@m13v/s4l 1.6.197-rc.10

package/scripts/sweep_post_link_clicks.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""
+sweep_post_link_clicks.py — behavioral bot-flagger for short-link click logs.
+
+Runs in addition to the per-hit UA regex in @m13v/seo-components. The UA
+regex catches obvious crawlers; this sweep catches everything that looks
+human in isolation but stops looking human when you correlate hits across
+ip_hash + code + post + time.
+
+All five rules + the R2 per-post excess loop + the counter rebuild now run
+server-side in POST /api/v1/post-links/clicks-sweep (HTTP-only, 2026-06-01;
+no DATABASE_URL on the operator box). This script is a thin trigger that
+POSTs the flags and prints the returned before/flips/after/counter numbers.
+
+Rules (all idempotent — re-running won't double-flag):
+
+  Tier 1 (zero false positives):
+    R1  same ip_hash + same code + >=3 hits in a 240s sliding window
+    R2  clicks on a post exceed views * platform_ctr_ceiling
+    R3  same ip_hash hits >=5 different codes within the window
+
+  Tier 2 (very low false positives, applied after Tier 1):
+    R4  no referrer + browser-looking UA + ip_hash co-occurs with bot rows
+    R5  same ip_hash hits >=4 different codes within any 60-second window
+
+Each flipped row records the rule in `bot_reason` so we can audit and roll
+back per-rule if a false positive shows up. After flipping, the counter
+post_links.clicks is rebuilt from the per-hit log so the dashboard matches.
+
+Usage:
+  scripts/sweep_post_link_clicks.py [--dry-run] [--lookback-hours N]
+                                    [--rules R1,R2,R3,R4,R5]
+                                    [--cron] [--rebuild-counter]
+
+  --lookback-hours N   only consider clicks newer than N hours (default 720
+                       on first/manual run, 6 in --cron mode)
+  --cron               quick-sweep mode: 6h lookback, decrement-only counter
+  --rebuild-counter    full SUM(NOT is_bot) rebuild of post_links.clicks
+
+Idempotent: only flips rows where is_bot=false today; never un-flips.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+
+REPO_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(REPO_DIR, "scripts"))
+
+from http_api import api_post, load_env  # noqa: E402
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--dry-run", action="store_true")
+    ap.add_argument("--lookback-hours", type=int, default=None)
+    ap.add_argument("--cron", action="store_true",
+                    help="quick-sweep mode: 6h lookback, decrement-only counter update")
+    ap.add_argument("--rebuild-counter", action="store_true",
+                    help="full counter rebuild from is_bot=false rows (safe, idempotent)")
+    ap.add_argument("--rules", default="R1,R2,R3,R4,R5",
+                    help="comma-separated rule list, default all five")
+    args = ap.parse_args()
+
+    load_env()
+
+    rules = [r.strip().upper() for r in args.rules.split(",") if r.strip()]
+    body = {
+        "dry_run": args.dry_run,
+        "cron": args.cron,
+        "rebuild_counter": args.rebuild_counter,
+        "rules": rules,
+    }
+    if args.lookback_hours is not None:
+        body["lookback_hours"] = int(args.lookback_hours)
+
+    resp = api_post("/api/v1/post-links/clicks-sweep", body)
+    data = resp.get("data") or {}
+
+    window = data.get("window_hours")
+    before = data.get("before") or {}
+    after = data.get("after") or {}
+    flips = data.get("flips") or {}
+    counter = data.get("counter") or {}
+
+    print(f"[before] window={window}h humans={before.get('humans')} "
+          f"bots={before.get('bots')} total={before.get('total')}", flush=True)
+    print("[flips]", " ".join(f"{k}={flips[k]}" for k in sorted(flips)), flush=True)
+    print(f"[after]  window={window}h humans={after.get('humans')} "
+          f"bots={after.get('bots')} total={after.get('total')}", flush=True)
+
+    mode = counter.get("mode")
+    if mode == "dry-run":
+        print(f"[counter] dry-run: would change SUM by ~{counter.get('would_change_sum')}; "
+              f"humans-total now {counter.get('humans_total')}", flush=True)
+    elif mode == "cron":
+        print(f"[counter] cron-mode: rebuilt counters for codes touching "
+              f"{counter.get('flagged_rows_touched')} flagged rows", flush=True)
+    elif mode == "full-rebuild":
+        print(f"[counter] full rebuild done; SUM(post_links.clicks) now = "
+              f"{counter.get('sum_after')}", flush=True)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/sync_ig_to_posts.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+"""Mirror posted Instagram rows from media_posts -> posts.
