@m13v/s4l 1.7.1 → 1.7.2-rc.1

package/mcp/dist/index.js

@@ -2837,6 +2837,16 @@ async function autopilotLoaded() {
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
 const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+// sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
+// within one continuous worker session) instead of drafting inline. Validated
+// via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
+// delegated work, survives); the one hard constraint proven: the delegated
+// sub-agent must never fully idle-wait (e.g. background + wait on a Monitor
+// notification) or the host kills the whole parent+child chain in 1-3 min.
+// Never live-fire tested against a real production job. Full design, what's
+// validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
+// Bump this constant to 9 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
 // 240s (4 min): comfortably inside the 900s single-Bash-call survival verified

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.1",
-  "installedAt": "2026-07-09T00:28:03.233Z"
+  "version": "1.7.2-rc.1",
+  "installedAt": "2026-07-09T01:04:07.949Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.1",
+  "version": "1.7.2-rc.1",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -418,7 +418,21 @@ def _details_lines(d):
             lines.append(
                 f"Original thread ({lang.lower()}): {_truncate(d.get('thread_text'), 280)}"
             )
-        if (d.get("reply_text_en") or "").strip():
+        # Two-draft cards: reply_text_en only ever mirrors Draft A (the
+        # canonical single-draft field), so Draft B's translation would be
+        # silently dropped from the popover unless we read each slot's own
+        # text_en directly off the drafts array.
+        dual_drafts = d.get("drafts")
+        if isinstance(dual_drafts, list) and len(dual_drafts) == 2:
+            slot_labels = {"a": "Draft A", "b": "Draft B"}
+            for draft in dual_drafts:
+                text_en = (draft.get("text_en") or "").strip()
+                if text_en:
+                    label = slot_labels.get(
+                        (draft.get("variant") or "").strip().lower(), "Draft"
+                    )
+                    lines.append(f"{label} in English: {_truncate(text_en, 280)}")
+        elif (d.get("reply_text_en") or "").strip():
             lines.append(
                 f"Draft in English: {_truncate(d.get('reply_text_en'), 280)}"
             )

package/mcp/menubar/s4l_menubar.py

@@ -775,6 +775,74 @@ class S4LMenuBar(rumps.App):
             "that schedules the draft tasks for this account",
         )
 
