@m13v/s4l 1.7.6-rc.2 → 1.7.6-rc.20

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -846,40 +846,28 @@ function parsePostCandidateResults(stdout) {
     }
     return [...byId.values()];
 }
-// Resolve the configured posting handle the SAME way account_resolver.py does:
-// AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
-// Returns the bare handle (no @) or null. The post preflight uses it so a missing
-// handle fails ONCE, loudly, instead of as N silent per-reply no_account_configured
-// skips (twitter_browser.py refuses to post with no handle — no impersonation).
-function readConfiguredTwitterHandle() {
+// Resolve the posting @handle through the ONE resolver (scripts/account_resolver.py:
+// env AUTOPOSTER_TWITTER_HANDLE -> config.json accounts.twitter.handle -> the durable
+// connect-time cookie mirror). Deferring to it, instead of re-reading config.json here,
+// keeps a single resolution path shared with the poster (twitter_browser.our_handle),
+// and keeps the handle in a single durable home (the cookie mirror) rather than a
+// second copy in config.json. Returns the bare handle (no @) or null; the preflight
+// refuses loudly on null so a missing handle fails ONCE, not as N silent per-reply
+// no_account_configured skips (and never as a hardcoded impersonation fallback).
+async function resolvePostingHandle() {
     const env = (process.env.AUTOPOSTER_TWITTER_HANDLE || "").trim().replace(/^@/, "");
     if (env)
         return env;
     try {
-        const cfg = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
-        const h = cfg?.accounts?.twitter?.handle;
-        const s = (typeof h === "string" ? h : "").trim().replace(/^@/, "");
-        return s || null;
-    }
-    catch {
-        return null;
-    }
-}
-// Self-heal a missing handle: read the live logged-in @handle from the managed
-// Chrome and persist it to config.json accounts.twitter.handle. This is ground
-// truth (the poster posts through that exact session), NOT a guess — so it's safe
-// where a hardcoded fallback would not be. Closes the onboarding gap where
-// connect_x's best-effort handle capture silently no-op'd and left posting dead.
-// Best-effort; never throws — the caller re-checks and refuses loudly if still unset.
-async function ensurePostingHandle() {
-    try {
-        await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
-            timeoutMs: 60_000,
+        const r = await runPython("scripts/account_resolver.py", ["twitter"], {
+            timeoutMs: 30_000,
             env: ({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
         });
+        const h = (r.stdout || "").trim().replace(/^@/, "");
+        return h || null;
     }
     catch {
-        /* best effort */
+        return null;
     }
 }
 async function ensureTwitterBrowserForPost() {
@@ -909,12 +897,57 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
+// Give-up bound for approved cards whose post attempts keep failing
+// transiently (browser lock contention, timeouts). 5 attempts spans several
+// drain cycles — plenty for genuine transients to clear — while guaranteeing
+// no card can retry forever (2026-07-17 zombie-card incident).
+const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
         c.discard_reason === "backend_status_expired");
 }
-function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+// Prompt-sandbox replay cards (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE)
+// carry experiments.sandbox=true; older sandbox rows predate that stamp but all
+// use the synthetic >=900,000,000 id range twitter_prompt_sandbox.py assigns.
+function isSandboxCandidate(c) {
+    const exps = c.experiments;
+    if (exps && typeof exps === "object" && exps.sandbox)
+        return true;
+    const id = Number(c.candidate_id);
+    return Number.isFinite(id) && id >= 900_000_000;
+}
+// Write field patches into the review-queue store UNDER ITS LOCK by shelling
+// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
+// _store_update and merge_review_queue.py hold around their read-modify-write.
+// Node has no native flock, and this process writing the store directly was
+// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
+// Returns false on any failure so callers can fall back to the legacy write.
+async function patchReviewStore(patches) {
+    if (!patches.length)
+        return true;
+    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
+    try {
+        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
+        const res = await runPython("scripts/store_patch.py", [tmp], {
+            timeoutMs: 30_000,
+            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -926,28 +959,106 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
+    //
+    // Review-queue store: go through the LOCKED patch path (store_patch.py)
+    // first. The fresh-read merge below closes most of the race window but not
+    // all of it — a menubar decision landing between our readPlan and writePlan
+    // still gets erased. The locked path holds the store's flock for the whole
+    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
+    // and enforces the same posted-sticky rules. Legacy path stays as the
+    // fallback and for per-batch /tmp plans (single writer, no lock needed).