+
+media_posts holds the IG-only fields (video_path, post_type, target_account,
+overlays, source_clips, composition_id). posts holds the platform-agnostic
+fields the dashboard reads (platform, our_url, our_content, our_account,
+posted_at, upvotes, comments_count, views, engagement_updated_at).
+
+This script copies the dashboard-essential fields across so the existing
+dashboard surfaces (Trends, Top, Activity, Stats by Engagement Style, Cohort)
+treat Instagram identically to Reddit/Twitter/LinkedIn.
+
+Idempotent: skips rows already mirrored (matched on platform='instagram' AND
+our_url=<IG permalink>). Safe to rerun. Called at end of run-instagram-daily.sh
+so new posts mirror immediately, and once on-demand for backfill.
+
+Usage:
+    python3 scripts/sync_ig_to_posts.py [--quiet] [--limit N]
+"""
+
+import argparse
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from http_api import api_get, api_post
+
+
+def log(msg, quiet=False):
+    if not quiet:
+        print(msg)
+
+
+def _load_canonical_style_names(quiet=False):
+    """Return the set of allowlisted engagement_style names.
+
+    Union of the hardcoded STYLES dict + the registry (seed + model_invented +
+    human_derived rows). Used to gate what we write to posts.engagement_style:
+    Claude sometimes stamps caption-style metadata with non-canonical labels
+    (e.g. 'studyly-rescue-arc') that never went through validate_or_register
+    on the IG render path. We refuse to mirror those into posts so they don't
+    pollute the dashboard's engagement-style A/B picker.
+    """
+    names = set()
+    try:
+        from engagement_styles import get_all_styles
+        names.update((get_all_styles() or {}).keys())
+    except Exception as e:
+        log(f"[sync] WARNING — could not load canonical styles: {e!r}", quiet)
+    return names
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--quiet", action="store_true")
+    parser.add_argument("--limit", type=int, default=None,
+                        help="Cap rows processed (for testing).")
+    args = parser.parse_args()
+
+    # 2026-05-25: gate posts.engagement_style writes against the canonical
+    # registry. IG renders pre-pick a style (run-instagram-render.sh) and ask
+    # Claude to stamp metadata.engagement_style=<picked>, but Claude has been
+    # observed writing caption_style/description_style with off-list labels
+    # (e.g. 'studyly-rescue-arc') instead. Mirroring those into posts.* lets
+    # them pollute the engagement_style A/B picker. We mirror NULL for any
+    # value not in the canonical set; the orphan label remains in
+    # media_posts.metadata for forensics.
+    canonical_styles = _load_canonical_style_names(args.quiet)
+
+    query = {}
+    if args.limit:
+        query["limit"] = int(args.limit)
+    resp = api_get("/api/v1/media-posts/posted-instagram", query=query or None)
+    rows = (resp.get("data") or {}).get("rows") or []
+    log(f"[sync] media_posts: {len(rows)} posted IG rows", args.quiet)
+
+    inserted = 0
+    skipped = 0
+    for r in rows:
+        posted_urls = r["posted_urls"]
+        if isinstance(posted_urls, str):
+            posted_urls = json.loads(posted_urls)
+        ig_url = (posted_urls or {}).get("instagram")
+        if not ig_url:
+            continue
+
+        # thread_url is NOT NULL; for original posts we self-reference
+        # (established pattern, 2,124 rows across other platforms).
