@m13v/s4l 1.7.5-rc.2 → 1.7.5-rc.21

package/scripts/twitter_browser.py

@@ -186,22 +186,32 @@ def find_twitter_cdp_port():
     returns the first port whose /json index lists at least one x.com or
     twitter.com tab (preferring logged-in tabs over login pages). Used only
     as a fallback when TWITTER_CDP_URL isn't exported by the caller.
+
+    Since the park-on-exit mitigation (2026-07-14) the harness tab sits on
+    x.com/robots.txt between runs, which still matches the x.com scan above.
+    A responding port whose cmdline carries the browser-harness profile dir
+    is kept as a last-resort fallback for the tab-somehow-closed case (never
+    a different platform's harness Chrome).
     """
     try:
         ps_out = subprocess.check_output(
             ["ps", "aux"], text=True, stderr=subprocess.DEVNULL
         )
         ports = set()
+        harness_ports = set()
         for line in ps_out.splitlines():
             if "chromium" not in line.lower() and "chrome" not in line.lower():
                 continue
             m = re.search(r"remote-debugging-port=(\d+)", line)
             if m:
                 ports.add(int(m.group(1)))
+                if "browser-profiles/browser-harness" in line:
+                    harness_ports.add(int(m.group(1)))
 
         import urllib.request
 
         best_port = None
+        harness_fallback = None
         for port in sorted(ports):
             try:
                 resp = urllib.request.urlopen(
@@ -214,6 +224,11 @@ def find_twitter_cdp_port():
                     if "x.com" in p.get("url", "") or "twitter.com" in p.get("url", "")
                 ]
                 if not twitter_urls:
+                    # Responding harness Chrome with its tab parked on
+                    # about:blank: usable, but only if nothing shows a live
+                    # x.com tab.
+                    if port in harness_ports and harness_fallback is None:
+                        harness_fallback = port
                     continue
                 # Prefer ports with logged-in pages (home, chat, notifications)
                 logged_in = any(
@@ -227,360 +242,46 @@ def find_twitter_cdp_port():
                     best_port = port
             except Exception:
                 continue
-        return best_port
+        return best_port if best_port is not None else harness_fallback
     except Exception:
         pass
     return None
 
 
-_LOCK_SESSION_ID = f"python:{os.getpid()}"
-_LOCK_INHERITED = False
-_LOCK_ACQUIRED_AT = 0.0
-_UUID_RE = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$")
-
-
-def _release_browser_lock():
-    """Release the lock if we hold it.
-
-    If we inherited the lock from a Claude session (UUID holder), leave it for
-    the hook/session-end handler to release — don't clobber the parent's lock.
-    """
-    if _LOCK_INHERITED:
-        return
-    try:
-        if os.path.exists(LOCK_FILE):
-            with open(LOCK_FILE) as f:
-                lock = json.load(f)
-            if lock.get("session_id") == _LOCK_SESSION_ID:
-                os.remove(LOCK_FILE)
-                # Quantify hold time: long holds are what starve peers into the
-                # "locked by session ... waited 45s, giving up" family (S4L-B),
-                # and the 2026-07-09/11 wedge showed a hung CDP connect holding
-                # this lock for 3 minutes per attempt. >=5s filter keeps the
-                # healthy-path noise out of the logs.
-                if _LOCK_ACQUIRED_AT:
-                    _held = time.time() - _LOCK_ACQUIRED_AT
-                    if _held >= 5:
-                        print(
-                            f"[browser-lock] held {_held:.0f}s "
-                            f"(role={LOCK_ROLE}, pid={os.getpid()})",
-                            file=sys.stderr,
-                        )
-    except (json.JSONDecodeError, OSError):
-        pass
+# ---- browser-session mutex (2026-07-14: shared implementation) -------------
+# The ~250-line battle-hardened mutex that lived here (O_EXCL claim, dead-PID
+# reclaim, role-aware post-preempts-scan, batch inherit via S4L_LOCK_OWNER,
+# UUID-session inherit, POST_LOCK_EXPIRY decoupling) moved VERBATIM to
+# scripts/browser_mutex.py so reddit_browser.py stops running a weaker copy.
+# Same lockfile, same JSON shape, same timers, same log/error strings —
+# behavior is unchanged. Incident history: docs/twitter_browser_lock.md.
+from browser_mutex import BrowserMutex
 
+_MUTEX = BrowserMutex(
+    lock_file=LOCK_FILE,
+    label="Twitter browser",
+    lock_expiry=LOCK_EXPIRY,
+    post_lock_expiry=POST_LOCK_EXPIRY,
+    wait_max=LOCK_WAIT_MAX,
+    poll_interval=LOCK_POLL_INTERVAL,
+    preempt_kill_wait=PREEMPT_KILL_WAIT,
+    role=LOCK_ROLE,
+)
 
-atexit.register(_release_browser_lock)
 
+def _acquire_browser_lock():
+    _MUTEX.acquire()
 
-def _is_holder_alive(holder: str) -> bool:
-    """Check whether a Claude session UUID lock holder is still running.
 