+    try {
+        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
+        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
+            const patches = stamped.map((c) => {
+                const set = {};
+                const unset = [];
+                if (c.posted === true) {
+                    set.posted = true;
+                    set.terminal = false;
+                    if (c.our_url)
+                        set.our_url = c.our_url;
+                    // Clear a stale failure stamp too: the menubar's per-card call can
+                    // see posted=0 (the batch drain posted it under a different call)
+                    // and stamp post_failed on a card that IS live (seen on 565462,
+                    // 2026-07-17). posted is the settled truth; the residue just adds a
+                    // false "didn't post" signal to dashboards/notifications.
+                    unset.push("discard_reason", "post_failed", "post_error");
+                }
+                else if (c.terminal === true) {
+                    set.terminal = true;
+                    set.terminal_reason = c.terminal_reason ?? null;
+                    // See the zombie-card note in the legacy branch below: a terminal
+                    // from a real post attempt must clear the overridable expiry stamp.
+                    unset.push("discard_reason");
+                }
+                if (typeof c.post_attempts === "number")
+                    set.post_attempts = c.post_attempts;
+                return { candidate_id: c.candidate_id, set, unset };
+            });
+            if (await patchReviewStore(patches))
+                return;
+            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
+        }
+    }
+    catch {
+        /* fall through to the legacy write */
+    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
         if (fresh && Array.isArray(fresh.candidates)) {
+            // candidate_id is NOT unique in the review-queue store: sandbox reruns
+            // and re-merged drafts append sibling rows with the same id. Stamping
+            // only one sibling (the old Map single-slot) left the others matching
+            // the drain's approved && !posted && !terminal filter, so the backlog
+            // re-drained the same candidate every heartbeat forever (2026-07-17
+            // incident: 23-card loop at 60s cadence). Stamp EVERY row with the id.
             const freshById = new Map();
             fresh.candidates.forEach((c) => {
-                if (c.candidate_id !== undefined && c.candidate_id !== null)
-                    freshById.set(String(c.candidate_id), c);
+                if (c.candidate_id !== undefined && c.candidate_id !== null) {
+                    const key = String(c.candidate_id);
+                    const list = freshById.get(key);
+                    if (list)
+                        list.push(c);
+                    else
+                        freshById.set(key, [c]);
+                }
             });
             for (const c of stamped) {
-                const f = freshById.get(String(c.candidate_id));
-                if (!f)
-                    continue;
-                if (c.posted === true) {
-                    f.posted = true;
-                    f.terminal = false;
-                    if (c.our_url)
-                        f.our_url = c.our_url;
-                }
-                else if (c.terminal === true && f.posted !== true) {
-                    f.terminal = true;
-                    f.terminal_reason = c.terminal_reason;
+                for (const f of freshById.get(String(c.candidate_id)) ?? []) {
+                    if (c.posted === true) {
+                        f.posted = true;
+                        f.terminal = false;
+                        if (c.our_url)
+                            f.our_url = c.our_url;
+                        // A post outcome closes the card's history: the pre-approval
+                        // freshness stamp must not survive it. Same for a stale
+                        // post_failed from a peer call's posted=0 misattribution (see
+                        // the locked-patch branch above).
+                        delete f.discard_reason;
+                        delete f.post_failed;
+                        delete f.post_error;
+                    }
+                    else if (c.terminal === true && f.posted !== true) {
+                        f.terminal = true;
+                        f.terminal_reason = c.terminal_reason;
+                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
+                        // 5 days): a stale discard_reason="backend_status_expired" left on
+                        // the fresh copy makes expiredStampOverridable() treat THIS
+                        // post-outcome terminal as overridable, so every later drain
+                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
+                        // forever. A terminal that came from an actual post attempt is
+                        // final; delete the expiry stamp so the override can never fire
+                        // on it again. (The drain's own `delete c.discard_reason` happens
+                        // on an in-memory copy that is never the write source; this line
+                        // is the one that persists.)
+                        delete f.discard_reason;
+                    }
+                    // Carry the retry counter so the give-up bound survives across
+                    // drains (each drain reads the store fresh).
+                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
+                        f.post_attempts = c.post_attempts;
                 }
             }
             writePlan(batchId, fresh);
@@ -1043,7 +1154,12 @@ async function postApproved(batchId, plan) {
     // and the stamp is cleared so every downstream terminal check agrees it's live.
     const approved = (plan.candidates || []).filter((c) => c.approved === true &&
         c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)));
+        (c.terminal !== true || expiredStampOverridable(c)) &&
+        // Prompt-sandbox replays can never post (twitter_post_plan.py post_one()
+        // hard-refuses them), so draining one is pure churn: it burns a browser
+        // lock turn and, if its terminal stamp later loses a store-write race,
+        // loops forever. Exclude them here regardless of stamp state.
+        !isSandboxCandidate(c));
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -1241,7 +1357,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1254,9 +1370,8 @@ async function postApproved(batchId, plan) {
     // If onboarding never persisted it, self-heal from the live session; if even that
     // can't determine it, refuse here with a clear reason rather than launching a
     // poster that silently burns the whole batch.