+    def _finish_schedule_setup(self, _=None):
+        """One-click fix for schedule_state == 'missing' when
+        scheduled_task_selfheal.can_create_for_active_account() confirms a
+        session directory already exists for the active account (2026-07-08):
+        quit Claude, create the registration via a direct file write (the
+        same heal() the update flow uses — see its module docstring for why
+        this is equivalent to what create_scheduled_task would produce), then
+        relaunch. Primary action for this case now instead of re-arm: no
+        clipboard paste, no chat turn required. Re-arm remains the fallback
+        for the rarer case where no session directory exists yet for the
+        active account (see _build_menu) — fix 5 never fabricates one."""
+        _activate_front()
+        choice = _show_alert(
+            title="Finish setting up drafts?",
+            message=(
+                "Claude needs to restart once to finish registering your draft "
+                "schedule for this account. Its window will close and reopen "
+                "in a moment — drafting starts within a few minutes after."
+            ),
+            ok="Restart & Finish Setup", cancel="Cancel",
+        )
+        if choice != 1:
+            return
+        _capture_msg(
+            "S4L finish-schedule-setup clicked",
+            phase="draft_schedule",
+            reason="missing",
+            _extra={"scheduled_tasks": _registry_summary_for_capture()},
+        )
+        self._notify("S4L", "Restarting Claude Desktop… setting up your draft schedule.")
+        threading.Thread(target=self._finish_schedule_setup_work, daemon=True).start()
+
+    def _finish_schedule_setup_work(self):
+        try:
+            user_data_dirs = self._claude_user_data_dirs()
+            self._quit_claude_and_wait()
+            # Claude is down: the same safe window _rewrite_scheduled_task_cwd
+            # always required. In-process is fine here (unlike the update
+            # flow's _fresh variant) — no new bundle was just downloaded, so
+            # the currently-running code IS the current code; nothing to go
+            # stale against.
+            self._rewrite_scheduled_task_cwd()
+            self._relaunch_claude(user_data_dirs)
+            self._sig = None
+            # Verify rather than claim success unconditionally — the earlier,
+            # now-deleted silent restart-fix drew a direct complaint for
+            # giving zero feedback either way (2026-07-08). CREATED_GRACE in
+            # schedule_state.py means a freshly-created, never-yet-fired task
+            # already reads "ok", so this doesn't need to wait for an actual
+            # first fire — just for Claude to be back up and the file to have
+            # landed.
+            time.sleep(12)
+            state = self._schedule_state()
+            if state == "ok":
+                self._notify(
+                    "S4L drafts set up",
+                    "Your draft schedule is registered — drafting starts within a few minutes.",
+                )
+            else:
+                self._notify(
+                    "S4L couldn't finish setup",
+                    "Restarting didn't register the schedule. Open the S4L menu → "
+                    "“Set up draft schedule” to finish it manually.",
+                )
+        except Exception as e:
+            self._notify("S4L setup restart failed", str(e)[:140])
+            _capture(e, phase="finish_schedule_setup")
+
     # ---- schedule-state detection ----------------------------------------
     def _schedule_state(self):
         """Is the draft schedule registered AND running for the live account?
@@ -2400,11 +2468,24 @@ class S4LMenuBar(rumps.App):
                     "schedule” to re-register it.",
                 )
             else:
-                self._notify(
-                    "S4L draft autopilot not scheduled",
-                    "No draft tasks are running on this Claude account (switching "
-                    "accounts clears them). Open the S4L menu → “Set up draft schedule”.",
-                )
+                can_selfheal = False
+                try:
+                    import scheduled_task_selfheal
+                    can_selfheal = scheduled_task_selfheal.can_create_for_active_account()
+                except Exception:
+                    pass
+                if can_selfheal:
+                    self._notify(
+                        "S4L draft autopilot not scheduled",
+                        "No draft tasks are running on this Claude account (switching "
+                        "accounts clears them). Open the S4L menu → “Finish setting up drafts”.",
+                    )
+                else:
+                    self._notify(
+                        "S4L draft autopilot not scheduled",
+                        "No draft tasks are running on this Claude account (switching "
+                        "accounts clears them). Open the S4L menu → “Set up draft schedule”.",
+                    )
             self._stall_notified = True
         elif not attention and self._stall_notified:
             if self._attention_clear_since is None:
@@ -2988,7 +3069,23 @@ class S4LMenuBar(rumps.App):
                 items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             else:
                 items.append(self._label("⚠ Draft tasks aren’t scheduled on this account"))
-                items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
+                # Prefer the automatic fix (2026-07-08): if the active account
+                # already has a session directory, _finish_schedule_setup can
+                # create the registration directly (heal() fix 5) with no
+                # clipboard paste needed. Fall back to re-arm only when fix 5
+                # has nowhere to write (no session dir yet for this account —
+                # it never fabricates one), since that's the one case where
+                # only the live create_scheduled_task host tool can help.
+                can_selfheal = False
+                try:
+                    import scheduled_task_selfheal
+                    can_selfheal = scheduled_task_selfheal.can_create_for_active_account()
+                except Exception:
+                    pass
+                if can_selfheal:
+                    items.append(rumps.MenuItem("Finish setting up drafts", callback=self._finish_schedule_setup))
+                else:
+                    items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             items.append(rumps.separator)
 
         if not runtime_ready:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.1",
+  "version": "1.7.2-rc.1",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.1",
+  "version": "1.7.2-rc.1",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/claude_job.py

@@ -335,6 +335,32 @@ def heartbeat_path() -> str:
     return os.path.join(queue_root(), "worker-heartbeat.json")
 
