@m13v/s4l 1.7.2-rc.14 → 1.7.2-rc.18

package/mcp/dist/index.js

@@ -870,6 +870,18 @@ async function ensureTwitterBrowserForPost() {
         },
     });
 }
+// A terminal stamp written by merge_review_queue.py's backend sync for a row the
+// freshness gate merely EXPIRED (not posted, not skipped) records "nobody decided
+// this in time" — an explicit human approval outranks it. The poster's own
+// at-post-time tweet_unavailable check remains the real gate on whether the
+// thread still exists. Without this override, a card approved while (or just
+// before) the sync stamped it is refused as already-decided and the approval
+// silently no-ops (2 of 3 approvals lost on 2026-07-10).
+function expiredStampOverridable(c) {
+    return (c.terminal === true &&
+        c.posted !== true &&
+        c.discard_reason === "backend_status_expired");
+}
 async function postApproved(batchId, plan) {
     // Drain serialization (2026-07-06 incident). Every call drains the WHOLE
     // approved backlog, so overlapping drains are pure waste and actively harmful:
@@ -922,7 +934,18 @@ async function postApproved(batchId, plan) {
     // drains the not-yet-posted approved backlog (e.g. a card a restart interrupted),
     // never re-posts a done one. This is what lets the startup backlog-drain and the
     // per-card menu-bar calls share one code path safely.
-    const approved = (plan.candidates || []).filter((c) => c.approved === true && c.posted !== true && c.terminal !== true);
+    // An approved card whose only blocker is an overridable backend-expiry stamp is
+    // included: approval outranks the freshness gate (see expiredStampOverridable),
+    // and the stamp is cleared so every downstream terminal check agrees it's live.
+    const approved = (plan.candidates || []).filter((c) => c.approved === true &&
+        c.posted !== true &&
+        (c.terminal !== true || expiredStampOverridable(c)));
+    for (const c of approved) {
+        if (c.terminal === true) {
+            c.terminal = false;
+            delete c.discard_reason;
+        }
+    }
     if (approved.length === 0)
         return { attempted: 0, exit_code: 0, summary: "nothing approved" };
     // PREFLIGHT: posting needs a configured @handle, or twitter_browser.py refuses
@@ -2316,9 +2339,17 @@ tool("post_drafts", {
     });
     // Cross-surface de-dup: chat and the menu-bar pop-ups can both approve, so
     // never re-post a candidate the other surface already posted OR ruled out.
+    // Exception: an overridable backend-expiry stamp yields to this explicit
+    // approval (see expiredStampOverridable) — clear it and post.
     const alreadyDone = [];
     for (const n of Array.from(approve)) {
-        if (candidates[n - 1]?.posted === true || candidates[n - 1]?.terminal === true) {
+        const c = candidates[n - 1];
+        if (c && expiredStampOverridable(c)) {
+            c.terminal = false;
+            delete c.discard_reason;
+            continue;
+        }
+        if (c?.posted === true || c?.terminal === true) {
             approve.delete(n);
             alreadyDone.push(n);
         }
@@ -4963,7 +4994,9 @@ async function drainApprovedBacklog() {
     try {
         const plan = readPlan(REVIEW_QUEUE_ID);
         const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true && c.posted !== true && c.terminal !== true);
+        const backlog = cands.filter((c) => c.approved === true &&
+            c.posted !== true &&
+            (c.terminal !== true || expiredStampOverridable(c)));
         if (!backlog.length)
             return;
         console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.2-rc.14",
-  "installedAt": "2026-07-10T04:31:17.238Z"
+  "version": "1.7.2-rc.18",
+  "installedAt": "2026-07-10T05:06:47.098Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.2-rc.14",
+  "version": "1.7.2-rc.18",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -8,6 +8,15 @@ fires once the last card is decided or the window is closed. The whole AppKit
 surface is isolated behind that one function so the menu bar wiring doesn't
 depend on the windowing details.
 
