@m13v/s4l 1.7.6-rc.8 → 1.7.6

package/mcp/menubar/s4l_state.py

@@ -90,22 +90,42 @@ def state_dir() -> str:
 # to the MCP: this needs to work from BOTH the menu bar (s4l_menubar.py) and
 # the Claude-independent dashboard_server.py, which share this process but
 # are a different process from the MCP server, so there's no way to delegate
-# to mcp/src/index.ts's pauseS4L/resumeS4L here. Mirrors those functions
-# (same 4 labels, same flag path) for the common pause->resume case. What it
-# deliberately does NOT do: mcp/src/index.ts's resumeS4L also re-runs the
-# readiness-gated install logic (persona/project/X-verified checks, content-
-# aware plist rewrite) via ensure*Installed() — that only matters for a box
-# that was never fully set up before Pause, an edge case the next Claude
-# boot / project_config call naturally heals once unpaused. This resume just
-# reloads the exact plists Pause unloaded (Pause never deletes anything).
+# to mcp/src/index.ts's pauseS4L/resumeS4L here. The label SET is not
+# duplicated though: index.ts's PAUSE_TARGETS registry is the single source of
+# truth, mirrored to <state>/pause-targets.json at every MCP boot and
+# pause/resume; pause_target_labels() reads that manifest, so a pipeline daemon
+# added to the registry reaches this button without touching this file.
+# PAUSE_TARGET_LABELS below is only the fallback for a box whose MCP has never
+# written the manifest. What this resume deliberately does NOT do:
+# mcp/src/index.ts's resumeS4L also re-runs the readiness-gated install logic
+# (persona/project/X-verified checks, content-aware plist rewrite) via
+# ensure*Installed() — that only matters for a box that was never fully set up
+# before Pause, an edge case the next Claude boot / project_config call
+# naturally heals once unpaused. This resume just reloads the exact plists
+# Pause unloaded (Pause never deletes anything).
 PAUSE_TARGET_LABELS = (
     AUTOPILOT_LABEL,
+    "com.m13v.social-reddit-search",
     "com.m13v.social-claude-reaper",
     "com.m13v.social-autopilot-stall-watch",
     "com.m13v.social-memory-snapshot",
 )
 
 
+def pause_target_labels() -> tuple:
+    try:
+        data = json.loads((Path(state_dir()) / "pause-targets.json").read_text())
+        labels = tuple(
+            l for l in data.get("labels", [])
+            if isinstance(l, str) and l.startswith("com.m13v.")
+        )
+        if labels:
+            return labels
+    except Exception:
+        pass
+    return PAUSE_TARGET_LABELS
+
+
 def pause_flag_path() -> str:
     return os.path.join(state_dir(), "paused.flag")
 
@@ -125,7 +145,7 @@ def pause_s4l() -> dict:
         return {"ok": False, "paused": is_paused(), "detail": f"could not write pause flag: {e}"}
     uid = os.getuid()
     results = []
-    for label in PAUSE_TARGET_LABELS:
+    for label in pause_target_labels():
         try:
             subprocess.run(
                 ["launchctl", "bootout", f"gui/{uid}/{label}"],
@@ -147,7 +167,7 @@ def resume_s4l() -> dict:
     uid = os.getuid()
     la_dir = str(Path.home() / "Library" / "LaunchAgents")
     results = []
-    for label in PAUSE_TARGET_LABELS:
+    for label in pause_target_labels():
         plist = os.path.join(la_dir, f"{label}.plist")
         if not os.path.exists(plist):
             results.append(f"{label}: no plist, skip")
@@ -269,7 +289,7 @@ def autopilot_loaded() -> bool:
 # A machine with any system-wide proxy configured (corporate VPN client,
 # security software, a residential-IP proxy for platform fingerprinting,
 # etc.) whose bypass list doesn't happen to include 127.0.0.1/localhost will
-# have every loopback health check and post_drafts call silently routed out
+# have every loopback health check and approve_drafts call silently routed out
 # through that proxy instead of hitting the MCP server directly — surfacing
 # as an opaque connection error/403 with no indication the proxy is at
 # fault. This is a local process talking to its own local server: it must
@@ -277,19 +297,39 @@ def autopilot_loaded() -> bool:
 _NO_PROXY_OPENER = urllib.request.build_opener(urllib.request.ProxyHandler({}))
 