-    A live Claude session puts its UUID on the cmdline as
-    `claude --session-id <UUID>`. pgrep matches it; absence means the
-    holder is dead and the lock is stale, even if its JSONL transcript
-    is still tail-flushing. Legacy semantics from the retired
-    twitter-agent-lock.sh PreToolUse hook; only python:PID holders are
-    written to the lock file today, so this code path is dormant unless
-    a Claude session still inherits an in-flight UUID lock.
-    """
-    if not holder:
-        return False
-    try:
-        return (
-            subprocess.run(
-                ["pgrep", "-f", f"claude.*--session-id {holder}"],
-                stdout=subprocess.DEVNULL,
-                stderr=subprocess.DEVNULL,
-                timeout=2,
-            ).returncode
-            == 0
-        )
-    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
-        return True  # err on the side of NOT stealing
-
-
-def _is_python_holder_alive(holder: str) -> bool:
-    """Liveness probe for a `python:PID` lock holder.
-
-    Holders written today are `python:<pid>` (see _LOCK_SESSION_ID). Before this
-    check existed (defect a, 2026-06-16), a holder whose process died WITHOUT
-    running its atexit _release_browser_lock (SIGKILL, OOM, watchdog SIGTERM,
-    hard hang) left the lockfile behind, and _acquire_browser_lock had no way to
-    tell it was dead -- so every peer waited the full LOCK_WAIT_MAX and gave up,
-    and the lock only cleared after LOCK_EXPIRY (300s). os.kill(pid, 0) sends no
-    signal; it just probes existence. Returns True (treat as held, do NOT steal)
-    for anything we cannot prove dead, so the worst case degrades to the old
-    LOCK_EXPIRY failsafe rather than stealing a live peer's lock.
-    """
-    if not holder.startswith("python:"):
-        return True  # not a python holder; this probe makes no claim
-    try:
-        pid = int(holder.split(":", 1)[1])
-    except (ValueError, IndexError):
-        return True  # unparseable holder -> don't steal on this basis
-    try:
-        os.kill(pid, 0)
-        return True            # process exists -> alive
-    except ProcessLookupError:
-        return False           # no such process -> dead, reclaimable
-    except PermissionError:
-        return True            # exists but another owner -> alive
-    except OSError:
-        return True            # ambiguous -> err toward NOT stealing
-
-
-def _try_take_lock() -> bool:
-    """Atomically claim LOCK_FILE for this process. Returns True iff we created
-    it. O_CREAT|O_EXCL makes "is it free? then take it" a single syscall, so two
-    cold-start acquirers can't both win the way the old os.path.exists +
-    open(w) check-then-act allowed (defect c, 2026-06-16). A False return means a
-    peer beat us to it; the caller re-loops and re-evaluates the holder.
-    """
-    try:
-        fd = os.open(LOCK_FILE, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o644)
-    except FileExistsError:
-        return False
-    except OSError:
-        return False
-    try:
-        os.write(fd, json.dumps(
-            {"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}
-        ).encode())
-    finally:
-        os.close(fd)
-    return True
-
-
-def _preempt_holder(pid: int) -> bool:
-    """Preempt a live lock holder we outrank (a poster taking the browser from a
-    scan). SIGTERM it, wait PREEMPT_KILL_WAIT for it to die so its pid frees the
-    lock, then escalate to SIGKILL once. Returns True once the holder is gone
-    (or was already gone). Best-effort; never raises. The caller then removes the
-    stale lockfile and claims it via O_EXCL.
-    """
-    try:
-        os.kill(pid, signal.SIGTERM)
-    except ProcessLookupError:
-        return True            # already gone
-    except OSError:
-        return False           # not ours to signal / ambiguous -> don't claim
-    deadline = time.time() + PREEMPT_KILL_WAIT
-    while time.time() < deadline:
-        try:
-            os.kill(pid, 0)
-        except OSError:
-            return True        # ProcessLookupError or perm change -> dead enough
-        time.sleep(0.2)
-    # Still alive after the SIGTERM grace window -> escalate once.
-    try:
-        os.kill(pid, signal.SIGKILL)
-    except OSError:
-        pass
-    try:
-        os.kill(pid, 0)
-    except OSError:
-        return True
-    return False
+def _refresh_browser_lock():
+    _MUTEX.refresh()
 
