@m13v/s4l 1.7.4-rc.21 → 1.7.4-rc.22

package/mcp/dist/index.js

@@ -163,6 +163,9 @@ function plistXml(opts) {
     const schedule = opts.keepAlive
         ? `\t<key>KeepAlive</key>\n\t<true/>`
         : `\t<key>StartInterval</key>\n\t<integer>${opts.intervalSecs}</integer>`;
+    const abandon = opts.abandonProcessGroup
+        ? `\n\t<key>AbandonProcessGroup</key>\n\t<true/>`
+        : "";
     // Background (cron/autopilot) runs get the same Chrome the interactive cycle
     // uses, so a no-sudo ~/Applications install (which the shell's own resolver
     // doesn't scan) is still found off-screen. Omitted when Chrome resolves via
@@ -188,7 +191,7 @@ function plistXml(opts) {
 \t<array>
 ${args}
 \t</array>
-${schedule}
+${schedule}${abandon}
 \t<key>StandardOutPath</key>
 \t<string>${opts.stdoutLog}</string>
 \t<key>StandardErrorPath</key>
@@ -3500,6 +3503,9 @@ async function ensureQueueKickerInstalled() {
             stdoutLog: path.join(logDir, "launchd-twitter-cycle-stdout.log"),
             stderrLog: path.join(logDir, "launchd-twitter-cycle-stderr.log"),
             extraEnv: kickerEnv(),
+            // Don't let launchd reap the harness Chrome the cycle launches when the
+            // kicker shell exits (2026-07-12 foreground-steal loop).
+            abandonProcessGroup: true,
         });
         // Content-aware install: an existing box has the OLD kicker plist pointing at
         // run-twitter-cycle.sh (no merge step). ensurePlist won't overwrite, so detect

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.4-rc.21",
-  "installedAt": "2026-07-12T04:40:26.669Z"
+  "version": "1.7.4-rc.22",
+  "installedAt": "2026-07-12T19:48:21.172Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.4-rc.21",
+  "version": "1.7.4-rc.22",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.4-rc.21",
+  "version": "1.7.4-rc.22",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.4-rc.21",
+  "version": "1.7.4-rc.22",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/cdp_ready_check.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Real CDP readiness probe for the harness Chrome.
+
+Exit 0 when a full Playwright connect_over_cdp handshake completes against the
+given CDP URL, 1 when it does not. /json/version alone is a LIVENESS check: a
+wedged Chrome (process alive, HTTP answering, websocket upgrade completing,
+but the browser loop never servicing the CDP session) passes it, and every
+downstream attach then eats Playwright's 180s default timeout while holding
+the browser lock (S4L-4H, Karol 2026-07-11; identical wedge locally 2026-07-09,
+twice, same Chrome instance both times).
+
+Usage: cdp_ready_check.py [CDP_URL] [TIMEOUT_MS]
+
+Prints a one-line JSON verdict to stdout so the caller can persist it
+(twitter-backend.sh writes it to skill/logs/cdp-health.json, which
+memory_snapshot.py carries onto the per-minute heartbeat sample).
+
+Falls back to an HTTP-only probe when playwright is not importable under the
+invoking interpreter, so a bare python3 caller degrades to the legacy
+liveness behavior instead of hard-failing.
+"""
+import json
+import sys
+import time
+
+
+def main() -> int:
+    url = (sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:9555").rstrip("/")
+    timeout_ms = int(sys.argv[2]) if len(sys.argv) > 2 else 8000
+    t0 = time.time()
+    try:
+        from playwright.sync_api import sync_playwright
+    except Exception:
+        import urllib.request
+        try:
+            urllib.request.urlopen(f"{url}/json/version", timeout=3)
+            print(json.dumps({"ready": True, "mode": "http-only"}))
+            return 0
+        except Exception as e:
+            print(json.dumps({
+                "ready": False, "mode": "http-only", "error": str(e)[:120],
+            }))
+            return 1
+    try:
+        with sync_playwright() as p:
+            browser = p.chromium.connect_over_cdp(url, timeout=timeout_ms)
+            n_contexts = len(browser.contexts)
+            browser.close()
+        print(json.dumps({
+            "ready": True, "mode": "cdp", "contexts": n_contexts,
+            "elapsed_s": round(time.time() - t0, 2),
+        }))
+        return 0
+    except Exception as e:
+        print(json.dumps({
+            "ready": False, "mode": "cdp",
+            "elapsed_s": round(time.time() - t0, 2),
+            "error": str(e)[:200].replace("\n", " "),
+        }))
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/linkedin_killswitch.py