+The panel is NONACTIVATING and auto-presented cards never take keyboard focus
+(2026-07-09 customer complaint: cards stole the caret mid-typing); the reply
+field becomes editable on first click, and only a user-initiated open
+(present_review(focus=True), the menu bar's "Review N pending drafts")
+activates the app and seats the caret immediately. A title-bar "Snooze 1h"
+button sits opposite the close cross; it and the cross both just close the
+panel, and the menu bar interprets any close with undecided drafts as a
+snooze (drafts stay pending, re-present after REVIEW_SNOOZE_SECONDS).
+
 Decision shape: {"n": int, "approved": bool, "loved": bool, "text": str,
 "edited": bool, "drop_link": bool, "reject_category": str|None,
 "reject_note": str|None, "interactions": [{"type": str, "ts": str}],
@@ -49,6 +58,7 @@ run loop, so that holds).
 
 import datetime
 import json
+import os
 import re
 import time
 
@@ -116,6 +126,26 @@ try:
     from AppKit import NSVisualEffectView
 except Exception:
     NSVisualEffectView = None
+# Nonactivating panel: an auto-presented card must never yank keyboard focus
+# from whatever the user is typing into (customer complaint 2026-07-09); the
+# panel becomes key only when the user clicks into one of its text fields.
+# Bit value 1 << 7 per AppKit; 0 degrades to the old always-activating panel.
+try:
+    from AppKit import NSWindowStyleMaskNonactivatingPanel
+except Exception:
+    NSWindowStyleMaskNonactivatingPanel = 0
+# Title-bar "Snooze 1h" button (sits opposite the close cross). Missing on
+# very old AppKit; the card then degrades to cross-only (closing still
+# snoozes, the label is just absent).
+try:
+    from AppKit import NSTitlebarAccessoryViewController, NSLayoutAttributeRight
+except Exception:
+    NSTitlebarAccessoryViewController = None
+    NSLayoutAttributeRight = None
+try:
+    from AppKit import NSBezelStyleInline
+except Exception:
+    NSBezelStyleInline = None
 try:
     # Registers the CGColor bridge type; without it every NSColor.CGColor()
     # call in _round_rect logs an ObjCPointerWarning to menubar.err.log.
@@ -149,6 +179,20 @@ REJECT_REASONS = (
 # Client-side cap on tracked interactions per card (server clips at 50 too).
 MAX_INTERACTIONS = 50
 
+
+def _snooze_secs():
+    """Snooze duration, for the title-bar button LABEL only. The menu bar owns
+    the actual timer (its REVIEW_SNOOZE_SECONDS reads the same env var)."""
+    try:
+        return max(60, int(float(os.environ.get("S4L_REVIEW_SNOOZE_S", "3600"))))
+    except Exception:
+        return 3600
+
+
+def _snooze_title():
+    s = _snooze_secs()
+    return f"Snooze {s // 3600}h" if s % 3600 == 0 else f"Snooze {s // 60}m"
+
 # Inline approve row: glyph + tooltip per approval level (button tag =
 # level). Level 1 = plain approve; 2 = loved=True on the decision, with the
 # exact level shipped as an approve_level_N interaction for the feedback
@@ -626,13 +670,21 @@ def _editable_scroll(frame, text=""):
 
