@m13v/s4l 1.7.5-rc.26 → 1.7.5-rc.28

package/mcp/dist/runtime.js

@@ -637,16 +637,34 @@ export function startProvisioning() {
     }
     return readProgress() ?? freshProgress();
 }
-// Bounded auto-retry for a provision that ended in failure. Called from the
-// runtime `status` handler on each poll: if the last run failed (done && !ok)
-// and nothing is in flight, kick a fresh run so a TRANSIENT failure (a dropped
-// Chromium download, a flaky DMG mount) self-heals during normal status polling
-// instead of parking until the next server boot. The venv/harness steps clean
-// their own partial artifacts, so a retry starts from a clean slate. Capped so a
-// genuinely broken environment (no network, no disk) surfaces the error instead
-// of looping forever. Returns true if it started a retry.
+// Bounded auto-retry for a provision that ended in failure OR silently died.
+// Called from the runtime `status` handler on each poll. Two distinct dead
+// states, both recoverable the same way:
+//   1. done && !ok — a real failure (fail() ran to completion).
+//   2. running still true, but updated_at hasn't moved in a long time — the
+//      HOLDING PROCESS WAS KILLED mid-provision (e.g. Claude Desktop quit
+//      mid-install: its onQuitCleanup path closes the MCP server abruptly,
+//      never reaching the .finally() that releases the provision lock or
+//      calls fail()). Confirmed live on the MacStadium QA box 2026-07-15: a
+//      quit ~16s into the Chromium step froze install-progress.json at
+//      "running": true forever. The reconnecting process(es) that spawned
+//      seconds later saw the lock file as still-fresh (< PROVISION_LOCK_STALE_MS
+//      old at that moment) and correctly deferred to it — but nothing ever
+//      retried afterward, because case 1's guard doesn't match "running", and
+//      ensureRuntimeProvisioned() only fires once, at process boot. Case 2
+//      closes that gap: once updated_at is stale enough that the holder is
+//      certainly dead, treat it exactly like case 1 — the venv/harness steps
+//      already clean their own partial artifacts, and startProvisioning()'s
+//      tryAcquireProvisionLock() will find the (by-now very stale) lock file
+//      and correctly reclaim it.
+// Capped so a genuinely broken environment (no network, no disk) surfaces the
+// error instead of looping forever. Returns true if it started a retry.
 let autoRetryCount = 0;
 const MAX_AUTO_RETRIES = 3;
+// Deliberately well above PROVISION_LOCK_STALE_MS (60s): a heartbeat this old
+// cannot be a merely-slow step (the heartbeat ticks every 15s regardless of
+// what the step itself is doing), only a dead holder.
+const STALLED_RUNNING_MS = 120_000;
 export function retryProvisionIfStalled() {
     try {
         if (runtimeReady())
@@ -654,8 +672,13 @@ export function retryProvisionIfStalled() {
         if (isProvisioning())
             return false;
         const p = readProgress();
-        if (!(p && p.done && !p.ok))
-            return false; // only retry a real failure
+        const failed = !!(p && p.done && !p.ok);
+        const zombieRunning = !!(p &&
+            p.running &&
+            !p.done &&
+            Date.now() - new Date(p.updated_at).getTime() > STALLED_RUNNING_MS);
+        if (!(failed || zombieRunning))
+            return false;
         if (autoRetryCount >= MAX_AUTO_RETRIES)
             return false;
         autoRetryCount += 1;

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.5-rc.26",
-  "installedAt": "2026-07-15T23:48:20.436Z"
+  "version": "1.7.5-rc.28",
+  "installedAt": "2026-07-16T00:10:58.816Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.5-rc.26",
+  "version": "1.7.5-rc.28",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -1070,6 +1070,21 @@ class S4LMenuBar(rumps.App):
     def _toggle_promotion(self, _=None):
         self._toggle_lane(st.MODE_PROMOTION)
 