 
-def _acquire_browser_lock():
-    """Acquire the Twitter browser session mutex (~/.claude/twitter-browser-lock.json).
-
-    This file-mutex is the UNIVERSAL serializer for every twitter_browser.py
-    browser op (all of them route through get_browser_and_page below). The shell
-    FIFO lock in skill/lock.sh only serializes the pipelines that bother to take
-    it; this one catches everything, including cross-pipeline handoff races and
-    MCP-driven posts.
-
-    Holders today are python:PID. UUID-style holders are a legacy artifact of the
-    retired PreToolUse hook (twitter-agent-lock.sh); a live UUID holder is a
-    parent Claude session still in flight, so we INHERIT rather than fight it.
-
-    Reclaim priority (a holder we can PROVE is dead is taken immediately, so a
-    crashed peer can never starve the fleet for LOCK_WAIT_MAX/LOCK_EXPIRY):
-      1. holder == us            -> re-entrant; we already hold it.
-      2. UUID holder, pid gone   -> stale legacy lock, reclaim.
-      3. python:PID, pid gone    -> dead peer (defect a fix), reclaim.
-      4. age >= LOCK_EXPIRY      -> failsafe for holders we cannot probe.
-      5. live UUID holder        -> inherit (parent session).
-      6. live python:PID holder  -> real peer; wait, then give up after
-                                    LOCK_WAIT_MAX with a structured error.
-
-    Acquisition itself is atomic (_try_take_lock / O_EXCL), so the moment we
-    decide the lock is free, no concurrent acquirer can also claim it.
-
-    NOTE for future maintainers: do NOT "simplify" this by having the shell
-    pipelines `rm -f` the lockfile around release_lock. That blind rm deleted
-    LIVE peers' locks (defect b) and was removed 2026-06-16. Dead holders are
-    reclaimed here instead. See docs/twitter_browser_lock.md.
-    """
-    global _LOCK_SESSION_ID, _LOCK_INHERITED, _LOCK_ACQUIRED_AT
-    deadline = time.time() + LOCK_WAIT_MAX
-    # Guarantee the lock dir exists so _try_take_lock's O_EXCL create can't fail
-    # for a missing-parent reason (which would otherwise spin the no-file path).
-    try:
-        os.makedirs(os.path.dirname(LOCK_FILE), exist_ok=True)
-    except OSError:
-        pass
-    while True:
-        if not os.path.exists(LOCK_FILE):
-            if _try_take_lock():
-                break
-            # Lost the create race to a peer (or a persistent create failure).
-            # Bound by `deadline` so this path can never spin forever.
-            if time.time() >= deadline:
-                print(json.dumps({
-                    "success": False,
-                    "error": f"Twitter browser lock contended on create; waited {LOCK_WAIT_MAX}s, giving up."
-                }))
-                sys.exit(1)
-            time.sleep(LOCK_POLL_INTERVAL)
-            continue
-        try:
-            with open(LOCK_FILE) as f:
-                lock = json.load(f)
-        except (json.JSONDecodeError, OSError):
-            # Corrupt / half-written / vanished between exists() and open().
-            # Try to claim atomically; if a peer holds a valid lock our O_EXCL
-            # create fails and we re-loop. Bounded by `deadline` so a persistently
-            # unreadable lockfile gives up instead of hanging the pipeline.
-            if _try_take_lock():
-                break
-            if time.time() >= deadline:
-                print(json.dumps({
-                    "success": False,
-                    "error": f"Twitter browser lock unreadable; waited {LOCK_WAIT_MAX}s, giving up."
-                }))
-                sys.exit(1)
-            time.sleep(LOCK_POLL_INTERVAL)
-            continue
-        age = time.time() - lock.get("timestamp", 0)
-        holder = lock.get("session_id", "")
-        holder_role = lock.get("role", "scan")  # legacy locks (no role) = preemptable
-
-        # 1. Re-entrant: the lock is already ours (same process, or a stale lock
-        # left by a previous process whose PID we have since reused). Refresh the
-        # timestamp so a peer's LOCK_EXPIRY failsafe can't reclaim it under us.
-        if holder == _LOCK_SESSION_ID and not _LOCK_INHERITED:
-            _refresh_browser_lock()
-            break
-
-        # 1b. Batch-owner inherit (posting). The poster (twitter_post_plan.py)
-        # acquires this lock ONCE and holds it across the WHOLE approved batch,
-        # exporting its own session id as S4L_LOCK_OWNER for the child
-        # twitter_browser.py reply subprocesses it spawns. Each child INHERITS the
-        # parent's hold instead of contending for it -- two role:"post" peers would
-        # otherwise both fall to the case-6 peer-wait and give up after
-        # LOCK_WAIT_MAX, breaking the post. The child refreshes the timestamp
-        # (proof of progress at this candidate boundary, so the POST_LOCK_EXPIRY
-        # failsafe only ever fires on a real hang) and, being _LOCK_INHERITED,
-        # leaves the lock in place for the PARENT to release at batch end. A DEAD
