@m13v/s4l 1.7.12-rc.5 → 1.7.12-rc.7

package/mcp/dist/index.js

@@ -5271,6 +5271,43 @@ function readPanelEndpoint() {
         return null;
     }
 }
+// A live pid is not enough to trust panel-endpoint.json: the exit-hook unlink
+// never runs on SIGKILL, so the file can point at a dead pid that the OS later
+// RECYCLES for an unrelated process — kill(pid, 0) then reports "alive" and
+// every instance would cede forever (no panel owner, no heartbeat/relay owner)
+// until the squatter happens to exit. Accept the registration only when the
+// pid's command line actually looks like an S4L MCP server; on ps failure fall
+// back to liveness alone rather than stealing a possibly-valid slot.
+function isS4lServerPid(pid) {
+    if (!isPidAlive(pid))
+        return false;
+    try {
+        const cmd = execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+            encoding: "utf-8",
+            timeout: 4000,
+        });
+        return cmd.includes("dist/index.js") || cmd.includes("@m13v/s4l-mcp");
+    }
+    catch {
+        return true;
+    }
+}
+// True when this process should run per-INSTALL periodic work (heartbeat,
+// transcript/provider relays, state snapshots). Several server instances are
+// routinely alive at once (Desktop, Code side-panel, per-minute queue workers —
+// each boots its own copy via the ~/.claude.json registration), and before this
+// gate every one of them ran every timer: 16 concurrent instances meant 48
+// heartbeat python spawns per 15 min and a measured ~11k fs-events/sec from
+// duplicate relay scans. Reuse the panel-endpoint election writePanelUrl already
+// maintains: the registered live S4L-server pid is the designated worker; when
+// the file is absent, stale, or squatted, anyone may run the work (the 120s
+// reclaim tick will elect a new owner shortly).
+function isInstallTickOwner() {
+    const existing = readPanelEndpoint();
+    if (!existing?.pid || existing.pid === process.pid)
+        return true;
+    return !isS4lServerPid(existing.pid);
+}
 // Publish the loopback URL to stable files so out-of-process readers can find
 // the ephemeral port without scraping `lsof`:
 //   - panel-url            plain text, for the Claude Code side-panel reverse proxy.
@@ -5295,7 +5332,7 @@ function writePanelUrl(url) {
         fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(path.join(dir, "panel-url"), url, "utf-8");
         const existing = readPanelEndpoint();
-        if (existing?.pid && existing.pid !== process.pid && isPidAlive(existing.pid)) {
+        if (existing?.pid && existing.pid !== process.pid && isS4lServerPid(existing.pid)) {
             // Someone else already holds a live registration (most likely a longer-
             // lived session than us) — don't clobber it. Our own panel is still up
             // and fully usable via `url` for anything that already has it (e.g. this
@@ -6212,6 +6249,67 @@ async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error(`[social-autoposter-mcp] connected. v=${VERSION} repo=${repoDir()}`);
+    // Exit when the client goes away. The SDK's StdioServerTransport listens only
+    // for stdin 'data'/'error' — never 'end'/'close' — so client death is invisible
+    // to it, and the eagerly-started panel HTTP listener below holds the event loop
+    // open forever. That combination orphaned 16 servers (33 GB RSS, duplicate
+    // autopilot timers) on 2026-09-18: every client exit (clean close OR SIGKILL,
+    // which just closes our stdin pipe) left a full server behind, reparented to
+    // launchd. Handle EOF ourselves, plus signals, plus a ppid backstop for the
+    // rare case where an inherited fd keeps the stdin pipe open past client death.
+    let shutdownStarted = false;
+    const exitNow = (reason) => {
+        console.error(`[social-autoposter-mcp] client gone (${reason}); exiting`);
+        try {
+            localPanel?.server.close();
+        }
+        catch {
+            /* best-effort */
+        }
+        process.exit(0);
+    };
+    const shutdown = (reason, force = false) => {
+        if (shutdownStarted) {
+            // A second signal while we wait out a drain means "stop now".
+            if (force)
+                exitNow(`${reason}, forced`);
+            return;
+        }
+        shutdownStarted = true;
+        if (!postingActive) {
+            exitNow(reason);
+            return;
+        }