+    def _toggle_canvas_review(self, _=None):
+        """Menu: flip which review surface presents pending drafts. Persisted
+        (st.write_review_layout), so it survives a restart; an already-open
+        surface keeps driving through whichever module it started with
+        (_review_mod_name) -- this only changes what the NEXT presentation
+        uses. See _review_mod()."""
+        current = st.read_review_layout()
+        st.write_review_layout("cards" if current == "canvas" else "canvas")
+        self._sig = None
+        try:
+            self._tick(None)
+        except Exception as e:
+            sys.stderr.write(f"[s4l-menubar] canvas toggle rebuild failed: {e}\n")
+            sys.stderr.flush()
+
     # Personal-brand share presets for the both-lanes-on state. rumps has no
     # slider, so the "Lane split" submenu offers these fixed points; the
     # dashboard's slider can set anything in between and the checkmark simply
@@ -2788,19 +2803,38 @@ class S4LMenuBar(rumps.App):
         until = self._last_presented_at + cadence
         return until if (cadence > 0 and now < until) else 0.0
 
+    def _review_mod(self):
+        """Which review-surface module drives the review-drafts flow: the
+        module that owns the currently open panel/window when one is open
+        (so a mid-session flip of the "Canvas review" checkbox never talks to
+        the wrong surface for an already-open one), else the persisted
+        st.read_review_layout() preference for a FRESH presentation. Both
+        modules expose the exact same present_review*/extend_active/
+        prune_active/active_status/heal_active/focus_active/dismiss_active
+        surface (see s4l_card_canvas.py's module docstring), so every call
+        site below is agnostic to which one this returns."""
+        name = self._review_mod_name or st.read_review_layout()
+        if name == "canvas":
+            import s4l_card_canvas
+
+            return "canvas", s4l_card_canvas
+        import s4l_card
+
+        return "cards", s4l_card
+
     def _review_now(self, _=None):
         """Menu: bring the pending draft cards up right now. Clears any snooze;
         this is the one presentation path that may take keyboard focus (the
         user explicitly asked for the cards)."""
         self._set_snooze(0.0)
         try:
-            import s4l_card
+            _, mod = self._review_mod()
 
-            if s4l_card.active_status():
+            if mod.active_status():
                 # A card is already on screen (user clicked while one is up,
                 # perhaps parked on another display): bring it to them instead.
-                s4l_card.heal_active()
-                s4l_card.focus_active()
+                mod.heal_active()
+                mod.focus_active()
                 return
         except Exception:
             pass
@@ -2856,14 +2890,17 @@ class S4LMenuBar(rumps.App):
         if self._review_active:
             if self._panel_open:
                 try:
-                    import s4l_card
+                    # _review_mod_name is already pinned to whichever module
+                    # actually opened this panel (set below); _review_mod()
+                    # returns that same module, not a fresh preference read.
+                    _, mod = self._review_mod()
 
                     prev_ns = {n for n, _ in (self._last_review_sig or ())}
                     cur_ns = {d.get("n") for d in drafts}
                     vanished = prev_ns - cur_ns
                     if vanished:
-                        s4l_card.prune_active(vanished)
-                    s4l_card.extend_active(drafts)
+                        mod.prune_active(vanished)
+                    mod.extend_active(drafts)
                 except Exception as e:
                     sys.stderr.write(f"[s4l-menubar] extend cards failed: {e}\n")
                     sys.stderr.flush()
@@ -2889,6 +2926,9 @@ class S4LMenuBar(rumps.App):
             self._review_active = True
             self._panel_open = True
         try:
+            layout_name, mod = self._review_mod()
+            self._review_mod_name = layout_name
+
             import s4l_card
 