-        # owner is never inherited: the alive-probe fails here and we fall through
-        # to the dead_python reclaim below, so a crashed batch can't wedge the
-        # browser. This is what closes the inter-candidate gap (the link_tail
-        # claude -p call, ~5-20s) the every-60s autopilot scan used to slip into.
-        _batch_owner = os.environ.get("S4L_LOCK_OWNER") or ""
-        if holder and holder == _batch_owner and _is_python_holder_alive(holder):
-            _LOCK_SESSION_ID = holder
-            _LOCK_INHERITED = True
-            _refresh_browser_lock()
-            print(f"[browser_lock] inherited batch owner={holder} "
-                  f"role={holder_role} -> pid={os.getpid()}", file=sys.stderr)
-            break
-
-        # 2-4. Reclaim a holder we can prove is dead/expired. Remove-then-take so
-        # the O_EXCL claim wins; if a peer reclaims at the same instant exactly
-        # one of us creates the file and the other re-loops (never both).
-        reclaim_reason = ""
-        if _UUID_RE.match(holder or "") and not _is_holder_alive(holder):
-            reclaim_reason = "dead_uuid"
-        elif holder.startswith("python:") and not _is_python_holder_alive(holder):
-            reclaim_reason = "dead_python"
-        elif age >= (POST_LOCK_EXPIRY if holder_role == "post" else LOCK_EXPIRY):
-            # Role-aware failsafe: a hung poster self-clears on the posting-only
-            # POST_LOCK_EXPIRY, a scan on the fleet-wide LOCK_EXPIRY. Scan
-            # behaviour is unchanged; only the post ceiling is decoupled.
-            reclaim_reason = "expired"
-        if reclaim_reason:
-            try:
-                os.remove(LOCK_FILE)
-            except OSError:
-                pass
-            if _try_take_lock():
-                # Verifiable signal that defect-a starvation was prevented.
-                print(f"[browser_lock] reclaimed holder={holder or '<none>'} "
-                      f"reason={reclaim_reason} age={int(age)}s -> pid={os.getpid()}",
-                      file=sys.stderr)
-                break
-            time.sleep(LOCK_POLL_INTERVAL)
-            continue
-
-        # 5. Live UUID holder = parent Claude session still in flight -> inherit.
-        if _UUID_RE.match(holder or ""):
-            _LOCK_SESSION_ID = holder
-            _LOCK_INHERITED = True
-            break
-
-        # 5b. POSTING PRIORITY (cross-process). A LIVE python:PID peer running a
-        # lower-priority op (role != "post": the scan/draft cycle, whether the
-        # plugin's own, a separate autopilot agent's, or the launchd cron's) must
-        # YIELD to an approved post. Preempt it by signal and reclaim, so the post
-        # takes the browser at once instead of waiting LOCK_WAIT_MAX and giving up
-        # while the scan holds it. The aborted scan just re-runs next cron tick;
-        # posting is the scarce, user-initiated action. Only a poster
-        # (LOCK_ROLE == "post") ever preempts, and only a non-post holder -- two
-        # posters fall through to the normal peer-wait below so neither kills the
-        # other. UUID holders are handled above (we inherit, never kill those).
-        if (
-            LOCK_ROLE == "post"
-            and holder.startswith("python:")
-            and holder_role != "post"
-            and _is_python_holder_alive(holder)
-        ):
-            try:
-                victim_pid = int(holder.split(":", 1)[1])
-            except (ValueError, IndexError):
-                victim_pid = 0
-            if victim_pid and _preempt_holder(victim_pid):
-                try:
-                    os.remove(LOCK_FILE)
-                except OSError:
-                    pass
-                if _try_take_lock():
-                    print(
-                        f"[browser_lock] post preempted holder={holder} "
-                        f"role={holder_role} age={int(age)}s -> pid={os.getpid()}",
-                        file=sys.stderr,
-                    )
-                    break
-            # Preempt didn't land (couldn't kill, or a peer reclaimed first) ->
-            # re-loop and re-evaluate rather than busy-spin.
-            time.sleep(LOCK_POLL_INTERVAL)
-            continue
-
-        # 6. Live python:PID peer. Wait, then give up. Reaching the deadline now
-        # means the holder is a genuinely LIVE peer (dead ones were reclaimed
-        # above), i.e. real contention -- NOT the defect-a starvation. The
-        # "locked by session" substring is preserved for downstream parsers.
-        if time.time() >= deadline:
-            print(json.dumps({
-                "success": False,
-                "error": f"Twitter browser locked by session {holder} ({int(age)}s, peer alive); waited {LOCK_WAIT_MAX}s, giving up."
-            }))
-            sys.exit(1)
-        time.sleep(LOCK_POLL_INTERVAL)
-        continue
-    _LOCK_ACQUIRED_AT = time.time()
+def _release_browser_lock():
+    _MUTEX.release()
 