@@ -884,6 +884,29 @@ def _hold_check_due_seconds():
     return (datetime.now(timezone.utc) - due).total_seconds()
 
 
+def _cadence_break_active():
+    """True while scripts/linkedin_cadence.py has us in a scheduled break.
+
+    Reads the cadence state file directly (no import of linkedin_cadence, to
+    avoid a circular import — linkedin_cadence imports this module). Recovery
+    must never attempt a real login or hold-check re-probe during a break,
+    REGARDLESS of which signal put the killswitch file in place: an
+    already-active real block (e.g. login_redirect) at the moment a break
+    starts must NOT get its 24h auto-recovery clock honored mid-break. The
+    2026-07-12 incident (a real hard_block login attempt fired during an
+    active cadence break) is exactly what this guards against."""
+    path = os.path.expanduser(
+        os.environ.get(
+            "LINKEDIN_CADENCE_FILE", os.path.join(STATE_DIR, "linkedin_cadence.json")
+        )
+    )
+    try:
+        with open(path, "r") as f:
+            return json.load(f).get("phase") == "break"
+    except Exception:
+        return False
+
+
 def _cmd_recover_check(args):
     """Gate for the hourly recovery job. Exits 0 when there is work to do and
     prints the MODE on stdout so the shell knows which path to drive:
@@ -898,6 +921,14 @@ def _cmd_recover_check(args):
     if not is_active():
         print("recover-check: killswitch not active, nothing to recover", file=sys.stderr)
         sys.exit(1)
+    if _cadence_break_active():
+        print(
+            "recover-check: cadence break active (scripts/linkedin_cadence.py); "
+            "suppressing ALL real recovery action (login/hold) regardless of "
+            "signal until the break ends, per 'stop all activity for 2 days'",
+            file=sys.stderr,
+        )
+        sys.exit(1)
     payload = read() or {}
     if payload.get("signal") == "scheduled_break":
         print(

package/scripts/memory_snapshot.py

@@ -700,6 +700,8 @@ def build_summary() -> dict[str, Any]:
         "menubar": menubar_status(),
         "twitter_cycle": twitter_cycle_status(),
         "draft_publish": draft_publish_wrapper_status(),
+        "chrome_relaunches": chrome_relaunch_status(),
+        "cdp_health": cdp_health_status(),
         "process_count": len(rows),
         "mem": {
             "total_mb": total,
@@ -845,6 +847,25 @@ def reaper_status() -> dict[str, Any] | None:
         return None
 
 
+def cdp_health_status() -> dict[str, Any] | None:
+    """Last CDP readiness verdict, carried on the heartbeat.
+
+    Written by skill/lib/twitter-backend.sh on every
+    ensure_twitter_browser_for_backend call: whether the harness Chrome
+    completed a REAL connect_over_cdp handshake (not just /json/version),
+    plus the action taken (ok / wedge_restart / relaunched / relaunch_failed /
+    external_wedged). Makes a wedged-Chrome episode (S4L-4H, 2026-07-11) a
+    one-query answer in installation_resource_samples instead of a Sentry +
+    local-log archaeology session. Best-effort."""
+    try:
+        p = REPO_DIR / "skill" / "logs" / "cdp-health.json"
+        data = json.loads(p.read_text())
+        data["age_sec"] = round(time.time() - p.stat().st_mtime, 1)
+        return data
+    except Exception:
+        return None
+
+
 def twitter_cycle_status() -> dict[str, Any] | None:
     """Tail of the newest twitter-cycle log, carried on the heartbeat.
 