 
+def _arm_deathwatch(job_id: str, qtype: str, batch: str) -> None:
+    """Best-effort dead-man's-switch (2026-07-08): arm scripts/producer_deathwatch.py
+    to flag an UNEXPECTED death (SIGKILL/OOM/hard crash) of THIS process while
+    it's blocked in the cmd_provider() poll loop below — the exact gap that
+    made orphaned salvage results ("worker drafted, no card") unexplainable.
+    Every normal return path in cmd_provider() calls _disarm_deathwatch()
+    first, so a clean exit never produces a report. Shared with
+    run_claude.sh's direct-exec path (every non-queue platform), which calls
+    producer_deathwatch.py's `arm`/`disarm` CLI directly instead of through
+    this Python wrapper — see that file for the single implementation both
+    callers share."""
+    try:
+        import producer_deathwatch as pdw
+        pdw.arm(os.getpid(), job_id, qtype, batch, call_path="queue")
+    except Exception:
+        pass
+
+
+def _disarm_deathwatch(job_id: str) -> None:
+    try:
+        import producer_deathwatch as pdw
+        pdw.disarm(job_id)
+    except Exception:
+        pass
+
+
 def _stamp_heartbeat(event: str, qtype: str | None = None) -> None:
     """Best-effort: never let a heartbeat write failure break the queue."""
     try:
@@ -690,6 +716,7 @@ def cmd_provider(ns) -> int:
     running_path = os.path.join(running_dir(), fname)
     _atomic_write(pending_path, job)
     _plog(f"enqueued {qtype} job {job_id} batch={batch}; waiting for a scheduled task (timeout {ns.timeout}s)")
+    _arm_deathwatch(job_id, qtype, batch)
     # Narrate the (multi-minute) block to the menu bar. The launchd draft lane has
     # no other activity writer, so without this the box looks idle while it works.
     # Cleared by run-draft-and-publish.sh's exit trap at cycle end (and by the
@@ -732,6 +759,7 @@ def cmd_provider(ns) -> int:
             os.remove(res_path)
             if res.get("status") == "error":
                 _plog(f"job {job_id} returned error: {res.get('error', 'unknown')}")
+                _disarm_deathwatch(job_id)
                 return 1
             obj = res.get("result")
             # Emit a claude `--output-format json` shaped envelope so the
@@ -759,6 +787,7 @@ def cmd_provider(ns) -> int:
             except Exception:
                 _ncand = "?"
             _plog(f"consumed result for job {job_id} batch={batch} ({qtype}); {_ncand} candidates -> producer assembles the plan")
+            _disarm_deathwatch(job_id)
             return 0
         time.sleep(POLL_INTERVAL_S)
 
@@ -779,6 +808,7 @@ def cmd_provider(ns) -> int:
     # flicker the ⚠ off). Cleared only when a draft actually drains.
     _bump_drain_timeout()
     _plog(f"timed out after {ns.timeout}s waiting for job {job_id} batch={batch} ({qtype}); removed the job")
+    _disarm_deathwatch(job_id)
     return 79  # mirror run_claude.sh's "blocked, skip cleanly" exit code
 
 

