@m13v/s4l 1.7.6 → 1.7.7-rc.2

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6",
-  "installedAt": "2026-07-18T17:32:42.014Z"
+  "version": "1.7.7-rc.2",
+  "installedAt": "2026-07-30T22:16:14.950Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6",
+  "version": "1.7.7-rc.2",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_browser_foreground.py

@@ -79,6 +79,7 @@ class _Worker(threading.Thread):
         super().__init__(daemon=True, name="s4l-browser-foreground")
         self._pid_cache = {}  # pid -> (is_harness, details dict)
         self._prev_app = None  # last non-harness frontmost app name
+        self._prev_app_pid = None  # ...and its pid, for precise re-activation
         self._last_key = None  # (cause, pid) of last emitted event
         self._last_emit_at = 0.0
         self._suppressed = 0
@@ -108,13 +109,19 @@ class _Worker(threading.Thread):
         if "chrome" not in low and "chromium" not in low:
             if cause == "activated" and name:
                 self._prev_app = name
+                self._prev_app_pid = pid
             return
         is_harness, details = self._classify(pid)
         if not is_harness:
             # The user's own Chrome counts as their workspace too.
             if cause == "activated" and name:
                 self._prev_app = name
+                self._prev_app_pid = pid
             return
+        # Suppress focus on EVERY harness activation, BEFORE the telemetry
+        # dedupe — the log is rate-limited, but hiding must fire every time or
+        # a fast pop-burst would leave later pops sitting in the foreground.
+        self._suppress_focus(pid, details)
         now = time.time()
         key = (cause, pid)
         if key == self._last_key and now - self._last_emit_at < _DEDUPE_SECONDS:
@@ -137,6 +144,48 @@ class _Worker(threading.Thread):
             context="browser-foreground",
         )
 
+    def _suppress_focus(self, pid, details):
+        # OS-LEVEL FOCUS SUPPRESSION (2026-07-30). The per-path code fixes
+        # (bh-harness activate suppression, tab reuse/park) each cover ONE way
+        # of driving Chrome; the reddit pipeline reaches it via a DIFFERENT
+        # path (reddit_browser.py Playwright connect/new_page) that bypasses
+        # them, and a raw external Playwright connect bypasses everything. This
+        # acts on the OS window event itself, so it covers EVERY connector:
+        # when an OFFSCREEN automation harness (window parked at negative Y —
+        # twitter/reddit/linkedin; NOT the onscreen setup-login window) grabs
+        # the foreground, hide that specific Chrome process by pid, then force
+        # focus back to the app the user was in. Screenshots/clicks are
+        # unaffected (CDP is offscreen-raster + synthetic input; the occlusion
+        # flags keep hidden tabs painting). Escape hatch: S4L_NO_HARNESS_HIDE.
+        if os.environ.get("S4L_NO_HARNESS_HIDE"):
+            return
+        pos = details.get("window_position") or ""
+        try:
+            offscreen = any(int(float(v)) < 0 for v in pos.split(",")[:2])
+        except Exception:
+            offscreen = False
+        if not offscreen:
+            return  # onscreen (e.g. setup login) — leave it visible
+        try:
+            from AppKit import NSRunningApplication
+
+            ra = NSRunningApplication.runningApplicationWithProcessIdentifier_(pid)
+            if ra is not None:
+                ra.hide()  # order the harness window out
+            # hide() alone does NOT reliably return focus here: all three
+            # harnesses share the "Google Chrome Beta" bundle, so hiding one
+            # process can leave the app-level active state on a sibling. Force
+            # focus back to the app the user was actually in.
+            if self._prev_app_pid and self._prev_app_pid != pid:
+                prev = NSRunningApplication.runningApplicationWithProcessIdentifier_(
+                    self._prev_app_pid
+                )
+                # NSApplicationActivateIgnoringOtherApps = 1 << 1
+                if prev is not None and not prev.isTerminated():
+                    prev.activateWithOptions_(1 << 1)
+        except Exception:
+            pass
+
     def run(self):
         while True:
             try:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6",
+  "version": "1.7.7-rc.2",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6",
+  "version": "1.7.7-rc.2",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/_pa_compact.py

@@ -0,0 +1,15 @@
+import json,sys,subprocess,os
+q=sys.argv[1]
+env=dict(os.environ); env["SOCIAL_AUTOPOSTER_LINKEDIN_SEARCH"]="1"
+p=subprocess.run(["/opt/homebrew/bin/python3.11","scripts/discover_linkedin_candidates.py","content",q],capture_output=True,text=True,env=env)
+out=p.stdout
+i=out.find("{")
+try: d=json.loads(out[i:])
+except Exception:
+    print(json.dumps({"query":q,"ok":False,"error":"parse_fail","tail":out[-300:]})); sys.exit()
+if not d.get("ok"):
+    print(json.dumps({"query":q,"ok":False,"error":d.get("error"),"result_count":0})); sys.exit()
+rows=[]
+for r in d.get("results",[])[:6]:
+    rows.append({"an":r.get("author_name"),"hl":(r.get("author_headline") or "")[:90],"pu":r.get("author_profile_url"),"aid":r.get("activity_id"),"ah":r.get("age_hours"),"rx":r.get("reactions"),"cm":r.get("comments"),"rp":r.get("reposts"),"vs":r.get("velocity_score"),"tx":(r.get("post_text") or "")[:260]})
+print(json.dumps({"query":q,"ok":True,"result_count":d.get("result_count"),"top":rows},ensure_ascii=False))

