@m13v/s4l 1.7.1-rc.9 → 1.7.2-rc.1

package/mcp/dist/index.js

@@ -25,7 +25,7 @@ import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from
 import { startProvisioning, isProvisioning, readProgress, runtimeReady, readRuntime, resolvePython, resolveChrome, ensureMenubar, menubarRunning, clearMenubarStop, ensurePipelineCurrent, ensureRuntimeProvisioned, retryProvisionIfStalled, } from "./runtime.js";
 import { blockOnboardingMilestone, completeOnboardingMilestone, ensureDoctorPhase, onboardingLedger, onboardingSnapshot, recordOnboardingAttempt, runDoctorPhase, } from "./onboarding.js";
 import { VERSION, versionStatus, latestPublishedVersion } from "./version.js";
-import { initSentry, sendHeartbeat, sendStateSnapshot, captureError, flushSentry, startLogStreaming, flushLogs, logLine } from "./telemetry.js";
+import { initSentry, sendHeartbeat, sendStateSnapshot, captureError, captureMessage, flushSentry, startLogStreaming, flushLogs, logLine, checkVersionChange } from "./telemetry.js";
 import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE, getUiCapability, } from "@modelcontextprotocol/ext-apps/server";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -885,11 +885,24 @@ async function postApproved(batchId, plan) {
     {
         const gateDeadline = Date.now() + 8 * 60_000;
         let waited = false;
+        let waitStartedAt = 0;
         while ((postingActive || isPeerDrainActive()) && Date.now() < gateDeadline) {
+            if (!waited) {
+                waitStartedAt = Date.now();
+                // This loop was previously silent end-to-end (2026-07-08 forensics: a
+                // ~1:45 gap in a user's approval batch had zero trace anywhere). Log
+                // once on entry (not per 5s tick, to avoid spamming the file) so a
+                // later "why did card N take so long" question has a starting point.
+                logPostEvent(`postApproved_wait_start batch=${batchId} blocked_by=${describePostingBlocker()}`);
+            }
             waited = true;
             await sleepMs(5000);
         }
-        if (postingActive || isPeerDrainActive()) {
+        const timedOut = postingActive || isPeerDrainActive();
+        if (waited) {
+            logPostEvent(`postApproved_wait_end batch=${batchId} waited_ms=${Date.now() - waitStartedAt} timed_out=${timedOut}`);
+        }
+        if (timedOut) {
             return {
                 attempted: 0,
                 exit_code: 0,
@@ -1181,10 +1194,21 @@ async function postApproved(batchId, plan) {
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
-    // the run exited non-zero OR fewer drafts posted than were approved. This is
-    // the only telemetry channel that reaches a customer .mcpb install (their cycle
-    // log lives on their machine). install_id/hostname are auto-tagged.
-    if (res.code !== 0 || realPosted < approved.length) {
+    // the run exited non-zero OR a REAL failure happened. This is the only
+    // telemetry channel that reaches a customer .mcpb install (their cycle log
+    // lives on their machine). install_id/hostname are auto-tagged.
+    //
+    // Gated on failure_reasons (not just realPosted < approved.length): the
+    // Python pipeline already reports every shortfall to Sentry itself
+    // (twitter_post_plan.py's capture_message), including benign skips like a
+    // deleted target tweet. Re-reporting the SAME benign skip here as a second,
+    // independently-fingerprinted `Error` (this capture group) doubled every
+    // such event into two distinct Sentry issues. Only add this Node-side
+    // capture when there's a real failure_reasons entry or a non-zero exit,
+    // i.e. something the Python capture wouldn't already have flagged as an
+    // actionable error on its own.
