@m13v/s4l 1.7.6-rc.19 → 1.7.6-rc.2

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -846,28 +846,40 @@ function parsePostCandidateResults(stdout) {
     }
     return [...byId.values()];
 }
-// Resolve the posting @handle through the ONE resolver (scripts/account_resolver.py:
-// env AUTOPOSTER_TWITTER_HANDLE -> config.json accounts.twitter.handle -> the durable
-// connect-time cookie mirror). Deferring to it, instead of re-reading config.json here,
-// keeps a single resolution path shared with the poster (twitter_browser.our_handle),
-// and keeps the handle in a single durable home (the cookie mirror) rather than a
-// second copy in config.json. Returns the bare handle (no @) or null; the preflight
-// refuses loudly on null so a missing handle fails ONCE, not as N silent per-reply
-// no_account_configured skips (and never as a hardcoded impersonation fallback).
-async function resolvePostingHandle() {
+// Resolve the configured posting handle the SAME way account_resolver.py does:
+// AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
+// Returns the bare handle (no @) or null. The post preflight uses it so a missing
+// handle fails ONCE, loudly, instead of as N silent per-reply no_account_configured
+// skips (twitter_browser.py refuses to post with no handle — no impersonation).
+function readConfiguredTwitterHandle() {
     const env = (process.env.AUTOPOSTER_TWITTER_HANDLE || "").trim().replace(/^@/, "");
     if (env)
         return env;
     try {
-        const r = await runPython("scripts/account_resolver.py", ["twitter"], {
-            timeoutMs: 30_000,
+        const cfg = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
+        const h = cfg?.accounts?.twitter?.handle;
+        const s = (typeof h === "string" ? h : "").trim().replace(/^@/, "");
+        return s || null;
+    }
+    catch {
+        return null;
+    }
+}
+// Self-heal a missing handle: read the live logged-in @handle from the managed
+// Chrome and persist it to config.json accounts.twitter.handle. This is ground
+// truth (the poster posts through that exact session), NOT a guess — so it's safe
+// where a hardcoded fallback would not be. Closes the onboarding gap where
+// connect_x's best-effort handle capture silently no-op'd and left posting dead.
+// Best-effort; never throws — the caller re-checks and refuses loudly if still unset.
+async function ensurePostingHandle() {
+    try {
+        await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
+            timeoutMs: 60_000,
             env: ({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
         });
-        const h = (r.stdout || "").trim().replace(/^@/, "");
-        return h || null;
     }
     catch {
-        return null;
+        /* best effort */
     }
 }
 async function ensureTwitterBrowserForPost() {
@@ -897,57 +909,12 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
-// Give-up bound for approved cards whose post attempts keep failing
-// transiently (browser lock contention, timeouts). 5 attempts spans several
-// drain cycles — plenty for genuine transients to clear — while guaranteeing
-// no card can retry forever (2026-07-17 zombie-card incident).
-const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
         c.discard_reason === "backend_status_expired");
 }
-// Prompt-sandbox replay cards (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE)
-// carry experiments.sandbox=true; older sandbox rows predate that stamp but all
-// use the synthetic >=900,000,000 id range twitter_prompt_sandbox.py assigns.
-function isSandboxCandidate(c) {
-    const exps = c.experiments;
-    if (exps && typeof exps === "object" && exps.sandbox)
-        return true;
-    const id = Number(c.candidate_id);
-    return Number.isFinite(id) && id >= 900_000_000;
-}
-// Write field patches into the review-queue store UNDER ITS LOCK by shelling
-// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
-// _store_update and merge_review_queue.py hold around their read-modify-write.
-// Node has no native flock, and this process writing the store directly was
-// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
-// Returns false on any failure so callers can fall back to the legacy write.
-async function patchReviewStore(patches) {
-    if (!patches.length)
-        return true;
-    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
-    try {
-        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
-        const res = await runPython("scripts/store_patch.py", [tmp], {
-            timeoutMs: 30_000,
-            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
-        });
-        return res.code === 0;
-    }
-    catch {
-        return false;
-    }
-    finally {
-        try {
-            fs.unlinkSync(tmp);
-        }
-        catch {
-            /* best effort */
-        }
-    }
-}
-async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -959,106 +926,28 @@ async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
-    //
-    // Review-queue store: go through the LOCKED patch path (store_patch.py)
-    // first. The fresh-read merge below closes most of the race window but not
-    // all of it — a menubar decision landing between our readPlan and writePlan
-    // still gets erased. The locked path holds the store's flock for the whole
-    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
-    // and enforces the same posted-sticky rules. Legacy path stays as the
-    // fallback and for per-batch /tmp plans (single writer, no lock needed).