 
+# /health is a trivial constant response, so any real latency is the OWNING MCP
+# process being briefly CPU-starved or paged out under machine load (Nhat's box:
+# ~8.6GB swap, 39% mem pressure, 582 procs), not the endpoint doing work. The old
+# single 1.5s attempt flapped a perfectly-alive server to "unreachable" on one
+# transient stall, and a false negative here strands approved drafts (see the
+# "dead pointer" note in mcp/src/index.ts). So probe forgivingly: a longer
+# deadline plus ONE retry. A genuinely-dead endpoint fails fast either way
+# (ECONNREFUSED returns immediately, both attempts), so this only rescues live
+# servers -- it never lets a real outage look healthy.
+_HEALTH_TIMEOUT_S = 4.0
+_HEALTH_ATTEMPTS = 2
+_HEALTH_RETRY_BACKOFF_S = 0.15
+
+
 def _endpoint_url():
     ep = read_json("panel-endpoint.json")
     url = (ep or {}).get("url")
     if not url:
         return None
-    try:
-        with _NO_PROXY_OPENER.open(url + "health", timeout=1.5) as r:
-            if r.status == 200:
-                return url
-    except Exception as e:
-        sys.stderr.write(f"[s4l-state] loopback health check failed: {type(e).__name__}: {e}\n")
-        sys.stderr.flush()
-        return None
+    last = None
+    for attempt in range(_HEALTH_ATTEMPTS):
+        try:
+            with _NO_PROXY_OPENER.open(url + "health", timeout=_HEALTH_TIMEOUT_S) as r:
+                return url if r.status == 200 else None
+        except Exception as e:
+            last = e
+            if attempt + 1 < _HEALTH_ATTEMPTS:
+                time.sleep(_HEALTH_RETRY_BACKOFF_S)
+    sys.stderr.write(
+        f"[s4l-state] loopback health check failed after {_HEALTH_ATTEMPTS} "
+        f"attempts: {type(last).__name__}: {last}\n"
+    )
+    sys.stderr.flush()
     return None
 
 
@@ -514,7 +554,7 @@ def accessibility_trusted() -> bool:
 # draft_cycle writes review-request.json when a fresh batch is ready; we read
 # the linked plan file (the /tmp/twitter_cycle_plan_<batch>.json the pipeline
 # produced), present the cards, then post the approved subset via the loopback
-# post_drafts tool. The chat-table review still works in parallel; both surfaces
+# approve_drafts tool. The chat-table review still works in parallel; both surfaces
 # de-dup on the plan's per-candidate `posted` flag.
 # How long an activity signal may go un-refreshed before the menu bar treats it
 # as idle. This is the SELF-HEAL for a frozen spinner: a writer can set a label
@@ -565,7 +605,7 @@ def read_activity():
 def write_activity(state: str, label: str):
     """Best-effort local activity update. The MCP server normally owns this file,
     but the menu-bar posting queue knows the whole approved-card burst while the
-    server only sees one post_drafts call at a time."""
+    server only sees one approve_drafts call at a time."""
     try:
         p = Path(state_dir()) / "activity.json"
         p.parent.mkdir(parents=True, exist_ok=True)
@@ -707,6 +747,11 @@ def candidate_state(c):
     """Canonical lifecycle state of ONE review-queue candidate. Use this instead
     of ad hoc flag checks — "not posted" is NOT "awaiting review".
 