package/scripts/producer_deathwatch.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""producer_deathwatch.py — dead-man's-switch for every Claude-calling
+producer process in the pipeline.
+
+Watches a single PID: either scripts/claude_job.py's blocking provider wait
+(cmd_provider, the queue path used by twitter-prep/feedback-digest/etc.), or
+scripts/run_claude.sh's direct `claude -p` exec (every other platform:
+reddit, linkedin, github, moltbook, instagram, dm-outreach-*, ...). If that
+PID disappears while its arm marker still exists, something killed it
+(SIGKILL / OOM / hard crash) rather than a normal return — a clean return
+always disarms first. This is the exact gap that made orphaned salvage
+results ("worker drafted, no card") unexplainable: the dying process can
+never log its own death, and salvage only sees the aftermath up to
+--max-age-hours later.
+
+On an unexpected death this:
+  1. Snapshots memory pressure + related processes.
+  2. Appends a structured JSON line to producer-deathwatch.jsonl (local,
+     box-only, for offline/box-local debugging).
+  3. POSTs the same event to /api/v1/producer-death-events so it's queryable
+     across every install from Postgres, not just grep-able on one box (see
+     migrations/2026-07-09-producer-death-events.sql).
+  4. Emits a one-line summary via claude_job._plog() into provider.log,
+     which scripts/relay_provider_log.py already ships to Cloud Logging.
+
+Three subcommands, so both Python (claude_job.py) and bash (run_claude.sh)
+callers share one implementation:
+  arm     — write the marker + spawn `watch` detached (start_new_session=True,
+            so it survives being in the same process group as the watched
+            pid if that group gets signaled). Called right before a caller
+            starts blocking on the watched pid.
+  disarm  — remove the marker. Called on every normal return path AND from
+            a signal-trap cleanup (e.g. run_claude.sh's _sa_cleanup, which
+            itself SIGKILLs the watched process group as part of ordinary
+            TERM/INT/HUP handling — that must disarm too, or a normal
+            watchdog-triggered shutdown would misreport as an unexpected
+            death).
+  watch   — the actual poll loop (internal; `arm` spawns this, nothing else
+            should call it directly).
+
+Best-effort throughout: this is diagnostics only, never allowed to affect
+the real job either way.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+from claude_job import queue_root, _plog  # noqa: E402
+
+POLL_S = 5.0
+
+
+def arm_path(job_id: str) -> str:
+    return os.path.join(queue_root(), f"deathwatch-armed-{job_id}.marker")
+
+
+def arm(watch_pid: int, job_id: str, qtype: str, batch: str, call_path: str) -> None:
+    """Write the marker and spawn a detached `watch` subprocess. Best-effort:
+    any failure here must never block the real caller."""
+    try:
+        marker = arm_path(job_id)
+        os.makedirs(queue_root(), exist_ok=True)
+        with open(marker, "w") as f:
+            f.write(str(watch_pid))
+        subprocess.Popen(
+            [sys.executable, os.path.abspath(__file__), "watch",
+             "--watch-pid", str(watch_pid), "--job-id", job_id,
+             "--qtype", qtype, "--batch", batch, "--call-path", call_path],
+            start_new_session=True,
+            stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+    except Exception:
+        pass
+
+
+def disarm(job_id: str) -> None:
+    try:
+        os.remove(arm_path(job_id))
+    except Exception:
+        pass
+
+
+def _snapshot() -> tuple[str, str]:
+    try:
+        vm = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=5).stdout.strip()
+    except Exception as e:
+        vm = f"(vm_stat failed: {e})"
+    try:
+        procs = subprocess.run(
+            ["/bin/ps", "-axo", "pid=,ppid=,%mem=,%cpu=,command="],
+            capture_output=True, text=True, timeout=5,
+        ).stdout
+        related = "\n".join(