+        metadata = r["metadata"]
+        if isinstance(metadata, str):
+            metadata = json.loads(metadata)
+        elif metadata is None:
+            metadata = {}
+        engagement_style = metadata.get("engagement_style") or metadata.get("caption_style")
+        if engagement_style and canonical_styles and engagement_style not in canonical_styles:
+            log(f"[sync] WARNING: dropping non-canonical engagement_style "
+                f"{engagement_style!r} for post-{r['post_number']} "
+                f"({r['target_account']}); mirroring NULL", args.quiet)
+            engagement_style = None
+
+        # The mirror endpoint is idempotent on (platform='instagram',
+        # our_url=ig_url): inserted=false means the row was already mirrored.
+        result = api_post(
+            "/api/v1/posts/mirror-instagram",
+            {
+                "ig_url": ig_url,
+                "caption_text": r["caption_text"] or "",
+                "target_account": r["target_account"] or "matt_diak",
+                "posted_at": r["posted_at"],
+                "project_name": r["project_name"],
+                "engagement_style": engagement_style,
+            },
+        )
+        rdata = result.get("data") or {}
+        posts_id = rdata.get("id")
+        if not rdata.get("inserted"):
+            skipped += 1
+            continue
+        inserted += 1
+        log(f"[sync] inserted post-{r['post_number']} ({r['target_account']}) -> {ig_url}", args.quiet)
+
+        # Attribute the freshly-mirrored posts row to any campaign that fired
+        # at post time. post_to_ig.py records metadata.applied_campaign_ids on
+        # the media_posts row (AI-disclosure labeling experiment etc.); forward
+        # each to /api/v1/campaigns/bump, which is idempotent (sets
+        # posts.campaign_id and advances the counter only on first attribution).
+        # Best-effort: a bump failure must not abort the sync.
+        applied = metadata.get("applied_campaign_ids") or []
+        if applied and posts_id:
+            for cid in applied:
+                try:
+                    api_post(
+                        "/api/v1/campaigns/bump",
+                        {"table": "posts", "id": int(posts_id), "campaign_id": int(cid)},
+                    )
+                    log(f"[sync]   campaign {cid} -> posts.id={posts_id}", args.quiet)
+                except SystemExit as e:
+                    log(f"[sync]   WARNING campaign {cid} bump failed: {e}", args.quiet)
+                except Exception as e:
+                    log(f"[sync]   WARNING campaign {cid} bump failed: {e}", args.quiet)
+
+    log(f"[sync] done: inserted={inserted} skipped_existing={skipped} total_scanned={len(rows)}", args.quiet)
+
+
+if __name__ == "__main__":
+    main()

package/scripts/test_browser_lock.py

@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+"""Regression test for the browser session-lock fix (2026-06-16).
+
+Covers BOTH twitter_browser.py and linkedin_browser.py (same fix, ported). With
+NO real browser, it exercises the three session-lock defects:
+  (a) dead python:PID holders must be reclaimed immediately (not after 300s)
+  (b) [shell-side, verified separately] no `rm -f` of the lockfile in pipelines
+  (c) lock acquisition must be atomic (two acquirers cannot both win)
+
+Run:
+    /opt/homebrew/bin/python3 scripts/test_browser_lock.py
+Exit 0 = all pass; non-zero with FAIL lines otherwise.
+
+Canonical "did the fix survive / still work?" check. See
+docs/twitter_browser_lock.md for the full verification playbook.