+    LOCKSTEP: mcp/src/index.ts::candidateState() is the TS mirror of this exact
+    precedence; change one and you MUST change the other. Every past divergence
+    between a hand-rolled raw-flag filter and this function became an incident
+    (post_failed drain asymmetry 2026-07-17, get_stats lane blindness).
+
     The review queue (review-queue.json) is an APPEND-FOREVER LEDGER: handled
     candidates are never removed, they are flag-stamped in place, so most rows
     in an old queue are retired. States, in precedence order:
@@ -903,7 +948,7 @@ def store_mark_post_failed(batch, n, candidate_id=None, error=None):
 
 def store_pending_posts(batch="review-queue"):
     """Approved-but-unposted candidates, for the restart resume path. Skips
-    posted/terminal/failed rows; each entry carries everything post_drafts
+    posted/terminal/failed rows; each entry carries everything approve_drafts
     needs (n, final text, drop_link)."""
     plan = read_plan(store_path())
     out = []
@@ -926,7 +971,7 @@ def store_pending_posts(batch="review-queue"):
 
 def store_reconcile_decisions(batch, decisions):
     """Re-stamp any of this session's decisions the store no longer shows. The
-    MCP server's post_drafts does a whole-file read-modify-write while a batch
+    MCP server's approve_drafts does a whole-file read-modify-write while a batch
     posts (minutes), so a decision stamped mid-drain can be clobbered by its
     stale rewrite; the menubar calls this every timer tick with its in-memory
     decision list so the store always converges back to what the user chose.
@@ -960,7 +1005,7 @@ def review_queue_posted_count():
     """Posts that have LANDED in the review-queue plan — the durable, cross-process
     truth. Independent of the menu bar's in-memory burst queue (which dies on a
     restart) and of WHICH process is posting (the menu bar worker, the autopilot,
-    or a host agent draining via post_drafts). Returns the posted count, or None
+    or a host agent draining via approve_drafts). Returns the posted count, or None
     when the plan can't be read. Drives the menu-bar posting indicator so progress
     stays visible regardless of how the drain is driven."""
     plan_path = None
@@ -997,13 +1042,17 @@ def review_drafts(plan, batch="review-queue"):
             continue
         out.append(
             {
-                "n": i + 1,  # 1-based, matches post_drafts numbering
+                "n": i + 1,  # 1-based, matches approve_drafts numbering
                 # Platform tag (reddit cards, 2026-07-14): absent/None means
                 # twitter (every plan written before the field shipped). The
                 # card renders the platform mark and profile link from this.
                 "platform": c.get("platform"),
                 "thread_author": c.get("thread_author"),
                 "thread_text": c.get("thread_text"),
+                # Reddit selftext body (2026-07-17): the card renders the title
+                # bold with this beneath it. Absent on twitter and on plans
+                # written before merge_review_queue started stamping it.
+                "thread_selftext": c.get("thread_selftext"),
                 "reply_text": c.get("reply_text") or "",
                 # English translations stamped at draft time (prep step) when
                 # language != en. Display-only: the card shows them so the
@@ -1253,11 +1302,16 @@ def write_review_layout(layout):
 # Server-side per-install throttle for the twitter cycle's virality bar:
 # high|medium|low|None (None = driver default). Source of truth is
 # installations.posting_mode via /api/v1/installations/posting-mode; unlike
-# the lane flags there is NO local mode.json copy, because the whole point is
-# remote adjustability (dashboard and menubar must agree with the server).
+# the lane flags there is NO local mode.json copy that RESOLVES the mode,
+# because the whole point is remote adjustability (dashboard and menubar must
+# agree with the server).
 # Reads are cached so the menu rebuild tick never blocks on the network: a
 # stale/missing cache kicks one background refresh and returns the last-known
-# value (None until the first refresh lands; the next rebuild shows the mark).
+# value. The in-memory cache is seeded from a disk copy of the last server
+# answer (scripts/s4l_posting_mode.py cache file, 2026-07-17): without it,
+# every menubar restart (updates restart the menubar) displayed the default
+# "Steady" until the first refresh landed, which read as the user's chosen
+# mode having been reset. The seed never suppresses a refresh (at stays 0.0).
 POSTING_MODE_TTL_SECS = 600
 _posting_mode_cache = {"mode": None, "known": False, "at": 0.0}
 _posting_mode_lock = threading.Lock()
@@ -1270,21 +1324,42 @@ def _scripts_on_path():
         sys.path.insert(0, scripts)
 