+            ln for ln in procs.splitlines()
+            if "claude" in ln or "run-twitter-cycle" in ln or "run_claude" in ln
+        ) or "(none matching claude/run-twitter-cycle/run_claude)"
+    except Exception as e:
+        related = f"(ps failed: {e})"
+    # Cap length: this rides into a Postgres text column and a JSON line;
+    # keep it bounded so a busy box's ps dump can't balloon either.
+    return vm[:4000], related[:4000]
+
+
+def _report_to_db(event: dict) -> None:
+    """Best-effort POST to /api/v1/producer-death-events. Catches
+    BaseException, not just Exception: http_api._request raises SystemExit
+    on a terminal 4xx/5xx, which must never be allowed to break the
+    diagnostic path (mirrors autopilot_stall_watch.py's same guard)."""
+    try:
+        import http_api  # noqa: E402 (sibling module, HERE already on sys.path)
+        http_api.api_post("/api/v1/producer-death-events", {
+            "watch_pid": event["watch_pid"],
+            "job_id": event["job_id"],
+            "batch_id": event["batch"] if event["batch"] != "-" else None,
+            "qtype": event["qtype"],
+            "call_path": event["call_path"],
+            "vm_stat_summary": event["vm_stat"],
+            "related_processes": event["related_processes"],
+        })
+    except BaseException:
+        pass
+
+
+def watch(watch_pid: int, job_id: str, qtype: str, batch: str, call_path: str) -> int:
+    marker = arm_path(job_id)
+    while True:
+        if not os.path.exists(marker):
+            return 0  # disarmed: the caller returned cleanly, nothing to report
+        try:
+            os.kill(watch_pid, 0)
+        except ProcessLookupError:
+            break  # pid gone but still armed -> unexpected death
+        except PermissionError:
+            pass  # exists, just not signalable from here; keep watching
+        except Exception:
+            pass
+        time.sleep(POLL_S)
+
+    ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    vm, related = _snapshot()
+    event = {
+        "ts": ts,
+        "event": "unexpected_death",
+        "watch_pid": watch_pid,
+        "job_id": job_id,
+        "qtype": qtype,
+        "batch": batch,
+        "call_path": call_path,
+        "vm_stat": vm,
+        "related_processes": related,
+    }
+    try:
+        os.makedirs(queue_root(), exist_ok=True)
+        with open(os.path.join(queue_root(), "producer-deathwatch.jsonl"), "a") as f:
+            f.write(json.dumps(event) + "\n")
+    except Exception:
+        pass
+    _report_to_db(event)
+    try:
+        _plog(f"[deathwatch] UNEXPECTED DEATH watch_pid={watch_pid} job={job_id} "
+              f"type={qtype} batch={batch} path={call_path} -> see producer-deathwatch.jsonl")
+    except Exception:
+        pass
+    try:
+        os.remove(marker)
+    except Exception:
+        pass
+    return 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    pa = sub.add_parser("arm")
+    pa.add_argument("--watch-pid", type=int, required=True)
+    pa.add_argument("--job-id", required=True)
+    pa.add_argument("--qtype", default="?")
+    pa.add_argument("--batch", default="-")
+    pa.add_argument("--call-path", default="queue", choices=["queue", "direct"])
+
+    pd = sub.add_parser("disarm")
+    pd.add_argument("--job-id", required=True)
+
+    pw = sub.add_parser("watch")
+    pw.add_argument("--watch-pid", type=int, required=True)
+    pw.add_argument("--job-id", required=True)
+    pw.add_argument("--qtype", default="?")
+    pw.add_argument("--batch", default="-")
+    pw.add_argument("--call-path", default="queue", choices=["queue", "direct"])
+
+    ns = ap.parse_args()
+    if ns.cmd == "arm":
+        arm(ns.watch_pid, ns.job_id, ns.qtype, ns.batch, ns.call_path)
+        return 0
+    if ns.cmd == "disarm":
+        disarm(ns.job_id)
+        return 0
+    return watch(ns.watch_pid, ns.job_id, ns.qtype, ns.batch, ns.call_path)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/run_claude.sh