+    const hasRealFailure = res.code !== 0 || Boolean(summObj?.failure_reasons);
+    if (hasRealFailure) {
         captureError(new Error(`post_drafts: ${realPosted}/${approved.length} posted (exit=${res.code})`), {
             component: "post",
             exit_code: String(res.code),
@@ -1594,7 +1618,10 @@ tool("engagement_mode", {
     // persona is seeded. (2026-06-30) Skipped when promotion-only, since the
     // product project isn't configured yet (it stays gated until project_config).
     let kickerInstall = null;
-    if (personalBrand) {
+    if (personalBrand && isPaused()) {
+        kickerInstall = { ok: false, detail: "skip (paused)" };
+    }
+    else if (personalBrand) {
         try {
             kickerInstall = await ensureQueueKickerInstalled();
             console.error(`[engagement_mode] launchd kicker: ${kickerInstall.ok ? "ok" : "skip"} (${kickerInstall.detail})`);
@@ -2088,7 +2115,10 @@ tool("project_config", {
         // persona-aware, so calling it from both setup paths is safe. Best-effort:
         // a kicker hiccup never fails setup. (2026-06-30)
         let kickerInstall = null;
-        if (result.ready) {
+        if (result.ready && isPaused()) {
+            kickerInstall = { ok: false, detail: "skip (paused)" };
+        }
+        else if (result.ready) {
             try {
                 kickerInstall = await ensureQueueKickerInstalled();
                 console.error(`[project_config] launchd kicker: ${kickerInstall.ok ? "ok" : "skip"} (${kickerInstall.detail})`);
@@ -2166,7 +2196,16 @@ tool("post_drafts", {
             .optional()
             .describe("1-based draft numbers to post as drafted, e.g. [1, 3, 5]."),
         edits: z
-            .array(z.object({ n: z.number().int().positive(), text: z.string() }))
+            .array(z.object({
+            n: z.number().int().positive(),
+            text: z.string(),
+            variant: z
+                .enum(["a", "b"])
+                .optional()
+                .describe("Two-draft cards only: which of candidate n's `drafts` entries this text came " +
+                "from, so the candidate's style/assigned_style/assigned_mode are switched to " +
+                "match (otherwise engagement_style stats would be attributed to the wrong style)."),
+        }))
             .optional()
             .describe("Rewrites: each {n, text} replaces draft n's wording, then posts it."),
         post_all: z.boolean().optional().describe("Post every draft in the batch."),
@@ -2222,7 +2261,22 @@ tool("post_drafts", {
             warnings.push(`ignored empty edit for #${e.n}`);
             return;
         }
-        candidates[e.n - 1].reply_text = text;
+        const c = candidates[e.n - 1];
+        c.reply_text = text;
+        // Two-draft cards: the human switched to the OTHER draft (with or
+        // without further hand-editing its text). Carry that draft's own
+        // style/assigned_style/assigned_mode onto the candidate so
+        // twitter_post_plan.py's per-candidate drift-coercion posts under (and
+        // logs) the style that's ACTUALLY posting, not whichever draft was
+        // recommended at plan-write time.
+        if (e.variant && Array.isArray(c.drafts)) {
+            const chosen = c.drafts.find((d) => d.variant === e.variant);
+            if (chosen) {
+                c.engagement_style = chosen.style ?? c.engagement_style;
+                c.assigned_style = chosen.assigned_style ?? null;
+                c.assigned_mode = chosen.assigned_mode ?? c.assigned_mode;
+            }
+        }
         approve.add(e.n);
         editedCount++;
     });
@@ -2484,6 +2538,7 @@ tool("runtime", {
     return jsonContent({
         ...snapshot,
         menubar_running: await menubarRunning(),
+        paused: isPaused(),
         onboarding: onboardingSnapshot(),
     });
 });
@@ -2514,6 +2569,37 @@ tool("restart_menubar", {
         menubar_running: running,
     });
 });
+// ---- pause_s4l: temporarily stop drafting/posting, reversibly --------------
+// The lighter alternative to Quit: unloads only the launchd jobs that scan,
+// draft, and post (plus their support daemons), leaving Claude Desktop, the
+// S4L tray, X connection, and the draft schedule registration untouched.