@@ -898,6 +919,42 @@ def draft_publish_wrapper_status() -> dict[str, Any] | None:
         return None
 
 
+def chrome_relaunch_status() -> dict[str, Any] | None:
+    """Harness-Chrome relaunch rate from skill/logs/chrome-relaunch-events.log.
+
+    The skill/lib/*-backend.sh launchers append one dated line per Chrome
+    launch. A healthy box launches Chrome rarely (boot, user quit, crash); a
+    high 24h count is the signature of the 2026-07-12 kill-respawn loop
+    (launchd reaping the kicker job's process group took Chrome with it every
+    cycle, and each relaunch stole the user's focus). Carried on the heartbeat
+    so the rate is queryable per-install WITHOUT the menubar foreground
+    observer, which only reports while the menubar process is alive."""
+    try:
+        p = REPO_DIR / "skill" / "logs" / "chrome-relaunch-events.log"
+        if not p.exists():
+            return None
+        now = time.time()
+        counts = {"1h": 0, "24h": 0}
+        last_line = None
+        for ln in _tail_lines(p, 400, approx_line_bytes=64):
+            ln = ln.strip()
+            if not ln:
+                continue
+            try:
+                ts = dt.datetime.strptime(ln.split()[0], "%Y-%m-%dT%H:%M:%SZ")
+                age = now - ts.replace(tzinfo=dt.timezone.utc).timestamp()
+            except (ValueError, IndexError):
+                continue
+            if age <= 3600:
+                counts["1h"] += 1
+            if age <= 86400:
+                counts["24h"] += 1
+            last_line = ln
+        return {"count_1h": counts["1h"], "count_24h": counts["24h"], "last": last_line}
+    except Exception:
+        return None
+
+
 def _tail_lines(path: Path, n: int, approx_line_bytes: int = 4096) -> list[str]:
     """Return the last `n` lines of a possibly-large file without reading it all.
     Reads a bounded tail window (n * approx_line_bytes) from the end. Best-effort."""

package/scripts/setup_twitter_auth.py

@@ -199,7 +199,12 @@ def _launch_chrome() -> bool:
         cmd += ["--window-position=80,80", "--window-size=1100,900"]
     cmd.append("about:blank")
     PROFILE_DIR.mkdir(parents=True, exist_ok=True)
-    proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    # start_new_session: Chrome must not inherit this process's group. When the
+    # caller is a transient launchd job, launchd SIGKILLs the job's whole
+    # process group on exit, reaping Chrome with it; the next lane's relaunch
+    # then steals the user's focus (2026-07-12, same fix as *-backend.sh).
+    proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                            start_new_session=True)
     try:
         PID_FILE.write_text(str(proc.pid))
     except OSError:

package/scripts/twitter_browser.py

@@ -68,6 +68,15 @@ PREEMPT_KILL_WAIT = 5  # secs to wait for a preempted scan holder to die before
 LOCK_ROLE = (os.environ.get("S4L_LOCK_ROLE") or "scan").strip() or "scan"
 VIEWPORT = {"width": 911, "height": 1016}
 
+# CDP connect ceiling. Playwright's connect_over_cdp default is 180s; a wedged
+# harness Chrome (process alive, /json/version answering, websocket upgrade
+# completing, but the browser loop never servicing the CDP handshake) made
+# every reply attempt eat the full 3 minutes WHILE HOLDING the browser lock
+# (S4L-4H, Karol 2026-07-11; identical wedge locally 2026-07-09). A localhost
+# socket either completes the handshake in milliseconds or is wedged; 15s is
+# generous headroom for a loaded box without feeding the lock-contention family.
+CDP_CONNECT_TIMEOUT_MS = int(os.environ.get("S4L_CDP_CONNECT_TIMEOUT_MS") or "15000")
+
 # Posting handle. Resolved at call time from AUTOPOSTER_TWITTER_HANDLE env
 # var (set by per-account launchd/systemd units) or config.json
 # accounts.twitter.handle. Returns None when neither source is set.
@@ -226,6 +235,7 @@ def find_twitter_cdp_port():
 
 _LOCK_SESSION_ID = f"python:{os.getpid()}"
 _LOCK_INHERITED = False
+_LOCK_ACQUIRED_AT = 0.0
 _UUID_RE = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
 
 
@@ -243,6 +253,19 @@ def _release_browser_lock():
                 lock = json.load(f)
             if lock.get("session_id") == _LOCK_SESSION_ID:
                 os.remove(LOCK_FILE)
+                # Quantify hold time: long holds are what starve peers into the
+                # "locked by session ... waited 45s, giving up" family (S4L-B),
+                # and the 2026-07-09/11 wedge showed a hung CDP connect holding
+                # this lock for 3 minutes per attempt. >=5s filter keeps the
+                # healthy-path noise out of the logs.
+                if _LOCK_ACQUIRED_AT:
+                    _held = time.time() - _LOCK_ACQUIRED_AT
+                    if _held >= 5:
+                        print(
+                            f"[browser-lock] held {_held:.0f}s "
+                            f"(role={LOCK_ROLE}, pid={os.getpid()})",
+                            file=sys.stderr,
+                        )
     except (json.JSONDecodeError, OSError):
         pass
 
