@m13v/s4l 1.7.5-rc.2 → 1.7.5-rc.21

package/scripts/post_reddit.py

@@ -31,11 +31,45 @@ from http_api import api_get, api_post, api_patch
 from author_history_block import render as _render_author_history
 from project_topics import topics_for_project
 
-REPO_DIR = os.path.expanduser("~/social-autoposter")
+# Honor S4L_REPO_DIR so managed-package installs resolve helper scripts inside
+# the package instead of a nonexistent ~/social-autoposter (the same $HOME
+# hardcode class that silently no-op'd session restore on customer boxes).
+REPO_DIR = os.path.expanduser(os.environ.get("S4L_REPO_DIR") or "~/social-autoposter")
 CONFIG_PATH = os.path.join(REPO_DIR, "config.json")
 REDDIT_BROWSER = os.path.join(REPO_DIR, "scripts", "reddit_browser.py")
 REDDIT_BROWSER_LOCK = os.path.join(REPO_DIR, "scripts", "reddit_browser_lock.py")
 REDDIT_TOOLS = os.path.join(REPO_DIR, "scripts", "reddit_tools.py")
+RUN_CLAUDE_SH = os.path.join(REPO_DIR, "scripts", "run_claude.sh")
+
+# JSON schema for the queue-routed draft turn (tag post-reddit-draft ->
+# claude_job.py type reddit-draft). One object, two arrays; posts[] entries
+# mirror the legacy JSONL "action":"post" line fields, rejects[] entries feed
+# _propose_excludes_from_rejects (thread_url + reason + proposed_excludes).
+REDDIT_DRAFT_SCHEMA = json.dumps({
+    "type": "object",
+    "properties": {
+        "posts": {"type": "array", "items": {"type": "object", "properties": {
+            "thread_url": {"type": "string"},
+            "reply_to_url": {"type": ["string", "null"]},
+            "text": {"type": "string"},
+            "thread_author": {"type": "string"},
+            "thread_title": {"type": "string"},
+            "engagement_style": {"type": "string"},
+            "search_topic": {"type": "string"},
+            "new_style": {"type": ["object", "null"], "properties": {
+                "description": {"type": "string"},
+                "example": {"type": "string"},
+            }},
+        }, "required": ["thread_url", "text", "thread_author",
+                        "thread_title", "engagement_style"]}},
+        "rejects": {"type": "array", "items": {"type": "object", "properties": {
+            "thread_url": {"type": "string"},
+            "reason": {"type": "string"},
+            "proposed_excludes": {"type": "array", "items": {"type": "string"}},
+        }, "required": ["thread_url", "reason"]}},
+    },
+    "required": ["posts", "rejects"],
+})
 
 # Interpreter every child subprocess must run under. A bare PYTHON resolved
 # to the user's system python, which lacks the pipeline deps (Playwright and
@@ -101,8 +135,44 @@ _TRANSIENT_CDP_ERRORS = {
     "all_attempts_failed",
     "comment_box_not_found",
     "not_logged_in",
+    # A concurrent reddit pipeline navigated the shared harness tab out from
+    # under the poster (2026-07-14: 5/5 approvals misclassified as
+    # account_blocked_in_sub this way). Always retryable.
+    "tab_contention",
 }
 
+# ---- posting-active flag (2026-07-14, mirrors twitter's posting-active) ----
+# Stamped for the whole --phase post run and heartbeated per row. Readers:
+# run-reddit-search.sh (skips a cycle fire while fresh) and reddit-backend.sh's
+# pre-launch defer hook (skips every other reddit pipeline's fire), so scans
+# and engagement never grab the ONE shared harness tab mid-post. A stale file
+# (heartbeat older than ~120s) never blocks anyone: a killed poster must not
+# wedge the fleet.
+_S4L_STATE_DIR = os.path.expanduser(os.environ.get("S4L_STATE_DIR") or "~/.social-autoposter-mcp")
+POSTING_ACTIVE_FILE = os.path.join(_S4L_STATE_DIR, "reddit-posting-active.json")
+
+
+def _stamp_posting_active():
+    try:
+        os.makedirs(_S4L_STATE_DIR, exist_ok=True)
+        with open(POSTING_ACTIVE_FILE, "w") as f:
+            json.dump({"pid": os.getpid(), "hb": time.time()}, f)
+    except Exception:
+        pass
+
+
+def _clear_posting_active():
+    try:
+        with open(POSTING_ACTIVE_FILE) as f:
+            if json.load(f).get("pid") != os.getpid():
+                return  # a peer poster owns the flag now; not ours to clear
+    except Exception:
+        pass
+    try:
+        os.remove(POSTING_ACTIVE_FILE)
+    except Exception:
+        pass
+
 from engagement_styles import (
     VALID_STYLES, get_styles_prompt, get_content_rules, validate_or_register,
     pick_style_for_post, get_voice_relationship_rule,
@@ -1029,13 +1099,87 @@ no candidate lines, no commentary about thread content (you don't see any).
 """
 