+// Fully reversible — action:'resume' reinstalls the exact same daemons via the
+// same idempotent ensure*Installed() functions boot uses. NOT "autopilot": S4L
+// is draft-first (a human approves every post), so this pauses/resumes the
+// draft pipeline itself, not some autonomous posting mode.
+tool("pause_s4l", {
+    title: "Pause or resume S4L",
+    description: "Pause temporarily stops S4L's own draft pipeline (the launchd kicker that scans/drafts/posts, " +
+        "plus its reaper/stall-watch/memory-snapshot support jobs) WITHOUT touching Claude Desktop, the " +
+        "S4L tray, your X connection, or the draft schedule registration — nothing is deleted, so it " +
+        "survives a Claude Desktop restart and Resume brings it right back. Use when the user asks to " +
+        "pause, stop, or temporarily disable S4L, or to resume/unpause it. This is NOT the same as Quit " +
+        "(which kills and restarts Claude Desktop and removes the draft schedule) — Pause is the lighter, " +
+        "fully reversible option. action:'status' (default) reports whether it's currently paused.",
+    inputSchema: {
+        action: z.enum(["status", "pause", "resume"]).optional(),
+    },
+}, async ({ action }) => {
+    if (action === "pause") {
+        const res = await pauseS4L();
+        return jsonContent({ action: "pause", paused: isPaused(), ...res });
+    }
+    if (action === "resume") {
+        const res = await resumeS4L();
+        return jsonContent({ action: "resume", paused: isPaused(), ...res });
+    }
+    return jsonContent({ action: "status", paused: isPaused() });
+});
 // ---- report_diagnosis: ship a field diagnosis to the developers -------------
 // First-class MCP wrapper over scripts/send_diagnostic_report.py (the same
 // Sentry lane the menubar "Diagnose & fix" prompt uses). Before this existed
@@ -2552,6 +2638,29 @@ tool("report_diagnosis", {
         return jsonContent({ ok: false, detail: String(e?.message || e).slice(0, 300) });
     }
 });
+// ---- client_event: lightweight UI telemetry ping from the dashboard panel --
+// The panel iframe is a browser context with no Sentry SDK and no server-side
+// telemetry access of its own. Before this, a panel button click (e.g. "Set up
+// draft schedule") had NO record anywhere — report_diagnosis needs a full
+// markdown report from an agent turn, which doesn't fit a plain click, so the
+// panel's rearm button silently had zero telemetry while its menu-bar sibling
+// did (see s4l_menubar.py _capture_msg). Not for agent use: the panel calls
+// this directly via app.callServerTool, never through chat.
+tool("client_event", {
+    title: "Log a lightweight client UI event",
+    description: "Internal telemetry hook for the dashboard panel to report a UI event (e.g. a button click). " +
+        "Not intended for the agent to call from chat.",
+    inputSchema: {
+        event: z.string().describe("Short event name, e.g. rearm_clicked"),
+        surface: z.string().optional().describe("UI surface the event came from, e.g. panel"),
+    },
+}, async ({ event, surface }) => {
+    captureMessage(`S4L client event: ${event}`, {
+        level: "info",
+        tags: { component: "panel", event, surface: surface || "panel" },
+    });
+    return jsonContent({ ok: true });
+});
 function runtimeSnapshot() {
     const rt = readRuntime();
     const progress = readProgress();
@@ -2728,6 +2837,16 @@ async function autopilotLoaded() {
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
 const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+// sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
+// within one continuous worker session) instead of drafting inline. Validated
+// via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
+// delegated work, survives); the one hard constraint proven: the delegated
+// sub-agent must never fully idle-wait (e.g. background + wait on a Monitor
+// notification) or the host kills the whole parent+child chain in 1-3 min.
