@m13v/s4l 1.7.6-rc.39 → 1.7.6-rc.40

package/mcp/dist/index.js

@@ -4715,15 +4715,15 @@ async function ensureMemorySnapshotInstalled() {
 }
 // ---- pause/resume: stop drafting/posting without touching Claude Desktop ---
 // Unlike Quit (which kills + relaunches Claude Desktop and deletes the draft
-// schedule), Pause only unloads the launchd jobs that actually DO work — the
-// kicker that scans/drafts/posts (TWITTER_AUTOPILOT_LABEL) plus its reaper,
-// stall-watch, and memory-snapshot support daemons — while leaving Claude
-// Desktop, the tray, and the Claude-native s4l-worker scheduled task alone.
-// The scheduled task still fires on its own cadence; claude_job.py's `next`
-// checks the same flag file and reports "no work" instantly instead of
+// schedule), Pause only unloads the launchd jobs that actually DO work — every
+// pipeline kicker (X cycle, Reddit discovery) plus the reaper, stall-watch, and
+// memory-snapshot support daemons — while leaving Claude Desktop, the tray, and
+// the Claude-native s4l-worker scheduled task alone. The scheduled task still
+// fires on its own cadence; claude_job.py's `next` checks the same flag file
+// (at entry AND on every poll iteration) and reports "no work" instead of
 // draining the queue, so nothing drafts or posts while paused even if a
 // worker session wakes up mid-pause. A flag file (nothing is deleted) is what
-// makes Resume a plain reinstall of the same 4 daemons — see resumeS4L.
+// makes Resume a plain reinstall of the same daemons — see resumeS4L.
 function pauseFlagPath() {
     return path.join(s4lStateDir(), "paused.flag");
 }
@@ -4735,15 +4735,38 @@ function isPaused() {
         return false;
     }
 }
+// THE single registry of pausable pipeline daemons. Pause unloads exactly this
+// set, Resume reinstalls exactly this set (each ensure re-applies its own
+// install gates: draftable lane, reddit connected, etc.), boot skips exactly
+// this set while paused, and the label list is mirrored to
+// <state>/pause-targets.json so the menubar's Python pause button
+// (mcp/menubar/s4l_state.py) acts on the same set without a second hardcoded
+// list. Add a new pipeline daemon HERE and every pause surface picks it up.
+// Feedback-digest is deliberately absent: it only distills past review
+// decisions, not drafting/posting, so it keeps running while paused.
 const PAUSE_TARGETS = [
-    { label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST },
-    { label: REAPER_LABEL, plist: REAPER_PLIST },
-    { label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST },
-    { label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST },
+    { tag: "queue-worker", label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST, ensure: ensureQueueKickerInstalled },
+    { tag: "reddit-kicker", label: REDDIT_SEARCH_LABEL, plist: REDDIT_SEARCH_PLIST, ensure: ensureRedditKickerInstalled },
+    { tag: "claude-reaper", label: REAPER_LABEL, plist: REAPER_PLIST, ensure: ensureClaudeReaperInstalled },
+    { tag: "stall-watch", label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST, ensure: ensureStallWatchInstalled },
+    { tag: "memory-snapshot", label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST, ensure: ensureMemorySnapshotInstalled },
 ];
+// Mirror the pausable label set into the state dir for the menubar's Python
+// pause/resume (which can't import this module). Written at boot and on every
+// pause/resume so the two surfaces can't drift.
+function writePauseTargetsManifest() {
+    try {
+        fs.mkdirSync(s4lStateDir(), { recursive: true });
+        fs.writeFileSync(path.join(s4lStateDir(), "pause-targets.json"), JSON.stringify({ labels: PAUSE_TARGETS.map((t) => t.label) }) + "\n", "utf-8");
+    }
+    catch {
+        /* best-effort */
+    }
+}
 async function pauseS4L() {
     if (isPaused())
         return { ok: true, detail: "already paused" };
+    writePauseTargetsManifest();
     try {
         fs.mkdirSync(path.dirname(pauseFlagPath()), { recursive: true });
         fs.writeFileSync(pauseFlagPath(), `paused at ${new Date().toISOString()}\n`, "utf-8");
@@ -4771,17 +4794,18 @@ async function resumeS4L() {
     catch {
         /* best-effort */
     }
-    const kicker = await ensureQueueKickerInstalled();
-    const reaper = await ensureClaudeReaperInstalled();
-    const stall = await ensureStallWatchInstalled();
-    const mem = await ensureMemorySnapshotInstalled();
-    const detail = [
-        `kicker: ${kicker.ok ? "ok" : "skip"} (${kicker.detail})`,
-        `reaper: ${reaper.ok ? "ok" : "skip"} (${reaper.detail})`,
-        `stall-watch: ${stall.ok ? "ok" : "skip"} (${stall.detail})`,
-        `memory-snapshot: ${mem.ok ? "ok" : "skip"} (${mem.detail})`,
-    ].join("; ");
-    return { ok: true, detail };
+    writePauseTargetsManifest();
+    const results = [];
+    for (const t of PAUSE_TARGETS) {
+        try {
+            const r = await t.ensure();
+            results.push(`${t.tag}: ${r.ok ? "ok" : "skip"} (${r.detail})`);
+        }
+        catch (e) {
+            results.push(`${t.tag}: ${e?.message || e}`);
+        }
+    }
+    return { ok: true, detail: results.join("; ") };
 }
 // Install/refresh the on-screen overlay watcher launchd job. Promotes the
 // harness status overlay from a best-effort, fired-from-other-tools nicety to a
@@ -5822,7 +5846,7 @@ appTool("dashboard", {
         (snap.update_available && snap.latest_version ? ` (update to ${snap.latest_version})` : "") +
         ` — projects ${snap.projects_ready}/${snap.projects_total} ready, ` +
