@m13v/s4l 1.7.4-rc.4 → 1.7.4

package/scripts/twitter_browser.py

@@ -68,6 +68,15 @@ PREEMPT_KILL_WAIT = 5  # secs to wait for a preempted scan holder to die before
 LOCK_ROLE = (os.environ.get("S4L_LOCK_ROLE") or "scan").strip() or "scan"
 VIEWPORT = {"width": 911, "height": 1016}
 
+# CDP connect ceiling. Playwright's connect_over_cdp default is 180s; a wedged
+# harness Chrome (process alive, /json/version answering, websocket upgrade
+# completing, but the browser loop never servicing the CDP handshake) made
+# every reply attempt eat the full 3 minutes WHILE HOLDING the browser lock
+# (S4L-4H, Karol 2026-07-11; identical wedge locally 2026-07-09). A localhost
+# socket either completes the handshake in milliseconds or is wedged; 15s is
+# generous headroom for a loaded box without feeding the lock-contention family.
+CDP_CONNECT_TIMEOUT_MS = int(os.environ.get("S4L_CDP_CONNECT_TIMEOUT_MS") or "15000")
+
 # Posting handle. Resolved at call time from AUTOPOSTER_TWITTER_HANDLE env
 # var (set by per-account launchd/systemd units) or config.json
 # accounts.twitter.handle. Returns None when neither source is set.
@@ -226,6 +235,7 @@ def find_twitter_cdp_port():
 
 _LOCK_SESSION_ID = f"python:{os.getpid()}"
 _LOCK_INHERITED = False
+_LOCK_ACQUIRED_AT = 0.0
 _UUID_RE = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
 
 
@@ -243,6 +253,19 @@ def _release_browser_lock():
                 lock = json.load(f)
             if lock.get("session_id") == _LOCK_SESSION_ID:
                 os.remove(LOCK_FILE)
+                # Quantify hold time: long holds are what starve peers into the
+                # "locked by session ... waited 45s, giving up" family (S4L-B),
+                # and the 2026-07-09/11 wedge showed a hung CDP connect holding
+                # this lock for 3 minutes per attempt. >=5s filter keeps the
+                # healthy-path noise out of the logs.
+                if _LOCK_ACQUIRED_AT:
+                    _held = time.time() - _LOCK_ACQUIRED_AT
+                    if _held >= 5:
+                        print(
+                            f"[browser-lock] held {_held:.0f}s "
+                            f"(role={LOCK_ROLE}, pid={os.getpid()})",
+                            file=sys.stderr,
+                        )
     except (json.JSONDecodeError, OSError):
         pass
 
@@ -392,7 +415,7 @@ def _acquire_browser_lock():
     LIVE peers' locks (defect b) and was removed 2026-06-16. Dead holders are
     reclaimed here instead. See docs/twitter_browser_lock.md.
     """
-    global _LOCK_SESSION_ID, _LOCK_INHERITED
+    global _LOCK_SESSION_ID, _LOCK_INHERITED, _LOCK_ACQUIRED_AT
     deadline = time.time() + LOCK_WAIT_MAX
     # Guarantee the lock dir exists so _try_take_lock's O_EXCL create can't fail
     # for a missing-parent reason (which would otherwise spin the no-file path).
@@ -548,6 +571,7 @@ def _acquire_browser_lock():
             sys.exit(1)
         time.sleep(LOCK_POLL_INTERVAL)
         continue
+    _LOCK_ACQUIRED_AT = time.time()
 
 
 def _refresh_browser_lock():
@@ -559,7 +583,88 @@ def _refresh_browser_lock():
         pass
 