             # present_feedback (the menu bar's feedback item) falls back to
@@ -2896,14 +2936,23 @@ class S4LMenuBar(rumps.App):
             # card shows. Same pattern for the title bar's "Discard all…"
             # button (moved out of the dropdown 2026-07-10), which reuses the
             # bulk-discard handler wholesale, confirmation alert included.
+            # Both are s4l_card-only surfaces (the standalone feedback panel
+            # and the corner card's title-bar accessory; the canvas has no
+            # equivalent title-bar button — "Select all" + "Discard
+            # selected" already cover that case natively), so this stays
+            # unconditional on s4l_card regardless of which layout is about
+            # to present, and never goes stale if the layout is switched.
             s4l_card.set_feedback_handler(self._on_feedback_text)
             s4l_card.set_discard_all_handler(self._discard_all_pending)
-            s4l_card.present_review(
-                drafts,
+            present_kwargs = dict(
                 on_decision=lambda d: self._on_card_decision(batch, d),
                 on_complete=lambda decisions: self._on_review_closed(batch, decisions),
                 focus=focus,
             )
+            if layout_name == "canvas":
+                mod.present_review_canvas(drafts, **present_kwargs)
+            else:
+                mod.present_review(drafts, **present_kwargs)
             # Record as shown only AFTER the cards are actually up, so a transient
             # card-UI failure never permanently suppresses this pending set.
             self._last_review_sig = sig
@@ -2914,11 +2963,12 @@ class S4LMenuBar(rumps.App):
             # notifies once per episode); a stderr line keeps fresh stacks
             # greppable.
             n = len(drafts)
-            sys.stderr.write(f"[s4l-menubar] presented {n} draft card(s)\n")
+            sys.stderr.write(f"[s4l-menubar] presented {n} draft{'s' if n != 1 else ''} ({layout_name})\n")
         except Exception as e:
-            # Card UI unavailable — don't strand the batch; chat review still works.
+            # Review UI unavailable — don't strand the batch; chat review still works.
             self._review_active = False
             self._panel_open = False
+            self._review_mod_name = None
             sys.stderr.write(f"[s4l-menubar] review cards failed: {e}\n")
             sys.stderr.flush()
             _capture(e, phase="review_cards")
@@ -2933,9 +2983,9 @@ class S4LMenuBar(rumps.App):
         once per episode; after REVIEW_UNATTENDED_SENTRY_SECONDS emit one
         Sentry event so ignored review surfaces are visible fleet-wide."""
         try:
-            import s4l_card
+            _, mod = self._review_mod()
 
-            status = s4l_card.active_status()
+            status = mod.active_status()
         except Exception:
             return
         if not status or not status.get("pending"):
@@ -2959,7 +3009,7 @@ class S4LMenuBar(rumps.App):
             self._review_heal_at = now
             healed = False
             try:
-                healed = s4l_card.heal_active()
+                healed = mod.heal_active()
             except Exception as e:
                 sys.stderr.write(f"[s4l-menubar] review heal failed: {e}\n")
                 sys.stderr.flush()
@@ -3132,6 +3182,10 @@ class S4LMenuBar(rumps.App):
         # isn't re-presented as a fresh batch.
         with self._review_lock:
             self._panel_open = False
+            # The surface is confirmed gone: release the pin so the NEXT
+            # presentation re-resolves from st.read_review_layout() (picks up
+            # a "Canvas review" toggle flipped while this one was open).
+            self._review_mod_name = None
             if self._posts_outstanding <= 0:
                 self._review_active = False
                 self._reset_posting_progress_locked()
@@ -3229,13 +3283,14 @@ class S4LMenuBar(rumps.App):
 
         threading.Thread(target=_persist_discard, daemon=True).start()
         try:
-            import s4l_card
+            _, mod = self._review_mod()
 
-            s4l_card.dismiss_active()
+            mod.dismiss_active()
         except Exception:
             pass
         with self._review_lock:
             self._panel_open = False
+            self._review_mod_name = None
             if self._posts_outstanding <= 0:
                 self._review_active = False
                 self._reset_posting_progress_locked()
@@ -3514,6 +3569,14 @@ class S4LMenuBar(rumps.App):
                 split_menu.add(it)
             items.append(split_menu)
 
+        # Review surface layout: the one-at-a-time corner card (default) vs.
+        # the large centered multi-select canvas (2026-07-15). Always visible
+        # for the same reason as the lane checkmarks above — a standing
+        # preference, not tied to whether anything is pending right now.
+        canvas_item = rumps.MenuItem("Canvas review", callback=self._toggle_canvas_review)
+        canvas_item.state = 1 if st.read_review_layout() == "canvas" else 0
+        items.append(canvas_item)
+
         # Reveal cadence: how often fresh draft cards may pop (the drafting
         # pipeline is unchanged; this only paces the pop-up). Always offered:
         # it is the "don't interrupt me every few minutes" control.