         `X ${snap.x_connected ? "connected" : "not connected"}, ` +
-        `autopilot ${snap.autopilot_on ? "on" : "off"}.`;
+        `autopilot ${snap.paused ? "PAUSED" : snap.autopilot_on ? "on" : "off"}.`;
     const base = {
         content: [{ type: "text", text: human }],
         structuredContent: { snapshot: JSON.stringify(snap) },
@@ -6074,73 +6098,34 @@ async function main() {
     catch (e) {
         console.error(`[queue-worker] could not create worker folder: ${e?.message || e}`);
     }
-    // The 4 pipeline daemons (kicker, reaper, stall-watch, memory-snapshot) are
-    // skipped at boot while paused.flag is present, so a Claude Desktop restart
+    // Pausable pipeline daemons — one loop over the SAME registry pause/resume
+    // use (PAUSE_TARGETS: X kicker, reddit kicker, reaper, stall-watch,
+    // memory-snapshot), so boot can never install a daemon Pause doesn't cover.
+    // Each is skipped while paused.flag is present, so a Claude Desktop restart
     // during a Pause doesn't silently un-pause the pipeline — see pauseS4L/
-    // resumeS4L. Feedback-digest is NOT gated: it only distills past review
-    // decisions, not drafting/posting, so it's harmless to keep running.
-    if (!isPaused()) {
-        void ensureQueueKickerInstalled()
-            .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
-    }
-    else {
-        console.error("[queue-worker] launchd kicker: skip (paused)");
-    }
-    // Reddit discovery kicker (optional platform): installs only when reddit is
-    // connected AND a draftable lane exists (product ready OR active persona, via
-    // the shared draftableLaneStatus). A box that never connected reddit is a cheap
-    // no-op skip. This boot-time call also SELF-HEALS installs broken by the old
-    // product-only gate: once the gate passes, the plist lands on the next boot
-    // (worker sessions boot ~1/min). Paused-gated like the X kicker (produces drafts).
-    if (!isPaused()) {
-        void ensureRedditKickerInstalled()
-            .then((r) => console.error(`[reddit-kicker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[reddit-kicker] kicker install failed:", e?.message || e));
-    }
-    else {
-        console.error("[reddit-kicker] launchd kicker: skip (paused)");
-    }
-    // Self-healing reaper for the agent-mode session leak the queue autopilot
-    // produces (finished `claude` worker sessions Desktop never tears down). A
-    // standalone guardrail; install unconditionally so it caps memory even on a
-    // box whose project isn't ready yet. Best-effort; must never block boot.
-    if (!isPaused()) {
-        void ensureClaudeReaperInstalled()
-            .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
-    }
-    else {
-        console.error("[claude-reaper] launchd reaper: skip (paused)");
+    // resumeS4L. Each ensure keeps its own install gates (draftable lane, reddit
+    // connected, etc.); a box that never connected reddit is a cheap no-op skip.
+    // The boot-time call also SELF-HEALS installs broken by older gates: once a
+    // gate passes, the plist lands on the next boot. All best-effort; never block
+    // boot.
+    writePauseTargetsManifest();
+    for (const t of PAUSE_TARGETS) {
+        if (isPaused()) {
+            console.error(`[${t.tag}] launchd ${t.label}: skip (paused)`);
+            continue;
+        }
+        void t.ensure()
+            .then((r) => console.error(`[${t.tag}] launchd: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error(`[${t.tag}] launchd install failed:`, e?.message || e));
     }
     // Feedback digest: hourly distillation of the user's card approve/reject
     // decisions into learned_preferences (see scripts/feedback_digest.py).
-    // Best-effort; a box with no review events runs a no-op.
+    // Best-effort; a box with no review events runs a no-op. NOT pause-gated (and
+    // not in PAUSE_TARGETS): it only distills past review decisions, not
+    // drafting/posting, so it's harmless to keep running.
     void ensureFeedbackDigestInstalled()
         .then((r) => console.error(`[feedback-digest] launchd digest: ${r.ok ? "ok" : "skip"} (${r.detail})`))
         .catch((e) => console.error("[feedback-digest] digest install failed:", e?.message || e));
-    // Autopilot stall watchdog: fleet-side Sentry alert when the draft routines stop
-    // draining (most often an account switch orphaning them). The menu bar shows the
-    // user the Re-arm action; this is the part we see. Best-effort; never blocks boot.
-    if (!isPaused()) {
-        void ensureStallWatchInstalled()
-            .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
-    }
-    else {
-        console.error("[stall-watch] launchd watchdog: skip (paused)");
-    }
-    // Periodic host-resource sampler (memory/process snapshot -> local JSONL). Gives
-    // us per-box resource history to diagnose RAM blowups (e.g. the agent-mode
-    // session leak). Best-effort; never blocks boot. Disable with S4L_MEMORY_SNAPSHOT=0.
-    if (!isPaused()) {
-        void ensureMemorySnapshotInstalled()
-            .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
-    }
-    else {
-        console.error("[memory-snapshot] launchd sampler: skip (paused)");
-    }
     // On-screen overlay watcher supervisor. The harness status overlay only renders
     // while the watcher process is alive, and that watcher had no supervisor — when
     // it died nothing respawned it and the overlay silently vanished. Install it as