+// Never live-fire tested against a real production job. Full design, what's
+// validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
+// Bump this constant to 9 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
 // 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
@@ -3553,6 +3672,76 @@ async function ensureMemorySnapshotInstalled() {
         return { ok: false, detail: e?.message || String(e) };
     }
 }
+// ---- pause/resume: stop drafting/posting without touching Claude Desktop ---
+// Unlike Quit (which kills + relaunches Claude Desktop and deletes the draft
+// schedule), Pause only unloads the launchd jobs that actually DO work — the
+// kicker that scans/drafts/posts (TWITTER_AUTOPILOT_LABEL) plus its reaper,
+// stall-watch, and memory-snapshot support daemons — while leaving Claude
+// Desktop, the tray, and the Claude-native s4l-worker scheduled task alone.
+// The scheduled task still fires on its own cadence; claude_job.py's `next`
+// checks the same flag file and reports "no work" instantly instead of
+// draining the queue, so nothing drafts or posts while paused even if a
+// worker session wakes up mid-pause. A flag file (nothing is deleted) is what
+// makes Resume a plain reinstall of the same 4 daemons — see resumeS4L.
+function pauseFlagPath() {
+    return path.join(s4lStateDir(), "paused.flag");
+}
+function isPaused() {
+    try {
+        return fs.existsSync(pauseFlagPath());
+    }
+    catch {
+        return false;
+    }
+}
+const PAUSE_TARGETS = [
+    { label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST },
+    { label: REAPER_LABEL, plist: REAPER_PLIST },
+    { label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST },
+    { label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST },
+];
+async function pauseS4L() {
+    if (isPaused())
+        return { ok: true, detail: "already paused" };
+    try {
+        fs.mkdirSync(path.dirname(pauseFlagPath()), { recursive: true });
+        fs.writeFileSync(pauseFlagPath(), `paused at ${new Date().toISOString()}\n`, "utf-8");
+    }
+    catch (e) {
+        return { ok: false, detail: `could not write pause flag: ${e?.message || e}` };
+    }
+    const uid = process.getuid ? process.getuid() : 0;
+    const results = [];
+    for (const { label, plist } of PAUSE_TARGETS) {
+        try {
+            const res = await unloadPlist(label, plist, uid);
+            results.push(`${label}: unloaded (rc=${res.code})`);
+        }
+        catch (e) {
+            results.push(`${label}: ${e?.message || e}`);
+        }
+    }
+    return { ok: true, detail: results.join("; ") };
+}
+async function resumeS4L() {
+    try {
+        fs.rmSync(pauseFlagPath(), { force: true });
+    }
+    catch {
+        /* best-effort */
+    }
+    const kicker = await ensureQueueKickerInstalled();
+    const reaper = await ensureClaudeReaperInstalled();
+    const stall = await ensureStallWatchInstalled();
+    const mem = await ensureMemorySnapshotInstalled();
+    const detail = [
+        `kicker: ${kicker.ok ? "ok" : "skip"} (${kicker.detail})`,
+        `reaper: ${reaper.ok ? "ok" : "skip"} (${reaper.detail})`,
+        `stall-watch: ${stall.ok ? "ok" : "skip"} (${stall.detail})`,
+        `memory-snapshot: ${mem.ok ? "ok" : "skip"} (${mem.detail})`,
+    ].join("; ");
+    return { ok: true, detail };
+}
 // Install/refresh the on-screen overlay watcher launchd job. Promotes the
 // harness status overlay from a best-effort, fired-from-other-tools nicety to a
 // first-class self-healing job. We run `harness_overlay.py watch` directly in
@@ -3620,13 +3809,80 @@ async function ensureOverlayWatchInstalled() {
         return { ok: false, detail: e?.message || String(e) };
     }
 }
+// Install/refresh the daily self-updater launchd job. This used to be bundled
+// into the now-deleted `autopilot` MCP tool (removed 2026-06-19, 88bd1cb9):
+// calling `autopilot enable` installed this job as a side effect, so removing
+// the tool silently orphaned it — UPDATER_LABEL/UPDATER_PLIST and the
+// auto_update_on status check survived (buildSnapshot still reports them), but
+// nothing has installed the plist since, on ANY box provisioned after that
+// commit (auto_update_on reads false forever). Restored here as its own
+// deterministic boot-time job, same pattern as its five siblings above.