+        // A posting drain is in flight: this process holds the shared
+        // twitter-browser shell lock under its OWN pid while a python poster child
+        // drives Chrome. Exiting now (a) lets the next per-minute cycle
+        // stale-reclaim the lock mid-post and (b) crashes the poster on EPIPE
+        // between a landed reply and its bookkeeping — the idempotent redrain then
+        // double-posts. Wait for the drain to finish (the interval is deliberately
+        // ref'd so it keeps the process alive), capped at the approve_drafts
+        // worst-case timeout.
+        console.error(`[social-autoposter-mcp] client gone (${reason}); waiting for in-flight posting drain before exit`);
+        const started = Date.now();
+        const wait = setInterval(() => {
+            if (!postingActive || Date.now() - started > 2 * 3600_000) {
+                clearInterval(wait);
+                exitNow(`${reason}, drain done`);
+            }
+        }, 5_000);
+    };
+    process.stdin.on("end", () => shutdown("stdin end"));
+    process.stdin.on("close", () => shutdown("stdin close"));
+    process.on("SIGTERM", () => shutdown("SIGTERM", true));
+    process.on("SIGINT", () => shutdown("SIGINT", true));
+    // Skip the backstop when we were BORN with ppid 1 (a launchd-managed server is
+    // legitimately parented to launchd; only a reparent-after-birth means orphaned).
+    if (process.ppid !== 1) {
+        const ppidWatch = setInterval(() => {
+            if (process.ppid === 1)
+                shutdown("orphaned (ppid=1)");
+        }, 30_000);
+        ppidWatch.unref();
+    }
     // Eagerly start the loopback panel server so the Claude Code side panel (and any
     // reverse proxy in front of it) always has a backend to hit, without waiting for
     // a first `dashboard` call. Best-effort: a bind failure must never block boot.
@@ -6245,8 +6343,16 @@ async function main() {
     // (parity with the npx launchd heartbeat). Once on startup, then every 15m
     // while the desktop app keeps the server alive. unref() so it never holds the
     // process open past a normal exit.
+    // Heartbeat + the relays + snapshots below are per-INSTALL work: gate every
+    // tick on the panel-endpoint election (isInstallTickOwner) so N concurrent
+    // instances produce 1x the spawns, not Nx. The startup heartbeat stays
+    // unconditional — a fresh install must phone home before it ever wins an
+    // election.
     void sendHeartbeat("startup");
-    const hb = setInterval(() => void sendHeartbeat("interval"), 15 * 60_000);
+    const hb = setInterval(() => {
+        if (isInstallTickOwner())
+            void sendHeartbeat("interval");
+    }, 15 * 60_000);
     hb.unref();
     // Ship Claude session transcripts (scheduled queue-worker runs + s4l repo
     // sessions) to the Cloud Logging relay so a user's session can be
@@ -6257,7 +6363,7 @@ async function main() {
     if ((process.env.S4L_TRANSCRIPT_RELAY ?? "1") !== "0") {
         let transcriptRelayRunning = false;
         const relayTranscripts = () => {
-            if (transcriptRelayRunning)
+            if (transcriptRelayRunning || !isInstallTickOwner())
                 return;
             transcriptRelayRunning = true;
             runPython("scripts/relay_session_transcripts.py", ["--max-lines", "600"], {
@@ -6283,7 +6389,7 @@ async function main() {
     if ((process.env.S4L_PROVIDER_LOG_RELAY ?? "1") !== "0") {
         let providerRelayRunning = false;
         const relayProviderLog = () => {
-            if (providerRelayRunning)
+            if (providerRelayRunning || !isInstallTickOwner())
                 return;
             providerRelayRunning = true;
             runPython("scripts/relay_provider_log.py", ["--max-lines", "500"], {
@@ -6306,7 +6412,10 @@ async function main() {
     // the recurring tick only POSTs when something actually changed; setup.ts
     // additionally fires it right after every config write.
     void sendStateSnapshot("startup");
-    const ss = setInterval(() => void sendStateSnapshot("interval"), 15 * 60_000);
+    const ss = setInterval(() => {
+        if (isInstallTickOwner())
+            void sendStateSnapshot("interval");
+    }, 15 * 60_000);
     ss.unref();
     // Voice-exemplar catch-up + periodic refresh, checked on every boot
     // (2026-07-16, extended from the original one-shot-for-legacy-installs