+"""
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import time
+from contextlib import redirect_stderr, redirect_stdout
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+for _cand in (HERE, os.path.join(HERE, "..")):
+    if os.path.exists(os.path.join(_cand, "twitter_browser.py")):
+        sys.path.insert(0, _cand)
+        break
+import twitter_browser  # noqa: E402
+import linkedin_browser  # noqa: E402
+
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    print(f"{'PASS' if cond else 'FAIL'}  {name}" + (f"  -- {detail}" if detail else ""))
+    if not cond:
+        FAILS.append(name)
+
+
+def write_lock(mod, holder, ts):
+    with open(mod.LOCK_FILE, "w") as f:
+        json.dump({"session_id": holder, "timestamp": ts}, f)
+
+
+def read_holder(mod):
+    with open(mod.LOCK_FILE) as f:
+        return json.load(f)["session_id"]
+
+
+def reset(mod):
+    mod._LOCK_SESSION_ID = f"python:{os.getpid()}"
+    mod._LOCK_INHERITED = False
+    try:
+        os.remove(mod.LOCK_FILE)
+    except OSError:
+        pass
+
+
+def dead_pid():
+    p = subprocess.Popen(["true"])
+    p.wait()
+    try:
+        os.kill(p.pid, 0)
+        return None
+    except ProcessLookupError:
+        return p.pid
+
+
+def run_suite(mod, giveup_substrings):
+    P = mod.__name__  # prefix for check names
+    tmpdir = tempfile.mkdtemp(prefix=f"brlock-{P}-")
+    mod.LOCK_FILE = os.path.join(tmpdir, "lock.json")
+    mod.LOCK_WAIT_MAX = 2
+    mod.LOCK_POLL_INTERVAL = 0.2
+    print(f"\n# {P}: LOCK_FILE={mod.LOCK_FILE}  LOCK_WAIT_MAX={mod.LOCK_WAIT_MAX}")
+
+    check(f"{P}.fix_present: _is_python_holder_alive", hasattr(mod, "_is_python_holder_alive"))
+    check(f"{P}.fix_present: _try_take_lock (atomic)", hasattr(mod, "_try_take_lock"))
+
+    # (c) atomic take
+    reset(mod)
+    first = mod._try_take_lock()
+    second = mod._try_take_lock()
+    check(f"{P}.c.atomic_take: first wins, second loses", first is True and second is False,
+          f"first={first} second={second}")
+    check(f"{P}.c.atomic_take: file holds our id", read_holder(mod) == mod._LOCK_SESSION_ID)
+
+    # (a) dead python:PID holder reclaimed immediately
+    reset(mod)
+    dp = dead_pid()
+    if dp is None:
+        check(f"{P}.a.dead_python_reclaim", False, "could not obtain a dead pid")
+    else:
+        write_lock(mod, f"python:{dp}", int(time.time()))  # RECENT ts
+        err = io.StringIO()
+        t0 = time.time()
+        with redirect_stderr(err):
+            mod._acquire_browser_lock()
+        elapsed = time.time() - t0
+        check(f"{P}.a.dead_python_reclaim: fast (<1s, not LOCK_WAIT_MAX)", elapsed < 1.0,
+              f"elapsed={elapsed:.2f}s")
+        check(f"{P}.a.dead_python_reclaim: lock now ours", read_holder(mod) == mod._LOCK_SESSION_ID)
+        check(f"{P}.a.dead_python_reclaim: marker reason=dead_python",
+              "reclaimed" in err.getvalue() and "reason=dead_python" in err.getvalue(),
+              err.getvalue().strip())
+
+    # LIVE python peer -> wait then give up
+    reset(mod)
+    peer = subprocess.Popen(["sleep", "30"])
+    try:
+        write_lock(mod, f"python:{peer.pid}", int(time.time()))
+        out, err = io.StringIO(), io.StringIO()
+        t0 = time.time()
+        code = None
+        try:
+            with redirect_stdout(out), redirect_stderr(err):
+                mod._acquire_browser_lock()