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.39",
-  "installedAt": "2026-07-18T17:11:26.296Z"
+  "version": "1.7.6-rc.40",
+  "installedAt": "2026-07-18T17:26:43.722Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.39",
+  "version": "1.7.6-rc.40",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_state.py

@@ -90,22 +90,42 @@ def state_dir() -> str:
 # to the MCP: this needs to work from BOTH the menu bar (s4l_menubar.py) and
 # the Claude-independent dashboard_server.py, which share this process but
 # are a different process from the MCP server, so there's no way to delegate
-# to mcp/src/index.ts's pauseS4L/resumeS4L here. Mirrors those functions
-# (same 4 labels, same flag path) for the common pause->resume case. What it
-# deliberately does NOT do: mcp/src/index.ts's resumeS4L also re-runs the
-# readiness-gated install logic (persona/project/X-verified checks, content-
-# aware plist rewrite) via ensure*Installed() — that only matters for a box
-# that was never fully set up before Pause, an edge case the next Claude
-# boot / project_config call naturally heals once unpaused. This resume just
-# reloads the exact plists Pause unloaded (Pause never deletes anything).
+# to mcp/src/index.ts's pauseS4L/resumeS4L here. The label SET is not
+# duplicated though: index.ts's PAUSE_TARGETS registry is the single source of
+# truth, mirrored to <state>/pause-targets.json at every MCP boot and
+# pause/resume; pause_target_labels() reads that manifest, so a pipeline daemon
+# added to the registry reaches this button without touching this file.
+# PAUSE_TARGET_LABELS below is only the fallback for a box whose MCP has never
+# written the manifest. What this resume deliberately does NOT do:
+# mcp/src/index.ts's resumeS4L also re-runs the readiness-gated install logic
+# (persona/project/X-verified checks, content-aware plist rewrite) via
+# ensure*Installed() — that only matters for a box that was never fully set up
+# before Pause, an edge case the next Claude boot / project_config call
+# naturally heals once unpaused. This resume just reloads the exact plists
+# Pause unloaded (Pause never deletes anything).
 PAUSE_TARGET_LABELS = (
     AUTOPILOT_LABEL,
+    "com.m13v.social-reddit-search",
     "com.m13v.social-claude-reaper",
     "com.m13v.social-autopilot-stall-watch",
     "com.m13v.social-memory-snapshot",
 )
 