package/mcp/dist/repo.js

@@ -85,6 +85,21 @@ export function run(cmd, args, opts = {}) {
         }
         let stdout = "";
         let stderr = "";
+        // Cap captured output to a tail. run() used to accumulate a child's full
+        // stdout+stderr unbounded for the child's lifetime; long-lived spawns (the
+        // 13h voice backfill) and stuck children pinned those strings and were the
+        // main driver of multi-GB server heaps. Callers that parse output read
+        // either whole small payloads or the LAST line, so keeping the tail
+        // preserves semantics. 8 MB per stream is far above any legitimate payload.
+        const MAX_CAPTURE_BYTES = 8 * 1024 * 1024;
+        const capTail = (s) => s.length > MAX_CAPTURE_BYTES ? s.slice(s.length - (MAX_CAPTURE_BYTES >> 1)) : s;
+        // The line-splitter buffers below only shed at '\n', so a child emitting
+        // long newline-free output (carriage-return progress bars, one huge line)
+        // would grow them unbounded for its lifetime — the same heap pathology the
+        // capture cap exists for. Keep only a tail of an oversized partial line
+        // (telemetry truncates lines to 8KB anyway).
+        const MAX_LINEBUF_BYTES = 1024 * 1024;
+        const capLineBuf = (buf) => buf.length > MAX_LINEBUF_BYTES ? buf.slice(-8192) : buf;
         // Per-stream partial-line buffers so onLine fires on whole lines only,
         // regardless of how the OS chunks the pipe reads.
         let outBuf = "";
@@ -104,7 +119,7 @@ export function run(cmd, args, opts = {}) {
                     /* a progress sink must never break the wrapped command */
                 }
             }
-            return buf;
+            return capLineBuf(buf);
         };
         // Parallel whole-line splitter that tees to the telemetry sink (if any),
         // kept separate from the onLine pump so neither path can affect the other.
@@ -127,29 +142,56 @@ export function run(cmd, args, opts = {}) {
                     /* the telemetry sink must never break the wrapped command */
                 }
             }
-            return buf;
+            return capLineBuf(buf);
         };
+        let settled = false;
         let timer;
+        let killTimer;
         if (opts.timeoutMs) {
             timer = setTimeout(() => {
                 child.kill("SIGTERM");
+                // A child that ignores SIGTERM used to live (and hold its pipes and our
+                // buffers) forever. Escalate — but GENEROUSLY: children trap SIGTERM on
+                // purpose to finish critical bookkeeping (twitter_post_plan.py finishes
+                // the current candidate's post + recording, which can take minutes, so a
+                // fast SIGKILL would reopen the posted-but-unrecorded double-post
+                // window). 15 min covers every graceful path; only a truly wedged child
+                // gets hard-killed.
+                killTimer = setTimeout(() => {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch {
+                        /* already gone */
+                    }
+                }, 15 * 60_000);
+                killTimer.unref();
             }, opts.timeoutMs);
         }
         child.stdout.on("data", (d) => {
+            if (settled)
+                return;
             const s = d.toString();
-            stdout += s;
+            stdout = capTail(stdout + s);
             outBuf = pump(s, "stdout", outBuf);
             sinkOutBuf = sinkPump(s, "stdout", sinkOutBuf);
         });
         child.stderr.on("data", (d) => {
+            if (settled)
+                return;
             const s = d.toString();
-            stderr += s;
+            stderr = capTail(stderr + s);
             errBuf = pump(s, "stderr", errBuf);
             sinkErrBuf = sinkPump(s, "stderr", sinkErrBuf);
         });
-        child.on("close", (code) => {
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
             if (timer)
                 clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
             // Flush any trailing partial line (output with no terminating newline).
             if (opts.onLine) {
                 if (outBuf)
@@ -185,10 +227,28 @@ export function run(cmd, args, opts = {}) {
                     }
             }
             resolve({ code: code ?? -1, stdout, stderr });
+        };
+        child.on("close", (code) => finish(code));
+        child.on("exit", (code) => {
+            // 'close' waits for the stdio pipes to drain, which never happens when a
+            // grandchild inherited them and outlives the child — the promise (and the
+            // captured output) then leaked for the grandchild's lifetime. After the
+            // child itself exits, give the pipes a grace to flush, then settle. The
+            // setImmediate hop matters: if the event loop was stalled past the grace
+            // by sync work, timers fire BEFORE the poll phase reads the data already
+            // sitting in the kernel buffer — hopping to the check phase lets those
+            // reads land first instead of truncating a successful child's output.
+            const drain = setTimeout(() => setImmediate(() => finish(code)), 10_000);
+            drain.unref();
         });
         child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
             if (timer)
                 clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
             resolve({ code: -1, stdout, stderr: stderr + String(err) });
         });
     });