 
+def _cdp_diagnostics(cdp_url):
+    """Cheap post-mortem probe after a failed CDP attach.
+
+    Distinguishes "Chrome down" (HTTP dead) from "Chrome wedged" (HTTP still
+    answering /json/version but the CDP session handshake never completing) in
+    the error JSON itself, so the Sentry event carries the diagnosis instead of
+    requiring log archaeology on the customer box (S4L-4H took exactly that).
+    """
+    import urllib.request
+    diag = {"http_alive": False}
+    base = cdp_url if "://" in cdp_url else f"http://{cdp_url}"
+    try:
+        with urllib.request.urlopen(f"{base}/json/version", timeout=3) as r:
+            v = json.loads(r.read().decode())
+        diag["http_alive"] = True
+        diag["browser"] = v.get("Browser")
+    except Exception as e:
+        diag["version_error"] = str(e)[:120]
+        return diag
+    try:
+        with urllib.request.urlopen(f"{base}/json/list", timeout=3) as r:
+            diag["targets"] = len(json.loads(r.read().decode()))
+    except Exception as e:
+        diag["list_error"] = str(e)[:120]
+    return diag
+
+
+# --- L1/L2 browser-hang guards (2026-07-13) ----------------------------------
+# L1: no single Playwright operation may block forever. Until today NO script
+# set a default timeout, so any page op could hang indefinitely — a twitter
+# cycle wedged 60+ min in Phase 2b-prep media capture during a network flap
+# (2026-07-13 08:02, pid 1380) while holding the twitter-browser lock, blocking
+# every peer pipeline until the 180-min watchdog cap. Healthy ops here finish
+# in <10s; navigation on the x.com SPA gets extra slack. Callers all have
+# retry layers above, so failing fast is strictly better than hanging.
+BROWSER_OP_TIMEOUT_MS = 30_000
+BROWSER_NAV_TIMEOUT_MS = 60_000
+# L2: liveness heartbeat for the SHELL browser lock (the cross-pipeline mutex,
+# /tmp/social-autoposter-twitter-browser.lock). Touched on attach and on every
+# page network request (throttled), so "lock held + heartbeat stale" means the
+# holder is wedged, not just slow — a healthy 65-min phase2b-gen hold shows
+# constant traffic. watchdog_hung_runs.py reads this to TERM wedged holders in
+# ~30 min instead of the 180-min age cap. Best-effort: never fails the caller.
+_BROWSER_LOCK_HEARTBEAT = "/tmp/social-autoposter-twitter-browser.lock/heartbeat"
+_HB_THROTTLE_S = 5
+_hb_last_touch = 0.0
+
+
+def _touch_browser_heartbeat(*_args):
+    global _hb_last_touch
+    now = time.time()
+    if now - _hb_last_touch < _HB_THROTTLE_S:
+        return
+    _hb_last_touch = now
+    try:
+        if os.path.isdir(os.path.dirname(_BROWSER_LOCK_HEARTBEAT)):
+            with open(_BROWSER_LOCK_HEARTBEAT, "w") as f:
+                f.write(str(int(now)))
+    except Exception:
+        pass
+
+
 def get_browser_and_page(playwright):
+    """Instrumented entry point: attach via _get_browser_and_page_raw, then
+    (L1) set default per-op/navigation timeouts so no page call can hang
+    forever, and (L2) wire the browser-lock liveness heartbeat. All new code
+    should use THIS, never the raw variant."""
+    browser, page, is_cdp = _get_browser_and_page_raw(playwright)
+    try:
+        page.set_default_timeout(BROWSER_OP_TIMEOUT_MS)
+        page.set_default_navigation_timeout(BROWSER_NAV_TIMEOUT_MS)
+    except Exception:
+        pass
+    _touch_browser_heartbeat()
+    try:
+        page.on("request", _touch_browser_heartbeat)
+    except Exception:
+        pass
+    return browser, page, is_cdp
+
+
+def _get_browser_and_page_raw(playwright):
     """Connect to the running twitter-harness Chrome via CDP.
 
     Returns (browser, page, is_cdp=True). `page` is a reused existing Twitter
@@ -581,8 +686,11 @@ def get_browser_and_page(playwright):
 
     cdp_url_override = os.environ.get("TWITTER_CDP_URL", "").strip()
     if cdp_url_override:
+        _t0 = time.time()
         try:
-            browser = playwright.chromium.connect_over_cdp(cdp_url_override)
+            browser = playwright.chromium.connect_over_cdp(
+                cdp_url_override, timeout=CDP_CONNECT_TIMEOUT_MS
+            )
             contexts = browser.contexts
             if contexts:
                 context = contexts[0]
@@ -601,16 +709,19 @@ def get_browser_and_page(playwright):
             _release_browser_lock()
             print(json.dumps({
                 "success": False,
-                "error": f"TWITTER_CDP_URL connect failed ({cdp_url_override}): {e}"
+                "error": f"TWITTER_CDP_URL connect failed ({cdp_url_override}): {e}",
+                "connect_elapsed_s": round(time.time() - _t0, 1),
+                "cdp_diag": _cdp_diagnostics(cdp_url_override),
             }))
             sys.exit(1)
 