 
+def _truncate(s, n):
+    s = s or ""
+    return s if len(s) <= n else s[:n] + "..."
+
+
+def _prefetch_thread_digests(candidates, reddit_username=None):
+    """Pre-fetch thread content for the draft prompt (2026-07-14).
+
+    The draft turn used to be agentic: Claude ran `reddit_tools.py fetch` via
+    the Bash tool per candidate. Queue routing (claude_job.py, tag
+    post-reddit-draft) only carries pure text->JSON turns, so the fetches now
+    happen HERE, in Python, and the digests are inlined into the prompt —
+    the same tool-free conversion the twitter Phase 2b prep got on 2026-06-26.
+    Same access pattern as before (reddit_tools fetch rides the harness
+    Chrome's CDP, which is multi-client safe), just a different caller.
+
+    Returns (digests, dropped): digests maps thread_url -> digest text for
+    candidates worth drafting; dropped is a list of (candidate, reason) for
+    threads that can no longer be posted to (archived/locked/blocked) so the
+    caller marks them permanently failed. Transient fetch failures land in
+    NEITHER (candidate stays pending; Phase 0 salvage retries next cycle).
+    """
+    digests = {}
+    dropped = []
+    our_name = (reddit_username or "").lower()
+    for c in candidates:
+        url = c.get("thread_url") or ""
+        if not url:
+            continue
+        try:
+            proc = subprocess.run(
+                [PYTHON, REDDIT_TOOLS, "fetch", url],
+                capture_output=True, text=True, timeout=90,
+            )
+            data = json.loads((proc.stdout or "").strip() or "{}")
+        except Exception as e:
+            print(f"[post_reddit] prefetch FAILED (transient) {url}: {e}",
+                  file=sys.stderr, flush=True)
+            continue
+        err = data.get("error")
+        if err:
+            if err in ("thread_archived", "thread_locked", "subreddit_blocked"):
+                dropped.append((c, err))
+            else:
+                print(f"[post_reddit] prefetch error (transient) {url}: {err}",
+                      file=sys.stderr, flush=True)
+            continue
+        thread = data.get("thread") or {}
+        comments = data.get("comments") or []
+        lines = [
+            f"subreddit: {thread.get('subreddit', '')}  score: {thread.get('score', 0)}"
+            f"  comments: {thread.get('num_comments', 0)}",
+            f"OP u/{thread.get('author', '')}: {thread.get('title', '')}",
+        ]
+        selftext = (thread.get("selftext") or "").strip()
+        if selftext:
+            lines.append(_truncate(selftext, 1500))
+        already = False
+        if comments:
+            lines.append("top comments:")
+            for cm in comments[:12]:
+                author = cm.get("author") or ""
+                if our_name and author.lower() == our_name:
+                    already = True
+                body = _truncate((cm.get("body") or "").strip().replace("\n", " "), 280)
+                lines.append(f"  u/{author} ({cm.get('score', 0)}): {body}")
+        if already:
+            lines.append("NOTE: one of OUR accounts already commented in this"
+                         " thread (astroturf OMIT rule applies).")
+        digests[url] = "\n".join(lines)
+    return digests, dropped
+
+
 def build_draft_prompt(project, config, candidates, top_report, recent_comments,
-                       style_assignment=None):
+                       style_assignment=None, digests=None):
     """DRAFT phase: write comments only for ripen-survivors.
 