 
+def pause_target_labels() -> tuple:
+    try:
+        data = json.loads((Path(state_dir()) / "pause-targets.json").read_text())
+        labels = tuple(
+            l for l in data.get("labels", [])
+            if isinstance(l, str) and l.startswith("com.m13v.")
+        )
+        if labels:
+            return labels
+    except Exception:
+        pass
+    return PAUSE_TARGET_LABELS
+
+
 def pause_flag_path() -> str:
     return os.path.join(state_dir(), "paused.flag")
 
@@ -125,7 +145,7 @@ def pause_s4l() -> dict:
         return {"ok": False, "paused": is_paused(), "detail": f"could not write pause flag: {e}"}
     uid = os.getuid()
     results = []
-    for label in PAUSE_TARGET_LABELS:
+    for label in pause_target_labels():
         try:
             subprocess.run(
                 ["launchctl", "bootout", f"gui/{uid}/{label}"],
@@ -147,7 +167,7 @@ def resume_s4l() -> dict:
     uid = os.getuid()
     la_dir = str(Path.home() / "Library" / "LaunchAgents")
     results = []
-    for label in PAUSE_TARGET_LABELS:
+    for label in pause_target_labels():
         plist = os.path.join(la_dir, f"{label}.plist")
         if not os.path.exists(plist):
             results.append(f"{label}: no plist, skip")

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.39",
+  "version": "1.7.6-rc.40",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.39",
+  "version": "1.7.6-rc.40",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/claude_job.py

@@ -608,14 +608,26 @@ def _atomic_write_text(path: str, text: str) -> None:
 
 
 def _sweep_stale() -> int:
-    """Remove pending/running job files older than STALE_TTL_S. Returns count."""
+    """GC job files orphaned by dead producers. Returns count removed.
+
+    Two different TTLs on purpose:
+      - pending/: a job unclaimed past the producer's whole wait window
+        (DEFAULT_TIMEOUT_S + margin) has no live producer left to consume its
+        result — drafting it later only burns a worker turn on a stale prompt.
+        This is the leak signature of a producer that was SIGKILLed by its
+        external wrapper before its own timeout-cleanup ran (2026-07-18: three
+        orphaned reddit-draft jobs piled up while paused).
+      - running/: a claimed job may legitimately still be drafting, so it gets
+        the longer STALE_TTL_S before we conclude the worker died too.
+    """
     removed = 0
     now = time.time()
-    roots = [running_dir()]
+    pending_ttl = DEFAULT_TIMEOUT_S + 120
+    roots = [(running_dir(), STALE_TTL_S)]
     pend = os.path.join(queue_root(), "pending")
     if os.path.isdir(pend):
-        roots += [os.path.join(pend, d) for d in os.listdir(pend)]
-    for d in roots:
+        roots += [(os.path.join(pend, d), pending_ttl) for d in os.listdir(pend)]
+    for d, ttl in roots:
         if not os.path.isdir(d):
             continue
         for name in os.listdir(d):
@@ -625,7 +637,7 @@ def _sweep_stale() -> int:
             try:
                 with open(fp) as f:
                     created = json.load(f).get("created_at", 0)
-                if now - float(created) > STALE_TTL_S:
+                if now - float(created) > ttl:
                     os.remove(fp)
                     removed += 1
             except Exception:
@@ -719,6 +731,13 @@ def cmd_provider(ns) -> int:
                 % (_before_len - len(prompt))
             )
 
