@m13v/s4l 1.7.1-rc.2 → 1.7.1-rc.21

package/mcp/menubar/s4l_state.py

@@ -82,6 +82,85 @@ def state_dir() -> str:
     )
 
 
+# ---- pause/resume: stop drafting/posting without touching Claude Desktop ---
+# Real mechanics (flag file + launchctl bootout/bootstrap), NOT a loopback call
+# to the MCP: this needs to work from BOTH the menu bar (s4l_menubar.py) and
+# the Claude-independent dashboard_server.py, which share this process but
+# are a different process from the MCP server, so there's no way to delegate
+# to mcp/src/index.ts's pauseS4L/resumeS4L here. Mirrors those functions
+# (same 4 labels, same flag path) for the common pause->resume case. What it
+# deliberately does NOT do: mcp/src/index.ts's resumeS4L also re-runs the
+# readiness-gated install logic (persona/project/X-verified checks, content-
+# aware plist rewrite) via ensure*Installed() — that only matters for a box
+# that was never fully set up before Pause, an edge case the next Claude
+# boot / project_config call naturally heals once unpaused. This resume just
+# reloads the exact plists Pause unloaded (Pause never deletes anything).
+PAUSE_TARGET_LABELS = (
+    AUTOPILOT_LABEL,
+    "com.m13v.social-claude-reaper",
+    "com.m13v.social-autopilot-stall-watch",
+    "com.m13v.social-memory-snapshot",
+)
+
+
+def pause_flag_path() -> str:
+    return os.path.join(state_dir(), "paused.flag")
+
+
+def is_paused() -> bool:
+    return os.path.exists(pause_flag_path())
+
+
+def pause_s4l() -> dict:
+    if is_paused():
+        return {"ok": True, "paused": True, "detail": "already paused"}
+    try:
+        os.makedirs(state_dir(), exist_ok=True)
+        with open(pause_flag_path(), "w") as fh:
+            fh.write(f"paused at {time.strftime('%Y-%m-%dT%H:%M:%S%z')}\n")
+    except Exception as e:
+        return {"ok": False, "paused": is_paused(), "detail": f"could not write pause flag: {e}"}
+    uid = os.getuid()
+    results = []
+    for label in PAUSE_TARGET_LABELS:
+        try:
+            subprocess.run(
+                ["launchctl", "bootout", f"gui/{uid}/{label}"],
+                capture_output=True, timeout=15,
+            )
+            results.append(f"{label}: unloaded")
+        except Exception as e:
+            results.append(f"{label}: {e}")
+    return {"ok": True, "paused": True, "detail": "; ".join(results)}
+
+
+def resume_s4l() -> dict:
+    try:
+        os.remove(pause_flag_path())
+    except FileNotFoundError:
+        pass
+    except Exception:
+        pass
+    uid = os.getuid()
+    la_dir = str(Path.home() / "Library" / "LaunchAgents")
+    results = []
+    for label in PAUSE_TARGET_LABELS:
+        plist = os.path.join(la_dir, f"{label}.plist")
+        if not os.path.exists(plist):
+            results.append(f"{label}: no plist, skip")
+            continue
+        try:
+            subprocess.run(["launchctl", "enable", f"gui/{uid}/{label}"], capture_output=True, timeout=15)
+            r = subprocess.run(
+                ["launchctl", "bootstrap", f"gui/{uid}", plist],
+                capture_output=True, timeout=15,
+            )
+            results.append(f"{label}: rc={r.returncode}")
+        except Exception as e:
+            results.append(f"{label}: {e}")
+    return {"ok": True, "paused": is_paused(), "detail": "; ".join(results)}
+
+
 def read_json(name: str):
     try:
         return json.loads((Path(state_dir()) / name).read_text())
@@ -162,7 +241,9 @@ def _endpoint_url():
         with urllib.request.urlopen(url + "health", timeout=1.5) as r:
             if r.status == 200:
                 return url
-    except Exception:
+    except Exception as e:
+        sys.stderr.write(f"[s4l-state] loopback health check failed: {type(e).__name__}: {e}\n")
+        sys.stderr.flush()
         return None
     return None
 