@@ -200,6 +200,16 @@ _sa_cleanup() {
     rm -f "$SIDE_LOG"
     rm -f "$ACTIVE_FILE"
 
+    # Disarm the deathwatch (see the arm call in the retry loop below). This
+    # path SIGKILLs $CLAUDE_PG's process group a few lines down as ordinary
+    # TERM/INT/HUP handling (e.g. the watchdog killing a genuinely hung run),
+    # so it must disarm too — otherwise a normal forced shutdown would
+    # misreport as an unexpected death once that kill lands.
+    if [ -n "${_SA_DW_JOB:-}" ]; then
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" disarm --job-id "$_SA_DW_JOB" \
+            >/dev/null 2>&1 || true
+    fi
+
     # Sweep orphan claude descendants. Process groups survive the parent's
     # death (kids reparented to launchd keep their PGID), so killing
     # `kill -- -PGID` reaches every grandchild, including ones reparented
@@ -308,8 +318,25 @@ EOF
         { claude --session-id "$SESSION_ID" ${MODEL_ARGS[@]+"${MODEL_ARGS[@]}"} "$@" | tee -a "$SIDE_LOG"; exit "${PIPESTATUS[0]}"; } &
         CLAUDE_PG=$!
         set +m
+        # Dead-man's-switch (2026-07-09): every non-queue-routed tag (reddit,
+        # linkedin, github, moltbook, instagram, dm-outreach-*, ...) blocks
+        # here exactly like claude_job.py's queue provider does, with the
+        # same silent-death risk (SIGKILL/OOM/hard crash while waiting). Arm
+        # per-attempt (job id includes $CLAUDE_PG so a retry never collides
+        # with a still-unwinding prior attempt's watcher); disarm right after
+        # `wait` returns AND from _sa_cleanup's trap (that path SIGKILLs
+        # $CLAUDE_PG itself as ordinary TERM/INT/HUP handling, which must
+        # disarm too or a normal watchdog-triggered shutdown would misreport
+        # as an unexpected death). See scripts/producer_deathwatch.py.
+        _SA_DW_JOB="${SESSION_ID}-${CLAUDE_PG}"
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" arm \
+            --watch-pid "$CLAUDE_PG" --job-id "$_SA_DW_JOB" --qtype "$SCRIPT_TAG" \
+            --batch "${BATCH_ID:-${SA_CYCLE_ID:--}}" --call-path direct \
+            >/dev/null 2>&1 || true
         wait "$CLAUDE_PG"
         RC=$?
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" disarm --job-id "$_SA_DW_JOB" \
+            >/dev/null 2>&1 || true
         if [ "$RC" -ne 127 ]; then
             break
         fi

package/scripts/scheduled_task_selfheal.py

@@ -266,6 +266,32 @@ def heal() -> dict:
     return summary
 
 
+def can_create_for_active_account() -> bool:
+    """Read-only: would fix 5 (see heal()) actually be able to create a fresh
+    registration right now? True only if the active account (resolved the same
+    way heal() does, via schedule_state's config.json lookup) has at least one
+    EXISTING session directory to write into — fix 5 never fabricates one.
+    Used by callers (the menu bar) to decide whether to offer an automatic
+    "restart to finish setup" action or fall back to the manual re-arm prompt,
+    BEFORE committing to a restart that would turn out to fix nothing."""
+    try:
+        for cfg in schedule_state._config_json_paths():
+            root = os.path.dirname(cfg)
+            uuid = schedule_state._active_account_uuid(cfg)
+            if not uuid:
+                continue
+            account_dir = os.path.join(root, "claude-code-sessions", uuid)
+            session_dirs = [
+                p for p in glob.glob(os.path.join(account_dir, "*"))
+                if os.path.isdir(p)
+            ]
+            if session_dirs:
+                return True
+    except Exception:
+        pass
+    return False
+
+
 def main() -> int:
     out = heal()
     print(json.dumps(out))

package/skill/run-twitter-cycle.sh

@@ -2058,6 +2058,24 @@ else
 fi
 rm -f "$MEDIA_URLS_FILE" 2>/dev/null || true
 
+# Release the twitter-browser lock now. Thread-media capture above was the
+# ONLY browser-touching step in Phase 2b-prep; the Claude drafting call below
+# is architecturally browser-free (--strict-mcp-config omits the
+# twitter-harness MCP, so the model can never reach the CDP Chrome even if it
+# tried) and, since the 2026-06-23 queue migration, "run-twitter-cycle-prep"
+# routes through claude_job.py to an independent worker process that can
+# block for up to S4L_CLAUDE_QUEUE_TIMEOUT (1800s default). Holding the
+# browser lock across that wait made this process a preemption target for
+# any post that needed the browser: the post-vs-scan hijack fix SIGKILLs
+# whoever holds the lock (see docs/twitter_browser_lock.md), which killed
+# this process mid-wait while the worker kept drafting in the background,
+# stranding the finished result until the salvage reconciler's 35-min window
+# (scripts/salvage_orphaned_prep_results.py) picked it up. Releasing here
+# removes this whole phase from being a SIGKILL target for the rest of the
+# drafting wait. Phase 2b-post re-acquires unconditionally below.
+log "Releasing twitter-browser lock before Claude drafting (drafting never touches the browser)..."
+release_lock "twitter-browser" 2>>"$LOG_FILE"
+
 # --- PERSONA CORPUS injection (personal_brand lane only) --------------------
 # build_persona.py apply writes a raw first-hand corpus sidecar next to
 # config.json. In the personal_brand lane we inline it so the drafter grounds
@@ -2432,30 +2450,12 @@ if [ "$PREP_PARSE_EXIT" -eq 0 ] && [ -f "$PLAN_FILE" ]; then
 fi
 log "Phase 2b-prep complete. plan_count=$PLAN_COUNT"
 