     `candidates` is the list of decisions that passed the delta gate, each
-    annotated with ripen data (delta_up, delta_comments, composite). Claude
-    fetches each thread, reads context, then writes the best comment.
+    annotated with ripen data (delta_up, delta_comments, composite). Thread
+    content is pre-fetched by _prefetch_thread_digests and inlined per
+    candidate (tool-free turn since 2026-07-14; the model must not fetch).
 
     2026-05-19: `style_assignment` is the pick_style_for_post() result the
     discover phase already wrote into the plan JSON. Forwarding it here so
@@ -1078,11 +1222,15 @@ def build_draft_prompt(project, config, candidates, top_report, recent_comments,
                 history_line = "\n    " + _hb.replace("\n", "\n    ")
         except Exception:
             pass
+        digest_block = ""
+        if digests and c.get("thread_url") in digests:
+            _d = digests[c["thread_url"]]
+            digest_block = "\n    THREAD CONTENT:\n      " + _d.replace("\n", "\n      ")
         candidate_lines.append(
             f"  - {c['thread_url']}{delta_info}\n"
             f"    title: {c.get('thread_title', '')}\n"
             f"    suggested style: {c.get('engagement_style', '')}"
-            f"{history_line}"
+            f"{history_line}{digest_block}"
         )
     candidates_block = "\n".join(candidate_lines)
 
@@ -1120,13 +1268,8 @@ OMIT THESE (clear no-bridge cases only):
 - Project: study tool. Thread where you've ALREADY commented under any of our accounts (`already_posted=true` or our usernames in the comment list): obvious astroturfing. OMIT.
 - Any thread where you'd be embarrassed to have your comment shown next to a {project.get('name', 'this project')} link in the same Reddit thread.
 
-## Tools (via Bash)
-- Fetch thread: python3 {REDDIT_TOOLS} fetch "THREAD_URL"
-- Do NOT run any searches. The threads are already chosen.
-
-## CRITICAL Bash rules
-- NEVER use run_in_background=true. All commands foreground.
-- Fetch each thread once to read OP and top comments for context. Use the fetched content to apply the SELECTION GATE.
+## THREAD CONTENT (pre-fetched)
+Each candidate above carries a THREAD CONTENT block (OP + top comments), already fetched for you. You have NO tools this session: do NOT fetch, search, or browse anything. Apply the SELECTION GATE using the inlined content only. If a candidate is somehow missing its THREAD CONTENT block, OMIT it.
 
 ## CRITICAL CONTENT RULES (apply only to threads that pass the gate)
 - Go BIMODAL on length: 1 punchy sentence (<100 chars) OR 4-5 sentences of real substance. Avoid 2-3 sentence middle-ground.
@@ -1148,15 +1291,19 @@ OMIT THESE (clear no-bridge cases only):
 {get_voice_relationship_rule()}
 
 ## OUTPUT FORMAT
-For each thread that PASSES the SELECTION GATE, output one JSON object per line:
-{{"action": "post", "thread_url": "SAME_URL_AS_GIVEN", "reply_to_url": null, "text": "your comment here", "thread_author": "username", "thread_title": "thread title", "engagement_style": "{(style_assignment or {}).get('style') or 'style_name'}", "search_topic": "the seed concept", "new_style": null}}
+Return ONE JSON object with two arrays (a JSON schema is enforced on this session):
+
+{{"posts": [...], "rejects": [...]}}
+
+Each posts[] entry is one thread that PASSES the SELECTION GATE:
+{{"thread_url": "SAME_URL_AS_GIVEN", "reply_to_url": null, "text": "your comment here", "thread_author": "username", "thread_title": "thread title", "engagement_style": "{(style_assignment or {}).get('style') or 'style_name'}", "search_topic": "the seed concept", "new_style": null}}
 
-For threads that FAIL the gate, simply omit the post JSON above. The shell handles unhandled candidates correctly (Phase 0 salvage on the next cycle re-checks them, and one-strike ripen failure has already pruned dead threads).
+For threads that FAIL the gate, simply leave them out of posts. The shell handles unhandled candidates correctly (Phase 0 salvage on the next cycle re-checks them, and one-strike ripen failure has already pruned dead threads). When nothing passes, return {{"posts": [], "rejects": []}}.
 