@@ -208,7 +289,9 @@ def loopback_tool(name: str, args=None, timeout: float = 20.0):
         )
         with urllib.request.urlopen(req, timeout=timeout) as r:
             return _parse_tool_result(json.loads(r.read().decode()))
-    except Exception:
+    except Exception as e:
+        sys.stderr.write(f"[s4l-state] loopback_tool({name!r}) failed: {type(e).__name__}: {e}\n")
+        sys.stderr.flush()
         return None
 
 
@@ -246,6 +329,12 @@ def ver_key(v):
     return _snapshot_module()._ver_key(v)
 
 
+def version():
+    """Installed version, delegated to scripts/snapshot.py::_resolve_version so
+    there is exactly ONE Python implementation, same pattern as ver_key above."""
+    return _snapshot_module()._resolve_version()
+
+
 def _refresh_snapshot_bg():
     try:
         snap = _compute_snapshot_full()
@@ -259,6 +348,43 @@ def _refresh_snapshot_bg():
         _snap_refreshing[0] = False
 
 
+# ---- version/update check: refreshed independently of the full snapshot ----
+# compute() calls _x_status() FIRST, which can block up to 90s in a subprocess
+# (setup_twitter_auth.py -> CDP to Chrome) whenever a scan job has the browser
+# busy. That stalls _refresh_snapshot_bg() for the whole duration, so
+# update_available/latest_version stay frozen on a busy box even though the
+# GitHub check itself is a ~1s curl. Poll scripts/snapshot.py::version_status()
+# on its own short cadence, gated by its own lock, so the "Update available"
+# banner never waits on X/Chrome state.
+_ver_cache = {"val": None, "at": 0.0}
+_ver_refreshing = [False]
+_VER_REFRESH_TTL = 20.0
+
+
+def _refresh_version_bg():
+    try:
+        val = _snapshot_module().version_status()
+        if isinstance(val, dict) and "update_available" in val:
+            with _snap_lock:
+                _ver_cache["val"] = val
+                _ver_cache["at"] = time.time()
+    except Exception:
+        pass
+    finally:
+        _ver_refreshing[0] = False
+
+
+def _version_overlay():
+    now = time.time()
+    with _snap_lock:
+        cached = _ver_cache["val"]
+        age = now - _ver_cache["at"]
+    if (cached is None or age > _VER_REFRESH_TTL) and not _ver_refreshing[0]:
+        _ver_refreshing[0] = True
+        threading.Thread(target=_refresh_version_bg, daemon=True).start()
+    return cached
+
+
 def snapshot():
     """Full snapshot computed DIRECTLY from the stateful files via
     scripts/snapshot.py — the SAME single-source module the MCP shells out to, so
@@ -268,7 +394,9 @@ def snapshot():
     a BACKGROUND thread; this returns the last cached result instantly.
 