package/scripts/_pa_q.py

@@ -0,0 +1,14 @@
+import json,subprocess,sys,os
+q=sys.argv[1]
+env=dict(os.environ); env["SOCIAL_AUTOPOSTER_LINKEDIN_SEARCH"]="1"
+p=subprocess.run(["/opt/homebrew/bin/python3.11","scripts/discover_linkedin_candidates.py","content",q],capture_output=True,text=True,env=env)
+out=p.stdout
+i=out.find("{")
+try: d=json.loads(out[i:])
+except Exception as e:
+    print(json.dumps({"query":q,"ok":False,"error":"parse","raw":out[-500:]})); sys.exit()
+if not d.get("ok"):
+    print(json.dumps({"query":q,"ok":False,"error":d.get("error"),"result_count":0})); sys.exit()
+res=d.get("results",[])
+slim=[{"n":r.get("author_name"),"h":(r.get("author_headline") or "")[:110],"t":(r.get("post_text") or "")[:260],"a":round(r.get("age_hours") or 0,1),"rx":r.get("reactions"),"c":r.get("comments"),"rp":r.get("reposts"),"aid":r.get("activity_id"),"u":r.get("author_profile_url")} for r in res[:8]]
+print(json.dumps({"query":q,"ok":True,"result_count":d.get("result_count"),"top":slim},ensure_ascii=False))

package/scripts/_pa_run.py

@@ -0,0 +1,20 @@
+import json,subprocess,sys,os
+q=sys.argv[1]
+env=dict(os.environ); env["SOCIAL_AUTOPOSTER_LINKEDIN_SEARCH"]="1"
+p=subprocess.run(["/opt/homebrew/bin/python3.11","scripts/discover_linkedin_candidates.py","content",q],capture_output=True,text=True,env=env)
+out=p.stdout
+i=out.find("{")
+try:
+    d=json.loads(out[i:])
+except Exception:
+    print("PARSE_FAIL"); print(out[-1500:]); sys.exit(0)
+if not d.get("ok"):
+    print("NOTOK",d.get("error"),d.get("retry_after_seconds")); sys.exit(0)
+json.dump(d,open("/tmp/pa_%s.json"%q.replace(" ","_"),"w"))
+print("query=",q,"result_count=",d.get("result_count"))
+for r in d["results"][:6]:
+    print("---")
+    print(" auth:",r["author_name"],"|",(r.get("author_headline") or "")[:110])
+    print(" url:",r.get("post_url"),"aid:",r.get("activity_id"))
+    print(" age:",r.get("age_hours"),"rx:",r["reactions"],"cm:",r["comments"],"rp:",r["reposts"])
+    print(" txt:",(r.get("post_text") or "")[:260].replace("\n"," "))