-## OPTIONAL: proposed_excludes (self-improving denylist)
-When you OMIT a thread because of a recurring CLASS of false-positive (the SUB itself surfaces wrong-audience threads, not just this one thread), you MAY emit a second JSON line for that thread:
+## OPTIONAL: rejects[] (self-improving denylist)
+When you OMIT a thread because of a recurring CLASS of false-positive (the SUB itself surfaces wrong-audience threads, not just this one thread), you MAY add a rejects[] entry for that thread:
 
-{{"action": "reject", "thread_url": "SAME_URL_AS_GIVEN", "reason": "short reason", "proposed_excludes": ["subreddit:bestofredditorupdates"]}}
+{{"thread_url": "SAME_URL_AS_GIVEN", "reason": "short reason", "proposed_excludes": ["subreddit:bestofredditorupdates"]}}
 
 Rules:
 - proposed_excludes entries MUST use the typed form `subreddit:<slug>` (lowercase, no `r/` prefix). Future shape: `keyword:<word>` is accepted but unused today.
@@ -1176,7 +1323,7 @@ Examples of WRONG proposals (do not emit):
 - Reject a specific r/nursing thread because OP is venting → DO NOT exclude r/nursing (it's our target audience; just omit this thread)
 - Reject one r/anki thread that's off-topic → DO NOT exclude r/anki (core ICP)
 
-Output DONE after all JSONs (both post and reject lines, in any order). Do NOT narrate. Fetch, gate, draft-or-reject, output JSONs, DONE.
+Do NOT narrate. Gate, draft-or-reject, return the single JSON object.
 """
 
 
@@ -1366,9 +1513,77 @@ Do NOT describe what you are doing. Do NOT narrate. Just search, draft, output J
 """
 
 
+def run_claude_structured(prompt, timeout=1200):
+    """Run the draft turn through scripts/run_claude.sh, tag post-reddit-draft.
+
+    The tag is mapped in claude_job.py TAG_TO_TYPE, so run_claude.sh routes it
+    through the file job queue and the s4l-worker scheduled task performs the
+    LLM turn (mapped tags deliberately have NO claude -p fallback: on a box
+    with no live worker the provider times out with exit 79 and this phase
+    skips, exactly like the twitter draft lane when Claude Desktop is closed).
+    run_claude.sh also owns session accounting (claude_sessions cost rows); it
+    honors our pre-set CLAUDE_SESSION_ID so posts keep their attribution.
+
+    Returns (ok, result, usage): result is the parsed structured_output dict
+    (posts/rejects per REDDIT_DRAFT_SCHEMA), or raw text when the envelope
+    carried an unparseable result (caller falls back to the legacy JSONL
+    regex parsers), or an error string when ok is False.
+    """
+    usage = {"input_tokens": 0, "output_tokens": 0, "cache_read": 0,
+             "cache_create": 0, "cost_usd": 0.0}
+    session_id = str(uuid.uuid4())
+    usage["session_id"] = session_id
+    # Inherited by run_claude.sh (which honors a caller-set session id) and by
+    # the log_post -> reddit_tools.py chain for posts.claude_session_id.
+    os.environ["CLAUDE_SESSION_ID"] = session_id
+    env = os.environ.copy()
+    env.pop("ANTHROPIC_API_KEY", None)  # claude uses OAuth, not API key
+    cmd = ["bash", RUN_CLAUDE_SH, "post-reddit-draft", "-p",
+           "--output-format", "json", "--json-schema", REDDIT_DRAFT_SCHEMA]
+    try:
+        proc = subprocess.run(cmd, input=prompt, env=env, text=True,
+                              capture_output=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        return False, "TIMEOUT", usage
+    # run_claude.sh narrates on stderr (queue enqueue, quota stamps); forward
+    # into the run log so cycle debugging keeps its trail.
+    for ln in (proc.stderr or "").splitlines():
+        print(f"[post_reddit] {ln[:300]}", file=sys.stderr, flush=True)
+    text = (proc.stdout or "").strip()
+    if proc.returncode != 0:
+        # exit 79 = queue provider timeout (no live worker) — the standard
+        # claude-blocked skip code; the caller records draft_error and the
+        # candidates stay pending for the next cycle.
+        return False, (text[:2000] or f"exit {proc.returncode}"), usage
+    try:
+        envlp, _ = json.JSONDecoder().raw_decode(text)
+    except Exception as e:
+        return False, f"envelope parse error: {e}: {text[:500]}", usage
+    try:
+        usage["cost_usd"] = float(envlp.get("total_cost_usd") or 0.0)
+    except (TypeError, ValueError):
+        pass
+    so = envlp.get("structured_output")
+    if so is None:
+        so = envlp.get("result")
+    if isinstance(so, str):
+        try:
+            so = json.loads(so)
+        except (json.JSONDecodeError, TypeError):
+            pass  # caller regex-parses the raw text
+    return True, so, usage
+
+
 def run_claude(prompt, timeout=600):
     """Run claude -p in bare mode with Bash tool only (no MCP needed).
 