 
+def _seed_posting_mode_from_disk():
+    """Seed the in-memory cache with the last server answer that any surface
+    persisted (menubar, MCP tool, panel). at stays 0.0 so the first read still
+    kicks a real refresh; the server answer overwrites the seed when it lands."""
+    try:
+        _scripts_on_path()
+        from s4l_posting_mode import read_cached_mode
+
+        mode = read_cached_mode()
+        if mode:
+            with _posting_mode_lock:
+                _posting_mode_cache["mode"] = mode
+    except Exception:
+        pass
+
+
+_seed_posting_mode_from_disk()
+
+
 def _refresh_posting_mode():
     try:
         _scripts_on_path()
         from http_api import api_get
+        from s4l_posting_mode import write_cached_mode
 
         r = api_get("/api/v1/installations/posting-mode")
         d = (r or {}).get("data") or {}
         mode = d.get("mode")
+        mode = mode if mode in ("high", "medium", "low") else None
+        write_cached_mode(mode)
         with _posting_mode_lock:
-            _posting_mode_cache.update(
-                mode=mode if mode in ("high", "medium", "low") else None,
-                known=True,
-                at=time.time(),
-            )
-    except Exception as e:
+            _posting_mode_cache.update(mode=mode, known=True, at=time.time())
+    except (Exception, SystemExit) as e:
+        # http_api raises SystemExit (not Exception) on terminal failure;
+        # catching only Exception let it kill this thread BEFORE the retry
+        # throttle below, so offline boxes hot-looped refresh attempts.
         sys.stderr.write(f"[s4l-state] posting-mode refresh failed: {e}\n")
         with _posting_mode_lock:
             # Throttle retries to the TTL window; keep last-known value.
@@ -1312,12 +1387,15 @@ def write_posting_mode(mode):
     r = api_post("/api/v1/installations/posting-mode", {"mode": mode})
     d = (r or {}).get("data") or {}
     stored = d.get("mode")
+    stored_valid = stored if stored in ("high", "medium", "low") else None
+    try:
+        from s4l_posting_mode import write_cached_mode
+
+        write_cached_mode(stored_valid)
+    except Exception:
+        pass
     with _posting_mode_lock:
-        _posting_mode_cache.update(
-            mode=stored if stored in ("high", "medium", "low") else None,
-            known=True,
-            at=time.time(),
-        )
+        _posting_mode_cache.update(mode=stored_valid, known=True, at=time.time())
     return stored
 
 
@@ -1336,7 +1414,7 @@ def toggle_lane(lane):
 # + store_pending_posts) is the only decision record and resume source now.
 
 
-def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):
+def approve_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):
     """Post / reject drafts via the loopback tool. `post` = 1-based numbers to post
     as-is; `edits` = [{n, text}] to rewrite then post; `reject` = numbers to mark
     DONE so they're never shown for review again (not posted); `clear_link` =
@@ -1346,7 +1424,7 @@ def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, t
     args = {"batch_id": batch_id, "post": post or [], "edits": edits or [], "reject": reject or [], "clear_link": clear_link or []}
     if activity_label:
         args["__s4l_activity_label"] = activity_label
-    return loopback_tool("post_drafts", args, timeout=timeout)
+    return loopback_tool("approve_drafts", args, timeout=timeout)
 
 
 # ---- review-events outbox (2026-07-02) --------------------------------------

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.8",
+  "version": "1.7.6",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.8",
+  "version": "1.7.6",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/account_resolver.py

@@ -7,6 +7,16 @@ Resolution order for each platform (first non-empty wins):
      checked-in file). Twitter retains the legacy `AUTOPOSTER_TWITTER_HANDLE`
      name as an alias.
   2. The matching field in `config.json` -> `accounts.<platform>.<field>`.
+  3. The platform's durable identity store, when it has one. Today only
+     twitter does: the keychain-independent cookie mirror stamps the live
+     @handle at connect time (see twitter_cookie_mirror). This is the SAME
+     ground truth the session posts through, so it's a safe last resort where
+     a hardcoded fallback would not be. It exists because config.json is not a
+     reliable single home for the handle: onboarding populated the mirror but
+     not always config (the "posts land 0/N, no_account_configured" bug), so
+     making config the ONLY source made it a single point of failure. There is
+     deliberately NO hardcoded default anywhere in this resolver; a missing
+     handle returns None and callers refuse rather than impersonate an account.
 