     cdp_port = find_twitter_cdp_port()
 
     if cdp_port:
+        _t0 = time.time()
         try:
             browser = playwright.chromium.connect_over_cdp(
-                f"http://localhost:{cdp_port}"
+                f"http://localhost:{cdp_port}", timeout=CDP_CONNECT_TIMEOUT_MS
             )
             contexts = browser.contexts
             if contexts:
@@ -625,7 +736,9 @@ def get_browser_and_page(playwright):
             _release_browser_lock()
             print(json.dumps({
                 "success": False,
-                "error": f"harness CDP attach failed (port {cdp_port}): {e}"
+                "error": f"harness CDP attach failed (port {cdp_port}): {e}",
+                "connect_elapsed_s": round(time.time() - _t0, 1),
+                "cdp_diag": _cdp_diagnostics(f"http://localhost:{cdp_port}"),
             }))
             sys.exit(1)
 
@@ -2035,7 +2148,7 @@ def read_conversation(thread_url, max_messages=20):
                 browser.close()
 
 
-def send_dm(thread_url, message, dm_id=None):
+def send_dm(thread_url, message, dm_id=None, apply_campaigns=True):
     """Send a message in a Twitter/X DM conversation.
 
     Navigates to the thread URL, types the message in the compose box,
@@ -2073,8 +2186,16 @@ def send_dm(thread_url, message, dm_id=None):
         message = wrap_res["text"]
         minted_link_codes = wrap_res.get("minted_codes", [])
 
+    # apply_campaigns=False (via S4L_SKIP_CAMPAIGN_SUFFIX on the send-dm CLI)
+    # opts this DM out of active-campaign suffixes. Set ONLY when delivering a
+    # HUMAN-drafted escalation reply (engage-dm-replies Phase 0): a human
+    # answering an escalation — often an AI-callout — must not get a bot tell
+    # coin-flipped onto their words (2026-07-13: the ' written with ai' suffix
+    # landing on a hand-approved recovery DM to ngeloxyz helped burn the lead).
+    # The autopilot never sets it, so the A/B experiment continues everywhere
+    # else. Mirrors reply_to_tweet's apply_campaigns plumbing.
     applied_campaigns = []
-    for cid, suffix, sample_rate in _load_active_twitter_campaigns():
+    for cid, suffix, sample_rate in (_load_active_twitter_campaigns() if apply_campaigns else []):
         if random.random() < sample_rate:
             # Wrap any URLs in the suffix through dm_short_links (DM rail) so
             # clicks attribute to this DM. Falls back to raw suffix if dm_id
@@ -2611,6 +2732,19 @@ def _anchor_repost_from_tweets(tweets, anchor_tweet_id):
 
 
 def scrape_thread_media(thread_url, scroll_count=1):
+    """Deadline wrapper: media capture relays CDP to the harness Chrome, and
+    against a half-wedged browser or dead renderer a single evaluate can hang
+    FOREVER (2026-07-13: hung 34+ min at candidate 24/92 holding the browser
+    lock; only the watchdog's 90-min lock-liveness net would have reaped it).
+    stall_guard aborts the process fast, stamps the wedge strike, and lets the
+    cycle-entry heal chain converge. Shared implementation — see
+    scripts/stall_guard.py; do NOT re-implement per step."""
+    from stall_guard import stall_guard
+    with stall_guard("thread_media", thread_url):
+        return _scrape_thread_media_inner(thread_url, scroll_count)
+
+
+def _scrape_thread_media_inner(thread_url, scroll_count=1):
     """Navigate to a tweet's permalink and return the media of the anchor tweet.
 