package/scripts/linkedin_pacing.py

@@ -0,0 +1,400 @@
+#!/usr/bin/env python3
+"""LinkedIn action pacing gate.
+
+Single source of truth for "is it safe to post another LinkedIn comment right
+now, or should we wait / stop for today". Every LinkedIn write path calls
+`check` immediately BEFORE each comment and honours the answer.
+
+Why this exists
+---------------
+Until 2026-07-29 the LinkedIn write path had NO pacing control at all: no
+minimum gap, no jitter, no hourly cap, no per-day cap. The human-looking cadence
+on healthy days was an accident of queue availability and lock contention, not a
+control. Observed inter-action gaps routinely bottomed out at 0-3 SECONDS.
+
+TWO ACTION STREAMS - counting only one is the trap
+--------------------------------------------------
+LinkedIn writes land in two different tables and BOTH must be counted:
+
+    replies (replied_at)  engage-linkedin.sh - replying to comments on our posts
+    posts   (posted_at)   run-linkedin.sh    - commenting on others' posts,
+                                               via log_post.py, status='active'
+
+The first cut of this gate counted only `replies` and therefore saw ~25% of
+reality: it read 2026-07-20 as 23 actions when the true figure was 90, and read
+2026-07-19 as ZERO when it was 73. Any future edit that narrows this query to a
+single table silently disables most of the gate. Only rows with status='active'
+count as real writes; log_post.py also records rejected candidates.
+
+What the data does and does NOT support
+---------------------------------------
+Combined-stream daily figures, 2026-07-06..07-20:
+
+    n/day      65 .. 96 actions
+    per hour   2.9 .. 4.4
+    CV         0.32 .. 1.26   on EVERY day, healthy or not
+
+An earlier draft of this file claimed CV (sd/mean of inter-action gaps)
+separated logout days from healthy ones at ~1.0. That was an artifact of the
+replies-only subsample. On the full stream it does NOT separate: 2026-07-14 ran
+96 actions at CV 0.72 with no logout, and 2026-07-20 ran 90 at CV 0.78 and was
+killed. We therefore do NOT rely on CV as a predictor; it is retained only at a
+very low floor to catch a true metronome, which remains bad regardless of
+whether it predicts a logout.
+
+Stated plainly: we have NO statistic that reliably separates logout days from
+healthy days. What we do know is (a) this account is flagged, in LinkedIn's own
+words ("temporary restriction for automated activity" twice, "automation tool
+detected" once), (b) every active stretch so far has ended in a session kill,
+6 for 6, and (c) 65-96 automated actions a day with sub-second minimum gaps is
+indefensible in absolute terms whatever the trigger turns out to be. The
+ceilings below are therefore a deliberate ~70% volume cut chosen on judgment,
+NOT a proven safe operating point. Revise them as evidence accumulates.
+
+Ceilings (env-overridable, see CONFIG below):
+    min gap            120s   hard floor; observed minimum was 0-3s
+    per rolling 1h     4      observed average was 2.9-4.4/h with bursts
+    per rolling 24h    25     observed 65-96/day
+    per rolling 72h    60     observed ~230/3d
+    CV floor           0.25   true-metronome catch only; NOT a logout predictor
+    min daily spread   4h     actions must not bunch into one short window
+
+CLI
+---
+    linkedin_pacing.py check            # exit 0 = post now, 75 = wait, 78 = stop
+    linkedin_pacing.py check --json     # machine-readable decision
+    linkedin_pacing.py status           # current counters, always exit 0
+
+Exit codes are distinct so a shell caller can tell "wait" from "stop for now":
+    0  -> allowed, post now
+    75 -> not yet; sleep `wait_seconds` then re-check (EX_TEMPFAIL-ish)
+    78 -> a ceiling is blown; do not post at all this run (matches the repo's
+          existing rc=78 "skip this fire" convention)
+
+FAIL-CLOSED: if the database cannot be read we deny (rc=78). The account is
+already flagged; posting blind is worse than skipping a cycle. This mirrors the
+existing "db_unavailable -> script already fails closed" rule in run-linkedin.sh.
+"""
+
+import argparse
+import json
+import math
+import os
+import random
+import statistics
+import sys
+from datetime import datetime, timedelta, timezone
+
+
+# --------------------------------------------------------------------------
+# CONFIG - every value env-overridable so we can tune without editing a frozen
+# file, and so tests can drive it against throwaway numbers.
+# --------------------------------------------------------------------------
+def _envf(name, default):
+    try:
+        return float(os.environ[name])
+    except (KeyError, ValueError):
+        return default
+
+
+def _envi(name, default):
+    try:
+        return int(os.environ[name])
+    except (KeyError, ValueError):
+        return default
+
+
+# --- interval GENERATION (not just a ceiling) ------------------------------
+# A pure floor+ceiling cap produces a clipped, bimodal shape: run flat out at
+# the floor until the hourly ceiling bites, then stall. Measured on the first
+# version of this file: 59% of all gaps sat exactly at the 120s floor and NOTHING
+# landed in the 3-10 minute band. That is a sharper machine signature than the
+# unpaced behaviour it replaced, so the floor alone is not pacing.
+#
+# Instead we model arrivals as a POISSON PROCESS: each gap is drawn from an
+# exponential distribution whose mean is set so the daily budget spreads across
+# the active window. Exponential arrivals are memoryless, naturally varied
+# (CV ~= 1.0 by construction), and produce no pile-up at any particular value.
+# MIN_GAP_S survives only as a clamp for the short tail.
+#
+# The draw is DETERMINISTIC in the timestamp of the previous action. This is
+# essential: the gate gets polled repeatedly while waiting, and a fresh random
+# draw per call would let the caller "reroll until lucky", collapsing the whole
+# distribution back onto the floor.
+ACTIVE_START_H = _envi("LI_PACE_ACTIVE_START_H", 8)    # local hour, inclusive
+ACTIVE_END_H   = _envi("LI_PACE_ACTIVE_END_H", 22)     # local hour, exclusive
+MAX_GAP_S      = _envi("LI_PACE_MAX_GAP_S", 4 * 3600)
+MIN_GAP_S      = _envi("LI_PACE_MIN_GAP_S", 120)
+CV_FLOOR       = _envf("LI_PACE_CV_FLOOR", 0.25)
+CV_WINDOW      = _envi("LI_PACE_CV_WINDOW", 10)
+MAX_PER_1H     = _envi("LI_PACE_MAX_1H", 4)
+MAX_PER_24H    = _envi("LI_PACE_MAX_24H", 25)
+MAX_PER_72H    = _envi("LI_PACE_MAX_72H", 60)
+MIN_SPREAD_S   = _envi("LI_PACE_MIN_SPREAD_S", 4 * 3600)
+# When CV is too low we do not just wait the floor, we inject a long randomized
+# pause to actively break the metronome and pull CV back up.
+CV_PAUSE_MIN_S = _envi("LI_PACE_CV_PAUSE_MIN_S", 900)
+CV_PAUSE_MAX_S = _envi("LI_PACE_CV_PAUSE_MAX_S", 3600)
+
+PLATFORM = "linkedin"
+
+RC_ALLOW = 0
+RC_WAIT = 75
+RC_STOP = 78
+
+
+def _database_url():
+    url = os.environ.get("DATABASE_URL")
+    if url:
+        return url.strip().strip('"').strip("'")
+    env_path = os.path.expanduser("~/social-autoposter/.env")
+    try:
+        with open(env_path, encoding="utf-8") as fh:
+            for line in fh:
+                line = line.strip()
+                if line.startswith("DATABASE_URL="):
+                    return line.split("=", 1)[1].strip().strip('"').strip("'")
+    except OSError:
+        pass
+    return None
+
+
+def _recent_timestamps(hours=72):
+    """Every LinkedIn write action in the last `hours`, UTC, ascending.
+
+    UNION of BOTH write streams. See the module docstring: counting only one
+    table silently disables most of this gate.
+
+    Raises on any failure so callers can fail closed.
+    """
+    import psycopg2  # imported lazily so `--help` works without the driver
+
+    url = _database_url()
+    if not url:
+        raise RuntimeError("DATABASE_URL not resolvable")
+    since = datetime.now(timezone.utc) - timedelta(hours=hours)
+    conn = psycopg2.connect(url, connect_timeout=10)
+    try:
+        with conn.cursor() as cur:
+            cur.execute(
+                "select ts from ("
+                "  select posted_at as ts from posts"
+                "   where platform = %s and status = 'active'"
+                "     and posted_at is not null and posted_at >= %s"
+                "  union all"
+                "  select replied_at as ts from replies"
+                "   where platform = %s"
+                "     and replied_at is not null and replied_at >= %s"
+                ") a order by ts",
+                (PLATFORM, since, PLATFORM, since),
+            )
+            return [r[0] for r in cur.fetchall()]
+    finally:
+        conn.close()
+
+
+def _active_seconds_per_day():
+    span = (ACTIVE_END_H - ACTIVE_START_H) % 24
+    return (span or 24) * 3600
+
+
+def _in_active_window(dt_local):
+    h = dt_local.hour
+    if ACTIVE_START_H == ACTIVE_END_H:
+        return True
+    if ACTIVE_START_H < ACTIVE_END_H:
+        return ACTIVE_START_H <= h < ACTIVE_END_H
+    return h >= ACTIVE_START_H or h < ACTIVE_END_H  # window wraps midnight
+
+
+def _seconds_to_window_open(dt_local):
+    """Seconds until the active window next opens. 0 if already open."""
+    if _in_active_window(dt_local):
+        return 0
+    nxt = dt_local.replace(hour=ACTIVE_START_H, minute=0, second=0, microsecond=0)
+    if nxt <= dt_local:
+        nxt += timedelta(days=1)
+    return (nxt - dt_local).total_seconds()
+
+
+def _target_gap(last_ts):
+    """Exponentially-distributed target gap, deterministic in `last_ts`.
+
+    mean = active_seconds_per_day / MAX_PER_24H, so a full day's budget spreads
+    naturally across the active window instead of bunching at a floor.
+
+    Determinism matters: see the CONFIG note. Same last_ts always yields the
+    same target, so polling cannot reroll its way down to MIN_GAP_S.
+    """
+    import hashlib
+
+    mean = _active_seconds_per_day() / max(MAX_PER_24H, 1)
+    digest = hashlib.sha256(last_ts.isoformat().encode("utf-8")).digest()
+    # 53 bits -> uniform in [0,1); nudged off the endpoints for the log below.
+    u = int.from_bytes(digest[:7], "big") / float(1 << 56)
+    u = min(max(u, 1e-9), 1 - 1e-9)
+    gap = -mean * math.log(1.0 - u)  # inverse-CDF of Exponential(1/mean)
+    return max(MIN_GAP_S, min(gap, MAX_GAP_S))
+
+
+def _gaps(ts):
+    return [
+        (b - a).total_seconds()
+        for a, b in zip(ts, ts[1:])
+        if (b - a).total_seconds() >= 0
+    ]
+
+
+def _cv(gaps):
+    """Coefficient of variation. None when undefined (need >= 2 gaps)."""
+    if len(gaps) < 2:
+        return None
+    mean = statistics.fmean(gaps)
+    if mean <= 0:
+        return 0.0
+    return statistics.stdev(gaps) / mean
+
+
+def evaluate(now=None, timestamps=None):
+    """Return a decision dict. Pure given its inputs, so it is testable."""
+    now = now or datetime.now(timezone.utc)
+    ts = timestamps if timestamps is not None else _recent_timestamps()
+
+    in_1h = [t for t in ts if t >= now - timedelta(hours=1)]
+    in_24h = [t for t in ts if t >= now - timedelta(hours=24)]
+    in_72h = ts
+
+    counters = {
+        "count_1h": len(in_1h),
+        "count_24h": len(in_24h),
+        "count_72h": len(in_72h),
+        "max_1h": MAX_PER_1H,
+        "max_24h": MAX_PER_24H,
+        "max_72h": MAX_PER_72H,
+    }
+
+    def decision(action, rc, reason, wait_seconds=0, **extra):
+        d = {
+            "action": action,
+            "rc": rc,
+            "reason": reason,
+            "wait_seconds": int(wait_seconds),
+            "checked_at": now.isoformat(),
+        }
+        d.update(counters)
+        d.update(extra)
+        return d
+
+    # ---- hard ceilings first: these mean "stop", not "wait a bit" ----------
+    if len(in_24h) >= MAX_PER_24H:
+        return decision("stop", RC_STOP,
+                        f"24h cap reached ({len(in_24h)}/{MAX_PER_24H})")
+    if len(in_72h) >= MAX_PER_72H:
+        return decision("stop", RC_STOP,
+                        f"72h cap reached ({len(in_72h)}/{MAX_PER_72H})")
+
+    # ---- rolling hour: a wait, since it clears on its own ------------------
+    if len(in_1h) >= MAX_PER_1H:
+        oldest = min(in_1h)
+        wait = (oldest + timedelta(hours=1) - now).total_seconds()
+        return decision("wait", RC_WAIT,
+                        f"1h cap reached ({len(in_1h)}/{MAX_PER_1H})",
+                        max(wait, 60))
+
+    # ---- active-hours window ----------------------------------------------
+    # Humans do not comment uniformly around the clock. Observed spans were
+    # 20-24h/day, which is itself a tell independent of volume.
+    now_local = now.astimezone()
+    to_open = _seconds_to_window_open(now_local)
+    if to_open > 0:
+        return decision("wait", RC_WAIT,
+                        f"outside active window "
+                        f"{ACTIVE_START_H:02d}:00-{ACTIVE_END_H:02d}:00 local",
+                        to_open)
+
+    # ---- sampled inter-action interval (the actual pacing) ----------------
+    # Not a flat floor: a per-gap draw from an exponential, so the resulting
+    # distribution is continuous instead of piling up at a single value.
+    if ts:
+        last = max(ts)
+        since_last = (now - last).total_seconds()
+        target = _target_gap(last)
+        if since_last < target:
+            return decision("wait", RC_WAIT,
+                            f"sampled interval not elapsed "
+                            f"({int(since_last)}s < {int(target)}s target)",
+                            target - since_last,
+                            seconds_since_last=int(since_last),
+                            target_gap_s=int(target))
+
+    # ---- cadence regularity -----------------------------------------------
+    # CRITICAL: both this rule and the spread rule below must be evaluated
+    # against the state that WOULD exist if we posted right now, never against
+    # history alone. History does not change while we wait, so a rule phrased
+    # over past gaps can never be satisfied by waiting: an earlier version of
+    # this file compared the last two gaps (120s, 120s -> CV 0.00), told the
+    # caller to sleep, and then returned the identical verdict forever. That
+    # livelocked the pipeline at 3 actions total and cost 1.3 actions/day
+    # instead of the intended ~25. Including the pending gap makes waiting
+    # monotonically increase CV, so the rule always resolves itself.
+    candidate_gap = (now - max(ts)).total_seconds() if ts else None
+    gaps = _gaps(ts)
+    if candidate_gap is not None:
+        gaps = gaps + [candidate_gap]
+    gaps = gaps[-CV_WINDOW:]
+    cv = _cv(gaps)
+    if cv is not None and cv < CV_FLOOR:
+        # Metronomic. Break it with a long randomized pause rather than the floor.
+        pause = random.uniform(CV_PAUSE_MIN_S, CV_PAUSE_MAX_S)
+        return decision("wait", RC_WAIT,
+                        f"cadence too regular (CV={cv:.2f} < {CV_FLOOR:.2f} "
+                        f"over last {len(gaps)} gaps incl. pending)",
+                        pause, cv=round(cv, 3))
+
+    # ---- daily spread: do not bunch the day's actions into one window ------
+    # Same "as if we posted now" framing: `now` is the effective end of the
+    # window, so the spread grows as we wait and the rule cannot livelock.
+    if len(in_24h) >= max(3, MAX_PER_24H // 2):
+        spread = (now - min(in_24h)).total_seconds()
+        if spread < MIN_SPREAD_S:
+            wait = MIN_SPREAD_S - spread
+            return decision("wait", RC_WAIT,
+                            f"daily spread too tight ({int(spread/60)}min over "
+                            f"{len(in_24h)} actions; want >= {MIN_SPREAD_S//3600}h)",
+                            wait, spread_minutes=int(spread / 60))
+
+    return decision("allow", RC_ALLOW, "within all pacing limits",
+                    cv=(round(cv, 3) if cv is not None else None))
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("command", choices=["check", "status"])
+    ap.add_argument("--json", action="store_true",