 The handle is normalized:
   - leading `@` is stripped (twitter)
@@ -22,18 +32,25 @@ Returns None if neither source has a value. Callers should treat None as
 
 Platform key map:
     twitter   -> accounts.twitter.handle           (env: AUTOPOSTER_TWITTER_HANDLE)
-    reddit    -> accounts.reddit.username          (env: AUTOPOSTER_REDDIT_USERNAME)
+    reddit    -> reddit_account.username (login ground truth, when present)
+                 else accounts.reddit.username     (env: AUTOPOSTER_REDDIT_USERNAME)
     linkedin  -> accounts.linkedin.name            (env: AUTOPOSTER_LINKEDIN_NAME)
     github    -> accounts.github.username          (env: AUTOPOSTER_GITHUB_USERNAME)
     moltbook  -> accounts.moltbook.username        (env: AUTOPOSTER_MOLTBOOK_USERNAME)
 """
 from __future__ import annotations
 
-import json
 import os
-from functools import lru_cache
+import sys
 from typing import Optional
 
+# THE config loader (scripts/config.py): S4L_CONFIG_PATH / state-dir canonical
+# home / S4L_REPO_DIR resolution + mtime-based caching. Rolling our own here
+# (the pre-2026-07-17 lru_cache + dirname(__file__) read) bypassed all of that
+# and could read a different config.json than the rest of the pipeline.
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from config import load_config as _load_config  # noqa: E402
+
 _PLATFORM_CONFIG_FIELD = {
     "twitter":  ("twitter",  "handle"),
     "x":        ("twitter",  "handle"),   # alias for the canonical post-platform
@@ -70,15 +87,22 @@ def normalize(handle: Optional[str]) -> Optional[str]:
     return h or None
 
 
-@lru_cache(maxsize=1)
-def _load_config() -> dict:
-    repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    cfg_path = os.path.join(repo_root, "config.json")
-    try:
-        with open(cfg_path, "r", encoding="utf-8") as f:
-            return json.load(f) or {}
-    except (OSError, json.JSONDecodeError):
-        return {}
+def _durable_handle(key: str) -> Optional[str]:
+    """Best-effort read of the platform's durable identity store, or None.
+
+    The durable store is written once at connect time and survives a fresh
+    install / keychain re-lock / Cookies-DB wipe, so it's the ground-truth last
+    resort when neither env nor config carries the handle. Only twitter has one
+    today (the cookie mirror); other platforms return None (env + config only).
+    Never raises: an unimportable/empty store must not break resolution.
+    """
+    if key in ("twitter", "x"):
+        try:
+            import twitter_cookie_mirror  # optional dep; scripts-dir sibling
+            return normalize((twitter_cookie_mirror.load_meta() or {}).get("handle"))
+        except Exception:
+            return None
+    return None
 
 
 def resolve(platform: str) -> Optional[str]:
@@ -92,11 +116,31 @@ def resolve(platform: str) -> Optional[str]:
     if env_value:
         return env_value
 