+//
+// Points at scripts/s4l_box_update.sh, NOT skill/social-autoposter-update.sh:
+// the latter is the npm-lane updater (npm view + npx update) and is a silent
+// no-op on a .mcpb box, which has no npm/npx on PATH (see version.ts). The
+// .mcpb-lane equivalent downloads the .mcpb directly from the channel-resolved
+// GitHub release and unpacks it over the extension dir — see that script's own
+// header for the channel/no-downgrade/retry guards. Default mode there
+// downloads + unpacks + restarts Claude Desktop with NO human in the loop,
+// matching the original bundled updater's intent ("keeps a headless install
+// current"); RunAtLoad so a box that boots already-behind checks promptly.
+async function ensureUpdaterInstalled() {
+    try {
+        if (process.platform !== "darwin")
+            return { ok: false, detail: "not macOS" };
+        if ((process.env.S4L_AUTO_UPDATE) === "0")
+            return { ok: false, detail: "disabled (S4L_AUTO_UPDATE=0)" };
+        const logDir = path.join(repoDir(), "skill", "logs");
+        try {
+            fs.mkdirSync(logDir, { recursive: true });
+        }
+        catch {
+            /* best-effort */
+        }
+        const xml = plistXml({
+            label: UPDATER_LABEL,
+            programArgs: ["/bin/bash", path.join(repoDir(), "scripts", "s4l_box_update.sh")],
+            intervalSecs: 86_400,
+            runAtLoad: true,
+            stdoutLog: path.join(logDir, "launchd-self-update-stdout.log"),
+            stderrLog: path.join(logDir, "launchd-self-update-stderr.log"),
+        });
+        const uid = process.getuid ? process.getuid() : 0;
+        let cur = null;
+        try {
+            cur = fs.readFileSync(UPDATER_PLIST, "utf-8");
+        }
+        catch {
+            cur = null;
+        }
+        let detail;
+        if (cur === xml) {
+            const res = await loadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
+            detail = `current (load rc=${res.code})`;
+        }
+        else {
+            if (cur !== null) {
+                await unloadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
+            }
+            fs.mkdirSync(path.dirname(UPDATER_PLIST), { recursive: true });
+            fs.writeFileSync(UPDATER_PLIST, xml, "utf-8");
+            const res = await loadPlist(UPDATER_LABEL, UPDATER_PLIST, uid);
+            detail = cur === null ? "installed + loaded" : `rewritten + reloaded (rc=${res.code})`;
+        }
+        return { ok: true, detail };
+    }
+    catch (e) {
+        return { ok: false, detail: e?.message || String(e) };
+    }
+}
 // Is the draft schedule registered AND running for the LIVE account?
 //   'ok'       — worker tasks present+enabled and FIRING (host actively running).
 //   'disabled' — present but a worker task is disabled.
 //   'missing'  — not firing anywhere (orphaned / not registered for the live
 //                account) -> dashboard offers "Set up draft schedule".
-// The algorithm (live-account detection by freshest lastRunAt, firing window,
-// etc.) lives in ONE place: scripts/schedule_state.py. The Python menu bar imports
+// The algorithm (live-account detection via config.json's lastKnownAccountUuid,
+// firing window, etc.) lives in ONE place: scripts/schedule_state.py. The Python menu bar imports
 // that module in-process; we shell out to it here. Keeping a single implementation
 // is the whole point — the two surfaces can no longer drift. The script is
 // stdlib-only and resolvePython() falls back to system python3, so this works even
@@ -3681,6 +3937,7 @@ async function buildSnapshot() {
     // (it's a launchctl check the Node side owns), so layer it on here. The panel
     // uses it to offer a one-click "restart menu bar" when the tray was quit.
     snap.menubar_running = await menubarRunning();
+    snap.paused = isPaused();
     await ensureDoctorPhase(snap.x_connected ? "full" : "pre_connect");
     if (snap.runtime_ready)
         completeOnboardingMilestone("runtime_ready");
@@ -3921,8 +4178,12 @@ function writePanelUrl(url) {
             // and fully usable via `url` for anything that already has it (e.g. this
             // process's own Code side-panel proxy); we just don't publish ourselves
             // as THE shared menu-bar target.