     Tiers: (1) the background-computed local snapshot; (2) the server's last
-    persisted `status-summary.json`; (3) the onboarding ledger."""
+    persisted `status-summary.json`; (3) the onboarding ledger. The version/update
+    fields are always overlaid from the independent _version_overlay() cache
+    (see above) so they stay live even while tier (1)'s compute() is blocked."""
     now = time.time()
     with _snap_lock:
         cached = _snap_cache["val"]
@@ -276,29 +404,40 @@ def snapshot():
     if (cached is None or age > 4.0) and not _snap_refreshing[0]:
         _snap_refreshing[0] = True
         threading.Thread(target=_refresh_snapshot_bg, daemon=True).start()
+
     if cached is not None:
         out = dict(cached)
         out["_live"] = True
-        return out
-    summ = read_json("status-summary.json")
-    if isinstance(summ, dict) and "projects_total" in summ:
-        summ["_live"] = False
-        summ["_from_summary"] = True
-        return summ
-    ob = read_onboarding()
-    return {
-        "_live": False,
-        "runtime_ready": runtime_ready(),
-        "onboarding": ob,
-        "autopilot_on": autopilot_loaded(),
-        "x_connected": False,  # unknowable offline; State derives from onboarding
-        "x_handle": None,
-        "projects_ready": 0,
-        "projects_total": 0,
-        "version": version(),
-        "update_available": False,
-        "latest_version": None,
-    }
+    else:
+        summ = read_json("status-summary.json")
+        if isinstance(summ, dict) and "projects_total" in summ:
+            out = dict(summ)
+            out["_live"] = False
+            out["_from_summary"] = True
+        else:
+            ob = read_onboarding()
+            out = {
+                "_live": False,
+                "runtime_ready": runtime_ready(),
+                "onboarding": ob,
+                "autopilot_on": autopilot_loaded(),
+                "x_connected": False,  # unknowable offline; State derives from onboarding
+                "x_handle": None,
+                "projects_ready": 0,
+                "projects_total": 0,
+                "version": version(),
+                "update_available": False,
+                "latest_version": None,
+            }
+
+    ver = _version_overlay()
+    if ver is not None:
+        out["version"] = ver.get("version", out.get("version"))
+        out["channel"] = ver.get("channel", out.get("channel"))
+        out["latest_version"] = ver.get("latest_version", out.get("latest_version"))
+        out["latest_tag"] = ver.get("latest_tag", out.get("latest_tag"))
+        out["update_available"] = ver.get("update_available", out.get("update_available"))
+    return out
 
 
 def stats_7d():
@@ -836,6 +975,13 @@ def review_drafts(plan, batch="review-queue"):
                 # scripts/active_experiments.py. Generic: the card renders
                 # whatever is here, so new experiments surface with no UI work.
                 "experiments": c.get("experiments") or {},
+                # Two-draft cards (2026-07-07; no-recommendation pass
+                # 2026-07-08): present only when the prep step wrote two
+                # independent drafts (fresh candidate, not a reused stale
+                # draft). The card shows both, defaulting to Draft A (slot 0,
+                # no model recommendation involved); absent on reused/legacy
+                # candidates, which fall back to the single-draft UI above.
+                "drafts": c.get("drafts"),
             }
         )
     # The review queue is append-only, so the highest stable index is newest and

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.1-rc.2",
+  "version": "1.7.1-rc.21",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/mcp/shared/doctor.cjs

@@ -149,6 +149,14 @@ function runDoctorSync(options = {}) {
         "deferred until X connection to avoid an unexpected keychain prompt"
       );
     }
+    // Once the durable cookie mirror is populated, the X session no longer
+    // depends on this keychain item (see twitter_cookie_mirror.py — it exists
+    // precisely so a locked/missing Safe Storage key isn't fatal). Skip the
+    // probe instead of re-triggering + re-failing it on every doctor run;
+    // same mirrorCount() gate keychain_autolock already uses below.
+    if (mirrorCount() > 0) {
+      return result("pass", "skipped — durable cookie mirror already covers this");
+    }
     const r = spawnSync(
       "security",
       [

package/mcp/shared/onboarding-ledger.cjs

@@ -10,6 +10,7 @@ const MILESTONES = [
   "environment_checked",
   "runtime_ready",
   "x_connected",
+  "x_verified",
   "profile_scanned",
   "mode_chosen",
   "project_ready",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.1-rc.2",
+  "version": "1.7.1-rc.21",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",
@@ -18,6 +18,7 @@
     "!bin/auth.js",
     "scripts/*.py",
     "!scripts/db_direct.py",
+    "!scripts/sync_blocked_authors.py",
     "!scripts/backfill_real_clicks.py",
     "!scripts/historical_engagement.py",
     "!scripts/style_length_report.py",
@@ -117,6 +118,7 @@
     "requirements.txt",
     "SKILL.md",
     "skill/*.sh",
+    "!skill/sync-blocked-authors.sh",
     "skill/lib/*.sh",
     "setup/SKILL.md",
     "browser-agent-configs/",