+                    help="emit the full decision as JSON")
+    args = ap.parse_args()
+
+    try:
+        d = evaluate()
+    except Exception as exc:  # noqa: BLE001 - fail closed on ANY read failure
+        d = {
+            "action": "stop",
+            "rc": RC_STOP,
+            "reason": f"pacing state unreadable, failing closed: {exc}",
+            "wait_seconds": 0,
+        }
+
+    if args.command == "status":
+        print(json.dumps(d, indent=2))
+        return 0
+
+    if args.json:
+        print(json.dumps(d))
+    else:
+        print(f"{d['action'].upper()}: {d['reason']}"
+              + (f" (wait {d['wait_seconds']}s)" if d["wait_seconds"] else ""))
+    return d["rc"]
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/linkedin_session_watch.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""LinkedIn session canary: detect a dropped session in ~60s instead of ~30min.
+
+What problem this solves
+------------------------
+`detect-gate` only probes the session at the START of a pipeline run. On
+2026-07-20 it reported "session healthy (feed renders)" at 20:27:31Z, the
+session was killed somewhere around 20:50Z mid-comment, and nothing noticed
+until the next run-linkedin fire at 20:57:12Z. That is a ~30 minute blind
+window in which the pipeline believed it was logged in.
+
+This canary closes that window by reading the `li_at` session cookie straight
+out of the ALREADY-RUNNING harness Chrome over CDP. Two properties matter:
+
+  1. It costs ZERO LinkedIn traffic. CDP is a local debugging channel, so this
+     adds no request footprint to an account that is already flagged. That is
+     why we do not simply fetch /feed/ on a timer.
+  2. It reads the LIVE browser, not the on-disk Cookies sqlite file. The
+     on-disk store lags badly: on 2026-07-20 the `linkedin` profile's Cookies
+     db had an mtime of 2026-07-02 while the live context still held a valid
+     li_at. Reading the file would produce false alarms.
+
+Conservative by design: if Chrome is down, or CDP does not answer, or the
+cookie read fails, we report `unknown` and do NOTHING. A canary that cries wolf
+gets ignored, and engaging the killswitch is disruptive (it halts nine launchd
+jobs). We only act on a positive, well-formed "Chrome is up, cookies read fine,
+li_at is absent".
+
+CLI
+---
+    linkedin_session_watch.py check            # report only, never engages
+    linkedin_session_watch.py check --engage   # engage killswitch if li_at gone
+    linkedin_session_watch.py check --json
+
+Exit codes:
+    0  li_at present (healthy)
+    1  li_at absent (session dropped)
+    2  unknown / not checkable (Chrome down, CDP silent) - NOT an error
+
+Intended use: launchd every 60s with --engage.
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import urllib.request
+from datetime import datetime, timezone
+
+CDP_URL = os.environ.get("LINKEDIN_CDP_URL", "http://127.0.0.1:9556")
+REPO_DIR = os.path.expanduser("~/social-autoposter")
+KILLSWITCH = os.path.join(REPO_DIR, "scripts", "linkedin_killswitch.py")
+STATE_PATH = os.path.expanduser(
+    "~/.claude/social-autoposter/linkedin.session_canary.json"
+)
+TIMEOUT_S = 8
+
+
+def _browser_ws_url():
+    """Browser-level CDP websocket URL, or None if Chrome is not reachable."""
+    try:
+        with urllib.request.urlopen(f"{CDP_URL}/json/version", timeout=TIMEOUT_S) as r:
+            return json.loads(r.read().decode("utf-8")).get("webSocketDebuggerUrl")
+    except Exception:
+        return None
+
+
+def _all_cookies(ws_url):
+    """Storage.getCookies at browser scope. Returns list, or None on failure.
+
+    Uses websocket-client, which is present on the pipeline's /opt/homebrew/bin/python3.
+    We deliberately avoid playwright's connect_over_cdp here: this runs every
+    minute alongside live pipeline work, and a passive single-command socket is
+    far less likely to perturb a run than attaching a full automation client.
+    """
+    try:
+        import websocket  # websocket-client
+    except ImportError:
+        return None
+    ws = None
+    try:
+        # suppress_origin is REQUIRED: websocket-client otherwise sends an
+        # Origin header and Chrome rejects the handshake with
+        # "403 Rejected an incoming WebSocket connection from the ... origin".
+        ws = websocket.create_connection(
+            ws_url, timeout=TIMEOUT_S, suppress_origin=True
+        )
+        ws.send(json.dumps({"id": 1, "method": "Storage.getCookies", "params": {}}))
+        # The browser endpoint can interleave events; read until our reply lands.
+        for _ in range(20):
+            msg = json.loads(ws.recv())
+            if msg.get("id") == 1:
+                if "error" in msg:
+                    return None
+                return msg.get("result", {}).get("cookies", [])
+        return None
+    except Exception:
+        return None
+    finally:
+        if ws is not None:
+            try:
+                ws.close()
+            except Exception:
+                pass
+
+
+def check():
+    now = datetime.now(timezone.utc).isoformat()
+    ws_url = _browser_ws_url()
+    if not ws_url:
+        return {"status": "unknown", "reason": "harness Chrome not reachable on CDP",
+                "checked_at": now}
+
+    cookies = _all_cookies(ws_url)
+    if cookies is None:
+        return {"status": "unknown", "reason": "CDP cookie read failed",
+                "checked_at": now}
+
+    li = [c for c in cookies if "linkedin.com" in (c.get("domain") or "")]
+    has_li_at = any(c.get("name") == "li_at" for c in li)
+    has_li_rm = any(c.get("name") == "li_rm" for c in li)
+
+    return {
+        "status": "healthy" if has_li_at else "dropped",
+        "reason": ("li_at present" if has_li_at
+                   else "li_at absent from live harness Chrome"),
+        "linkedin_cookie_count": len(li),
+        "has_li_rm": has_li_rm,
+        "checked_at": now,
+    }
+
+
+def _killswitch_active():
+    try:
+        return subprocess.run(
+            ["/opt/homebrew/bin/python3", KILLSWITCH, "check"],
+            capture_output=True, timeout=30,
+        ).returncode != 0
+    except Exception:
+        return True  # assume active; never double-engage on uncertainty
+
+
+def engage(detail):
+    """Engage the killswitch. Idempotent upstream: the FIRST signal wins."""
+    if _killswitch_active():
+        return {"engaged": False, "note": "killswitch already active"}
+    try:
+        p = subprocess.run(
+            ["/opt/homebrew/bin/python3", KILLSWITCH, "engage",
+             "--signal", "li_at_cleared", "--detail", detail],
+            capture_output=True, text=True, timeout=120,
+        )
+        return {"engaged": p.returncode == 0,
+                "stdout": (p.stdout or "").strip()[:300],
+                "stderr": (p.stderr or "").strip()[:300]}
+    except Exception as exc:  # noqa: BLE001
+        return {"engaged": False, "error": str(exc)[:200]}
+
+
+def _write_state(result):
+    try:
+        os.makedirs(os.path.dirname(STATE_PATH), exist_ok=True)
+        with open(STATE_PATH, "w", encoding="utf-8") as fh:
+            json.dump(result, fh, indent=2)
+    except OSError:
+        pass
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("command", choices=["check"])
+    ap.add_argument("--engage", action="store_true",
+                    help="engage the killswitch when li_at is absent")
+    ap.add_argument("--json", action="store_true")
+    args = ap.parse_args()
+
+    result = check()
+
+    if result["status"] == "dropped" and args.engage:
+        result["killswitch"] = engage(
+            "session canary: li_at absent from live harness Chrome"
+        )
+
+    _write_state(result)
+
+    if args.json:
+        print(json.dumps(result))
+    else:
+        print(f"{result['status'].upper()}: {result['reason']}")
+
+    return {"healthy": 0, "dropped": 1, "unknown": 2}[result["status"]]
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/post_reddit.py