-    if (!readConfiguredTwitterHandle())
-        await ensurePostingHandle();
-    if (!readConfiguredTwitterHandle()) {
+    const postingHandle = await resolvePostingHandle();
+    if (!postingHandle) {
         postingActive = false;
         stopPostingFlagHeartbeat();
         return {
@@ -1264,9 +1379,9 @@ async function postApproved(batchId, plan) {
             exit_code: 0,
             posted: 0,
             summary: "no_account_configured",
-            error: "X is connected but no posting @handle is configured, so every reply would be refused " +
-                "(no_account_configured). Re-run project_config action:'connect_x' to capture the handle, " +
-                "or set accounts.twitter.handle in config.json.",
+            error: "X is connected but no posting @handle could be resolved (env, config, or the " +
+                "connect-time cookie mirror), so every reply would be refused (no_account_configured). " +
+                "Re-run project_config action:'connect_x' to re-capture the handle.",
         };
     }
     // Mark posting active so the draft-cycle scan DEFERS launching any scan for the
@@ -1482,6 +1597,21 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
+                //
+                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
+                // unbounded retry is a zombie generator (one card retried 438 times
+                // over 5 days on the Nhat install). Count the transient failures and
+                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
+                // the last failure visible so the give-up is diagnosable, and the
+                // on-disk post-events trail records it for forensics.
+                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
+                c.post_attempts = attempts;
+                if (attempts >= MAX_POST_ATTEMPTS) {
+                    c.terminal = true;
+                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
+                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
+                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
+                }
                 touchedPlan = true;
             }
         });
@@ -1496,7 +1626,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        mergeApprovedStampsIntoStore(batchId, plan, approved);
+        await mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2741,6 +2871,16 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
+    // Review-queue store: snapshot every row now so the write below can be a
+    // field-level DIFF applied under the store lock (store_patch.py) instead
+    // of an unlocked whole-file replace. This function holds its in-memory
+    // plan across user think-time; a whole-file write here erased any menubar
+    // decision or merge that landed in between (the 2026-07-17 truth-loss
+    // family). Non-store batches keep the plain write: single writer.
+    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
+    const rowsBefore = isStoreBatch
+        ? candidates.map((c) => JSON.stringify(c))
+        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -2877,7 +3017,40 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    writePlan(batch_id, plan);
+    // Persist the decision mutations. Store batch: diff each row against its
+    // snapshot and apply only the changed fields under the store lock, so a
+    // concurrent menubar decision or merge is never erased. Anything else
+    // (per-batch /tmp plans): plain write, single writer.
+    let storeWriteDone = false;
+    if (isStoreBatch) {
+        const patches = [];
+        candidates.forEach((c, i) => {
+            const beforeRaw = rowsBefore[i];
+            const afterRaw = JSON.stringify(c);
+            if (beforeRaw === afterRaw)
+                return;
+            const before = JSON.parse(beforeRaw ?? "{}");
+            const after = JSON.parse(afterRaw);
+            const set = {};
+            const unset = [];
+            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
+                if (!(k in after) || after[k] === undefined) {
+                    if (k in before)
+                        unset.push(k);
+                }
+                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
+                    set[k] = after[k];
+                }
+            }
+            if (Object.keys(set).length || unset.length)
+                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
+        });
+        storeWriteDone = await patchReviewStore(patches);
+        if (!storeWriteDone)
+            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+    }
+    if (!storeWriteDone)
+        writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,
@@ -3468,8 +3641,8 @@ async function autopilotLoaded() {
 // fires every minute, claims ONE job, runs the pipeline's own prompt as its
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
-const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 240s -> 900s (see QUEUE_WORKER_POLL_SECONDS); version bump forces the prompt refresh that carries the new --wait-seconds onto existing installs. v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v10 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
 // sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
 // within one continuous worker session) instead of drafting inline. Validated
 // via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
@@ -3478,19 +3651,26 @@ const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_jo
 // notification) or the host kills the whole parent+child chain in 1-3 min.
 // Never live-fire tested against a real production job. Full design, what's
 // validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
-// Bump this constant to 9 only once that plan is actually implemented.
+// Bump this constant to 10 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
-// 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
-// live on 2026-07-06, and covers a meaningful chunk of the ~8min average
-// real job inter-arrival gap measured on the box, while still keeping each
-// worker session bounded. The cron's `* * * * *` cadence remains the outer
-// safety net for whatever the poll window doesn't catch.