+    DEPRECATED 2026-07-14: the draft phase (the only caller) moved to
+    run_claude_structured, which routes through run_claude.sh -> the
+    claude_job.py queue (tag post-reddit-draft) so the s4l-worker scheduled
+    task performs the turn. Kept for reference and emergency manual use only;
+    do NOT wire new callers to this (it bypasses session cost accounting and
+    the queue seam).
+
     Streams output in real time to stderr (picked up by tee in the shell wrapper)
     while collecting the full output for JSON parsing.
     """
@@ -2210,8 +2425,29 @@ def _draft_iteration(plan, config, reddit_username):
     # the draft phase (the discover phase loads it for the search step).
     # Pass empty string; the trace audit still captures top_performers
     # and recent_comments, which is the bulk of the few-shot context.
+    # Tool-free turn (2026-07-14): fetch every thread HERE and inline the
+    # digests, so the draft prompt is pure text->JSON and queue-routable.
+    # Dead threads (archived/locked/blocked) are marked permanently failed
+    # now instead of at post time; transient fetch failures stay pending
+    # (dropped from THIS cycle only; Phase 0 salvage retries them).
+    _before_prefetch = len(candidates)
+    digests, dropped = _prefetch_thread_digests(candidates, reddit_username)
+    for _c, _why in dropped:
+        _url = _c.get("thread_url", "")
+        print(f"[post_reddit] prefetch drop {_url}: {_why}")
+        _db_mark_candidate_attempt(_url, reason=f"prefetch_{_why}", permanent=True)
+    candidates = [c for c in candidates if c.get("thread_url") in digests]
+    print(f"[post_reddit] prefetch: {len(candidates)} thread(s) inlined, "
+          f"{len(dropped)} dropped dead, "
+          f"{_before_prefetch - len(candidates) - len(dropped)} transient-skipped")
+    if not candidates:
+        plan = dict(plan)
+        plan["decisions"] = []
+        plan["phase"] = "draft"
+        return plan
+
     prompt = build_draft_prompt(project, config, candidates, top_report, recent_comments,
-                                style_assignment=style_assignment)
+                                style_assignment=style_assignment, digests=digests)
 
     # Build the generation_trace audit blob: what Claude is about to see.
     # Captured BEFORE the Claude call so we never end up with a post row
@@ -2243,17 +2479,31 @@ def _draft_iteration(plan, config, reddit_username):
 
     print(f"[post_reddit] Starting draft session for {len(candidates)} thread(s)...")
     start = time.time()
-    ok, output, usage = run_claude(prompt, timeout=600)
+    ok, output, usage = run_claude_structured(prompt, timeout=1200)
     elapsed = time.time() - start
     print(f"[post_reddit] Draft finished in {elapsed:.0f}s (${usage['cost_usd']:.4f})")
 
     if not ok:
-        print(f"[post_reddit] Draft FAILED: {output[:300]}")
+        print(f"[post_reddit] Draft FAILED: {str(output)[:300]}")
         plan["draft_error"] = "claude_failed"
         plan["draft_cost"] = usage["cost_usd"]
         return plan
 