@@ -2879,7 +2879,7 @@ def main():
     parser.add_argument("--batch-id", dest="batch_id", default=None,
                         help="Cycle-level batch_id (e.g. rdcycle-YYYYMMDD-HHMMSS). Used by "
                              "--phase phase0 / --phase salvage / --phase discover to attribute "
-                             "rows in reddit_candidates and reddit_batches. Required for "
+                             "rows in reddit_candidates. Required for "
                              "phase0 and salvage; optional for discover (defaults to a "
                              "per-discover synthetic id).")
     args = parser.parse_args()

package/scripts/reddit_ban_check.py

@@ -99,7 +99,22 @@ def _reddit_page(pw):
     try:
         browser = pw.chromium.connect_over_cdp(ws)
         ctx = browser.contexts[0] if browser.contexts else browser.new_context()
-        page = ctx.new_page()
+        # Reuse an existing reddit tab instead of new_page(). new_page() opens
+        # a fresh tab on the reddit homepage and STEALS OS FOCUS every call —
+        # this ran ~per-strike and was the reddit focus-pop the other reddit
+        # helpers (reddit_browser / reddit_browser_fetch) already fixed but
+        # this 2026-07-17 ban-check never did. Navigating a background tab does
+        # not pop. Prefer a tab already on reddit.com; else pages[0]; else
+        # create one. Left OPEN for reuse (cleanup_harness_tabs trims to one).
+        page = None
+        for pg in ctx.pages:
+            if "reddit.com" in (pg.url or "") and "login" not in (pg.url or ""):
+                page = pg
+                break
+        if page is None and ctx.pages:
+            page = ctx.pages[0]
+        if page is None:
+            page = ctx.new_page()
         page.set_default_timeout(20000)
         return browser, page
     except Exception:

package/scripts/tlh_freshness_284.py

@@ -0,0 +1,134 @@
+import os, re, subprocess, hashlib, itertools, json
+import psycopg2
+from collections import defaultdict
+
+REM = os.path.expanduser("~/social-autoposter/mixer/remotion")
+PUB = os.path.join(REM, "public", "mixer")
+FFPROBE = "ffprobe"
+os.environ["PATH"] = "/opt/homebrew/Cellar/ffmpeg/8.1.1/bin:" + os.environ.get("PATH","")
+
+def dburl():
+    with open(os.path.expanduser("~/social-autoposter/.env")) as f:
+        for line in f:
+            if line.startswith("DATABASE_URL="):
+                return line.split("=",1)[1].strip()
+    raise SystemExit("no DATABASE_URL")
+
+def probe_dur(p):
+    try:
+        out = subprocess.check_output([FFPROBE,"-v","error","-show_entries","format=duration","-of","csv=p=0",p]).decode().strip()
+        return float(out)
+    except Exception:
+        return None
+
+def md5(p):
+    h=hashlib.md5()
+    with open(p,"rb") as f:
+        for chunk in iter(lambda:f.read(1<<20), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+# 1. all tlh-*.mp4 slot files, their duration + content md5
+slots={}
+for fn in os.listdir(PUB):
+    if fn.startswith("tlh-") and fn.endswith(".mp4"):
+        p=os.path.join(PUB,fn)
+        d=probe_dur(p)
+        slots[fn]={"dur":d,"md5":md5(p)}
+
+# content class = md5. Map filename -> class
+fn2class={fn:info["md5"] for fn,info in slots.items()}
+# which classes are ~2.0s (target 2.0 slots). Consider a file 2.0s if 1.95<=dur<=2.05
+two_sec_classes=set()
+class_dur=defaultdict(list)
+for fn,info in slots.items():
+    if info["dur"] is not None:
+        class_dur[info["md5"]].append(info["dur"])
+for cls,durs in class_dur.items():
+    avg=sum(durs)/len(durs)
+    if 1.95<=avg<=2.05:
+        two_sec_classes.add(cls)
+
+# 2. DB: all lesson-% rows, source_clips + post_number
+conn=psycopg2.connect(dburl())
+cur=conn.cursor()
+cur.execute("""SELECT post_number, variant_id, source_clips, metadata->>'theme_angle'
+               FROM media_posts WHERE variant_id LIKE 'lesson-%' AND source_clips IS NOT NULL
+               ORDER BY post_number""")
+rows=cur.fetchall()
+
+# map each row -> set of content classes (from src basenames), record post ordering
+variant_classes=[]  # (post_number, variant_id, frozenset(classes))
+class_last_post=defaultdict(lambda:-1)
+for pn,vid,sc,angle in rows:
+    if isinstance(sc,str):
+        sc=json.loads(sc)
+    classes=set()
+    for c in sc:
+        src=c.get("src","")
+        base=os.path.basename(src)
+        cls=fn2class.get(base)
+        if cls:
+            classes.add(cls)
+    variant_classes.append((pn,vid,frozenset(classes)))
+    for cls in classes:
+        if pn>class_last_post[cls]:
+            class_last_post[cls]=pn
+
+# recent organic renders = last 5 lesson rows by post_number
+recent5=set()
+for pn,vid,cls in sorted(variant_classes,key=lambda x:-x[0])[:5]:
+    recent5|=set(cls)
+
+# candidate 2.0s classes, ranked by staleness (lowest last_post first)
+cands=[(class_last_post[c],c) for c in two_sec_classes]
+cands.sort()  # stalest first
+print("== 2.0s content classes, stalest first (last_post, class, example_files) ==")
+class_files=defaultdict(list)
+for fn,cls in fn2class.items():
+    class_files[cls].append(fn)
+for lp,c in cands[:20]:
+    print(f"  last_post={lp:>4}  {c[:12]}  files={sorted(class_files[c])[:4]}")
+
+# no-3+-co-occurrence: chosen 4-set shares <=2 classes with ANY prior variant
+def ok_set(fourset):
+    fs=set(fourset)
+    for pn,vid,cls in variant_classes:
+        if len(fs & set(cls))>=3:
+            return False
+    return True
+
+# not in recent5
+pool=[c for lp,c in cands if c not in recent5]
+print(f"\n== pool (stale, not in last-5) size={len(pool)} ==")
+
+# greedily search: take combinations of the stalest, prefer overall stalest sum
+chosen=None
+# limit search to stalest ~14 for tractability
+search=pool[:14]
+best=None
+for combo in itertools.combinations(search,4):
+    if ok_set(combo):
+        score=sum(class_last_post[c] for c in combo)
+        if best is None or score<best[0]:
+            best=(score,combo)
+if best:
+    chosen=best[1]
+    print("\n== CHOSEN 4-set (min staleness score, no 3+ co-occurrence) ==")
+    for c in chosen:
+        print(f"  last_post={class_last_post[c]:>4}  {c[:12]}  pick_file={sorted(class_files[c])[0]}")
+    # verify max pairwise co-occurrence
+    maxco=0
+    for pn,vid,cls in variant_classes:
+        ov=len(set(chosen)&set(cls))
+        maxco=max(maxco,ov)
+    print(f"  max overlap with any prior variant = {maxco}")
+    print("  RESULT_FILES="+",".join(sorted(class_files[c])[0] for c in chosen))
+else:
+    print("NO VALID SET FOUND")
+
+# also report existing max lesson number
+cur.execute("SELECT variant_id FROM media_posts WHERE variant_id ~ '^lesson-[0-9]+$'")
+nums=[int(r[0].split('-')[1]) for r in cur.fetchall()]
+print("\nDB max lesson num =", max(nums) if nums else None)
+cur.close(); conn.close()

package/skill/engage-linkedin.sh

@@ -278,8 +278,46 @@ RESET_COUNT=$(li_reset_processing 2)
 
 PENDING_COUNT=$(li_reply_count pending)
 