package/scripts/active_users.py

@@ -32,13 +32,10 @@ from urllib.parse import unquote
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from db import load_env, get_conn  # noqa: E402
-
 # Our own installs, hidden by default so the roster is real external users.
-INTERNAL_EMAILS = {"i@m13v.com", "agent@mk0r.com", "matt@mediar.ai"}
-INTERNAL_HOSTNAME_SUBSTR = ("e2b.local", "71522")  # mk0r E2B sandboxes; MacStadium QA box
-# MacStadium remote QA box (hostname "71522", no git_email). It actively runs the
-# pipeline and posts, so without this it masquerades as our only posting customer.
-INTERNAL_HARDWARE_UUIDS = {"07CB793D-6E32-5EF8-82E2-7CDEABD47FBC"}
+# Shared with autopilot_stall_watch.py via identity.py so the two lists can't
+# drift apart (see identity.is_internal_install).
+from identity import INTERNAL_EMAILS, INTERNAL_HOSTNAME_SUBSTR, INTERNAL_HARDWARE_UUIDS  # noqa: E402
 
 # Connected X handle resolves only from posts.our_account; drop scaffolding values.
 PLACEHOLDER_HANDLES = {"your-twitter-handle", "your_handle", "your-handle", "none", "null", ""}

package/scripts/autopilot_stall_watch.py

@@ -42,6 +42,7 @@ import time
 # SAPS_->S4L_ env mirror (brand rename 2026-07-03): old launchd plists and
 # scheduled-task prompts still export SAPS_*; this process reads S4L_*.
 import s4l_env  # noqa: E402  (lives next to this file in scripts/)
+import identity  # noqa: E402  (lives next to this file in scripts/)
 
 s4l_env.mirror()
 
@@ -141,6 +142,45 @@ def _recent_rate_limit(window: int = 1200) -> bool:
     return False
 
 
+BATCH_PROGRESSION_MIN_BATCHES = 5
+BATCH_PROGRESSED_PHASES = {"phase2b-gen", "phase2b-post"}
+
+
+def _recent_batches_not_progressing(min_batches: int = BATCH_PROGRESSION_MIN_BATCHES) -> bool:
+    """True if the last `min_batches` twitter_batches for THIS install ALL failed
+    to reach phase2b-gen (real draft generation) or later. A second, independent
+    detection layer: the queue's consecutive_timeouts counter is one level
+    removed from the actual product outcome (did a batch progress). During the
+    Karol 2026-07-07 investigation the DB showed the stall the whole time — 46
+    consecutive batches dying at phase2b-prep — while this watchdog's other
+    signals took hours longer to latch. Requires network (via http_api); any
+    failure (offline, endpoint missing, not enough batch history yet) returns
+    False so this signal can only ever ADD confidence, never false-positive on
+    its own from a transient API hiccup.
+
+    NOTE: catches BaseException, not just Exception — scripts/http_api.py's
+    _request() deliberately raises SystemExit (not a plain Exception; it
+    inherits from BaseException) on a terminal 4xx/5xx, which is correct for
+    most one-shot pipeline callers but would silently kill this entire
+    best-effort watchdog process if left uncaught here. Caught by testing this
+    against a not-yet-deployed endpoint version during development."""
+    try:
+        repo = os.environ.get("S4L_REPO_DIR")
+        if repo:
+            scripts_dir = os.path.join(repo, "scripts")
+            if scripts_dir not in sys.path:
+                sys.path.insert(0, scripts_dir)
+        import http_api  # noqa: E402
+
+        resp = http_api.api_get("/api/v1/twitter-batches", {"list": "1", "limit": str(min_batches)})
+        batches = (resp or {}).get("batches") or []
+        if len(batches) < min_batches:
+            return False  # not enough history yet to conclude a stall
+        return all((b or {}).get("current_phase") not in BATCH_PROGRESSED_PHASES for b in batches)
+    except BaseException:
+        return False
+
+
 def _oldest_pending_age() -> float | None:
     """Seconds since the oldest unclaimed pending draft job was written, or None
     if nothing is pending (idle queue). The FAST signal: catches a fresh stall
@@ -162,6 +202,25 @@ def _oldest_pending_age() -> float | None:
     return time.time() - oldest
 