-    drafted = parse_post_decisions(output)
+    if isinstance(output, dict):
+        # Queue/schema path: posts[] mirrors the legacy JSONL post-line shape.
+        drafted = []
+        _seen_urls = set()
+        for _d in output.get("posts") or []:
+            if not isinstance(_d, dict):
+                continue
+            _url = _d.get("thread_url", "")
+            if _d.get("text") and _url and _url not in _seen_urls:
+                _d.setdefault("action", "post")
+                drafted.append(_d)
+                _seen_urls.add(_url)
+    else:
+        # Legacy fallback: the envelope carried free text; regex-parse it.
+        drafted = parse_post_decisions(output or "")
     print(f"[post_reddit] Draft produced {len(drafted)} post(s)")
 
     # 2026-05-11: parse optional action=reject lines and forward any
@@ -2263,7 +2513,10 @@ def _draft_iteration(plan, config, reddit_username):
     # here MUST NOT kill the draft phase; the post pipeline is the critical
     # path. See parse_reject_decisions / _propose_excludes_from_rejects.
     try:
-        rejects = parse_reject_decisions(output)
+        if isinstance(output, dict):
+            rejects = [r for r in (output.get("rejects") or []) if isinstance(r, dict)]
+        else:
+            rejects = parse_reject_decisions(output or "")
         if rejects:
             cand_by_url = {c.get("thread_url"): c for c in candidates if c.get("thread_url")}
             counters = _propose_excludes_from_rejects(
@@ -2315,6 +2568,12 @@ def _draft_iteration(plan, config, reddit_username):
     plan["decisions"] = merged
     plan["draft_cost"] = usage["cost_usd"]
     plan["draft_session_id"] = usage.get("session_id")
+    # Also stamp the key _post_iteration actually reads: in two-phase mode
+    # (draft in process A, post in process B) it re-exports
+    # plan["session_id"] as CLAUDE_SESSION_ID, and this was never set after
+    # discover went programmatic (session attribution silently dropped on
+    # the two-phase path until 2026-07-14).
+    plan["session_id"] = usage.get("session_id")
     plan["phase"] = "draft"
     # Stash the picker assignment so _post_iteration (which runs in a
     # separate process via JSON-serialized plan) can pass it to
@@ -2362,6 +2621,10 @@ def _post_iteration(plan, reddit_username):
     failed = 0
 
     for i, decision in enumerate(decisions):
+        # Heartbeat the posting-active flag per row so readers see a fresh
+        # stamp for the whole drain (rows are ~45s + 180s inter-post sleeps;
+        # the reader freshness window is 120s, so re-stamp before EACH row).
+        _stamp_posting_active()
         thread_url = decision["thread_url"]
         reply_to_url = decision.get("reply_to_url")
         text = decision["text"]
@@ -2662,9 +2925,11 @@ def main():
                       f"posting. stderr: {(_chk.stderr or '').strip()[:300]}", file=sys.stderr)
                 sys.exit(3)
         try:
+            _stamp_posting_active()
             posted, failed = _post_iteration(plan, reddit_username)
             print(f"[post_reddit] phase=post project={plan.get('project_name')} posted={posted} failed={failed}")
         finally:
+            _clear_posting_active()
             # Clean up the generation_trace temp file. By this point every
             # post that landed has the trace JSONB persisted to its row,
             # so the on-disk file is redundant. Best-effort delete.

package/scripts/reddit_browser.py

@@ -243,8 +243,6 @@ def find_reddit_cdp_port():
     return None
 
 
-_LOCK_SESSION_ID = f"python:{os.getpid()}"
-
 # Path to the bash-lock lease helper. Bumping this lease from inside reddit_browser.py
 # is what shields Python-CDP pipelines (run-reddit-search, audit-reddit-resurrect,
 # stats.sh reddit phase, engage-reddit) from the watchdog's 60-90s reclaim. Those
@@ -279,72 +277,41 @@ def _heartbeat_bash_lease():
         pass  # Best-effort. Never fail a CDP op because of lease bookkeeping.
 