@@ -392,7 +415,7 @@ def _acquire_browser_lock():
     LIVE peers' locks (defect b) and was removed 2026-06-16. Dead holders are
     reclaimed here instead. See docs/twitter_browser_lock.md.
     """
-    global _LOCK_SESSION_ID, _LOCK_INHERITED
+    global _LOCK_SESSION_ID, _LOCK_INHERITED, _LOCK_ACQUIRED_AT
     deadline = time.time() + LOCK_WAIT_MAX
     # Guarantee the lock dir exists so _try_take_lock's O_EXCL create can't fail
     # for a missing-parent reason (which would otherwise spin the no-file path).
@@ -548,6 +571,7 @@ def _acquire_browser_lock():
             sys.exit(1)
         time.sleep(LOCK_POLL_INTERVAL)
         continue
+    _LOCK_ACQUIRED_AT = time.time()
 
 
 def _refresh_browser_lock():
@@ -559,6 +583,33 @@ def _refresh_browser_lock():
         pass
 
 
+def _cdp_diagnostics(cdp_url):
+    """Cheap post-mortem probe after a failed CDP attach.
+
+    Distinguishes "Chrome down" (HTTP dead) from "Chrome wedged" (HTTP still
+    answering /json/version but the CDP session handshake never completing) in
+    the error JSON itself, so the Sentry event carries the diagnosis instead of
+    requiring log archaeology on the customer box (S4L-4H took exactly that).
+    """
+    import urllib.request
+    diag = {"http_alive": False}
+    base = cdp_url if "://" in cdp_url else f"http://{cdp_url}"
+    try:
+        with urllib.request.urlopen(f"{base}/json/version", timeout=3) as r:
+            v = json.loads(r.read().decode())
+        diag["http_alive"] = True
+        diag["browser"] = v.get("Browser")
+    except Exception as e:
+        diag["version_error"] = str(e)[:120]
+        return diag
+    try:
+        with urllib.request.urlopen(f"{base}/json/list", timeout=3) as r:
+            diag["targets"] = len(json.loads(r.read().decode()))
+    except Exception as e:
+        diag["list_error"] = str(e)[:120]
+    return diag
+
+
 def get_browser_and_page(playwright):
     """Connect to the running twitter-harness Chrome via CDP.
 
@@ -581,8 +632,11 @@ def get_browser_and_page(playwright):
 
     cdp_url_override = os.environ.get("TWITTER_CDP_URL", "").strip()
     if cdp_url_override:
+        _t0 = time.time()
         try:
-            browser = playwright.chromium.connect_over_cdp(cdp_url_override)
+            browser = playwright.chromium.connect_over_cdp(
+                cdp_url_override, timeout=CDP_CONNECT_TIMEOUT_MS
+            )
             contexts = browser.contexts
             if contexts:
                 context = contexts[0]
@@ -601,16 +655,19 @@ def get_browser_and_page(playwright):
             _release_browser_lock()
             print(json.dumps({
                 "success": False,
-                "error": f"TWITTER_CDP_URL connect failed ({cdp_url_override}): {e}"
+                "error": f"TWITTER_CDP_URL connect failed ({cdp_url_override}): {e}",
+                "connect_elapsed_s": round(time.time() - _t0, 1),
+                "cdp_diag": _cdp_diagnostics(cdp_url_override),
             }))
             sys.exit(1)
 
     cdp_port = find_twitter_cdp_port()
 
     if cdp_port:
+        _t0 = time.time()
         try:
             browser = playwright.chromium.connect_over_cdp(
-                f"http://localhost:{cdp_port}"
+                f"http://localhost:{cdp_port}", timeout=CDP_CONNECT_TIMEOUT_MS
             )
             contexts = browser.contexts
             if contexts:
@@ -625,7 +682,9 @@ def get_browser_and_page(playwright):
             _release_browser_lock()
             print(json.dumps({
                 "success": False,
-                "error": f"harness CDP attach failed (port {cdp_port}): {e}"
+                "error": f"harness CDP attach failed (port {cdp_port}): {e}",
+                "connect_elapsed_s": round(time.time() - _t0, 1),
+                "cdp_diag": _cdp_diagnostics(f"http://localhost:{cdp_port}"),
             }))
             sys.exit(1)
 

package/scripts/twitter_post_plan.py

@@ -104,7 +104,16 @@ signal.signal(signal.SIGTERM, _on_sigterm)
 # since both shell out to this script. Set before any child is spawned.
 os.environ["S4L_LOCK_ROLE"] = "post"
 