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.12-rc.5",
-  "installedAt": "2026-09-01T23:32:18.166Z"
+  "version": "1.7.12-rc.7",
+  "installedAt": "2026-09-24T20:17:26.520Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.12-rc.5",
+  "version": "1.7.12-rc.7",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.12-rc.5",
+  "version": "1.7.12-rc.7",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.12-rc.5",
+  "version": "1.7.12-rc.7",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/draft_prompt_core.py

@@ -301,10 +301,19 @@ def _load_config():
 def projects_json(lane=None, only_project=None):
     """The ALL_PROJECTS_JSON block: per-project drafting config as a JSON
     string. lane='personal_brand' emits ONLY the persona project through the
-    whitelist; otherwise every project through the ops denylist.
+    whitelist; otherwise every ROUTABLE project through the ops denylist.
     only_project (reddit lane: one project per draft call) narrows the
     promotion output to that single project's entry. Returns '{}' on any
-    failure, mirroring the shell's `|| echo "{}"`."""
+    failure, mirroring the shell's `|| echo "{}"`.
+
+    Routable (2026-09-23): the promotion roster excludes persona entries and
+    archived projects (enabled: false). ALL_PROJECTS_JSON doubles as the prep
+    step's PROJECT ROUTING target list ("...unless the thread content clearly
+    better fits another project"), so an unfiltered roster let a promotion
+    cycle re-route a candidate onto the persona while the personal_brand lane
+    was switched OFF (observed 2026-09-23: a promotion-lane card posted as
+    PersonalBrand), or onto an archived project. The persona is reachable
+    ONLY via the personal_brand lane's whitelist branch above."""
     lane = lane if lane is not None else os.environ.get("S4L_ACTIVE_LANE", "")
     try:
         config = _load_config()
@@ -319,6 +328,10 @@ def projects_json(lane=None, only_project=None):
         for p in projects:
             if only_project and p.get("name") != only_project:
                 continue
+            if not only_project and (
+                p.get("persona") is True or p.get("enabled", True) is False
+            ):
+                continue
             out[p["name"]] = {k: v for k, v in p.items() if k not in _OPS_KEYS}
         return json.dumps(out, indent=2)
     except Exception:

package/scripts/dump_visitor_history.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Dump a visitor's cross-thread history as JSON for prompt injection.
+
+Gives the web-chat agent memory of a returning visitor across ALL their
+threads, so it never goes cold ("nothing like that on our side") on a known
+user just because they opened a fresh thread. Reads:
+
+    GET /api/v1/web-chat/visitor?email=<email>&exclude=<thread>&limit=N
+
+Used by skill/check-web-chats.sh alongside dump_web_chat_history.py:
+
+    $(python3 scripts/dump_visitor_history.py --email "$EMAIL" --exclude "$THREAD_ID")
+
+Returns:
+  {
+    "visitor_email": ..., "thread_count": N, "excluded_thread": ...,
+    "threads": [{ thread_id, project, page_url, created_at, last_message_at }, ...],
+    "recent_messages": [{ thread_id, sender, sender_name, text, created_at }, ...]
+  }
+
+On any error (no email, thread-only visitor, endpoint 404) it prints an empty
+skeleton and exits 0, so the caller can always inline the output safely.
+"""
+
+import argparse
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from http_api import api_get
+
+EMPTY = {"visitor_email": "", "thread_count": 0, "threads": [], "recent_messages": []}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--email", required=True)
+    parser.add_argument("--exclude", default="", help="thread_id to leave out (the current one)")
+    parser.add_argument("--project", default="")
+    parser.add_argument("--limit", type=int, default=120)
+    args = parser.parse_args()
+
+    email = (args.email or "").strip()
+    if not email or "@" not in email:
+        print(json.dumps(EMPTY))
+        return
+
+    query = {"email": email, "limit": args.limit}
+    if args.exclude:
+        query["exclude"] = args.exclude
+    if args.project:
+        query["project"] = args.project
+
+    try:
+        resp = api_get("/api/v1/web-chat/visitor", query=query, ok_on_404=True)
+    except Exception as e:  # never let a memory lookup crash the spawn
+        print(json.dumps({**EMPTY, "visitor_email": email, "_error": str(e)}))
+        return
+
+    if resp.get("_not_found"):
+        print(json.dumps({**EMPTY, "visitor_email": email}))
+        return
+
+    out = resp.get("data") or {}
+    if not out:
+        out = {**EMPTY, "visitor_email": email}
+    print(json.dumps(out, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/scripts/engage_github.py