+    # S4L paused: refuse to enqueue at all. Workers won't claim while paused, so
+    # an enqueued job would just sit in pending/ while this producer burns its
+    # whole wait window "drafting" and then dies to its external timeout.
+    if _is_paused():
+        _plog(f"S4L paused; refusing to enqueue {qtype} job")
+        return 1
+
     job_id = uuid.uuid4().hex
     created = time.time()
     # Cycle batch id (run-twitter-cycle.sh exports BATCH_ID) so every provider.log
@@ -749,11 +768,31 @@ def cmd_provider(ns) -> int:
     _act_write(qtype)
 
     res_path = os.path.join(result_dir(), f"{job_id}.json")
-    deadline = created + ns.timeout
+    # Give up before ns.timeout, not at it: external wrappers (post_reddit's
+    # subprocess timeout, gtimeout in shell lanes) start their clocks at
+    # process start — before stdin read + enqueue — so an internal deadline of
+    # exactly created + timeout LOSES that race and the producer gets SIGKILLed
+    # before the cleanup below ever runs (2026-07-18 deathwatch "unexpected
+    # death" at enqueue+1800s, leaking pending files and a stuck "drafting"
+    # label). The 60s margin guarantees the graceful path wins.
+    deadline = created + max(60, ns.timeout - 60)
     last_hb = created  # last menu-bar heartbeat (see below)
     claimed_at = None  # set the moment a worker moves the job pending/ -> running/
     while time.time() < deadline:
         now = time.time()
+        # Pause landed mid-wait: abandon immediately with the same cleanup the
+        # timeout path does, instead of blocking the full wait window against a
+        # queue no worker will drain while paused.
+        if _is_paused():
+            _plog(f"job {job_id} abandoned: S4L paused mid-wait; cleaning up")
+            for p in (pending_path, running_path):
+                try:
+                    os.remove(p)
+                except OSError:
+                    pass
+            _act_clear()
+            _disarm_deathwatch(job_id)
+            return 1
         # A worker claims a job by atomically renaming pending/ -> running/, so the
         # pending file vanishing is our signal that drafting actually STARTED (vs.
         # the job still sitting unclaimed). Latch the claim time once so the label
@@ -972,12 +1011,26 @@ def _attempt_claim(ns, qtype: str) -> bool:
     return False
 
 
+def _is_paused() -> bool:
+    # S4L paused (mcp/src/index.ts pauseS4L / the menubar pause button): the
+    # one flag file every pipeline surface honors.
+    return os.path.exists(os.path.join(state_dir(), "paused.flag"))
+
+
 def cmd_next(ns) -> int:
     _apply_state_dir_override(ns)
-    # S4L paused (mcp/src/index.ts pauseAutopilot): report no work instead of
-    # claiming a job, so an already-queued draft can't drain/post while paused
-    # even though the scheduled task worker still fires on its own cadence.
-    if os.path.exists(os.path.join(state_dir(), "paused.flag")):
+    # GC jobs orphaned by dead/killed producers BEFORE claiming (and before the
+    # pause check, so orphans left behind by a pause don't sit until the next
+    # enqueue-side sweep — while paused nothing enqueues, so this is the only
+    # sweeper running). Without this, a resume would hand workers stale jobs
+    # whose producer died long ago.
+    swept = _sweep_stale()
+    if swept:
+        _plog(f"swept {swept} stale queue job file(s) before claim pass")
+    # S4L paused: report no work instead of claiming a job, so an
+    # already-queued draft can't drain/post while paused even though the
+    # scheduled task worker still fires on its own cadence.
+    if _is_paused():
         print(json.dumps({}))
         return 0
     qtype = ns.type
@@ -997,6 +1050,13 @@ def cmd_next(ns) -> int:
     start = time.time()
     attempt = 0
     while True:
+        # Re-check pause on every iteration, not just at entry: a worker
+        # already inside its wait window when Pause is clicked must stop
+        # claiming immediately (observed 2026-07-18: pause at 12:24, a
+        # pre-pause poller claimed a reddit-draft job at 12:29 anyway).
+        if _is_paused():
+            _plog(f"polling {qtype}: paused.flag appeared mid-wait; exiting without claiming")
+            break
         if _attempt_claim(ns, qtype):
             return 0
         attempt += 1