-REPO_DIR = os.path.expanduser("~/social-autoposter")
+# Resolve the repo root the way the rest of the pipeline does (run_claude.sh,
+# identity.py): S4L_REPO_DIR when the caller sets it, else this script's own
+# parent tree. The old hardcoded ~/social-autoposter pointed OUTSIDE the
+# managed package on customer boxes, so every child spawned below
+# (twitter_browser.py, log_post.py, ...) ran code auto-update could never
+# reach (S4L-4H triage 2026-07-12, Karol's install).
+REPO_DIR = (
+    os.environ.get("S4L_REPO_DIR")
+    or os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+)
 TWITTER_BROWSER = os.path.join(REPO_DIR, "scripts", "twitter_browser.py")
 LOG_POST = os.path.join(REPO_DIR, "scripts", "log_post.py")
 CAMPAIGN_BUMP = os.path.join(REPO_DIR, "scripts", "campaign_bump.py")

package/skill/lib/linkedin-backend.sh

@@ -289,6 +289,9 @@ ensure_linkedin_browser_for_backend() {
     # Probe + launch harness Chrome on port 9556 if needed.
     if ! curl -sf --max-time 2 -o /dev/null http://127.0.0.1:9556/json/version 2>/dev/null; then
         echo "[$(date +%H:%M:%S)] LinkedIn harness Chrome down on port 9556, launching..." >&2
+        # Dated relaunch stamp for central observability (see twitter-backend.sh).
+        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) port=9556" \
+            >> "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/logs/chrome-relaunch-events.log" 2>/dev/null || true
         local _chrome_bin
         _chrome_bin=$(_resolve_chrome_bin)
         if [ -z "$_chrome_bin" ]; then
@@ -330,7 +333,15 @@ ensure_linkedin_browser_for_backend() {
         # The occlusion/backgrounding flags matter: the window sits offscreen,
         # and without them Chrome stops laying out SPA-rendered content, so
         # every element measures 0x0 and clicks become impossible (2026-07-03).
-        "$_chrome_bin" \
+        # os.setsid: Chrome must escape THIS job's process group — launchd
+        # SIGKILLs a transient job's whole process group when the shell exits,
+        # and `disown` does not change the pgid, so Chrome died with every
+        # completed run and the next lane's relaunch stole the user's focus
+        # (2026-07-12; same fix as twitter-backend.sh).
+        "${S4L_PYTHON:-python3}" -c 'import os,sys
+os.setsid()
+os.execv(sys.argv[1], sys.argv[1:])' \
+            "$_chrome_bin" \
             --remote-debugging-port=9556 \
             --user-data-dir="$HOME/.claude/browser-profiles/browser-harness-linkedin" \
             --no-first-run --no-default-browser-check \

package/skill/lib/twitter-backend.sh

@@ -31,6 +31,14 @@
 
 MCP_CONFIG_FILE="$HOME/.claude/browser-agent-configs/twitter-harness-mcp.json"
 