 
+def _pending_count() -> int:
+    """Number of unclaimed pending draft jobs across all types. Cheap: same glob
+    shape as _oldest_pending_age, just counted instead of min'd. Feeds the
+    queue_health_samples row (see _report_queue_health_sample)."""
+    pend_root = os.path.join(_queue_root(), "pending")
+    n = 0
+    for sub in glob.glob(os.path.join(pend_root, "*")):
+        for jf in glob.glob(os.path.join(sub, "*.json")):
+            if not jf.endswith(".tmp"):
+                n += 1
+    return n
+
+
+def _running_count() -> int:
+    """Number of claimed-but-unfinished jobs. See _pending_count."""
+    run_root = os.path.join(_queue_root(), "running")
+    return sum(1 for jf in glob.glob(os.path.join(run_root, "*.json")) if not jf.endswith(".tmp"))
+
+
 def _oldest_running_age() -> float | None:
     """Seconds since the oldest CLAIMED-but-unfinished job was written, or None if
     nothing is in flight. A worker claims by moving a job pending/ -> running/ and
@@ -217,18 +276,97 @@ def _sentry():
     return sentry_init
 
 
+def _report_recovery(total_duration_s: float, paged_duration_s: float | None) -> None:
+    """Log a recovery milestone (with duration) once per stall episode that
+    actually paged. Previously this had to be hand-reconstructed per incident by
+    diffing DB/log timestamps after the fact (see the Karol 2026-07-07
+    update-orphan investigation); this makes it a first-class, queryable Sentry
+    event so incident severity is trackable fleet-wide over time instead of
+    per-investigation. Only fires for episodes that crossed ALERT_AFTER — a
+    stall that self-clears before paging is normal jitter, not an incident."""
+    try:
+        sentry = _sentry()
+        sentry.init()
+        total_min = total_duration_s / 60.0
+        paged_str = f"{paged_duration_s / 60.0:.1f} min" if paged_duration_s is not None else "n/a"
+        sentry.capture_message(
+            "social-autoposter autopilot recovered: draft jobs draining again "
+            f"after {total_min:.1f} min stalled ({paged_str} since it paged).",
+            level="info",
+            tags={"component": "autopilot", "issue": "stall_recovered"},
+            extra={
+                "stall_total_duration_seconds": round(total_duration_s, 1),
+                "stall_paged_duration_seconds": (
+                    round(paged_duration_s, 1) if paged_duration_s is not None else None
+                ),
+            },
+        )
+        sentry.flush()
+    except Exception:
+        sys.stderr.write(f"[stall-watch] recovered after {total_duration_s:.0f}s but Sentry report failed\n")
+
+
+def _report_queue_health_sample(
+    pending: int,
+    running: int,
+    timeouts: int,
+    age: float | None,
+    run_age: float | None,
+    stalled: bool,
+    batches_stuck: bool,
+) -> None:
+    """Best-effort POST of one queue_health_samples row, on EVERY tick (not
+    just while stalled) — a continuous baseline is the point: it's what makes