 
-def _release_browser_lock():
-    """Release the lock if we hold it."""
-    try:
-        if os.path.exists(LOCK_FILE):
-            with open(LOCK_FILE) as f:
-                lock = json.load(f)
-            if lock.get("session_id") == _LOCK_SESSION_ID:
-                os.remove(LOCK_FILE)
-    except (json.JSONDecodeError, OSError):
-        pass
+# ---- browser-session mutex (2026-07-14: shared implementation) -------------
+# The old inline lock here still had the check-then-write claim race AND the
+# dead-holder starvation (a SIGKILLed peer blocked everyone for the full
+# 300s LOCK_EXPIRY) that twitter_browser.py fixed on 2026-06-16. Both drivers
+# now share scripts/browser_mutex.py (twitter's proven mutex, parameterized):
+# reddit gains the O_EXCL atomic claim, dead-PID reclaim, batch inherit via
+# S4L_LOCK_OWNER, and role-aware posting priority (only active when a caller
+# sets S4L_LOCK_ROLE=post; default scan keeps today's no-preemption behavior).
+# The bash-lease bump rides the mutex's on_touch hook, so every acquire AND
+# refresh keeps the watchdog fed exactly as before.
+from browser_mutex import BrowserMutex
+
+_MUTEX = BrowserMutex(
+    lock_file=LOCK_FILE,
+    label="Reddit browser",
+    lock_expiry=LOCK_EXPIRY,
+    wait_max=LOCK_WAIT_MAX,
+    poll_interval=LOCK_POLL_INTERVAL,
+    on_touch=_heartbeat_bash_lease,
+)
 
 
-atexit.register(_release_browser_lock)
+def _acquire_browser_lock():
+    _MUTEX.acquire()
 
 
-def _acquire_browser_lock():
-    """Wait for the Reddit browser lock to free, then acquire it.
+def _refresh_browser_lock():
+    _MUTEX.refresh()
 
-    Polls every LOCK_POLL_INTERVAL seconds for up to LOCK_WAIT_MAX seconds.
-    Exits 1 only after exhausting the wait budget; the launchd caller will
-    retry on the next 5-min tick.
-    """
-    deadline = time.time() + LOCK_WAIT_MAX
-    while True:
-        if os.path.exists(LOCK_FILE):
-            try:
-                with open(LOCK_FILE) as f:
-                    lock = json.load(f)
-                age = time.time() - lock.get("timestamp", 0)
-                if age >= LOCK_EXPIRY:
-                    break
-                holder = lock.get("session_id", "unknown")
-                if time.time() >= deadline:
-                    print(json.dumps({
-                        "success": False,
-                        "error": f"Reddit browser locked by session {holder} ({int(age)}s); waited {LOCK_WAIT_MAX}s, giving up."
-                    }))
-                    sys.exit(1)
-                time.sleep(LOCK_POLL_INTERVAL)
-                continue
-            except (json.JSONDecodeError, OSError):
-                pass
-        break
-    with open(LOCK_FILE, "w") as f:
-        json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}, f)
-    # Also bump the bash-lock lease so the watchdog respects this CDP burst.
-    # See _heartbeat_bash_lease() for why: Python-CDP pipelines never trigger
-    # the MCP PreToolUse heartbeat hook, so without this call the watchdog
-    # would steal the bash lock at age >= 60s during legitimate CDP work.
-    _heartbeat_bash_lease()
 
+def _release_browser_lock():
+    _MUTEX.release()
 
-def _refresh_browser_lock():
-    """Refresh the lock timestamp to prevent expiry during long operations.
 
-    Also bumps the bash-lock lease so the watchdog won't reclaim during
-    multi-step CDP ops. Call this from inside long CDP flows (scroll loops,
-    multi-second waits) to keep both the python lock file mtime AND the bash
-    lease fresh.
-    """
-    try:
-        with open(LOCK_FILE, "w") as f:
-            json.dump({"session_id": _LOCK_SESSION_ID, "timestamp": int(time.time())}, f)
-    except OSError:
-        pass
-    _heartbeat_bash_lease()
+atexit.register(_release_browser_lock)
 
 
 # --- L1/L2 browser-hang guards (2026-07-13, mirrors twitter_browser.py) ------
@@ -589,6 +556,28 @@ def post_comment(thread_url, text):
             if "login" in page.url.lower():
                 return {"ok": False, "error": "not_logged_in"}
 
