diff --git a/backend/apps/agents/browser/browser_agent.py b/backend/apps/agents/browser/browser_agent.py
index d6c1e861..073041b8 100644
--- a/backend/apps/agents/browser/browser_agent.py
+++ b/backend/apps/agents/browser/browser_agent.py
@@ -928,7 +928,12 @@ async def run_browser_agent(
     from backend.apps.agents.browser import browser_prestage
     from backend.apps.agents.browser import browser_plan_dispatch
     # Computed here (pure, task-only) so prestage + every dispatch tier below shares one verdict.
-    task_is_send = not deliverable_is_informational("", task)
+    # `task` here is prompt + an aux-written routing brief (compose_task), and the brief's prose
+    # can read informational and wrongly disarm a real send (facebook: the brief tripped the
+    # info-ask gate while the user's own "start a post" is plainly an action). The user's words
+    # are authoritative, so a send stands if EITHER the composed task OR the raw prompt says action.
+    task_is_send = not (deliverable_is_informational("", task)
+                        and deliverable_is_informational("", user_prompt or task))
     if (browser_prestage.prestage_enabled() and not app_mode and not cancel_event.is_set()
             and not p_skip_prestage_for_skill):
         try:
diff --git a/backend/apps/agents/browser/browser_send_script.py b/backend/apps/agents/browser/browser_send_script.py
index f875b5b1..15c56071 100644
--- a/backend/apps/agents/browser/browser_send_script.py
+++ b/backend/apps/agents/browser/browser_send_script.py
@@ -228,8 +228,11 @@ async def run_send_script(
         else:
             logger.info(f"[browser-sendscript] decline: no composer or opener after poll ({current_url[:50]!r})")
             return None
-    if P_READONLY_RE.search(task) or P_READONLY_RE.search(payload_source or ""):
-        logger.info("[browser-sendscript] decline: read-only directive in task")
+    # Key read-only on the user's OWN words, not the advisory brief composed into `task`: the aux
+    # brief wrote "do not submit/post it" for a plain "start a post", which falsely read-only-flagged
+    # a real send. Fall back to task only when the raw prompt isn't threaded through.
+    if P_READONLY_RE.search(payload_source or task):
+        logger.info("[browser-sendscript] decline: read-only directive in user request")
         return None
     if looks_like_login_wall(current_url, state_text):
         logger.info(f"[browser-sendscript] decline: login/auth wall ({(current_url or '')[:60]!r})")