package/scripts/preflight.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # preflight.sh — sourced helper for launchd-fired run-*.sh wrappers.
 #
-# Three checks, each emits a `[skipped: <reason>]` stderr line and exits 0
+# Four checks, each emits a `[skipped: <reason>]` stderr line and exits 0
 # (so launchd treats the slot as cleanly consumed and fires the next one
 # on schedule, rather than thinking the job is broken):
 #
@@ -28,7 +28,16 @@
 #        still recovering automatically within 10 min of the underlying
 #        cap being lifted.
 #
-#   3. preflight_acquire_slot_or_skip <pool_name> [max_slots=4]
+#   3. preflight_skip_if_paused
+#        Reads <state>/paused.flag (S4L Pause: written by mcp/src/index.ts
+#        pauseS4L and the menubar's pause button). Pause boots the pipeline
+#        launchd jobs out, but that only covers jobs loaded at pause time —
+#        this guard is the shared runtime backstop every pipeline wrapper
+#        calls, so a job that was mid-flight, re-loaded by a Claude boot,
+#        or added later can never draft/post while paused. One guard, all
+#        pipelines: add a new run-*.sh wrapper and call this, done.
+#
+#   4. preflight_acquire_slot_or_skip <pool_name> [max_slots=4]
 #        Slot-pool admission control via mkdir on
 #        /tmp/sa-${pool_name}-slot-{1..max_slots}.lock. If all slots are
 #        held by live PIDs, skips. Stale slots (PID dead) are GC'd before
@@ -146,7 +155,18 @@ PY
 }
 
 # ---------------------------------------------------------------------------
-# 3. Slot-pool admission (parallel-cycle cap)
+# 3. S4L Pause preflight
+# ---------------------------------------------------------------------------
+preflight_skip_if_paused() {
+    local flag="${S4L_STATE_DIR:-$HOME/.social-autoposter-mcp}/paused.flag"
+    [ -e "$flag" ] || return 0
+    local script_tag="${SA_PREFLIGHT_SCRIPT:-${SCRIPT_TAG:-$(basename "$0")}}"
+    echo "[skipped: paused flag=$flag script=$script_tag] $(date)" >&2
+    exit 0
+}
+
+# ---------------------------------------------------------------------------
+# 4. Slot-pool admission (parallel-cycle cap)
 # ---------------------------------------------------------------------------
 preflight_acquire_slot_or_skip() {
     local pool_name="$1"

package/skill/run-draft-and-publish.sh

@@ -28,6 +28,13 @@ EOF_ENV
 REPO_DIR="${S4L_REPO_DIR:-$(cd "$(dirname "$0")/.." && pwd)}"
 PY="${S4L_PYTHON:-python3}"
 
+# Shared pause guard (scripts/preflight.sh): every pipeline kicker honors the
+# same paused.flag, so Pause stops the X lane the same way it stops Reddit —
+# even if launchd re-fires this wrapper while the flag is up.
+SA_PREFLIGHT_SCRIPT="run-draft-and-publish"
+source "$REPO_DIR/scripts/preflight.sh"
+preflight_skip_if_paused
+
 # Salvage twitter-prep drafts orphaned when a producer cycle died after its worker
 # wrote the result but before consuming it (a consumed result is deleted, so a
 # surviving one in claude-queue/result/ = never consumed). Best-effort, dedup-safe

package/skill/run-reddit-search-launchd.sh

@@ -40,6 +40,7 @@ ERR="$LOG_DIR/launchd-reddit-search-stderr.log"
 # See scripts/preflight.sh for full design.
 SA_PREFLIGHT_SCRIPT="run-reddit-search"
 source "$REPO_DIR/scripts/preflight.sh"
+preflight_skip_if_paused
 preflight_skip_if_claude_blocked
 preflight_skip_if_jetsam_pressure