+        except SystemExit as e:
+            code = e.code
+        elapsed = time.time() - t0
+        check(f"{P}.live_peer.giveup: exits 1", code == 1, f"code={code}")
+        check(f"{P}.live_peer.giveup: waited ~LOCK_WAIT_MAX", elapsed >= mod.LOCK_WAIT_MAX * 0.8,
+              f"elapsed={elapsed:.2f}s")
+        payload = out.getvalue()
+        for sub in giveup_substrings:
+            check(f"{P}.live_peer.giveup: payload has '{sub}'", sub in payload, payload.strip())
+    finally:
+        peer.terminate()
+        peer.wait()
+
+    # re-entrant -> take fast, refresh timestamp
+    reset(mod)
+    old_ts = int(time.time()) - 120
+    write_lock(mod, mod._LOCK_SESSION_ID, old_ts)
+    t0 = time.time()
+    mod._acquire_browser_lock()
+    check(f"{P}.reentrant: fast", time.time() - t0 < 1.0)
+    with open(mod.LOCK_FILE) as f:
+        new_ts = json.load(f)["timestamp"]
+    check(f"{P}.reentrant: timestamp refreshed", new_ts > old_ts, f"old={old_ts} new={new_ts}")
+
+    # dead UUID holder -> reclaim
+    reset(mod)
+    write_lock(mod, "deadbeef-0000-0000-0000-000000000000", int(time.time()))
+    err = io.StringIO()
+    with redirect_stderr(err):
+        mod._acquire_browser_lock()
+    check(f"{P}.dead_uuid_reclaim: lock now ours", read_holder(mod) == mod._LOCK_SESSION_ID)
+    check(f"{P}.dead_uuid_reclaim: marker reason=dead_uuid", "reason=dead_uuid" in err.getvalue(),
+          err.getvalue().strip())
+
+    # expired holder -> reclaim
+    reset(mod)
+    write_lock(mod, "weird:holder:form", int(time.time()) - (mod.LOCK_EXPIRY + 50))
+    err = io.StringIO()
+    with redirect_stderr(err):
+        mod._acquire_browser_lock()
+    check(f"{P}.expired_reclaim: lock now ours", read_holder(mod) == mod._LOCK_SESSION_ID)
+    check(f"{P}.expired_reclaim: marker reason=expired", "reason=expired" in err.getvalue(),
+          err.getvalue().strip())
+
+    # cold start -> fast + silent
+    reset(mod)
+    err = io.StringIO()
+    t0 = time.time()
+    with redirect_stderr(err):
+        mod._acquire_browser_lock()
+    check(f"{P}.cold_start: fast + silent", (time.time() - t0) < 1.0 and "reclaim" not in err.getvalue())
+
+    try:
+        os.remove(mod.LOCK_FILE)
+    except OSError:
+        pass
+    os.rmdir(tmpdir)
+
+
+# twitter giveup: {"success": false, "error": "...locked by session ... peer alive..."}
+run_suite(twitter_browser, ["locked by session", "peer alive"])
+# linkedin giveup: {"ok": false, "error": "profile_locked", "detail": "...peer_alive=1"}
+run_suite(linkedin_browser, ["profile_locked", "peer_alive"])
+
+print()
+if FAILS:
+    print(f"RESULT: {len(FAILS)} FAILED -> {FAILS}")
+    sys.exit(1)
+print("RESULT: ALL PASS")

package/scripts/test_installation_api.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# End-to-end smoke test for the installation auth lane.
+#
+# Run AFTER:
+#   1. ~/social-autoposter-website/scripts/migrate-installations.sql applied
+#      against $DATABASE_URL.
+#   2. Latest social-autoposter-website deployed to Vercel.
+#
+# Hits:
+#   - GET  heartbeat with no header  (expect 400)
+#   - POST heartbeat with header     (expect 200 + installation row)
+#   - GET  heartbeat with header     (expect 200 + same installation row)
+#   - GET  /api/v1/replies?limit=1   (expect 200 with install header, no bearer)
+#
+# No data is inserted to `replies` here; this only exercises the auth path.