+    "was this box actually healthy at time T" a one-line SQL query instead of
+    absence-of-evidence. See migrations/2026-07-07-queue-health-samples.sql.
+
+    Catches BaseException, not just Exception — see _recent_batches_not_progressing
+    for why (http_api._request raises SystemExit on a terminal 4xx/5xx, which
+    must never be allowed to kill this watchdog process)."""
+    try:
+        repo = os.environ.get("S4L_REPO_DIR")
+        if repo:
+            scripts_dir = os.path.join(repo, "scripts")
+            if scripts_dir not in sys.path:
+                sys.path.insert(0, scripts_dir)
+        import http_api  # noqa: E402
+
+        http_api.api_post(
+            "/api/v1/queue-health-samples",
+            {
+                "pending": pending,
+                "running": running,
+                "consecutive_timeouts": timeouts,
+                "oldest_pending_age_s": int(age) if age is not None else None,
+                "oldest_running_age_s": int(run_age) if run_age is not None else None,
+                "stalled": stalled,
+                "batches_stuck": batches_stuck,
+            },
+        )
+    except BaseException:
+        pass
+
+
 def main() -> int:
     age = _oldest_pending_age()
     run_age = _oldest_running_age()
     timeouts = _consecutive_timeouts()
-    # Three complementary signals, OR'd; all gated on the autopilot actually being
+    configured = _autopilot_configured()
+    # batches_stuck is deliberately computed unconditionally (not short-circuited
+    # by the other signals) — it's a genuinely independent, outcome-level
+    # backstop, not a cheaper proxy for the same thing. It's what would have
+    # caught the Karol 2026-07-07 stall immediately instead of hours later.
+    batches_stuck = configured and _recent_batches_not_progressing()
+    # Four complementary signals, OR'd; all gated on the autopilot actually being
     # configured here. (1) durable producer drain latch, (2) fast pending-age (job
-    # never claimed), (3) running-age (job claimed then wedged mid-run). (3) is the
-    # only one that catches a worker dying after it picked up the job.
-    stalled = _autopilot_configured() and (
+    # never claimed), (3) running-age (job claimed then wedged mid-run) — (3) is
+    # the only one of the first three that catches a worker dying after it picked
+    # up the job — (4) batches_stuck, the outcome-level backstop above.
+    stalled = configured and (
         timeouts >= 1
         or (age is not None and age > STALL_SECONDS)
         or (run_age is not None and run_age > RUNNING_STALL_SECONDS)
+        or batches_stuck
     )
     # A rate-limit stall is expected and self-heals at the quota reset — never page
     # for it (and re-arm can't fix it). Treat it as "not an actionable stall" so the
@@ -236,45 +374,84 @@ def main() -> int:
     if stalled and _recent_rate_limit():
         stalled = False
 