     Deterministic, model-free media capture for the MAIN posting cycle: the
@@ -2814,7 +2948,11 @@ def main():
             except ValueError:
                 print(f"send-dm: dm_id must be int, got {sys.argv[4]!r}", file=sys.stderr)
                 sys.exit(1)
-        result = send_dm(sys.argv[2], sys.argv[3], dm_id=dm_id_arg)
+        # S4L_SKIP_CAMPAIGN_SUFFIX=1 opts this DM out of campaign suffixes.
+        # Set ONLY by engage-dm-replies Phase 0 when delivering a human-drafted
+        # escalation reply — see send_dm's apply_campaigns comment.
+        _skip_camp = os.environ.get("S4L_SKIP_CAMPAIGN_SUFFIX", "").strip().lower() in ("1", "true", "yes")
+        result = send_dm(sys.argv[2], sys.argv[3], dm_id=dm_id_arg, apply_campaigns=not _skip_camp)
         print(json.dumps(result, indent=2))
 
     elif cmd == "notifications":

package/scripts/twitter_post_plan.py

@@ -104,7 +104,16 @@ signal.signal(signal.SIGTERM, _on_sigterm)
 # since both shell out to this script. Set before any child is spawned.
 os.environ["S4L_LOCK_ROLE"] = "post"
 
-REPO_DIR = os.path.expanduser("~/social-autoposter")
+# Resolve the repo root the way the rest of the pipeline does (run_claude.sh,
+# identity.py): S4L_REPO_DIR when the caller sets it, else this script's own
+# parent tree. The old hardcoded ~/social-autoposter pointed OUTSIDE the
+# managed package on customer boxes, so every child spawned below
+# (twitter_browser.py, log_post.py, ...) ran code auto-update could never
+# reach (S4L-4H triage 2026-07-12, Karol's install).
+REPO_DIR = (
+    os.environ.get("S4L_REPO_DIR")
+    or os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+)
 TWITTER_BROWSER = os.path.join(REPO_DIR, "scripts", "twitter_browser.py")
 LOG_POST = os.path.join(REPO_DIR, "scripts", "log_post.py")
 CAMPAIGN_BUMP = os.path.join(REPO_DIR, "scripts", "campaign_bump.py")

package/scripts/twitter_scan.py

@@ -55,6 +55,7 @@ import json
 import os
 import pathlib
 import re
+import sys
 import time
 import urllib.parse
 
@@ -245,6 +246,15 @@ def _navigate(url: str) -> None:
         new_tab(url)
 
 
+# Per-query stall guard: shared implementation (scripts/stall_guard.py) used
+# by every browser-touching pipeline step — do NOT re-implement per step.
+# S4L_SCAN_QUERY_DEADLINE_S kept as a scan-specific override for continuity
+# with rc.36-38; unset, the shared default applies.
+from stall_guard import stall_guard  # noqa: E402
+
+_SCAN_DEADLINE_OVERRIDE = os.environ.get("S4L_SCAN_QUERY_DEADLINE_S")
+
+
 def scan(
     query: str,
     project: str,
@@ -257,6 +267,22 @@ def scan(
     ###TWEETS_BEGIN###/###TWEETS_END### sentinels for the scan model to relay
     into StructuredOutput; also returns the kept list so direct callers (tests,
     future shell-driven invocations) can consume it without parsing stdout."""
+    with stall_guard(
+        "scan_query",
+        query,
+        deadline_s=float(_SCAN_DEADLINE_OVERRIDE) if _SCAN_DEADLINE_OVERRIDE else None,
+    ):
+        return _scan_inner(query, project, search_topic, freshness_hours, skip_ids, settle_seconds)
+
+
+def _scan_inner(
+    query: str,
+    project: str,
+    search_topic: str,
+    freshness_hours: int = 6,
+    skip_ids=None,
+    settle_seconds: float = 4.0,
+) -> list:
     skip = {str(s) for s in (skip_ids or [])}
     url = _build_url(query, int(freshness_hours))
     _navigate(url)