+# Repo root for the helper scripts this file shells out to, resolved from this
+# file's own location (skill/lib/ -> two up), honoring S4L_REPO_DIR when the
+# caller sets it. The old $HOME/social-autoposter hardcodes ran code OUTSIDE
+# the managed package on customer boxes (unreachable by auto-update) and
+# silently no-op'd where that directory didn't exist, so session restore and
+# tab cleanup never actually ran on such installs (S4L-4H triage 2026-07-12).
+_BH_REPO_DIR="${S4L_REPO_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+
 # Per-host env override (written by bin/cli.js when installing on an AppMaker
 # VM, where the canonical browser is Chromium on port 9222 behind the SOAX
 # residential proxy at 127.0.0.1:3003, NOT the harness Chrome on 9555). On a
@@ -134,7 +142,30 @@ cleanup_harness_tabs() {
             return 0
         fi
     fi
-    python3 "$HOME/social-autoposter/scripts/cleanup_harness_tabs.py" 2>/dev/null || true
+    python3 "$_BH_REPO_DIR/scripts/cleanup_harness_tabs.py" 2>/dev/null || true
+}
+
+_bh_cdp_ready() {
+    # Real CDP readiness: complete an actual connect_over_cdp handshake against
+    # the harness. /json/version alone is a liveness probe that a WEDGED Chrome
+    # still passes (S4L-4H); see scripts/cdp_ready_check.py. Prints the probe's
+    # one-line JSON verdict on stdout; exit status is the verdict.
+    "${S4L_PYTHON:-python3}" "$_BH_REPO_DIR/scripts/cdp_ready_check.py" \
+        "${1:-$_BH_DEFAULT_URL}" 8000 2>/dev/null
+}
+
+_bh_record_cdp_health() {
+    # Persist the latest readiness verdict where memory_snapshot.py picks it up
+    # (cdp_health block on the per-minute heartbeat sample), so a wedge and its
+    # restart are visible centrally in installation_resource_samples without
+    # SSHing the box. $1 = action tag, $2 = the probe's JSON verdict (may be
+    # empty). Best effort, never fails the caller.
+    printf '{"ts":"%s","url":"%s","action":"%s","verdict":%s}\n' \
+        "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+        "${TWITTER_CDP_URL:-$_BH_DEFAULT_URL}" \
+        "$1" \
+        "${2:-null}" \
+        > "$_BH_REPO_DIR/skill/logs/cdp-health.json" 2>/dev/null || true
 }
 