+# ---- PACING PREFLIGHT (the enforceable half of the pacing gate) -----------
+# The per-reply Step 3b gate inside the Phase B prompt is the fine-grained
+# control, but it depends on the model obeying an instruction. This preflight
+# is the hard stop: when a 24h/72h ceiling is already blown there is nothing
+# Phase B could legally post, so we skip the phase before paying for browser
+# bootstrap, the pending pull and a Claude run.
+#
+# rc=78 ("stop") zeroes PENDING_COUNT rather than exiting, deliberately: an
+# early exit here would skip the run summary and the dashboard metric line at
+# the bottom of this script, and a pipeline that goes quiet WITHOUT reporting
+# is precisely how the 2026-07-20 outage stayed invisible for nine days.
+# rc=75 ("wait") still enters the phase; the per-reply gate sleeps the short
+# remainder itself.
+_LI_PACE_RC=0
+_LI_PACE_JSON="$("$PY_BIN" "$REPO_DIR/scripts/linkedin_pacing.py" check --json 2>&1)" || _LI_PACE_RC=$?
+_LI_PACE_WAIT=$(printf '%s' "$_LI_PACE_JSON" | "$PY_BIN" -c \
+    'import json,sys
+try: print(int(json.load(sys.stdin).get("wait_seconds", 0)))
+except Exception: print(0)' 2>/dev/null || echo 0)
+log "PACING: $_LI_PACE_JSON"
+
+# Skip Phase B when a ceiling is blown (rc=78) OR when the next slot is far off
+# (rc=75 with a long wait). The long-wait case is mostly the overnight
+# active-hours window: without this we would spin up a full Claude session that
+# is forbidden from posting anything for the next several hours. Short waits
+# (< 15 min) still enter the phase, since drafting takes time anyway and the
+# per-reply Step 3b gate can sleep the small remainder.
+if [ "$PENDING_COUNT" -ne 0 ] && { [ "$_LI_PACE_RC" -eq 78 ] || \
+     { [ "$_LI_PACE_RC" -eq 75 ] && [ "${_LI_PACE_WAIT:-0}" -gt 900 ]; }; }; then
+    log "PACING: not postable now (rc=$_LI_PACE_RC, next slot in ${_LI_PACE_WAIT}s); skipping Phase B ($PENDING_COUNT rows stay pending)"
+    PENDING_COUNT=0
+    LI_PACED_OUT=1
+fi
+
 if [ "$PENDING_COUNT" -eq 0 ]; then
-    log "Phase B: No pending LinkedIn replies. Done!"
+    if [ "${LI_PACED_OUT:-0}" -eq 1 ]; then
+        log "Phase B: held back by the pacing gate, not by an empty queue."
+    else
+        log "Phase B: No pending LinkedIn replies. Done!"
+    fi
 else
     log "Phase B: $PENDING_COUNT pending LinkedIn replies to process"
 
@@ -467,6 +505,24 @@ MANDATORY reply flow for every item:
           mode ($PICKED_MODE=invent) craft a NEW snake_case style name not in the
           curated block above and pass it as the [engagement_style] arg in Step 5.
           Professional but casual. NEVER em dashes. Match parent post language.
+  Step 3b: PACING GATE - MANDATORY, run this IMMEDIATELY BEFORE every single
+          post in Step 4. Never post two replies without a fresh check in
+          between; never batch several posts behind one check.
+             python3 $REPO_DIR/scripts/linkedin_pacing.py check --json
+          Read the JSON "action" field and obey it exactly:
+            "allow" (exit 0) -> proceed to Step 4 for THIS reply only.
+            "wait"  (exit 75) -> sleep the returned "wait_seconds", then
+                                 re-run the check. If it still says wait after
+                                 3 attempts, LEAVE the row pending (do NOT mark
+                                 skipped) and move to the next reply; the next
+                                 cycle will pick it up.
+            "stop"  (exit 78) -> a 24h/72h ceiling is blown. STOP POSTING
+                                 ENTIRELY for this run. Leave all remaining
+                                 rows pending and finish the run cleanly.
+          Do NOT try to out-think, average, or "catch up on" this gate; it is
+          the control that keeps our comment cadence from looking like a
+          metronome. On 2026-07-20 an unpaced run put 23 comments out in 22
+          minutes at 60s +/- 29s and the session was killed that evening.
   Step 4: post reply (OAuth API first, browser fallback)
   Step 5: python3 reply_db.py replied ID "text" [url] [engagement_style] [is_recommendation]   <- mark AFTER success. engagement_style is the style name you applied (in USE mode the assigned '${PICKED_STYLE}'). is_recommendation="1" only when you mentioned a project (Tier 2/3).
 If Step 5 fails, the item stays 'processing' and will be reset to 'pending' on the next run.

package/skill/run-linkedin.sh

@@ -106,6 +106,30 @@ export SA_CYCLE_ID="$BATCH_ID"
 
 echo "=== LinkedIn Post Run: $(date) (batch=$BATCH_ID) ===" | tee "$LOG_FILE"
 
+# ---- PACING GATE (2026-07-30) --------------------------------------------
+# This pipeline is the LARGER of the two LinkedIn write paths: it logged 67-74
+# actions/day via log_post.py in the week before the 2026-07-20 session kill,
+# against ~23/day from engage-linkedin.sh. Gating only that other script would
+# have left ~75% of our LinkedIn footprint unpaced.
+#
+# Placed BEFORE Phase A on purpose. Phase B posts exactly ONE comment per fire,
+# so a single per-run check is sufficient, and bailing here also skips Phase A
+# discovery (~$10-15 of Claude spend) rather than paying for candidates we are
+# not allowed to act on.
+#
+# Any non-allow verdict skips the fire outright: this job is on a 15-minute
+# launchd cadence, so the next fire re-checks shortly. We deliberately do not
+# sleep inside the run and hold the browser lock while waiting.
+if [ "$LINKEDIN_BACKEND" = "browser" ]; then
+    _LI_PACE_RC=0
+    _LI_PACE_OUT="$(python3 "$REPO_DIR/scripts/linkedin_pacing.py" check 2>&1)" || _LI_PACE_RC=$?
+    echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] PACING: $_LI_PACE_OUT" | tee -a "$LOG_FILE"
+    if [ "$_LI_PACE_RC" -ne 0 ]; then
+        echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] PACING: skipping this fire (rc=$_LI_PACE_RC); next fire re-checks in ~15min" | tee -a "$LOG_FILE"
+        exit 0
+    fi
+fi
+
 # 2026-05-01: lock policy was changed from "hold for the entire run" to
 # "hold only while a Claude phase is actively driving the browser". The old
 # policy meant a single 25-45min cycle held linkedin-browser exclusively for