+    # Record this tick regardless of outcome — see _report_queue_health_sample.
+    _report_queue_health_sample(
+        _pending_count(), _running_count(), timeouts, age, run_age, stalled, batches_stuck
+    )
+
     st = _read_state()
     consecutive = int(st.get("consecutive", 0))
     alerted = bool(st.get("alerted", False))
+    # first_seen_at: first check this episode looked stalled at all (predates
+    # paging by ALERT_AFTER checks). alerted_at: the single moment we paged.
+    # Both are stamped once and carried forward untouched for the rest of the
+    # episode — NOT refreshed every check — so they measure the episode's
+    # start, not "last time we saw it stalled".
+    first_seen_at = st.get("first_seen_at")
+    alerted_at = st.get("alerted_at")
 
     if not stalled:
         # Recovered (or never stalled) -> reset the episode so the next stall pages.
         if consecutive or alerted:
+            if alerted and first_seen_at:
+                total_duration = time.time() - float(first_seen_at)
+                paged_duration = (time.time() - float(alerted_at)) if alerted_at else None
+                _report_recovery(total_duration, paged_duration)
             _write_state({"consecutive": 0, "alerted": False})
         return 0
 
     consecutive += 1
+    if first_seen_at is None:
+        first_seen_at = time.time()
     age_str = f"{int(age)}s" if age is not None else "n/a (between cycles)"
     run_age_str = f"{int(run_age)}s" if run_age is not None else "n/a (none in flight)"
-    # Distinguish the two shapes so the alert points at the right cause: a claimed-
-    # but-wedged job (running-age) is a mid-run worker death, not an orphaned routine.
+    # Distinguish the shapes so the alert points at the right cause: a claimed-
+    # but-wedged job (running-age) is a mid-run worker death, batches_stuck is
+    # the outcome-level backstop firing independently of the queue signals, and
+    # the fallback is the classic orphaned-routine case.
     wedged_inflight = run_age is not None and run_age > RUNNING_STALL_SECONDS
     if consecutive >= ALERT_AFTER and not alerted:
         try:
             sentry = _sentry()
             sentry.init()
-            cause = (
-                "a worker claimed a draft job and then died mid-run (claude -p child "
-                "never came up / crashed)"
-                if wedged_inflight
-                else "scheduled-task routines likely orphaned — Claude Desktop account change?"
-            )
+            if wedged_inflight:
+                cause = (
+                    "a worker claimed a draft job and then died mid-run (claude -p child "
+                    "never came up / crashed)"
+                )
+                stall_shape = "inflight_wedged"
+            elif batches_stuck:
+                cause = (
+                    f"last {BATCH_PROGRESSION_MIN_BATCHES} twitter_batches all failed to "
+                    "reach phase2b-gen — drafting is not actually happening even if the "
+                    "queue-level counters look ambiguous"
+                )
+                stall_shape = "batches_not_progressing"
+            else:
+                cause = "scheduled-task routines likely orphaned — Claude Desktop account change?"
+                stall_shape = "not_draining"
+            # Our own staging/QA/dev boxes (identity.is_internal_install) get set
+            # up and rebuilt with nobody actively feeding the queue, which looks
+            # identical to a real stall on the signals above. Downgrade those to
+            # warning instead of error so they don't page as a customer incident
+            # (the digest only scans error/fatal) while still leaving a Sentry
+            # record if we ever need to look one up by hand.
+            is_internal = identity.is_internal_install()
             sentry.capture_message(
                 "social-autoposter autopilot stalled: draft jobs are not being "
                 f"drained ({cause}). producer consecutive timeouts={timeouts}, "
                 f"oldest pending job age={age_str}, oldest in-flight (running) job "
                 f"age={run_age_str}, sustained {consecutive} checks.",
-                level="error",
+                level=("warning" if is_internal else "error"),
                 tags={
                     "component": "autopilot",
                     "issue": "stall",
-                    "stall_shape": "inflight_wedged" if wedged_inflight else "not_draining",
+                    "stall_shape": stall_shape,
                     "consecutive_timeouts": str(timeouts),
                     "oldest_pending_age_s": str(int(age)) if age is not None else "",
                     "oldest_running_age_s": str(int(run_age)) if run_age is not None else "",
+                    "batches_stuck": str(batches_stuck),
+                    "internal_install": str(is_internal),
                 },
             )
             sentry.flush()
@@ -285,8 +462,15 @@ def main() -> int:
                 f"pending_age={age_str}, running_age={run_age_str}) but Sentry report failed\n"
             )
         alerted = True
-
-    _write_state({"consecutive": consecutive, "alerted": alerted, "at": time.time()})
+        alerted_at = time.time()
+
+    _write_state({
+        "consecutive": consecutive,
+        "alerted": alerted,
+        "first_seen_at": first_seen_at,
+        "alerted_at": alerted_at,
+        "at": time.time(),
+    })
     return 0
 
 

package/scripts/claude_job.py

@@ -920,6 +920,12 @@ def _attempt_claim(ns, qtype: str) -> bool:
 
 def cmd_next(ns) -> int:
     _apply_state_dir_override(ns)
+    # S4L paused (mcp/src/index.ts pauseAutopilot): report no work instead of
+    # claiming a job, so an already-queued draft can't drain/post while paused
+    # even though the scheduled task worker still fires on its own cadence.
+    if os.path.exists(os.path.join(state_dir(), "paused.flag")):
+        print(json.dumps({}))
+        return 0
     qtype = ns.type
     wait_seconds = max(0, ns.wait_seconds or 0)
     # wait_seconds=0 (default) is the legacy single-shot behavior: one pass,