@@ -270,19 +270,32 @@ Read the FULL thread above. There is NO cap on how many times we can reply to a
 
 CHECK ESCALATION FIRST. Escalation hands the thread to the human who owns
 this account; they answer by email and their answer is posted as the
-comment. ESCALATE (output action=escalate with a one-line reason) when any
-of these is true:
-- The replier directly addresses OUR author (by @mention or unmistakable
-  context) with a question about something WE said, e.g. "@{our_username}
-  could you expand on what you mean?". A personal question to us deserves
-  the human's own answer, not a generated one.
-- The replier reports a bug, breakage, or defect in one of OUR products
+comment. Escalation is EXPENSIVE (a human inbox interrupt), so investigate
+the thread and decide case by case: escalate ONLY when a well-written
+generated reply cannot adequately serve because the comment needs the
+human's OWN voice, knowledge, or commitment. That means one of:
+- They ask our author something only the human can truthfully answer:
+  personal history or experience ("how did you come across this
+  project?"), intentions, commitments, or private context.
+- They directly ask our author to explain or justify something WE said
+  and the subtext is confusion or pushback about our comment ("@{our_username}
+  could you expand on what you mean?", "who is that comment for?").
+  Getting the clarification wrong would embarrass us; the human answers.
+- They report a bug, breakage, or defect in one of OUR products
   (anything in config.json). Bug reports need the maker's eyes.
-- The replier is the repo OWNER (or an obvious maintainer) engaging
-  seriously with our comment. Maintainer conversations are relationships
-  the human should hold personally.
-When a comment fits both ESCALATE and REPLY, escalate. Do not draft a
-reply text for an escalated comment.
+- A genuine relationship moment with the repo owner/maintainer: strong
+  praise of our contribution, an invitation to collaborate or contribute,
+  or an explicit request for a decision from us.
+NOT grounds for escalation on their own (2026-09-04 recalibration; the
+blanket "owner engaging seriously" rule flooded the human's inbox):
+- The repo owner merely engaging seriously: agreeing with us, clarifying
+  scope, posting design decisions, or announcing a merge/close. Write a
+  substantive reply (or skip if concluded) instead.
+- Thread activity that is weeks old: a personal email answer to a stale
+  comment lands worse than a normal reply. Prefer reply or skip.
+When you do escalate, the reason line MUST say what the human uniquely
+adds that a generated reply cannot. Do not draft a reply text for an
+escalated comment.
 
 Otherwise, DEFAULT TO REPLY when you have substance. Lean toward engagement, not silence.
 

package/scripts/invent_topics.py

@@ -189,20 +189,27 @@ def load_project_topics(project_name: str,
 
 
 def project_universe_strings(project_name: str) -> set[str]:
-    """Full active universe for the project from project_search_topics.
+    """Full universe for the project from project_search_topics, EVERY status.
 
     Read from /api/v1/project-search-topics for the freshest read at
     invent time. Lowercased for case-insensitive matching against
     proposals.
+
+    status=all (2026-09-22): the dedup/avoid set must include paused and
+    excluded topics, not just active ones. A paused topic absent from the
+    universe would be re-proposed as "new" and the validate_proposals upsert
+    (status='active') would silently resurrect it, undoing a deliberate
+    repositioning. Paused topics in the prompt's covered list are equally
+    correct: the model must not re-propose them.
     """
     try:
         resp = api_get(
             "/api/v1/project-search-topics",
-            query={"project": project_name, "status": "active"},
+            query={"project": project_name, "status": "all"},
         )
     except Exception as exc:
         raise SystemExit(
-            f"could not fetch active universe for project={project_name!r}: {exc}"
+            f"could not fetch topic universe for project={project_name!r}: {exc}"
         ) from exc
     rows = ((resp or {}).get("data") or {}).get("topics") or []
     return {(r.get("topic") or "").strip().lower() for r in rows if r.get("topic")}