package/scripts/watchdog_hung_runs.py

@@ -17,8 +17,44 @@ from pathlib import Path
 
 REPO = Path("/Users/matthewdi/social-autoposter")
 LOG_RUN_PY = REPO / "scripts" / "log_run.py"
-SKILL_PATH_MARKER = "/social-autoposter/skill/"
+# Both homes of skill/*.sh: the operator repo AND the installed-app package.
+# The single operator-repo marker left every kicker-driven cycle (which runs
+# from ~/.social-autoposter-mcp/repo/package/skill/) invisible to this
+# watchdog — a scan stuck on a half-wedged Chrome sat 23+ minutes at zero
+# progress with nothing entitled to kill it (2026-07-13).
+SKILL_PATH_MARKERS = (
+    "/social-autoposter/skill/",
+    "/.social-autoposter-mcp/repo/package/skill/",
+)
 MAX_AGE_SEC = 45 * 60
+
+# --- L2: browser-lock liveness (2026-07-13) ----------------------------------
+# The age caps below are backstops sized ABOVE the worst-case duration of a
+# HEALTHY run, so they can't tell "90 min in and progressing" from "wedged
+# since minute 4". This check can: the shared browser libs (twitter_browser.py
+# / reddit_browser.py get_browser_and_page) touch <lock_dir>/heartbeat on every
+# attach and page network event, so a *-browser lock held by a LIVE process
+# whose heartbeat has gone stale means the holder is wedged mid-browser-work
+# (2026-07-13: pid 1380 hung 60+ min in Phase 2b-prep media capture during a
+# network flap, blocking every peer pipeline until the 180-min age cap).
+# Thresholds: WARN at 30 min stale (log-only). KILL at 90 min stale — above
+# the gen phase's documented 60-min worst-case ceiling, so a legit long hold
+# with no python browser invocations can't be false-killed — and ONLY when
+# peers are actually queued waiting (an unwanted lock harms nobody). The
+# 2026-07-12 lock.sh signal fix makes the TERM safe: the holder releases its
+# locks and exits instead of continuing lock-protected work.
+# ONLY the heartbeat-instrumented platforms. linkedin-browser holders write no
+# heartbeat (the linkedin pipeline drives Chrome via the bh harness, not a
+# shared python lib), so on pid-file age alone a healthy long linkedin run
+# would be indistinguishable from a wedge — add it here only once its driver
+# touches <lock_dir>/heartbeat too.
+BROWSER_LOCKS_WATCHED = (
+    "/tmp/social-autoposter-twitter-browser.lock",
+    "/tmp/social-autoposter-reddit-browser.lock",
+)
+HB_WARN_SEC = 30 * 60
+HB_KILL_SEC = 90 * 60
+HB_REWARN_SEC = 30 * 60  # re-log the warning at most this often per holder
 # Per-script cap overrides for pipelines that legitimately run longer than
 # the 45 min global (stats.py over ~4-5k posts + rate-limit sleeps).
 # Key is (script_file, platform_or_None). Lookup order: (script, platform),
@@ -184,12 +220,12 @@ def list_skill_shell_processes():
             ppid = int(ppid_s)
         except ValueError:
             continue
-        if SKILL_PATH_MARKER not in command:
+        if not any(m in command for m in SKILL_PATH_MARKERS):
             continue
         script_name = None
         tokens = command.split()
         for tok in tokens:
-            if tok.endswith(".sh") and SKILL_PATH_MARKER in tok:
+            if tok.endswith(".sh") and any(m in tok for m in SKILL_PATH_MARKERS):
                 script_name = os.path.basename(tok)
                 break
         if not script_name:
@@ -317,6 +353,83 @@ def emit_job_log(label, elapsed_sec):
     )
 