-    section, field = _PLATFORM_CONFIG_FIELD[key]
     cfg = _load_config()
+
+    # Reddit's login ground truth outranks the plain config field: the top-level
+    # `reddit_account` block is the auth-bearing "who this machine actually logs
+    # in as" record (operator machines / VMs). Drift between it and
+    # accounts.reddit.username broke the VM's post-permalink lookup (wrong
+    # username -> JS found 0 matching comments -> pipeline recorded `failed`
+    # despite the comment landing). This is THE ONLY place both keys are read;
+    # every caller goes through resolve("reddit") so they can never disagree
+    # about the winner again.
+    if key == "reddit":
+        legacy = normalize(((cfg.get("reddit_account") or {}).get("username")))
+        if legacy:
+            return legacy
+
+    section, field = _PLATFORM_CONFIG_FIELD[key]
     accounts = cfg.get("accounts") or {}
     block = accounts.get(section) or {}
-    return normalize(block.get(field))
+    config_value = normalize(block.get(field))
+    if config_value:
+        return config_value
+
+    # Last resort: the durable identity store (twitter cookie mirror). Keeps
+    # config.json from being a single point of failure without ever guessing.
+    return _durable_handle(key)
 
 
 def require(platform: str) -> str:

package/scripts/amplitude_24h_signups.py

@@ -80,7 +80,13 @@ import zipfile
 from datetime import datetime, timedelta, timezone
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-CONFIG_PATH = os.path.join(REPO_ROOT, "config.json")
+# THE canonical config loader (scripts/config.py): S4L_CONFIG_PATH / state-dir /
+# S4L_REPO_DIR aware, mtime-cached. Replaces this file's hand-rolled loader and
+# its hardcoded config path (the S4L-4H dead-path class on customer boxes).
+import os as _cfg_os, sys as _cfg_sys
+_cfg_sys.path.insert(0, _cfg_os.path.dirname(_cfg_os.path.abspath(__file__)))
+from config import config_path as _canonical_config_path, load_config
+CONFIG_PATH = _canonical_config_path()
 ENV_PATH = os.path.join(REPO_ROOT, ".env")
 CACHE_DIR = os.path.join(REPO_ROOT, "skill", "cache")
 CACHE_PATH = os.path.join(CACHE_DIR, "amplitude_24h_signups.json")
@@ -110,9 +116,6 @@ def load_env():
                 os.environ.setdefault(k.strip(), v.strip())
 
 
-def load_config():
-    with open(CONFIG_PATH) as f:
-        return json.load(f)
 
 
 def keychain_get(name):

package/scripts/amplitude_signups.py

@@ -29,7 +29,13 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-CONFIG_PATH = os.path.join(REPO_ROOT, "config.json")
+# THE canonical config loader (scripts/config.py): S4L_CONFIG_PATH / state-dir /
+# S4L_REPO_DIR aware, mtime-cached. Replaces this file's hand-rolled loader and
+# its hardcoded config path (the S4L-4H dead-path class on customer boxes).
+import os as _cfg_os, sys as _cfg_sys
+_cfg_sys.path.insert(0, _cfg_os.path.dirname(_cfg_os.path.abspath(__file__)))
+from config import config_path as _canonical_config_path, load_config
+CONFIG_PATH = _canonical_config_path()
 ENV_PATH = os.path.join(REPO_ROOT, ".env")
 API_BASE = "https://amplitude.com/api/2/events/segmentation"
 
@@ -45,9 +51,6 @@ def load_env():
                 os.environ.setdefault(k.strip(), v.strip())
 
 
-def load_config():
-    with open(CONFIG_PATH) as f:
-        return json.load(f)
 
 
 def fetch_signup_series(api_key, secret_key, signup_event, attribution_filter, start, end):

package/scripts/autopilot_stall_watch.py

@@ -229,7 +229,14 @@ def _recent_batches_not_progressing(min_batches: int = BATCH_PROGRESSION_MIN_BAT
         import http_api  # noqa: E402
 
         resp = http_api.api_get("/api/v1/twitter-batches", {"list": "1", "limit": str(min_batches)})
-        batches = (resp or {}).get("batches") or []
+        # http_api.api_get returns the RAW envelope {"ok":..,"data":{"batches":[..],
+        # "owner_host":..}} — it does NOT unwrap "data". The batches live at
+        # resp["data"]["batches"], never at resp["batches"]. Reading the wrong key
+        # made this return [] -> len<min -> False on EVERY call, so batches_stuck was
+        # hardwired False and the "drafting is not actually happening" stall cause
+        # could never be selected (missed Nhat's 07-15 phase2b-prep pileup entirely).
+        # Do NOT collapse back to resp.get("batches").
+        batches = ((resp or {}).get("data") or {}).get("batches") or []
         if len(batches) < min_batches:
             return False  # not enough history yet to conclude a stall
         return all((b or {}).get("current_phase") not in BATCH_PROGRESSED_PHASES for b in batches)