+            logPanelEvent(`panel_cede existing_pid=${existing.pid}`);
             return;
         }
+        logPanelEvent(existing?.pid
+            ? `panel_takeover dead_pid=${existing.pid}`
+            : `panel_claim previous=none`);
         fs.writeFileSync(panelEndpointPath(), JSON.stringify({ url, pid: process.pid, version: VERSION, started_at: new Date().toISOString() }, null, 2) + "\n", "utf-8");
     }
     catch (e) {
@@ -4073,6 +4334,25 @@ function isPeerDrainActive() {
         return false;
     }
 }
+// Human-readable reason for the postApproved wait gate, used only for the
+// wait_start log line — distinguishes "our own drain hasn't hit its grace
+// release yet" from "a peer MCP instance (different pid, e.g. a separate
+// Claude session/queue-worker) is mid-drain," and names the peer pid + how
+// much longer its flag has left so a log reader doesn't have to guess.
+function describePostingBlocker() {
+    if (postingActive)
+        return "own_in_process_flag";
+    try {
+        const j = JSON.parse(fs.readFileSync(postingFlagPath(), "utf-8"));
+        if (typeof j?.expires_at === "number" && j.expires_at > Date.now() && typeof j?.pid === "number") {
+            return `peer_pid=${j.pid} expires_in_ms=${j.expires_at - Date.now()}`;
+        }
+    }
+    catch {
+        /* best effort */
+    }
+    return "unknown";
+}
 // activity.json: a tiny "what's running right now" signal the menu bar reads to
 // show a loading spinner + label (scanning / drafting / posting / …). Written by
 // long-running tools, cleared when they finish. Best-effort; absence == idle.
@@ -4257,6 +4537,25 @@ function logPostEvent(msg) {
         /* best effort */
     }
 }
+// Timestamped on-disk trail of panel-endpoint.json ownership handoffs. Mirrors
+// logPostEvent's rationale (per-process console.error is hard to even locate
+// across ephemeral, per-host-session MCP instances), for the panel-election
+// side instead of the posting side. writePanelUrl() runs on every process's
+// eager startup, so this also captures the mundane "claimed with nothing
+// registered" and "ceded to an already-alive owner" cases, not just handoffs
+// — that's what makes it possible to tell "a fresh instance took over from a
+// dead registrant" apart from "an approve click found nothing registered at
+// all" after the fact, instead of inferring it from timing alone.
+function logPanelEvent(msg) {
+    try {
+        const dir = path.join(repoDir(), "skill", "logs");
+        fs.mkdirSync(dir, { recursive: true });
+        fs.appendFileSync(path.join(dir, "panel-events.log"), `${new Date().toISOString()} pid=${process.pid} ${msg}\n`);
+    }
+    catch {
+        /* best effort */
+    }
+}
 function sigkillScanTree(pid) {
     logPostEvent(`sigkill_scan_tree target=${pid}`);
     try {
@@ -4666,6 +4965,15 @@ async function drainApprovedBacklog() {
 }
 async function main() {
     initSentry();
+    // Detect a self-update (old_version -> new_version) as the very first thing
+    // after Sentry is up, before anything else that could restart/exit. See
+    // checkVersionChange's own docstring for why this exists.