-    try {
-        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
-        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
-            const patches = stamped.map((c) => {
-                const set = {};
-                const unset = [];
-                if (c.posted === true) {
-                    set.posted = true;
-                    set.terminal = false;
-                    if (c.our_url)
-                        set.our_url = c.our_url;
-                    // Clear a stale failure stamp too: the menubar's per-card call can
-                    // see posted=0 (the batch drain posted it under a different call)
-                    // and stamp post_failed on a card that IS live (seen on 565462,
-                    // 2026-07-17). posted is the settled truth; the residue just adds a
-                    // false "didn't post" signal to dashboards/notifications.
-                    unset.push("discard_reason", "post_failed", "post_error");
-                }
-                else if (c.terminal === true) {
-                    set.terminal = true;
-                    set.terminal_reason = c.terminal_reason ?? null;
-                    // See the zombie-card note in the legacy branch below: a terminal
-                    // from a real post attempt must clear the overridable expiry stamp.
-                    unset.push("discard_reason");
-                }
-                if (typeof c.post_attempts === "number")
-                    set.post_attempts = c.post_attempts;
-                return { candidate_id: c.candidate_id, set, unset };
-            });
-            if (await patchReviewStore(patches))
-                return;
-            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
-        }
-    }
-    catch {
-        /* fall through to the legacy write */
-    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
         if (fresh && Array.isArray(fresh.candidates)) {
-            // candidate_id is NOT unique in the review-queue store: sandbox reruns
-            // and re-merged drafts append sibling rows with the same id. Stamping
-            // only one sibling (the old Map single-slot) left the others matching
-            // the drain's approved && !posted && !terminal filter, so the backlog
-            // re-drained the same candidate every heartbeat forever (2026-07-17
-            // incident: 23-card loop at 60s cadence). Stamp EVERY row with the id.
             const freshById = new Map();
             fresh.candidates.forEach((c) => {
-                if (c.candidate_id !== undefined && c.candidate_id !== null) {
-                    const key = String(c.candidate_id);
-                    const list = freshById.get(key);
-                    if (list)
-                        list.push(c);
-                    else
-                        freshById.set(key, [c]);
-                }
+                if (c.candidate_id !== undefined && c.candidate_id !== null)
+                    freshById.set(String(c.candidate_id), c);
             });
             for (const c of stamped) {
-                for (const f of freshById.get(String(c.candidate_id)) ?? []) {
-                    if (c.posted === true) {
-                        f.posted = true;
-                        f.terminal = false;
-                        if (c.our_url)
-                            f.our_url = c.our_url;
-                        // A post outcome closes the card's history: the pre-approval
-                        // freshness stamp must not survive it. Same for a stale
-                        // post_failed from a peer call's posted=0 misattribution (see
-                        // the locked-patch branch above).
-                        delete f.discard_reason;
-                        delete f.post_failed;
-                        delete f.post_error;
-                    }
-                    else if (c.terminal === true && f.posted !== true) {
-                        f.terminal = true;
-                        f.terminal_reason = c.terminal_reason;
-                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
-                        // 5 days): a stale discard_reason="backend_status_expired" left on
-                        // the fresh copy makes expiredStampOverridable() treat THIS
-                        // post-outcome terminal as overridable, so every later drain
-                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
-                        // forever. A terminal that came from an actual post attempt is
-                        // final; delete the expiry stamp so the override can never fire
-                        // on it again. (The drain's own `delete c.discard_reason` happens
-                        // on an in-memory copy that is never the write source; this line
-                        // is the one that persists.)
-                        delete f.discard_reason;
-                    }
-                    // Carry the retry counter so the give-up bound survives across
-                    // drains (each drain reads the store fresh).
-                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
-                        f.post_attempts = c.post_attempts;
+                const f = freshById.get(String(c.candidate_id));
+                if (!f)
+                    continue;
+                if (c.posted === true) {
+                    f.posted = true;
+                    f.terminal = false;
+                    if (c.our_url)
+                        f.our_url = c.our_url;
+                }
+                else if (c.terminal === true && f.posted !== true) {
+                    f.terminal = true;
+                    f.terminal_reason = c.terminal_reason;
                 }
             }
             writePlan(batchId, fresh);
@@ -1154,12 +1043,7 @@ async function postApproved(batchId, plan) {
     // and the stamp is cleared so every downstream terminal check agrees it's live.
     const approved = (plan.candidates || []).filter((c) => c.approved === true &&
         c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)) &&
-        // Prompt-sandbox replays can never post (twitter_post_plan.py post_one()
-        // hard-refuses them), so draining one is pure churn: it burns a browser
-        // lock turn and, if its terminal stamp later loses a store-write race,
-        // loops forever. Exclude them here regardless of stamp state.
-        !isSandboxCandidate(c));
+        (c.terminal !== true || expiredStampOverridable(c)));
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -1357,7 +1241,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1370,8 +1254,9 @@ async function postApproved(batchId, plan) {
     // If onboarding never persisted it, self-heal from the live session; if even that
     // can't determine it, refuse here with a clear reason rather than launching a
     // poster that silently burns the whole batch.