package/scripts/browser_lifecycle.py

@@ -0,0 +1,90 @@
+"""Shared harness-tab lifecycle: ONE park-on-exit implementation for every
+platform browser lib (twitter_browser.py, reddit_browser.py, future).
+
+Born 2026-07-17 from the user's unification directive: the parking/revive
+discipline lived only in twitter_browser.py, so the reddit harness idled on
+live reddit pages in a visible window and kept its own failure modes. Per
+feedback_minimize_code_footprint there must be exactly one implementation.
+
+Design constraints inherited from the twitter parker (see
+insights_chrome150_renderer_crash_wedge_2026_07_14):
+  - Raw CDP over HTTP+websocket with hard 3s timeouts, NEVER Playwright:
+    at atexit the Playwright loop may be gone, and against a wedged browser
+    this must fail fast, not hang the exit.
+  - suppress_origin: Chrome 111+ rejects ws clients whose Origin header is
+    not in --remote-allow-origins.
+  - Park target is the platform's own /robots.txt, NOT about:blank: a static
+    ~100-byte document with no SPA to leak or crash, whose URL still matches
+    every tab-reuse heuristic (bh list_tabs hides "about:" as internal, and
+    an about:blank park made scans mint new tabs — the proven focus-steal
+    trigger Target.createTarget).
+  - Skip tabs already parked; never raise; S4L_NO_TAB_PARK=1 escape hatch.
+"""
+import atexit
+import json
+import os
+import sys
+import urllib.request
+
+# Loopback CDP must never route through a proxy (macOS system proxy settings
+# leak into urllib's default opener; a box-wide forwarder 403s 127.0.0.1).
+_OPENER = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+
+_registered = set()
+
+
+def _targets(cdp_base: str):
+    with _OPENER.open(cdp_base.rstrip("/") + "/json/list", timeout=3) as r:
+        return json.loads(r.read())
+
+
+def _navigate_ws(ws_url: str, url: str) -> None:
+    import websocket
+
+    ws = websocket.create_connection(ws_url, timeout=3, suppress_origin=True)
+    try:
+        ws.send(json.dumps({
+            "id": 1, "method": "Page.navigate", "params": {"url": url},
+        }))
+        ws.recv()
+    finally:
+        ws.close()
+
+
+def park_tabs(cdp_base: str, host_markers, park_url: str, label: str) -> None:
+    """Navigate every page tab whose URL matches host_markers to park_url.
+    Best-effort; a wedged browser just fails the 3s connects quietly."""
+    try:
+        for t in _targets(cdp_base):
+            u = t.get("url", "")
+            if t.get("type") != "page":
+                continue
+            if not any(h in u for h in host_markers):
+                continue
+            if u.split("?", 1)[0].rstrip("/").endswith("/robots.txt"):
+                continue  # already parked
+            if not t.get("webSocketDebuggerUrl"):
+                continue
+            try:
+                _navigate_ws(t["webSocketDebuggerUrl"], park_url)
+                print(
+                    f"[{label}] parked tab on {park_url} (was {u[:80]})",
+                    file=sys.stderr,
+                )
+            except Exception:
+                continue
+    except Exception:
+        pass
+
+
+def register_park_on_exit(cdp_base: str, host_markers, park_url: str, label: str) -> None:
+    """Arm park_tabs to run at process exit, once per (endpoint, park_url).
+    Call from a platform lib's get_browser_and_page so only processes that
+    actually used the browser park it."""
+    if os.environ.get("S4L_NO_TAB_PARK"):
+        return
+    key = (cdp_base, park_url)
+    if key in _registered:
+        return
+    _registered.add(key)
+    atexit.register(park_tabs, cdp_base, tuple(host_markers), park_url, label)