+    try {
+        checkVersionChange();
+    }
+    catch (e) {
+        console.error("[social-autoposter-mcp] version-change check failed:", e?.message || e);
+    }
     // Tee the verbatim stdout/stderr of every pipeline subprocess to the s4l
     // Cloud Run relay (-> Cloud Logging) so we can troubleshoot/rescue any user
     // scenario (silent stalls, partial onboarding) without asking them to ship a
@@ -4707,16 +5015,31 @@ async function main() {
     catch (e) {
         console.error(`[queue-worker] could not create worker folder: ${e?.message || e}`);
     }
-    void ensureQueueKickerInstalled()
-        .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-        .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
+    // The 4 pipeline daemons (kicker, reaper, stall-watch, memory-snapshot) are
+    // skipped at boot while paused.flag is present, so a Claude Desktop restart
+    // during a Pause doesn't silently un-pause the pipeline — see pauseS4L/
+    // resumeS4L. Feedback-digest is NOT gated: it only distills past review
+    // decisions, not drafting/posting, so it's harmless to keep running.
+    if (!isPaused()) {
+        void ensureQueueKickerInstalled()
+            .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
+    }
+    else {
+        console.error("[queue-worker] launchd kicker: skip (paused)");
+    }
     // Self-healing reaper for the agent-mode session leak the queue autopilot
     // produces (finished `claude` worker sessions Desktop never tears down). A
     // standalone guardrail; install unconditionally so it caps memory even on a
     // box whose project isn't ready yet. Best-effort; must never block boot.
-    void ensureClaudeReaperInstalled()
-        .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-        .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
+    if (!isPaused()) {
+        void ensureClaudeReaperInstalled()
+            .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
+    }
+    else {
+        console.error("[claude-reaper] launchd reaper: skip (paused)");
+    }
     // Feedback digest: hourly distillation of the user's card approve/reject
     // decisions into learned_preferences (see scripts/feedback_digest.py).
     // Best-effort; a box with no review events runs a no-op.
@@ -4726,15 +5049,25 @@ async function main() {
     // Autopilot stall watchdog: fleet-side Sentry alert when the draft routines stop
     // draining (most often an account switch orphaning them). The menu bar shows the
     // user the Re-arm action; this is the part we see. Best-effort; never blocks boot.
-    void ensureStallWatchInstalled()
-        .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-        .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
+    if (!isPaused()) {
+        void ensureStallWatchInstalled()
+            .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
+    }
+    else {
+        console.error("[stall-watch] launchd watchdog: skip (paused)");
+    }
     // Periodic host-resource sampler (memory/process snapshot -> local JSONL). Gives
     // us per-box resource history to diagnose RAM blowups (e.g. the agent-mode
     // session leak). Best-effort; never blocks boot. Disable with S4L_MEMORY_SNAPSHOT=0.
-    void ensureMemorySnapshotInstalled()
-        .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-        .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
+    if (!isPaused()) {
+        void ensureMemorySnapshotInstalled()
+            .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
+    }
+    else {
+        console.error("[memory-snapshot] launchd sampler: skip (paused)");
+    }
     // On-screen overlay watcher supervisor. The harness status overlay only renders
     // while the watcher process is alive, and that watcher had no supervisor — when
     // it died nothing respawned it and the overlay silently vanished. Install it as
@@ -4743,6 +5076,13 @@ async function main() {
     void ensureOverlayWatchInstalled()
         .then((r) => console.error(`[overlay-watch] launchd supervisor: ${r.ok ? "ok" : "skip"} (${r.detail})`))
         .catch((e) => console.error("[overlay-watch] supervisor install failed:", e?.message || e));
+    // Daily self-updater: restored 2026-07-08 after 88bd1cb9 ("Remove autopilot
+    // tool") silently dropped its only install path (it used to be bundled into
+    // the deleted `autopilot enable` action). Best-effort; never blocks boot.
+    // Disable with S4L_AUTO_UPDATE=0.
+    void ensureUpdaterInstalled()
+        .then((r) => console.error(`[self-update] launchd updater: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+        .catch((e) => console.error("[self-update] updater install failed:", e?.message || e));
     // Heal installs onboarded before short_links_live defaulted to false: such a
     // project wraps short links against the customer's own domain, which has no
     // /r/[code] resolver, so every minted link 404s. Re-point them at the s4l.ai