 
 class _ReviewController(NSObject):
-    def initWithDrafts_onDecision_onComplete_(self, drafts, on_decision, on_complete):
+    def initWithDrafts_onDecision_onComplete_focus_(
+        self, drafts, on_decision, on_complete, focus
+    ):
         self = objc.super(_ReviewController, self).init()
         if self is None:
             return None
         self._drafts = list(drafts)
         self._on_decision = on_decision
         self._on_complete = on_complete
+        # focus=True only for a USER-initiated open (the menu bar's "Review N
+        # pending drafts"): activate the app and seat the caret in the reply
+        # field. Auto-presented cards (the timer tick) must appear without
+        # taking keyboard focus from whatever the user is doing.
+        self._focus = bool(focus)
+        self._close_reason = None  # "snooze" when the title-bar button closed us
         self._idx = 0
         self._decisions = []
         self._panel = None
@@ -776,26 +828,35 @@ class _ReviewController(NSObject):
             NSWindowStyleMaskTitled
             | NSWindowStyleMaskClosable
             | NSWindowStyleMaskUtilityWindow
+            | NSWindowStyleMaskNonactivatingPanel
         )
         panel = _ReviewPanel.alloc().initWithContentRect_styleMask_backing_defer_(
             frame, style, NSBackingStoreBuffered, False
         )
         panel.setLevel_(NSFloatingWindowLevel)
         panel.setFloatingPanel_(True)
-        panel.setBecomesKeyOnlyIfNeeded_(False)  # let the reply field be edited
+        # Key only when a text field is clicked: buttons (Approve/Reject) work
+        # without ever taking keyboard focus, and clicking into the reply field
+        # makes this nonactivating panel key without activating the app, so
+        # the user's frontmost app keeps its state. The old False + activate-
+        # on-present combination stole the keyboard mid-typing (2026-07-09
+        # customer complaint).
+        panel.setBecomesKeyOnlyIfNeeded_(True)
         panel.setHidesOnDeactivate_(False)
         panel.setReleasedWhenClosed_(False)
         panel.setDelegate_(self)
+        self._add_snooze_accessory(panel)
         self._panel = panel
         self._render()
-        panel.makeKeyAndOrderFront_(None)
         panel.orderFrontRegardless()
         self._log_surface("presented")
-        self.focusReply_(None)
-        # App activation/key-window promotion lands on the run loop; do one
-        # deferred pass so the first card is editable even when opened from the
-        # status-bar timer while another app is frontmost.
-        self.performSelector_withObject_afterDelay_("focusReply:", None, 0.05)
+        if self._focus:
+            # User asked for the cards (menu item): behave like a normal open,
+            # activate and put the caret in the reply field. Deferred second
+            # pass because activation/key promotion lands on the run loop.
+            panel.makeKeyAndOrderFront_(None)
+            self.focusReply_(None)
+            self.performSelector_withObject_afterDelay_("focusReply:", None, 0.05)
 
     def focusReply_(self, sender):
         panel = self._panel
@@ -826,6 +887,52 @@ class _ReviewController(NSObject):
         except Exception:
             pass
 
+    @objc.python_method
+    def _add_snooze_accessory(self, panel):
+        """"Snooze 1h" in the title bar, opposite the close cross: the explicit
+        "not now" affordance. It just closes the panel; the menu bar treats any
+        close with undecided drafts as a snooze, so the cross and this button
+        are the same action, this one merely says so out loud."""
+        if NSTitlebarAccessoryViewController is None or NSLayoutAttributeRight is None:
+            return
+        try:
+            btn = NSButton.alloc().initWithFrame_(NSMakeRect(0, 0, 80, 17))
+            btn.setTitle_(_snooze_title())
+            if NSBezelStyleInline is not None:
+                btn.setBezelStyle_(NSBezelStyleInline)
+            else:
+                btn.setBezelStyle_(NSBezelStyleRounded)
+            btn.setFont_(NSFont.systemFontOfSize_(10.0))
+            btn.setToolTip_(
+                "Put these drafts away for now. They stay pending and the "
+                "card comes back later (or sooner from the S4L menu)."
+            )
+            btn.setTarget_(self)
+            btn.setAction_("snoozeClicked:")
+            btn.sizeToFit()
+            bf = btn.frame()
+            holder = NSView.alloc().initWithFrame_(
+                NSMakeRect(0, 0, bf.size.width + 8, max(19, bf.size.height + 2))
+            )
+            btn.setFrameOrigin_(
+                (4, max(0, (holder.frame().size.height - bf.size.height) / 2.0))
+            )
+            holder.addSubview_(btn)
+            acc = NSTitlebarAccessoryViewController.alloc().init()
+            acc.setView_(holder)
+            acc.setLayoutAttribute_(NSLayoutAttributeRight)
+            panel.addTitlebarAccessoryViewController_(acc)
+        except Exception as e:
+            _log(f"snooze accessory unavailable: {e}")
+
+    def snoozeClicked_(self, sender):
+        self._track("snooze")
+        self._close_reason = "snooze"
+        try:
+            self._panel.performClose_(None)
+        except Exception:
+            self._finish()
+
     @objc.python_method
     def _eye_button(self, frame, kind):
         """Borderless SF-Symbol eye whose hover/click opens a popover. A plain
@@ -1240,9 +1347,15 @@ class _ReviewController(NSObject):
         )
         # setContentView_ rebuilds the view tree, so the caret would otherwise
         # default to the Approve button. Re-seat it in the reply field for every
-        # card (not just the first) so each one is immediately editable.
-        self._panel.makeFirstResponder_(tv)
-        self.performSelector_withObject_afterDelay_("focusReply:", None, 0.05)
+        # card the user is ACTIVELY reviewing (they opened the stack from the
+        # menu, or already decided/touched something), so each one is
+        # immediately editable. NOT on the initial auto-presented render:
+        # focusReply_ activates the app, and yanking the caret out of whatever
+        # the user was typing was the 2026-07-09 "too distracting" complaint.
+        # An untouched card's field becomes editable on first click instead.
+        if self._focus or self._decisions or self._last_interaction_at is not None:
+            self._panel.makeFirstResponder_(tv)
+            self.performSelector_withObject_afterDelay_("focusReply:", None, 0.05)
 