+// 900s (15 min, per Matthew 2026-07-17, up from 240s): sits AT the single-
+// Bash-call survival ceiling verified live on 2026-07-06 (the host's ~90s
+// inactivity kill fires only on model silence, and one in-flight tool call
+// survived a full 900s probe). This covers the ~8min average real job
+// inter-arrival gap outright, so most jobs are claimed by an already-polling
+// session instead of paying a fresh spin-up, and MCP boot side effects
+// (backfill checks, backlog drains) run 1/15min instead of 1/5min. Watch
+// point: 900s has zero margin below the verified ceiling — if workers start
+// dying mid-poll with no reaper kill recorded, the host clipped the call;
+// back off to 600s. The cron's `* * * * *` cadence remains the outer safety
+// net for whatever the poll window doesn't catch.
 // COUPLING: scripts/reap_stale_claude_sessions.py's S4L_REAPER_CLAIM_GRACE_SEC
 // default MUST stay >= this value + margin — a claimless session inside this
 // poll window is legitimately still working, not a husk, and a too-tight
 // claim_grace would SIGTERM it mid-poll before it ever gets to claim.
-const QUEUE_WORKER_POLL_SECONDS = 240;
+// (Bumped to 1020s alongside this change.)
+const QUEUE_WORKER_POLL_SECONDS = 900;
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -5684,30 +5864,18 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// Post any cards the user APPROVED that never landed — e.g. a restart killed the
-// batch mid-way. "Proceed to post the already-approved items." postApproved is
-// idempotent (it filters posted/terminal), so this only drains the genuine
-// backlog and never double-posts. Best-effort; never throws.
-async function drainApprovedBacklog() {
-    try {
-        const plan = readPlan(REVIEW_QUEUE_ID);
-        const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true &&
-            c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)));
-        if (!backlog.length)
-            return;
-        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
-        await postApproved(REVIEW_QUEUE_ID, plan);
-    }
-    catch (e) {
-        console.error("[post] drainApprovedBacklog error:", e?.message || e);
-        // Same reasoning as the other postApproved call site: don't let an
-        // escaped exception leave the cross-instance posting flag stuck true.
-        postingActive = false;
-        stopPostingFlagHeartbeat();
-    }
-}
+// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
+// which was sane when boots meant "user launched Claude Desktop" — but each
+// queue-worker session boots its own MCP server, so the drain had silently
+// become a ~5-minute cron running across up to 4 concurrent MCP instances.
+// Combined with universal posting preemption, every drain wakeup SIGKILLed
+// whatever held the twitter-browser lock (profile scans included), and any
+// stamp bug turned into an infinite retry loop (438 retries over 5 days on
+// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
+// the menubar's _resume_approved_queue, which runs on loopback-reachable and
+// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
+// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
+// it and its resume covers the backlog.
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -5883,13 +6051,9 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
-    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
-    {
-        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
-        if (typeof t.unref === "function")
-            t.unref();
-    }
+    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
+    // here is gone — backlog recovery is owned by the menubar's periodic
+    // _resume_approved_queue (single drainer; see the removal note above).
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.

package/mcp/dist/telemetry.js

@@ -301,7 +301,8 @@ function collectStateSnapshot() {
         ["install_progress", "install-progress.json", 64_000],
         ["onboarding_progress", "onboarding-progress.json", 256_000],
         ["review_queue", "review-queue.json", 256_000],
-        ["approved_queue", "approved-queue.json", 256_000],
+        // approved-queue.json removed 2026-07-17: the ledger is gone; the review
+        // store is the only local decision record.
     ];
     for (const [key, file, cap] of stateFiles) {
         const val = readJsonCapped(path.join(stateDir, file), cap);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.2",
-  "installedAt": "2026-07-17T00:56:09.664Z"
+  "version": "1.7.6-rc.20",
+  "installedAt": "2026-07-17T22:21:49.587Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.2",
+  "version": "1.7.6-rc.20",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_browser_foreground.py

@@ -46,7 +46,13 @@ import s4l_log_relay
 
 # A managed harness Chrome is one launched on a profile under this marker
 # (browser-harness = twitter 9555, browser-harness-linkedin = 9556, ...).
-_PROFILE_MARKER = os.path.join(".claude", "browser-profiles", "browser-harness")
+# Any managed harness profile under browser-profiles/ counts — matching the
+# literal "browser-harness" prefix silently EXCLUDED the reddit harness
+# (profile "reddit-harness"), so reddit-Chrome activations went unlogged and
+# unattributable for days (2026-07-17). The remote-debugging-port requirement
+# in the check below keeps the user's own Chrome / MCP-agent profiles (which
+# use the debugging PIPE, not a port) out of scope.
+_PROFILE_MARKER = os.path.join(".claude", "browser-profiles", "")
 
 # Within this window, repeats of the same (cause, pid) are counted, not emitted.
 # A screencast-reconnect storm raises Chrome every few seconds; one line per