+
+set -euo pipefail
+
+BASE_URL="${BASE_URL:-https://s4l.ai}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+PYTHON_BIN="${PYTHON_BIN:-python3}"
+HDR=$("$PYTHON_BIN" "$SCRIPT_DIR/identity.py" header)
+echo "install_id: $("$PYTHON_BIN" -c "import base64,json,sys; d=json.loads(base64.b64decode(sys.argv[1])); print(d['install_id'])" "$HDR")"
+echo "base_url:   $BASE_URL"
+echo
+
+step() { echo; echo "=== $1 ==="; }
+
+step "1) GET /api/v1/installations/heartbeat (no header) -> expect 400"
+curl -sS -w "\nHTTP %{http_code}\n" "$BASE_URL/api/v1/installations/heartbeat" | tail -20
+
+step "2) POST /api/v1/installations/heartbeat (with header) -> expect 200"
+curl -sS -w "\nHTTP %{http_code}\n" \
+  -X POST \
+  -H "X-Installation: $HDR" \
+  -H "content-type: application/json" \
+  -d '{}' \
+  "$BASE_URL/api/v1/installations/heartbeat" | tail -40
+
+step "3) GET /api/v1/installations/heartbeat (with header) -> expect 200"
+curl -sS -w "\nHTTP %{http_code}\n" \
+  -H "X-Installation: $HDR" \
+  "$BASE_URL/api/v1/installations/heartbeat" | tail -40
+
+step "4) GET /api/v1/replies?limit=1 (with install header, no bearer) -> expect 200"
+curl -sS -w "\nHTTP %{http_code}\n" \
+  -H "X-Installation: $HDR" \
+  "$BASE_URL/api/v1/replies?limit=1" | tail -10
+
+echo
+echo "Done. If all 4 returned the expected codes, the install lane is wired."

package/scripts/test_percard_posting.py

@@ -0,0 +1,142 @@
+"""Headless logic test for per-card serialized posting in the menu bar.
+
+Stubs the heavy deps (rumps / sentry_init / s4l_state) so s4l_menubar imports
+without AppKit, then drives the REAL _on_card_decision + _post_worker_loop on an
+instance built via object.__new__ (bypassing rumps.App.__init__). Verifies:
+  1. posts run strictly one-at-a-time (no overlap on the shared browser)
+  2. order is preserved (FIFO)
+  3. plain approvals -> post=[n]; edited approvals -> edits=[{n,text}]
+  4. rejected cards never post
+  5. _posts_outstanding / _review_active settle to idle once drained
+  6. activity progress reflects the approved burst total, not each 1-item call
+"""
+import os
+import queue
+import sys
+import threading
+import time
+import types
+
+HERE = os.path.join(os.path.dirname(__file__), "..", "mcp", "menubar")
+sys.path.insert(0, os.path.abspath(HERE))
+
+# --- stub heavy deps so the import is headless --------------------------------
+rumps = types.ModuleType("rumps")
+class _App:
+    def __init__(self, *a, **k):
+        pass
+rumps.App = _App
+rumps.Timer = lambda *a, **k: types.SimpleNamespace(start=lambda: None, stop=lambda: None)
+rumps.MenuItem = lambda *a, **k: object()
+rumps.separator = object()
+rumps.notification = lambda *a, **k: None
+sys.modules["rumps"] = rumps
+
+sentry_init = types.ModuleType("sentry_init")
+sentry_init.init_sentry = lambda *a, **k: None
+sentry_init.capture = lambda *a, **k: None
+sys.modules["sentry_init"] = sentry_init
+
+# Track concurrency + record every post_drafts call.