 
+def _holder_cmdline(pid: int) -> str:
+    try:
+        out = subprocess.run(
+            ["ps", "-p", str(pid), "-o", "command="],
+            capture_output=True, text=True, timeout=5,
+        ).stdout.strip()
+        return out[:200]
+    except Exception:
+        return ""
+
+
+def check_browser_lock_liveness() -> None:
+    """L2: TERM a live *-browser lock holder whose liveness heartbeat has gone
+    stale for HB_KILL_SEC while peers wait. See the constants block up top."""
+    now = time.time()
+    for lock_dir in BROWSER_LOCKS_WATCHED:
+        if not os.path.isdir(lock_dir):
+            continue
+        try:
+            with open(os.path.join(lock_dir, "pid")) as f:
+                holder = int((f.read().strip() or "0"))
+        except (OSError, ValueError):
+            continue
+        if holder <= 0:
+            continue
+        try:
+            os.kill(holder, 0)  # liveness probe only
+        except ProcessLookupError:
+            continue  # dead holder: acquire_lock's dead_pid reclaim owns this
+        except OSError:
+            continue
+        # Last liveness = freshest of the heartbeat (browser libs) and the pid
+        # file (stamped at acquire), so a just-acquired lock is never "stale".
+        marks = []
+        for name in ("heartbeat", "pid"):
+            try:
+                marks.append(os.path.getmtime(os.path.join(lock_dir, name)))
+            except OSError:
+                pass
+        if not marks:
+            continue
+        stale = now - max(marks)
+        if stale < HB_WARN_SEC:
+            continue
+        try:
+            waiters = len(os.listdir(f"{lock_dir}.queue"))
+        except OSError:
+            waiters = 0
+        lock_name = os.path.basename(lock_dir)
+        if stale >= HB_KILL_SEC and waiters >= 1:
+            cmd = _holder_cmdline(holder)
+            watchdog_log(
+                f"KILL-STALE-HOLDER {lock_name} pid={holder} heartbeat_stale={int(stale)}s "
+                f"waiters={waiters} cmd={cmd!r}"
+            )
+            killed = kill_tree(holder)
+            watchdog_log(f"  killed pids: {killed}")
+            continue
+        # Warn tier: log-only, rate-limited via a marker inside the lock dir
+        # (dies with the lock, so each hold re-warns independently).
+        marker = os.path.join(lock_dir, "hb-warned")
+        try:
+            if now - os.path.getmtime(marker) < HB_REWARN_SEC:
+                continue
+        except OSError:
+            pass
+        try:
+            with open(marker, "w") as f:
+                f.write(str(int(now)))
+        except OSError:
+            pass
+        watchdog_log(
+            f"WARN-STALE-HOLDER {lock_name} pid={holder} heartbeat_stale={int(stale)}s "
+            f"waiters={waiters} cmd={_holder_cmdline(holder)!r}"
+        )
+
+
 def main() -> None:
     procs = list_skill_shell_processes()
     for pid, ppid, etimes, script_file, platform in procs:
@@ -337,6 +450,7 @@ def main() -> None:
             watchdog_log(f"  script trap already logged {label} — skipping watchdog emit")
         else:
             emit_job_log(label, etimes)
+    check_browser_lock_liveness()
 
 
 if __name__ == "__main__":

package/skill/amplitude-24h-signups.sh

@@ -34,5 +34,5 @@ RUN_START=$(date +%s)
 EXIT_CODE=$?
 RUN_ELAPSED=$(( $(date +%s) - RUN_START ))
 
-echo "[$(date +%H:%M:%S)] === done in ${RUN_ELAPSED}s (exit=${EXIT_CODE}) ==="
+echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] === done in ${RUN_ELAPSED}s (exit=${EXIT_CODE}) ==="
 exit "$EXIT_CODE"

package/skill/audit-dm-staleness.sh

@@ -14,7 +14,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/audit-dm-staleness-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 # HTTP-only lane (2026-06-01): both staleness UPDATEs run server-side via the
 # s4l.ai API (POST /api/v1/dms/staleness-sweep). No DATABASE_URL, no psql.

package/skill/audit-linkedin.sh

@@ -6,7 +6,7 @@
 # State: ~/.claude/social-autoposter/linkedin.killswitch
 # Clear: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear
 if [ -f "$HOME/.claude/social-autoposter/linkedin.killswitch" ]; then
-    echo "[$(date +%H:%M:%S)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
     echo "  Re-auth LinkedIn in harness Chrome, then: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear"
     exit 0
 fi

package/skill/audit-reddit-resurrect.sh

@@ -38,7 +38,7 @@ AUDIT_HELPER="$REPO_DIR/scripts/audit_helper.py"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/audit-reddit-resurrect-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" >> "$LOG_FILE"; echo "[$(date +%H:%M:%S)] $*"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$LOG_FILE"; echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"; }
 