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.5-rc.26",
+  "version": "1.7.5-rc.28",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.5-rc.26",
+  "version": "1.7.5-rc.28",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/reddit_browser_fetch.py

@@ -33,6 +33,9 @@ import sys
 import time
 from urllib.parse import urlparse
 
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from browser_mutex import BrowserMutex
+
 
 def _default_cdp_url():
     return os.environ.get("REDDIT_CDP_URL", "http://127.0.0.1:9557").strip() \
@@ -70,6 +73,50 @@ def _yield_to_poster():
         sys.stderr.write("[reddit_browser_fetch] yielded to active poster\n")
 
 
+# ---- browser-session mutex (2026-07-15) -------------------------------------
+# Overlapping run-reddit-search.sh cycles are BY DESIGN (the "double-fork
+# wrapper" in that script deliberately lets cycles stack when one runs longer
+# than the 15-min launchd interval, which is routine — cycles regularly take
+# 20-40 min). Every one of those cycles' discover-phase fetches calls
+# browser_get_json, and until now nothing serialized them: two concurrent
+# calls both reuse the SAME harness tab (see the tab-reuse comment below), so
+# one call's page.goto() destroys the other's in-flight page.evaluate()
+# execution context ("Execution context was destroyed, most likely because
+# of a navigation" / "TypeError: Failed to fetch"). That failure returns
+# (None, 0), the caller falls back to urllib, and urllib has been 403'd by
+# Reddit's bot wall since 2026-05-28 — so what looks like "Reddit blocked us"
+# is actually two of our own readers racing each other.
+#
+# reddit_browser.py (posting) already fixed this class of bug for itself via
+# scripts/browser_mutex.py (twitter's proven mutex, parameterized) — same
+# lock_file, same JSON shape, so this shares that lock domain rather than
+# adding a fourth divergent one. Role defaults to "scan" (a read), matching
+# every other reader; BrowserMutex's own env read means an actual role="post"
+# caller would still inherit posting priority automatically.
+_LOCK_FILE = os.path.expanduser("~/.claude/reddit-agent-lock.json")
+_MUTEX = BrowserMutex(
+    lock_file=_LOCK_FILE,
+    label="Reddit browser",
+    lock_expiry=300,
+    wait_max=45,
+    poll_interval=2,
+)
+
+
+def _acquire_fetch_lock() -> bool:
+    """True if the tab is ours. BrowserMutex.acquire() prints a JSON error and
+    sys.exit(1)s on contention timeout — correct for a CLI entrypoint like
+    reddit_browser.py's own callers, but browser_get_json is a library call
+    nested inside reddit_tools.py/post_reddit.py and must degrade to its
+    documented (None, 0) contract instead of killing the caller process."""
+    try:
+        _MUTEX.acquire()
+        return True
+    except SystemExit:
+        sys.stderr.write("[reddit_browser_fetch] tab lock contended; skipping this fetch\n")
+        return False
+
+
 def browser_get_json(url, cdp_url=None, timeout_ms=25000):
     """Fetch a Reddit JSON URL through the logged-in harness Chrome.
 
@@ -88,73 +135,81 @@ def browser_get_json(url, cdp_url=None, timeout_ms=25000):
     host = parsed.netloc or "www.reddit.com"
     host_root = f"{parsed.scheme or 'https'}://{host}/"
 