 
-def _refresh_browser_lock():
-    """Refresh the lock timestamp to prevent expiry during long operations."""
-    try:
-        with open(LOCK_FILE, "w") as f:
-            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time()), "role": LOCK_ROLE}, f)
-    except OSError:
-        pass
+atexit.register(_release_browser_lock)
 
 
 def _cdp_diagnostics(cdp_url):
@@ -645,11 +346,149 @@ def _touch_browser_heartbeat(*_args):
         pass
 
 
+# L3: CHOKE-POINT self-liveness watchdog (2026-07-14). The per-call-site
+# stall_guard wrappers proved to be coverage-by-enumeration: the batch media
+# path (scrape_many_thread_media) was missed and hung 31+ min on a crashed
+# renderer with only the external watchdog's 90-min net under it. This layer
+# is enforcement at the ONE entry every Playwright browser op flows through:
+# if THIS process has produced zero browser activity (no heartbeat touches —
+# no attach, no page network traffic) for the deadline while holding the
+# browser, it is hung; print a marker, stamp the wedge strike, and self-abort
+# so the lock and cycle slot free up. Applies to every current and FUTURE
+# call site automatically. Write path excluded by ROLE (S4L_LOCK_ROLE=post):
+# aborting mid-post risks a posted-but-unrecorded reply (double-post on
+# retry), so posting keeps its own timeouts + the external nets.
+_SELF_WATCHDOG_ARMED = False
+
+
+def _arm_self_liveness_watchdog():
+    global _SELF_WATCHDOG_ARMED
+    if _SELF_WATCHDOG_ARMED or LOCK_ROLE == "post":
+        return
+    _SELF_WATCHDOG_ARMED = True
+    import threading
+
+    deadline = float(os.environ.get("S4L_BROWSER_OP_DEADLINE_S", "240")) + 60.0
+    interval = max(5.0, min(20.0, deadline / 4.0))
+
+    def _loop():
+        while True:
+            time.sleep(interval)
+            if not _hb_last_touch:
+                continue
+            idle = time.time() - _hb_last_touch
+            if idle > deadline:
+                print(
+                    f"[twitter_browser] SELF_LIVENESS_ABORT role={LOCK_ROLE} "
+                    f"idle={idle:.0f}s deadline={deadline:.0f}s — browser held "
+                    "with zero activity (hung op); stamping wedge strike and "
+                    "aborting so the lock frees",
+                    file=sys.stderr,
+                )
+                try:
+                    # Matches the two-strike gate in skill/lib/twitter-backend.sh.
+                    with open("/tmp/s4l_cdp_wedge_strike_9555", "w") as f:
+                        f.write(str(int(time.time())))
+                except OSError:
+                    pass
+                os._exit(75)  # EX_TEMPFAIL
+
+    threading.Thread(target=_loop, daemon=True).start()
+
+
+# PARK-ON-EXIT (2026-07-14, Chrome 150 crash-storm mitigation). Root cause of
+# the 07-12..07-14 stalls: Chrome 150 (live at the 07-12 reboot) crashes the
+# x.com renderer with a deliberate internal CHECK abort roughly hourly while
+# the tab sits unthrottled on x.com between pipeline runs, and a crashed
+# renderer precedes most whole-browser CDP wedges by minutes (see Crashpad
+# dump ↔ cdp_wedge correlation, memory
+# insights_chrome150_renderer_crash_wedge_2026_07_14). Parking every
+# x.com/twitter.com tab when the last browser-using python process exits
+# removes the heavy SPA from the idle window entirely. Raw CDP over
+# HTTP+websocket with hard 3s timeouts, NEVER Playwright: at atexit the
+# Playwright loop may be gone, and against an already-wedged browser this
+# must fail fast, not hang the exit.
+#
+# PARK TARGET IS x.com/robots.txt, NOT about:blank (user rule 2026-07-14:
+# always REUSE the tab; creating tabs risks focus steal). The bh harness's