-    const postingHandle = await resolvePostingHandle();
-    if (!postingHandle) {
+    if (!readConfiguredTwitterHandle())
+        await ensurePostingHandle();
+    if (!readConfiguredTwitterHandle()) {
         postingActive = false;
         stopPostingFlagHeartbeat();
         return {
@@ -1379,9 +1264,9 @@ async function postApproved(batchId, plan) {
             exit_code: 0,
             posted: 0,
             summary: "no_account_configured",
-            error: "X is connected but no posting @handle could be resolved (env, config, or the " +
-                "connect-time cookie mirror), so every reply would be refused (no_account_configured). " +
-                "Re-run project_config action:'connect_x' to re-capture the handle.",
+            error: "X is connected but no posting @handle is configured, so every reply would be refused " +
+                "(no_account_configured). Re-run project_config action:'connect_x' to capture the handle, " +
+                "or set accounts.twitter.handle in config.json.",
         };
     }
     // Mark posting active so the draft-cycle scan DEFERS launching any scan for the
@@ -1597,21 +1482,6 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
-                //
-                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
-                // unbounded retry is a zombie generator (one card retried 438 times
-                // over 5 days on the Nhat install). Count the transient failures and
-                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
-                // the last failure visible so the give-up is diagnosable, and the
-                // on-disk post-events trail records it for forensics.
-                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
-                c.post_attempts = attempts;
-                if (attempts >= MAX_POST_ATTEMPTS) {
-                    c.terminal = true;
-                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
-                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
-                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
-                }
                 touchedPlan = true;
             }
         });
@@ -1626,7 +1496,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        await mergeApprovedStampsIntoStore(batchId, plan, approved);
+        mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2871,16 +2741,6 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
-    // Review-queue store: snapshot every row now so the write below can be a
-    // field-level DIFF applied under the store lock (store_patch.py) instead
-    // of an unlocked whole-file replace. This function holds its in-memory
-    // plan across user think-time; a whole-file write here erased any menubar
-    // decision or merge that landed in between (the 2026-07-17 truth-loss
-    // family). Non-store batches keep the plain write: single writer.
-    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
-    const rowsBefore = isStoreBatch
-        ? candidates.map((c) => JSON.stringify(c))
-        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -3017,40 +2877,7 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    // Persist the decision mutations. Store batch: diff each row against its
-    // snapshot and apply only the changed fields under the store lock, so a
-    // concurrent menubar decision or merge is never erased. Anything else
-    // (per-batch /tmp plans): plain write, single writer.
-    let storeWriteDone = false;
-    if (isStoreBatch) {
-        const patches = [];
-        candidates.forEach((c, i) => {
-            const beforeRaw = rowsBefore[i];
-            const afterRaw = JSON.stringify(c);
-            if (beforeRaw === afterRaw)
-                return;
-            const before = JSON.parse(beforeRaw ?? "{}");
-            const after = JSON.parse(afterRaw);
-            const set = {};
-            const unset = [];
-            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
-                if (!(k in after) || after[k] === undefined) {
-                    if (k in before)
-                        unset.push(k);
-                }
-                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
-                    set[k] = after[k];
-                }
-            }
-            if (Object.keys(set).length || unset.length)
-                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
-        });
-        storeWriteDone = await patchReviewStore(patches);
-        if (!storeWriteDone)
-            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
-    }
-    if (!storeWriteDone)
-        writePlan(batch_id, plan);
+    writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,
@@ -3641,8 +3468,8 @@ async function autopilotLoaded() {
 // fires every minute, claims ONE job, runs the pipeline's own prompt as its
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
-const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 240s -> 900s (see QUEUE_WORKER_POLL_SECONDS); version bump forces the prompt refresh that carries the new --wait-seconds onto existing installs. v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-// v10 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
 // sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
 // within one continuous worker session) instead of drafting inline. Validated
 // via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
@@ -3651,26 +3478,19 @@ const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 2
 // notification) or the host kills the whole parent+child chain in 1-3 min.
 // Never live-fire tested against a real production job. Full design, what's
 // validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
-// Bump this constant to 10 only once that plan is actually implemented.
+// Bump this constant to 9 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
-// 900s (15 min, per Matthew 2026-07-17, up from 240s): sits AT the single-
-// Bash-call survival ceiling verified live on 2026-07-06 (the host's ~90s
-// inactivity kill fires only on model silence, and one in-flight tool call
-// survived a full 900s probe). This covers the ~8min average real job
-// inter-arrival gap outright, so most jobs are claimed by an already-polling
-// session instead of paying a fresh spin-up, and MCP boot side effects
-// (backfill checks, backlog drains) run 1/15min instead of 1/5min. Watch
-// point: 900s has zero margin below the verified ceiling — if workers start
-// dying mid-poll with no reaper kill recorded, the host clipped the call;
-// back off to 600s. The cron's `* * * * *` cadence remains the outer safety
-// net for whatever the poll window doesn't catch.