-    with sync_playwright() as p:
-        browser = None
-        page = None
-        try:
-            browser = p.chromium.connect_over_cdp(cdp_url)
-            if not browser.contexts:
-                sys.stderr.write("[reddit_browser_fetch] no CDP contexts on harness\n")
-                return None, 0
-            ctx = browser.contexts[0]
-            # Reuse an existing tab instead of new_page() on every fetch. new_page()
-            # steals OS focus each call (there are many discovery fetches per cycle,
-            # so this churned the user's focus constantly); navigating a background
-            # tab does not. Prefer a tab already on reddit.com; else pages[0]; else
-            # create one. Mirrors reddit_browser / twitter_browser tab reuse. The
-            # page is left OPEN for the next fetch (cleanup_harness_tabs trims to one
-            # at cycle start).
+    # Tab access is mutex-protected (2026-07-15, see _MUTEX above): everything
+    # from tab selection through the evaluate retries must be atomic relative
+    # to every other concurrent fetch, since they all share the ONE reused tab.
+    if not _acquire_fetch_lock():
+        return None, 0
+    try:
+        with sync_playwright() as p:
+            browser = None
             page = None
-            for pg in ctx.pages:
-                if "reddit.com" in (pg.url or "") and "login" not in (pg.url or ""):
-                    page = pg
-                    break
-            if page is None and ctx.pages:
-                page = ctx.pages[0]
-            if page is None:
-                page = ctx.new_page()
-            # Load the matching host root so the subsequent fetch() is same-origin
-            # (no CORS between www/old) and carries the logged-in session.
             try:
-                page.goto(host_root, wait_until="load", timeout=timeout_ms)
-            except Exception:
-                pass  # partial load is fine; we just need an active reddit origin
-            # Same-origin fetch with a couple retries — reddit.com sometimes does a
-            # client redirect on first load that destroys the execution context.
-            js = (
-                "async (u) => {"
-                "  const r = await fetch(u, {credentials:'include',"
-                "                            headers:{'Accept':'application/json'}});"
-                "  const t = await r.text();"
-                "  return {status: r.status, body: t};"
-                "}"
-            )
-            last_err = None
-            for attempt in range(3):
+                browser = p.chromium.connect_over_cdp(cdp_url)
+                if not browser.contexts:
+                    sys.stderr.write("[reddit_browser_fetch] no CDP contexts on harness\n")
+                    return None, 0
+                ctx = browser.contexts[0]
+                # Reuse an existing tab instead of new_page() on every fetch. new_page()
+                # steals OS focus each call (there are many discovery fetches per cycle,
+                # so this churned the user's focus constantly); navigating a background
+                # tab does not. Prefer a tab already on reddit.com; else pages[0]; else
+                # create one. Mirrors reddit_browser / twitter_browser tab reuse. The
+                # page is left OPEN for the next fetch (cleanup_harness_tabs trims to one
+                # at cycle start).
+                page = None
+                for pg in ctx.pages:
+                    if "reddit.com" in (pg.url or "") and "login" not in (pg.url or ""):
+                        page = pg
+                        break
+                if page is None and ctx.pages:
+                    page = ctx.pages[0]
+                if page is None:
+                    page = ctx.new_page()
+                # Load the matching host root so the subsequent fetch() is same-origin
+                # (no CORS between www/old) and carries the logged-in session.
                 try:
-                    res = page.evaluate(js, url)
-                    status = int(res.get("status", 0))
-                    body = res.get("body") or ""
-                    if status != 200:
-                        return None, status
-                    return body, status
-                except Exception as e:
-                    last_err = e
-                    time.sleep(2.0)  # let a redirect settle, then retry
-            sys.stderr.write(f"[reddit_browser_fetch] evaluate failed after retries: {last_err}\n")
-            return None, 0
-        except Exception as e:
-            sys.stderr.write(f"[reddit_browser_fetch] error: {e}\n")
-            return None, 0
-        finally:
-            # Do NOT close the page: it is a REUSED tab, and closing it forces the
-            # next fetch to new_page() which steals OS focus. Leaving it open lets
-            # the next fetch reuse it (cleanup_harness_tabs trims to one at cycle
-            # start). Also never close the connect_over_cdp browser/context: that can
-            # terminate the real harness Chrome (see reddit_browser.py warning). The
-            # sync_playwright() context exit disconnects the CDP client cleanly
-            # without killing the remote browser.
-            pass
+                    page.goto(host_root, wait_until="load", timeout=timeout_ms)
+                except Exception:
+                    pass  # partial load is fine; we just need an active reddit origin
+                # Same-origin fetch with a couple retries — reddit.com sometimes does a
+                # client redirect on first load that destroys the execution context.
+                js = (
+                    "async (u) => {"
+                    "  const r = await fetch(u, {credentials:'include',"
+                    "                            headers:{'Accept':'application/json'}});"
+                    "  const t = await r.text();"
+                    "  return {status: r.status, body: t};"
+                    "}"
+                )
+                last_err = None
+                for attempt in range(3):
+                    try:
+                        res = page.evaluate(js, url)
+                        status = int(res.get("status", 0))
+                        body = res.get("body") or ""
+                        if status != 200:
+                            return None, status
+                        return body, status
+                    except Exception as e:
+                        last_err = e
+                        time.sleep(2.0)  # let a redirect settle, then retry
+                sys.stderr.write(f"[reddit_browser_fetch] evaluate failed after retries: {last_err}\n")
+                return None, 0
+            except Exception as e:
+                sys.stderr.write(f"[reddit_browser_fetch] error: {e}\n")
+                return None, 0
+            finally:
+                # Do NOT close the page: it is a REUSED tab, and closing it forces the
+                # next fetch to new_page() which steals OS focus. Leaving it open lets
+                # the next fetch reuse it (cleanup_harness_tabs trims to one at cycle
+                # start). Also never close the connect_over_cdp browser/context: that can
+                # terminate the real harness Chrome (see reddit_browser.py warning). The
+                # sync_playwright() context exit disconnects the CDP client cleanly
+                # without killing the remote browser.
+                pass
+    finally:
+        _MUTEX.release()
 