+overlap_detected = []
+inflight = {"n": 0}
+inflight_lock = threading.Lock()
+calls = []
+activity_events = []
+
+def fake_post_drafts(batch_id, post=None, edits=None, timeout=900, activity_label=None):
+    with inflight_lock:
+        inflight["n"] += 1
+        if inflight["n"] > 1:
+            overlap_detected.append(True)
+    calls.append(
+        {
+            "batch": batch_id,
+            "post": post or [],
+            "edits": edits or [],
+            "activity_label": activity_label,
+        }
+    )
+    time.sleep(0.15)  # simulate a slow post so overlaps would be caught
+    with inflight_lock:
+        inflight["n"] -= 1
+    # mimic the real shape: posted count
+    n_posted = len(post or []) + len(edits or [])
+    return {"posted": n_posted}
+
+st = types.ModuleType("s4l_state")
+st.post_drafts = fake_post_drafts
+st.write_activity = lambda state, label: activity_events.append((state, label))
+st.accessibility_trusted = lambda: True
+st.clear_review_request = lambda: None
+sys.modules["s4l_state"] = st
+
+import s4l_menubar  # noqa: E402
+
+# --- build an instance without running rumps.App.__init__ ---------------------
+app = object.__new__(s4l_menubar.S4LMenuBar)
+app._post_q = queue.Queue()
+app._post_worker = None
+app._review_lock = threading.Lock()
+app._panel_open = True
+app._posts_outstanding = 0
+app._posting_batch_total = 0
+app._posting_batch_done = 0
+app._review_active = False
+app._notify = lambda title, msg: None  # silence Notification Center
+
+BATCH = "review-queue"
+
+# Approve a quick burst (as if the user clicked Approve on several cards fast),
+# one edited, plus a rejected card that must NOT post.
+decisions = [
+    {"n": 1, "approved": True, "text": "reply one", "edited": False},
+    {"n": 2, "approved": True, "text": "edited two", "edited": True},
+    {"n": 3, "approved": False, "text": "skip", "edited": False},
+    {"n": 4, "approved": True, "text": "reply four", "edited": False},
+]
+for d in decisions:
+    app._on_card_decision(BATCH, d)
+    time.sleep(0.02)  # tight succession -> overlap would happen if not serialized
+
+# Panel closes while posts may still be draining.
+app._on_review_closed(BATCH, decisions)
+
+# Wait for the queue to drain.
+deadline = time.time() + 10
+while time.time() < deadline:
+    with app._review_lock:
+        if app._posts_outstanding == 0 and app._post_q.empty():
+            break
+    time.sleep(0.05)
+
+# --- assertions ---------------------------------------------------------------
+fail = []
+if overlap_detected:
+    fail.append(f"posts overlapped ({len(overlap_detected)} times) — not serialized")
+posted_ns = [(c["post"], c["edits"]) for c in calls]
+expected = [([1], []), ([], [{"n": 2, "text": "edited two"}]), ([4], [])]
+if posted_ns != expected:
+    fail.append(f"wrong calls/order: got {posted_ns}\n  expected {expected}")
+labels = [c["activity_label"] for c in calls if c.get("activity_label")]
+if not any(label == "posting 2/3" for label in labels):
+    fail.append(f"second post did not carry burst progress 2/3: labels={labels}")
+if not any(label == "posting 3/3" for label in labels):
+    fail.append(f"third post did not carry burst progress 3/3: labels={labels}")
+if not any(event == ("posting", "posting 1/3") for event in activity_events):
+    fail.append(f"activity never expanded first post to 1/3: events={activity_events}")
+if any(c["post"] == [3] or any(e.get("n") == 3 for e in c["edits"]) for c in calls):
+    fail.append("rejected card #3 was posted")
+with app._review_lock:
+    if app._posts_outstanding != 0:
+        fail.append(f"_posts_outstanding leaked: {app._posts_outstanding}")
+    if app._review_active:
+        fail.append("_review_active stuck true after drain + panel closed")
+
+if fail:
+    print("FAIL:")
+    for f in fail:
+        print("  -", f)
+    sys.exit(1)
+print("PASS: 3 posts, serialized, FIFO order, #3 skipped, flags settled idle.")
+print("  calls:", posted_ns)