 RUN_START=$(date +%s)
 log "=== Reddit resurrect audit: $(date) ==="

package/skill/audit.sh

@@ -62,10 +62,10 @@ case "${PLATFORM:-all}" in
         _LI_BOOT_RC=0
         ( source "$(dirname "$0")/lib/linkedin-backend.sh"; ensure_linkedin_browser_for_backend ) || _LI_BOOT_RC=$?
         if [ "$_LI_BOOT_RC" -eq 78 ]; then
-            echo "[$(date +%H:%M:%S)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire"
+            echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire"
             exit 0
         elif [ "$_LI_BOOT_RC" -ne 0 ]; then
-            echo "[$(date +%H:%M:%S)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
+            echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
             exit "$_LI_BOOT_RC"
         fi
         ;;
@@ -84,10 +84,10 @@ case "${PLATFORM:-all}" in
         _LI_BOOT_RC=0
         ( source "$(dirname "$0")/lib/linkedin-backend.sh"; ensure_linkedin_browser_for_backend ) || _LI_BOOT_RC=$?
         if [ "$_LI_BOOT_RC" -eq 78 ]; then
-            echo "[$(date +%H:%M:%S)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire (all-platform audit)"
+            echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire (all-platform audit)"
             exit 0
         elif [ "$_LI_BOOT_RC" -ne 0 ]; then
-            echo "[$(date +%H:%M:%S)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
+            echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
             exit "$_LI_BOOT_RC"
         fi
         python3 "$REPO_DIR_FOR_LOCK/scripts/reddit_browser_lock.py" acquire --timeout 3600 --ttl 90 2>&1 || \
@@ -113,7 +113,7 @@ mkdir -p "$LOG_DIR"
 LOG_TAG="${PLATFORM:-all}"
 LOG_FILE="$LOG_DIR/audit-${LOG_TAG}-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" >> "$LOG_FILE"; echo "[$(date +%H:%M:%S)] $*"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$LOG_FILE"; echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*"; }
 
 RUN_START=$(date +%s)
 log "=== Audit Pipeline Run (${LOG_TAG}): $(date) ==="

package/skill/check-web-chats.sh

@@ -35,7 +35,7 @@ mkdir -p "$LOG_DIR"
 PYTHON_BIN="${PYTHON_BIN:-/opt/homebrew/bin/python3.11}"
 [ -x "$PYTHON_BIN" ] || PYTHON_BIN="/usr/bin/python3"
 
-log() { echo "[$(date +%H:%M:%S)] $*" >> "$LOG_DIR/web-chat.log"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$LOG_DIR/web-chat.log"; }
 
 # Step 1: query Postgres for unread threads.
 CHATS=$("$PYTHON_BIN" "$SCRIPTS_DIR/check_unread_web_chats.py" 2>>"$LOG_DIR/web-chat.log")

package/skill/dm-outreach-linkedin.sh

@@ -12,7 +12,7 @@ set -euo pipefail
 # State: ~/.claude/social-autoposter/linkedin.killswitch
 # Clear: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear
 if [ -f "$HOME/.claude/social-autoposter/linkedin.killswitch" ]; then
-    echo "[$(date +%H:%M:%S)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn pipeline."
     echo "  Re-auth LinkedIn in harness Chrome, then: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear"
     exit 0
 fi
@@ -37,10 +37,10 @@ acquire_lock "linkedin-browser" 3600
 _LI_BOOT_RC=0
 ensure_linkedin_browser_for_backend || _LI_BOOT_RC=$?
 if [ "$_LI_BOOT_RC" -eq 78 ]; then
-    echo "[$(date +%H:%M:%S)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire"
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] linkedin-pipeline lock: peer pipeline is driving the 9556 Chrome; skipping this fire"
     exit 0
 elif [ "$_LI_BOOT_RC" -ne 0 ]; then
-    echo "[$(date +%H:%M:%S)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] ERROR: linkedin browser bootstrap failed (rc=$_LI_BOOT_RC)"
     exit "$_LI_BOOT_RC"
 fi
 acquire_lock "dm-outreach-linkedin" 2700
@@ -56,7 +56,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/dm-outreach-linkedin-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 RUN_START=$(date +%s)
 log "=== LinkedIn DM Outreach Run: $(date) ==="

package/skill/dm-outreach-reddit.sh

@@ -50,7 +50,7 @@ LOG_DIR="$REPO_DIR/skill/logs"
 mkdir -p "$LOG_DIR"
 LOG_FILE="$LOG_DIR/dm-outreach-reddit-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 RUN_START=$(date +%s)
 log "=== Reddit DM Outreach Run: $(date) ==="

