a 1s poll never sees a half-written file.
 function persistStatusSummary(snap) {
     try {
-        const dir = sapsStateDir();
+        const dir = s4lStateDir();
         fs.mkdirSync(dir, { recursive: true });
         const tmp = path.join(dir, `status-summary.json.${process.pid}.tmp`);
         fs.writeFileSync(tmp, JSON.stringify({ ...snap, written_at: new Date().toISOString() }) + "\n", "utf-8");
@@ -3807,7 +3794,7 @@ function persistStatusSummary(snap) {
 // just means no pop-ups this batch (chat review still works).
 function writeReviewRequest(req) {
     try {
-        const dir = sapsStateDir();
+        const dir = s4lStateDir();
         fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(path.join(dir, "review-request.json"), JSON.stringify(req, null, 2) + "\n", "utf-8");
     }
@@ -3822,7 +3809,7 @@ function writeReviewRequest(req) {
 // S4L_PANEL_OPEN_BROWSER=1 to restore the old auto-open behavior. (The URL is
 // always returned to the caller regardless, so nothing is lost when we don't open.)
 async function openInBrowser(url) {
-    if (!(process.env.S4L_PANEL_OPEN_BROWSER ?? process.env.SAPS_PANEL_OPEN_BROWSER))
+    if (!(process.env.S4L_PANEL_OPEN_BROWSER))
         return;
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
@@ -3904,7 +3891,23 @@ const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
 // autopilot tick stacks another on top (the zombie pileup that stale-reclaimed the
 // lock mid-post). SIGKILL can't be trapped. Kill children first so the harness CDP
 // driver lets go of Chrome immediately.
+// Timestamped on-disk trail for every scan preemption and posting-flag failure.
+// The console.error lines land in Claude Desktop's per-profile MCP log, which has
+// proven hard to even LOCATE during incidents (2026-07-06 forensics had to infer
+// two of six scan kills from bash job-control lines). This file lives next to the
+// post-*.log dumps so one directory tells the whole posting story. Best-effort.
+function logPostEvent(msg) {
+    try {
+        const dir = path.join(repoDir(), "skill", "logs");
+        fs.mkdirSync(dir, { recursive: true });
+        fs.appendFileSync(path.join(dir, "post-preempt-events.log"), `${new Date().toISOString()} pid=${process.pid} ${msg}\n`);
+    }
+    catch {
+        /* best effort */
+    }
+}
 function sigkillScanTree(pid) {
+    logPostEvent(`sigkill_scan_tree target=${pid}`);
     try {
         const out = execFileSync("pgrep", ["-P", String(pid)], { encoding: "utf-8", timeout: 4000 });
         for (const cstr of out.split(/\s+/)) {
@@ -3957,7 +3960,7 @@ function sigkillAllScans() {
 // BETWEEN every card that a parked scan stale-reclaimed (the hijack). Instead we
 // keep the lock and only release it after SHELL_LOCK_GRACE_MS of no posting, so the
 // hold EXPANDS as more cards get approved and there is never a gap between cards.
-const SHELL_LOCK_GRACE_MS = Number(process.env.S4L_POST_LOCK_GRACE_MS ?? process.env.SAPS_POST_LOCK_GRACE_MS) || 60_000;
+const SHELL_LOCK_GRACE_MS = Number(process.env.S4L_POST_LOCK_GRACE_MS) || 60_000;
 let shellLockReleaseTimer = null;
 // True from the start of a post batch until SHELL_LOCK_GRACE_MS after the last
 // card. The draft-cycle scan checks this and DEFERS launching a scan while it's set —
@@ -3990,6 +3993,7 @@ function preemptScanHoldingBrowser() {
         const pid = shellLockHolderPid();
         if (pid && pidAlive(pid) && pidIsScan(pid)) {
             console.error(`[post] preempting cross-process scan holding the twitter-browser lock (pid ${pid}) — SIGKILL tree`);
+            logPostEvent(`preempt_scan_holding_browser scan_pid=${pid}`);
             sigkillScanTree(pid);
         }
     }
@@ -4034,6 +4038,7 @@ async function acquireShellBrowserLock() {
                 rmShellLockDir();
             }
             else if (pidIsScan(pid)) {
+                logPostEvent(`preempt_scan_on_lock_acquire scan_pid=${pid} attempt=${attempt}`);
                 sigkillScanTree(pid); // SIGKILL — scans trap SIGTERM and survive it
                 await sleepMs(300);
                 rmShellLockDir();
@@ -4443,6 +4448,32 @@ async function main() {
         const tr = setInterval(relayTranscripts, 5 * 60_000);
         tr.unref();
     }
+    // Relay the queue producer/consumer log (claude-queue/provider.log) so a
+    // stranded/orphaned draft batch — a producer that died after its worker wrote
+    // the result but before consuming it — is visible in Cloud Logging remotely,
+    // not just on the box (context="queue-provider"). Incremental (byte offset),
+    // self-locking, forward-only baseline. Best-effort; opt out S4L_PROVIDER_LOG_RELAY=0.
+    if ((process.env.S4L_PROVIDER_LOG_RELAY ?? "1") !== "0") {
+        let providerRelayRunning = false;
+        const relayProviderLog = () => {
+            if (providerRelayRunning)
+                return;
+            providerRelayRunning = true;
+            runPython("scripts/relay_provider_log.py", ["--max-lines", "500"], {
+                timeoutMs: 120_000,
+            })
+                .catch((e) => {
+                console.error("[social-autoposter-mcp] provider-log relay failed:", e?.message || e);
+            })
+                .finally(() => {
+                providerRelayRunning = false;
+            });
+        };
+        const prBoot = setTimeout(relayProviderLog, 95_000); // off the boot hot path
+        prBoot.unref();
+        const pr = setInterval(relayProviderLog, 5 * 60_000);
+        pr.unref();
+    }
     // Sync the install's configuration state (config.json, persona corpus, mode,
     // queues, onboarding ledger) to the backend. Hash-gated on the interval, so
     // the recurring tick only POSTs when something actually changed; setup.ts