+// 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
+// live on 2026-07-06, and covers a meaningful chunk of the ~8min average
+// real job inter-arrival gap measured on the box, while still keeping each
+// worker session bounded. The cron's `* * * * *` cadence remains the outer
+// safety net for whatever the poll window doesn't catch.
 // COUPLING: scripts/reap_stale_claude_sessions.py's S4L_REAPER_CLAIM_GRACE_SEC
 // default MUST stay >= this value + margin — a claimless session inside this
 // poll window is legitimately still working, not a husk, and a too-tight
 // claim_grace would SIGTERM it mid-poll before it ever gets to claim.
-// (Bumped to 1020s alongside this change.)
-const QUEUE_WORKER_POLL_SECONDS = 900;
+const QUEUE_WORKER_POLL_SECONDS = 240;
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -5864,18 +5684,30 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
-// which was sane when boots meant "user launched Claude Desktop" — but each
-// queue-worker session boots its own MCP server, so the drain had silently
-// become a ~5-minute cron running across up to 4 concurrent MCP instances.
-// Combined with universal posting preemption, every drain wakeup SIGKILLed
-// whatever held the twitter-browser lock (profile scans included), and any
-// stamp bug turned into an infinite retry loop (438 retries over 5 days on
-// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
-// the menubar's _resume_approved_queue, which runs on loopback-reachable and
-// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
-// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
-// it and its resume covers the backlog.
+// Post any cards the user APPROVED that never landed — e.g. a restart killed the
+// batch mid-way. "Proceed to post the already-approved items." postApproved is
+// idempotent (it filters posted/terminal), so this only drains the genuine
+// backlog and never double-posts. Best-effort; never throws.
+async function drainApprovedBacklog() {
+    try {
+        const plan = readPlan(REVIEW_QUEUE_ID);
+        const cands = plan?.candidates || [];
+        const backlog = cands.filter((c) => c.approved === true &&
+            c.posted !== true &&
+            (c.terminal !== true || expiredStampOverridable(c)));
+        if (!backlog.length)
+            return;
+        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
+        await postApproved(REVIEW_QUEUE_ID, plan);
+    }
+    catch (e) {
+        console.error("[post] drainApprovedBacklog error:", e?.message || e);
+        // Same reasoning as the other postApproved call site: don't let an
+        // escaped exception leave the cross-instance posting flag stuck true.
+        postingActive = false;
+        stopPostingFlagHeartbeat();
+    }
+}
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -6051,9 +5883,13 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
-    // here is gone — backlog recovery is owned by the menubar's periodic
-    // _resume_approved_queue (single drainer; see the removal note above).
+    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
+    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
+    {
+        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
+        if (typeof t.unref === "function")
+            t.unref();
+    }
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.

package/mcp/dist/telemetry.js

@@ -301,8 +301,7 @@ function collectStateSnapshot() {
         ["install_progress", "install-progress.json", 64_000],
         ["onboarding_progress", "onboarding-progress.json", 256_000],
         ["review_queue", "review-queue.json", 256_000],
-        // approved-queue.json removed 2026-07-17: the ledger is gone; the review
-        // store is the only local decision record.
+        ["approved_queue", "approved-queue.json", 256_000],
     ];
     for (const [key, file, cap] of stateFiles) {
         const val = readJsonCapped(path.join(stateDir, file), cap);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.19",
-  "installedAt": "2026-07-17T22:21:24.853Z"
+  "version": "1.7.6-rc.2",
+  "installedAt": "2026-07-17T00:56:09.664Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.19",
+  "version": "1.7.6-rc.2",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_browser_foreground.py

@@ -46,13 +46,7 @@ import s4l_log_relay
 
 # A managed harness Chrome is one launched on a profile under this marker
 # (browser-harness = twitter 9555, browser-harness-linkedin = 9556, ...).
-# Any managed harness profile under browser-profiles/ counts — matching the
-# literal "browser-harness" prefix silently EXCLUDED the reddit harness
-# (profile "reddit-harness"), so reddit-Chrome activations went unlogged and
-# unattributable for days (2026-07-17). The remote-debugging-port requirement
-# in the check below keeps the user's own Chrome / MCP-agent profiles (which
-# use the debugging PIPE, not a port) out of scope.
-_PROFILE_MARKER = os.path.join(".claude", "browser-profiles", "")
+_PROFILE_MARKER = os.path.join(".claude", "browser-profiles", "browser-harness")
 
 # Within this window, repeats of the same (cause, pid) are counted, not emitted.
 # A screencast-reconnect storm raises Chrome every few seconds; one line per