package/skill/dm-outreach-twitter.sh

@@ -44,7 +44,7 @@ SKILL_FILE="$REPO_DIR/SKILL.md"
 # dm-outreach-linkedin.sh (migrated 2026-05-12).
 # (LOG_DIR/LOG_FILE bootstrapped at top of script.)
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 RUN_START=$(date +%s)
 log "=== Twitter DM Outreach Run: $(date) ==="

package/skill/engage-dm-replies.sh

@@ -35,7 +35,7 @@ fi
 # State: ~/.claude/social-autoposter/linkedin.killswitch
 # Clear: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear
 if [ "$PLATFORM" = "linkedin" ] && [ -f "$HOME/.claude/social-autoposter/linkedin.killswitch" ]; then
-    echo "[$(date +%H:%M:%S)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn DM-replies pipeline."
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] LINKEDIN_KILLSWITCH active. Aborting LinkedIn DM-replies pipeline."
     echo "  Re-auth LinkedIn in harness Chrome, then: python3 ~/social-autoposter/scripts/linkedin_killswitch.py clear"
     exit 0
 fi
@@ -116,7 +116,7 @@ LOG_SUFFIX=""
 [ -n "$PLATFORM" ] && LOG_SUFFIX="-$PLATFORM"
 LOG_FILE="$LOG_DIR/engage-dm-replies${LOG_SUFFIX}-$(date +%Y-%m-%d_%H%M%S).log"
 
-log() { echo "[$(date +%H:%M:%S)] $*" | tee -a "$LOG_FILE"; }
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG_FILE"; }
 
 RUN_START=$(date +%s)
 log "=== DM Reply Engagement Run: $(date) (platform: ${PLATFORM:-all}) ==="
@@ -302,12 +302,25 @@ The \`public_target_url\` field is THEIR public comment that originally led to t
 
 ### Step C. If \`reply_channel\` is \`dm\` or \`both\`: deliver the DM
 
+**NO CAMPAIGN SUFFIX ON HUMAN REPLIES.** A row in this queue is a HUMAN answering
+an escalation (often an AI-callout), so the campaign suffix (e.g. ' written with
+ai') must NEVER be coin-flipped onto it — it re-burns the exact lead the human is
+trying to recover (2026-07-13: the suffix landed on the hand-approved ngeloxyz
+recovery DM and helped kill the thread). When sending via the python CLIs, ALWAYS
+prefix the env opt-out:
+\`\`\`bash
+S4L_SKIP_CAMPAIGN_SUFFIX=1 python3 scripts/twitter_browser.py send-dm THREAD_URL "MESSAGE" DM_ID
+S4L_SKIP_CAMPAIGN_SUFFIX=1 python3 scripts/reddit_browser.py send-dm CHAT_URL "MESSAGE" DM_ID
+\`\`\`
+This applies ONLY inside Phase 0 (human replies). Auto-replies in the later phases
+keep the normal campaign behavior — do NOT carry this env var forward.
+
 1. Craft a natural DM based on the human's instructions and the conversation context.
 2. Navigate to the conversation on the correct platform using \`chat_url\` (or find the conversation with their_author).
    - **Reddit Chat** (mcp__reddit-harness__bh_run tool, CDP-driven real Chrome on port 9557)
    - **LinkedIn Messages** (mcp__linkedin-harness__bh_run tool, CDP-driven real Chrome on port 9556)
    - **X/Twitter DMs** (mcp__twitter-harness__bh_run tool), if encrypted DM passcode dialog appears, enter: $TWITTER_DM_PASSCODE
-3. Type and send the crafted DM.
+3. Type and send the crafted DM (with the suffix opt-out env var when using the python send-dm CLIs, per the rule above).
 4. Log the outbound message (log what you ACTUALLY SENT, not the human's instructions). Pass --verified ONLY when the browser tool returned verified=true. If verification failed, log nothing and let the next cycle retry; never pass --verified speculatively:
    \`\`\`bash
    cd ~/social-autoposter && python3 scripts/dm_conversation.py log-outbound --dm-id DM_ID --content "THE_CRAFTED_DM_YOU_SENT" --verified