 
 def main(argv):

package/skill/run-twitter-cycle.sh

@@ -2154,7 +2154,14 @@ SKIP_FILE="/tmp/twitter_cycle_skips_${BATCH_ID}.json"
 # of stale phase2a (20-min budget). Without this stamp, mid-Phase-2b runs get
 # wrongly salvaged once 20 min elapse past phase2a's start, creating false
 # phase2b_silent run-monitor rows even when posts succeeded.
-python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-prep 2>&1 | tee -a "$LOG_FILE" || true
+# Sandbox short-circuit: skip so a sandbox run never auto-creates a
+# twitter_batches row (advance's own "auto-creates the row if start was
+# missed" fallback would otherwise silently do it, since sandbox mode never
+# calls 'start' — found live 2026-07-15, a stray sandbox-* row landed in
+# production twitter_batches from this exact call).
+if [ -z "${S4L_SANDBOX_CANDIDATES_FILE:-}" ]; then
+    python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-prep 2>&1 | tee -a "$LOG_FILE" || true
+fi
 log "Re-acquiring twitter-browser lock for Phase 2b-prep (read+draft only)..."
 acquire_lock "twitter-browser" 3600 2>>"$LOG_FILE"
 log "twitter-browser lock held (pid=$$) Phase 2b-prep"
@@ -2700,7 +2707,10 @@ fi
 # phase2b-gen has the longest budget (60 min) because the SEO landing-page
 # build can legitimately run 10-40 min. Stamping it here is what protects
 # this cycle from being salvaged out from under itself.
-python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-gen 2>&1 | tee -a "$LOG_FILE" || true
+# Same sandbox short-circuit as the phase2b-prep advance above.
+if [ -z "${S4L_SANDBOX_CANDIDATES_FILE:-}" ]; then
+    python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-gen 2>&1 | tee -a "$LOG_FILE" || true
+fi
 log "Phase 2b-gen: generating SEO pages for $PLAN_COUNT candidate(s) without holding the browser lock..."
 python3 "$REPO_DIR/scripts/twitter_gen_links.py" --plan "$PLAN_FILE" 2>&1 | tee -a "$LOG_FILE"
 GEN_EXIT=${PIPESTATUS[0]:-1}
@@ -2781,7 +2791,10 @@ fi
 # Stamp phase2b-post (15-min budget) before the browser-side reply loop. After
 # 2b-gen's potentially long run, peer cycles' 20-min phase2a fallback would
 # already be tripping if we left the row at phase2a.
-python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-post 2>&1 | tee -a "$LOG_FILE" || true
+# Same sandbox short-circuit as the phase2b-prep advance above.
+if [ -z "${S4L_SANDBOX_CANDIDATES_FILE:-}" ]; then
+    python3 "$REPO_DIR/scripts/twitter_batch_phase.py" advance "$BATCH_ID" --phase phase2b-post 2>&1 | tee -a "$LOG_FILE" || true
+fi
 # Always re-acquire: the lock was released right after thread-media capture
 # (before Claude drafting), well before 2b-gen, so it is never still held here.
 log "Re-acquiring twitter-browser lock for Phase 2b-post..."