+            # Tab-collision guard (2026-07-14): every reddit pipeline shares
+            # the ONE harness tab, and a concurrent scan/fetch/engage session
+            # can navigate it between our goto and the checks below. The
+            # missing comment form then misclassified as account_blocked_in_sub
+            # (a PERMANENT verdict) — 5/5 approved cards false-positived this
+            # way on 2026-07-14. Verify the tab still shows OUR thread; re-goto
+            # once if hijacked, and classify a persistent hijack as the
+            # TRANSIENT tab_contention so the row is retried, never buried.
+            import re as _re
+            _tid_m = _re.search(r"/comments/([a-z0-9]+)", old_url)
+            _tid = _tid_m.group(1) if _tid_m else None
+
+            def _tab_is_ours():
+                return bool(_tid) and f"/comments/{_tid}" in (page.url or "")
+
+            if not _tab_is_ours():
+                page.goto(old_url, wait_until="domcontentloaded")
+                page.wait_for_timeout(3000)
+                _ensure_old_reddit(page)
+                if not _tab_is_ours():
+                    return {"ok": False, "error": "tab_contention"}
+
             # Check if the top-level comment form exists at all.
             # When the sub gates top-level commenting on this account (CrowdControl,
             # AutoMod karma/age threshold, mod-approved-only, shadowban), old reddit
@@ -596,10 +585,20 @@ def post_comment(thread_url, text):
             # page. The sub itself may be public; the gate is account-level. There
             # is no error banner and no API field that exposes this, so the only
             # signal is the missing form on a logged-in page load.
-            has_comment_form = page.locator(
-                ".commentarea .usertext.cloneable, .commentarea > form.usertext"
-            ).count() > 0
+            _form_sel = ".commentarea .usertext.cloneable, .commentarea > form.usertext"
+            has_comment_form = page.locator(_form_sel).count() > 0
+            if not has_comment_form:
+                # Slow-render tolerance: give the form a short explicit wait
+                # before concluding the sub gates this account (an instant
+                # count() on a slow load is another false-positive source).
+                try:
+                    page.locator(_form_sel).first.wait_for(state="attached", timeout=6000)
+                    has_comment_form = True
+                except Exception:
+                    pass
             if not has_comment_form:
+                if not _tab_is_ours():
+                    return {"ok": False, "error": "tab_contention"}
                 return {"ok": False, "error": "account_blocked_in_sub"}
 
             # Some subs render the form but show a gate notice instead of a usable

package/scripts/reddit_browser_fetch.py

@@ -39,12 +39,44 @@ def _default_cdp_url():
         or "http://127.0.0.1:9557"
 
 
+_POSTING_FLAG = os.path.join(
+    os.path.expanduser(os.environ.get("S4L_STATE_DIR") or "~/.social-autoposter-mcp"),
+    "reddit-posting-active.json",
+)
+_POSTING_FRESH_S = 120
+_POSTING_YIELD_MAX_S = 300
+
+
+def _yield_to_poster():
+    """Posting owns the ONE shared harness tab (2026-07-14). Every reader
+    fetch navigates the tab to the reddit host root, which is exactly what
+    yanked the tab out from under mid-post drains (the tab_contention /
+    false account_blocked_in_sub family). A fresh reddit-posting-active.json
+    (heartbeated per row by post_reddit.py) means a poster is mid-drain:
+    WAIT for it instead of navigating, bounded so a stale flag can never
+    starve discovery/stats (they just run a few minutes later)."""
+    deadline = time.time() + _POSTING_YIELD_MAX_S
+    waited = False
+    while time.time() < deadline:
+        try:
+            age = time.time() - os.path.getmtime(_POSTING_FLAG)
+        except OSError:
+            break  # no flag -> no poster
+        if age >= _POSTING_FRESH_S:
+            break  # stale flag -> dead poster; never blocks readers
+        waited = True
+        time.sleep(5)
+    if waited:
+        sys.stderr.write("[reddit_browser_fetch] yielded to active poster\n")
+
+
 def browser_get_json(url, cdp_url=None, timeout_ms=25000):
     """Fetch a Reddit JSON URL through the logged-in harness Chrome.
 
     Returns (body_str_or_None, http_status_int). On any transport/connect
     failure returns (None, 0) so the caller can fall back to urllib.
     """
+    _yield_to_poster()
     cdp_url = (cdp_url or _default_cdp_url())
     try:
         from playwright.sync_api import sync_playwright