 _resolve_chrome_bin() {
@@ -165,21 +196,67 @@ ensure_twitter_browser_for_backend() {
     if [ "${TWITTER_CDP_URL:-$_BH_DEFAULT_URL}" != "$_BH_DEFAULT_URL" ]; then
         local _ext_url="${TWITTER_CDP_URL}"
         if curl -sf --max-time 2 -o /dev/null "${_ext_url}/json/version" 2>/dev/null; then
+            # HTTP answers; verify the CDP handshake actually completes before
+            # handing this browser to the pipeline. We do NOT restart an
+            # externally-managed Chrome; fail fast so the cycle doesn't burn
+            # 180s per downstream attach against a wedged browser.
+            local _ext_verdict
+            if ! _ext_verdict=$(_bh_cdp_ready "$_ext_url"); then
+                echo "[$(date +%H:%M:%S)] ERROR: external Chrome at ${_ext_url} is WEDGED (/json/version answers but the CDP handshake never completes). Host must restart it (AppMaker /opt/startup.sh, etc)." >&2
+                echo "twitter_cdp_wedge: detected url=${_ext_url} action=none-external" >&2
+                _bh_record_cdp_health external_wedged "$_ext_verdict"
+                return 1
+            fi
+            _bh_record_cdp_health ok-external "$_ext_verdict"
             echo "[$(date +%H:%M:%S)] Using externally-managed Chrome at ${_ext_url} (skipping harness launch + tab cleanup)" >&2
             # Restore the Twitter login if the sandbox was substituted. AppMaker
             # Hobby-tier sandboxes have a 1h TTL; on substitution /root is reseeded
             # from /etc/skel-root and the harness profile (cookies) is wiped. This
             # re-injects the stored session from social_accounts via the HTTP API.
             # No-op when already logged in. Never blocks the cycle on failure.
-            python3 "$HOME/social-autoposter/scripts/restore_twitter_session.py" 2>&1 | sed 's/^/[restore] /' >&2 || true
+            python3 "$_BH_REPO_DIR/scripts/restore_twitter_session.py" 2>&1 | sed 's/^/[restore] /' >&2 || true
             return 0
         fi
         echo "[$(date +%H:%M:%S)] ERROR: TWITTER_CDP_URL=${_ext_url} not reachable. External Chrome must be managed by host (AppMaker /opt/startup.sh, etc)." >&2
         return 1
     fi
-    # Probe + launch harness Chrome on port 9555 if needed.
+    # Probe + launch harness Chrome on port 9555 if needed. Two-stage probe:
+    # /json/version (liveness) then a real CDP handshake (readiness). A wedged
+    # Chrome passes the first and fails the second; handing it downstream made
+    # every attach eat Playwright's 180s default while holding the browser lock
+    # (S4L-4H), so it gets killed and relaunched here instead.
+    local _need_launch=0 _launch_reason=""
+    local _bh_prof_dir="$HOME/.claude/browser-profiles/browser-harness"
     if ! curl -sf --max-time 2 -o /dev/null http://127.0.0.1:9555/json/version 2>/dev/null; then
+        _need_launch=1; _launch_reason="http_down"
         echo "[$(date +%H:%M:%S)] Harness Chrome down on port 9555, launching..." >&2
+    else
+        local _ready_verdict
+        if ! _ready_verdict=$(_bh_cdp_ready "$_BH_DEFAULT_URL"); then
+            _need_launch=1; _launch_reason="cdp_wedge"
+            echo "[$(date +%H:%M:%S)] Harness Chrome WEDGED on port 9555 (/json/version answers but the CDP handshake never completes: ${_ready_verdict:-no verdict}); killing and relaunching..." >&2
+            # Machine-greppable marker (same stderr-marker convention as
+            # twitter_access_gate; bin/server.js parses these).
+            echo "twitter_cdp_wedge: detected url=$_BH_DEFAULT_URL action=restart" >&2
+            _bh_record_cdp_health wedge_restart "$_ready_verdict"
+            local _wedge_pids
+            _wedge_pids=$(pgrep -f -- "--user-data-dir=$_bh_prof_dir " 2>/dev/null || true)
+            if [ -n "$_wedge_pids" ]; then
+                kill $_wedge_pids 2>/dev/null || true
+                sleep 2
+                _wedge_pids=$(pgrep -f -- "--user-data-dir=$_bh_prof_dir " 2>/dev/null || true)
+                [ -n "$_wedge_pids" ] && { kill -9 $_wedge_pids 2>/dev/null || true; sleep 1; }
+                rm -f "$_bh_prof_dir/SingletonLock" "$_bh_prof_dir/SingletonSocket" "$_bh_prof_dir/SingletonCookie" 2>/dev/null || true
+            fi
+        fi
+    fi
+    if [ "$_need_launch" = 1 ]; then
+        # Dated relaunch stamp for central observability: memory_snapshot.py
+        # counts these (chrome_relaunches block) so a kill-respawn loop like
+        # 2026-07-12's launchd pgroup reaping is visible per-install in Cloud
+        # Logging without depending on the menubar foreground observer.
+        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) port=9555 reason=${_launch_reason}" \
+            >> "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/logs/chrome-relaunch-events.log" 2>/dev/null || true
         local _chrome_bin
         _chrome_bin=$(_resolve_chrome_bin)
         if [ -z "$_chrome_bin" ]; then
@@ -232,7 +309,18 @@ ensure_twitter_browser_for_backend() {
             [ -n "$_stale_pids" ] && { kill -9 $_stale_pids 2>/dev/null || true; sleep 1; }
             rm -f "$_prof_dir/SingletonLock" "$_prof_dir/SingletonSocket" "$_prof_dir/SingletonCookie" 2>/dev/null || true
         fi
-        "$_chrome_bin" \
+        # os.setsid: Chrome must escape THIS job's process group. The kicker is a
+        # transient launchd job, and launchd SIGKILLs the job's whole process
+        # group the moment the shell exits (no AbandonProcessGroup) — `disown`
+        # does not change the pgid, so a plainly-backgrounded Chrome died on
+        # every cycle completion and the NEXT cycle's relaunch stole the user's
+        # focus (2026-07-12 root cause; the foreground-telemetry `cause:launched`
+        # loop). A new session makes Chrome survive its launcher regardless of
+        # which lane spawned it.
+        "${S4L_PYTHON:-python3}" -c 'import os,sys
+os.setsid()
+os.execv(sys.argv[1], sys.argv[1:])' \
+            "$_chrome_bin" \
             --remote-debugging-port=9555 \
             --user-data-dir="$HOME/.claude/browser-profiles/browser-harness" \
             --no-first-run --no-default-browser-check \
@@ -248,9 +336,23 @@ ensure_twitter_browser_for_backend() {
         done
         if ! curl -sf --max-time 2 -o /dev/null http://127.0.0.1:9555/json/version 2>/dev/null; then
             echo "[$(date +%H:%M:%S)] ERROR: harness Chrome failed to start within 12s" >&2
+            _bh_record_cdp_health launch_failed null
+            return 1
+        fi
+        # Verify the fresh Chrome actually completes a CDP handshake before
+        # declaring victory; a relaunch that comes up wedged again should fail
+        # the cycle loudly, not feed 180s hangs downstream.
+        local _post_verdict
+        if ! _post_verdict=$(_bh_cdp_ready "$_BH_DEFAULT_URL"); then
+            echo "[$(date +%H:%M:%S)] ERROR: harness Chrome answers HTTP after relaunch but the CDP handshake is STILL failing: ${_post_verdict:-no verdict}" >&2
+            echo "twitter_cdp_wedge: detected url=$_BH_DEFAULT_URL action=relaunch_failed" >&2
+            _bh_record_cdp_health relaunch_failed "$_post_verdict"
             return 1
         fi
+        _bh_record_cdp_health relaunched "$_post_verdict"
         echo "[$(date +%H:%M:%S)] Harness Chrome up on port 9555" >&2
+    else
+        _bh_record_cdp_health ok "${_ready_verdict:-null}"
     fi
     # Re-inject the stored X session if the harness Chrome is logged out — e.g. a
     # keychain re-lock wiped Chrome's encrypted Cookies SQLite on this launch
@@ -259,7 +361,7 @@ ensure_twitter_browser_for_backend() {
     # No-op when already logged in; never blocks the cycle on failure. Runs on
     # both the freshly-launched and already-up paths so a mid-life logout heals.
     TWITTER_CDP_URL="http://127.0.0.1:9555" \
-        python3 "$HOME/social-autoposter/scripts/restore_twitter_session.py" 2>&1 \
+        python3 "$_BH_REPO_DIR/scripts/restore_twitter_session.py" 2>&1 \
         | sed 's/^/[restore] /' >&2 || true
     # Always close leftover tabs from prior runs. Safe under acquire_lock
     # "twitter-browser" serialization (every caller of this function holds