-# Determine if Phase 2b-gen will be a no-op. When TWITTER_PAGE_GEN_RATE=0
-# globally, scripts/twitter_gen_links.py rewrites the plan with plain URLs in
-# <1s. In that case the release-now + re-acquire-after-gen dance is pure waste:
-# under cycle overlap the re-acquire can sit in the FIFO ticket queue for
-# 30-90s behind the very `engage-twitter` / next `run-twitter-cycle` we just
-# handed the lock to. We keep the lock through 2b-gen instead and skip the
-# dance entirely.
-GEN_RATE_RAW="${TWITTER_PAGE_GEN_RATE:-0.0}"
-GEN_IS_NOOP=false
-case "$GEN_RATE_RAW" in
-  0|0.0|0.00|0.000|"") GEN_IS_NOOP=true ;;
-esac
-
-# Release the lock unless (a) plan is non-empty AND (b) gen is a no-op. The
-# empty-plan early-exit below still needs the release for a clean handoff, so
-# we cannot just skip when GEN_IS_NOOP=true unconditionally.
-if [ "${PLAN_COUNT:-0}" = "0" ] || ! $GEN_IS_NOOP; then
-    log "Releasing twitter-browser lock (gen step is lock-free)..."
-    release_lock "twitter-browser" 2>>"$LOG_FILE"
-    # (2026-06-16) session-lock rm removed (defect b); dead holders self-reclaim
-    # in twitter_browser.py now. Do NOT re-add. See Phase 1 note + docs/twitter_browser_lock.md.
-else
-    log "Keeping twitter-browser lock through Phase 2b-gen (TWITTER_PAGE_GEN_RATE=$GEN_RATE_RAW, gen is a no-op; skipping release/re-acquire dance)"
-fi
+# twitter-browser lock was already released right after thread-media capture
+# (before the Claude drafting call above), since nothing from there through
+# Phase 2b-gen touches the browser. Phase 2b-post re-acquires unconditionally
+# below. (2026-06-16) session-lock rm removed (defect b); dead holders
+# self-reclaim in twitter_browser.py now. Do NOT re-add. See Phase 1 note +
+# docs/twitter_browser_lock.md.
 
 if [ "${PLAN_COUNT:-0}" = "0" ]; then
     log "Empty plan from prep step. Exiting cycle without posting (pending rows salvaged next cycle)."
@@ -2575,12 +2575,10 @@ fi
 # 2b-gen's potentially long run, peer cycles' 20-min phase2a fallback would
 # already be tripping if we left the row at phase2a.
 python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-post 2>&1 | tee -a "$LOG_FILE" || true
-# Re-acquire only if we actually released for gen (see GEN_IS_NOOP above).
-# When the lock was kept through 2b-gen there's nothing to re-acquire.
-if ! $GEN_IS_NOOP; then
-    log "Re-acquiring twitter-browser lock for Phase 2b-post..."
-    acquire_lock "twitter-browser" 3600 2>>"$LOG_FILE"
-fi
+# Always re-acquire: the lock was released right after thread-media capture
+# (before Claude drafting), well before 2b-gen, so it is never still held here.
+log "Re-acquiring twitter-browser lock for Phase 2b-post..."
+acquire_lock "twitter-browser" 3600 2>>"$LOG_FILE"
 log "twitter-browser lock held (pid=$$) Phase 2b-post"
 # Drop stale singleton locks (see clean_stale_singleton.sh, also called in Phase 1 / 2b-prep).
 ensure_twitter_browser_for_backend 2>&1 | tee -a "$LOG_FILE"