package/scripts/pick_thread_target.py

@@ -215,6 +215,10 @@ def build_candidates(config):
     thread_blocked = load_thread_blocked_subs(config)
     candidates = []
     for p in config.get("projects", []):
+        # Project-level archive flag wins over the per-lane flag: an archived
+        # project (enabled: false) must not post from ANY lane.
+        if p.get("enabled", True) is False:
+            continue
         t = p.get("threads") or {}
         if not t.get("enabled"):
             continue

package/scripts/pick_twitter_thread_target.py

@@ -97,6 +97,10 @@ def angle_recency(project_recents, angle_text):
 def build_candidates(config, project_recents):
     candidates = []   # (project_dict, angle_text, floor_days, last_used_days_ago_or_None)
     for p in config.get("projects", []):
+        # Project-level archive flag wins over the per-lane flag: an archived
+        # project (enabled: false) must not post from ANY lane.
+        if p.get("enabled", True) is False:
+            continue
         tt = p.get("twitter_threads") or {}
         if not tt.get("enabled"):
             continue

package/scripts/project_topics.py

@@ -156,13 +156,69 @@ def _bootstrap_from_config(name: str) -> int:
     return seeded
 
 
+def _sync_new_config_topics(name: str, active: List[str]) -> List[str]:
+    """Additive config->DB sync (2026-09-22). Before this, config.json
+    search_topics only reached the DB on the zero-active-rows first bootstrap;
+    topics ADDED to config later were silently ignored forever (this is how
+    Sundial's 09-11 math seeds never ran). Now any config topic the DB has
+    NEVER seen (in any status) is inserted as source='seed'/active on read.
+
+    Paused/excluded rows stay authoritative: a topic that still lingers in
+    config but was deliberately paused in the DB is known (status=all check)
+    and is NOT re-inserted or reactivated. Costs nothing in steady state: the
+    status=all read fires only when config carries a topic missing from the
+    active set. Returns the newly inserted topics ([] on any failure)."""
+    if os.environ.get("S4L_NO_TOPIC_AUTOSEED") == "1":
+        return []
+    missing = [t for t in _config_topics_for(name) if t not in set(active)]
+    if not missing:
+        return []
+    try:
+        from http_api import api_get, api_post
+        resp = api_get(
+            "/api/v1/project-search-topics",
+            query={"project": name, "status": "all"},
+        )
+    except Exception as e:
+        sys.stderr.write(
+            f"[project_topics] config-sync skipped project={name!r}: {e}\n"
+        )
+        return []
+    rows = ((resp or {}).get("data") or {}).get("topics") or []
+    known = {(r.get("topic") or "").strip() for r in rows}
+    inserted: List[str] = []
+    for topic in missing:
+        if topic in known:
+            continue  # exists paused/excluded (or raced in): leave it alone
+        try:
+            api_post(
+                "/api/v1/project-search-topics",
+                body={"project": name, "topic": topic,
+                      "source": "seed", "status": "active",
+                      "notes": "config->DB additive sync"},
+            )
+            inserted.append(topic)
+        except Exception as e:
+            sys.stderr.write(
+                f"[project_topics] config-sync FAILED project={name!r} "
+                f"topic={topic!r}: {e}\n"
+            )
+    if inserted:
+        sys.stderr.write(
+            f"[project_topics] config-sync added {len(inserted)} new topic(s) "
+            f"for project={name!r}: {inserted}\n"
+        )
+    return inserted
+
+
 def topics_for_project(name: str) -> List[str]:
     """Active topics for one project (DB-backed, process-cached, self-healing).
 
     On the first read where the DB has no active topics but config.json carries
     a search_topics[] seed, the seed is mirrored into the DB once and re-read,
     so adding a project to config.json is enough to make it run. After that the
-    DB is the single living source of truth."""
+    DB is the living source of truth for topic STATUS (pausing/excluding), while
+    topics newly ADDED to config keep flowing in via _sync_new_config_topics."""
     if not name:
         return []
     key = name.strip()
@@ -173,6 +229,8 @@ def topics_for_project(name: str) -> List[str]:
         _BOOTSTRAP_ATTEMPTED.add(key)
         if _bootstrap_from_config(key) > 0:
             topics = _fetch_active_topics(key)
+    else:
+        topics = topics + _sync_new_config_topics(key, topics)
     _CACHE[key] = topics
     return topics