package/skill/run-twitter-cycle.sh

@@ -883,6 +883,33 @@ print(cd//60, cons, cd, max(0, now-fs))' "$_GATE_FILE" "$_NOW" 2>/dev/null || ec
     release_lock "twitter-browser" 2>/dev/null || true
     exit 1
 fi
+# Probe-error guard (2026-07-12, S4L-4H): output lacking a "gated" verdict
+# means the probe CRASHED (typically the CDP attach failed or timed out on a
+# wedged Chrome) rather than returning a clean bill. The old code logged
+# 'Pre-flight access OK: {"success": false, ...}' and marched a wedged browser
+# into the scan. Heal once (ensure_twitter_browser_for_backend now does a real
+# CDP readiness check and restarts a wedged harness Chrome), re-probe, and end
+# the cycle if there is still no verdict.
+if [ -z "$_ACCESS_OUT" ] || ! printf '%s' "$_ACCESS_OUT" | grep -q '"gated"'; then
+    log "  Pre-flight access probe FAILED (no verdict; browser not driveable): $(printf '%s' "$_ACCESS_OUT" | tr '\n' ' ' | tr -s ' ' | sed 's/^ *//')"
+    echo "twitter_cdp_wedge: access_probe_no_verdict" >&2
+    ensure_twitter_browser_for_backend || true
+    _ACCESS_OUT=$(TWITTER_CDP_URL="${TWITTER_CDP_URL:-http://127.0.0.1:9555}" \
+        python3 "$REPO_DIR/scripts/twitter_access_check.py" --session-probe --wait-ms 12000 2>/dev/null)
+    if [ -z "$_ACCESS_OUT" ] || ! printf '%s' "$_ACCESS_OUT" | grep -q '"gated"'; then
+        log "  Pre-flight access probe still has no verdict after harness heal; ending cycle."
+        echo "twitter_batches: ended $BATCH_ID"
+        release_lock "twitter-browser" 2>/dev/null || true
+        exit 1
+    fi
+    if printf '%s' "$_ACCESS_OUT" | grep -q '"gated": *true'; then
+        log "  Recovered probe reports an access gate; ending cycle (backoff engages on the next firing)."
+        echo "twitter_batches: ended $BATCH_ID"
+        release_lock "twitter-browser" 2>/dev/null || true
+        exit 1
+    fi
+    log "  Access probe recovered after harness heal."
+fi
 # Probe came back clean. If a backoff marker exists we were gated: record the
 # recovery (how long the gate lasted, since first_seen) BEFORE deleting it, so
 # the lift event + duration survive in the log even though the marker is gone.