+# list_tabs() treats "about:" as INTERNAL and hides it, so an about:blank
+# park made twitter_scan._navigate see zero real tabs and open a NEW tab
+# every cycle. robots.txt is a static ~100-byte text document (no SPA, no
+# JS, nothing to leak or crash) whose URL still matches every reuse
+# heuristic: harness list_tabs (plain https), the x.com-tab preference in
+# _get_browser_and_page_raw, and find_twitter_cdp_port discovery. The
+# harness-profile discovery fallback stays as a belt for a closed tab.
+_PARK_URL = "https://x.com/robots.txt"
+_PARK_REGISTERED = False
+
+
+def _park_twitter_tabs():
+    try:
+        import urllib.request
+
+        base = (
+            os.environ.get("TWITTER_CDP_URL", "").strip()
+            or "http://127.0.0.1:9555"
+        ).rstrip("/")
+        resp = urllib.request.urlopen(base + "/json/list", timeout=3)
+        targets = json.loads(resp.read())
+        for t in targets:
+            url = t.get("url", "")
+            if t.get("type") != "page":
+                continue
+            if "x.com" not in url and "twitter.com" not in url:
+                continue
+            if url.split("?", 1)[0].rstrip("/").endswith("/robots.txt"):
+                continue  # already parked
+            ws_url = t.get("webSocketDebuggerUrl")
+            if not ws_url:
+                continue
+            try:
+                import websocket
+
+                # suppress_origin: Chrome 111+ rejects CDP websocket clients
+                # that send an Origin header not in --remote-allow-origins
+                # (same pattern as restore_twitter_session.py).
+                ws = websocket.create_connection(
+                    ws_url, timeout=3, suppress_origin=True
+                )
+                try:
+                    ws.send(json.dumps({
+                        "id": 1,
+                        "method": "Page.navigate",
+                        "params": {"url": _PARK_URL},
+                    }))
+                    ws.recv()
+                finally:
+                    ws.close()
+                print(
+                    f"[twitter_browser] parked tab on {_PARK_URL} (was {url[:80]})",
+                    file=sys.stderr,
+                )
+            except Exception:
+                continue
+    except Exception:
+        pass
+
+
+def _register_park_on_exit():
+    """Arm parking once per process, only for processes that actually used the
+    browser. Registered AFTER the module-level _release_browser_lock atexit,
+    so it runs BEFORE it (LIFO): park while still holding the python lock,
+    then release. S4L_NO_TAB_PARK=1 is the escape hatch."""
+    global _PARK_REGISTERED
+    if _PARK_REGISTERED or os.environ.get("S4L_NO_TAB_PARK"):
+        return
+    _PARK_REGISTERED = True
+    atexit.register(_park_twitter_tabs)
+
+
 def get_browser_and_page(playwright):
     """Instrumented entry point: attach via _get_browser_and_page_raw, then
     (L1) set default per-op/navigation timeouts so no page call can hang
-    forever, and (L2) wire the browser-lock liveness heartbeat. All new code
-    should use THIS, never the raw variant."""
+    forever, (L2) wire the browser-lock liveness heartbeat, and (L3) arm the
+    self-liveness watchdog so a hung op in ANY caller self-aborts. All new
+    code should use THIS, never the raw variant."""
     browser, page, is_cdp = _get_browser_and_page_raw(playwright)
     try:
         page.set_default_timeout(BROWSER_OP_TIMEOUT_MS)
@@ -661,6 +500,8 @@ def get_browser_and_page(playwright):
         page.on("request", _touch_browser_heartbeat)
     except Exception:
         pass
+    _arm_self_liveness_watchdog()
+    _register_park_on_exit()
     return browser, page, is_cdp