     @objc.python_method
     def _close_stats_popover(self):
@@ -1793,7 +1906,10 @@ class _ReviewController(NSObject):
 
     def windowShouldClose_(self, sender):
         # Closing the window stops review; remaining cards are left undecided
-        # (not posted). Finish with whatever was decided so far.
+        # (not posted). Finish with whatever was decided so far. The menu bar
+        # treats a close with undecided drafts as SNOOZE (they re-present after
+        # REVIEW_SNOOZE_SECONDS, or sooner via the menu), whether it came from
+        # the cross or the title-bar Snooze button.
         self._finish()
         return True
 
@@ -1815,11 +1931,12 @@ class _ReviewController(NSObject):
             except Exception:
                 pass
         _active = None
-        _log(f"closed: {len(self._decisions)} decided of {len(self._drafts)}")
-        _write_review_state(last_event="closed")
+        reason = self._close_reason or "closed"
+        _log(f"closed: {len(self._decisions)} decided of {len(self._drafts)} ({reason})")
+        _write_review_state(last_event="snoozed" if reason == "snooze" else "closed")
 
 
-def present_review(drafts, on_decision=None, on_complete=None):
+def present_review(drafts, on_decision=None, on_complete=None, focus=False):
     """Show the review cards (main thread only). drafts: list of
     {n, thread_author, thread_text, reply_text, link_url, thread_url?, stats?}
     where stats is the discovery-time candidate snapshot
@@ -1841,14 +1958,17 @@ def present_review(drafts, on_decision=None, on_complete=None):
     active experiment/scenario arm.
     on_decision(decision) fires the instant each card is approved/rejected (so an
     approved draft posts right away); on_complete(decisions) fires when the user
-    finishes the last card or closes the window. Both run on the main thread."""
+    finishes the last card or closes the window. Both run on the main thread.
+    focus=True (user-initiated open, e.g. the menu bar's "Review N pending
+    drafts") activates the app and seats the caret in the reply field; the
+    default False shows the card without taking keyboard focus."""
     global _active
     if not drafts:
         if on_complete is not None:
             on_complete([])
         return
-    _active = _ReviewController.alloc().initWithDrafts_onDecision_onComplete_(
-        drafts, on_decision, on_complete
+    _active = _ReviewController.alloc().initWithDrafts_onDecision_onComplete_focus_(
+        drafts, on_decision, on_complete, focus
     )
 
 
@@ -1961,6 +2081,20 @@ def heal_active():
         return False
 
 
+def focus_active():
+    """Bring the open card to the user deliberately (menu 'Review pending
+    drafts' while a card is already up): activate + caret in the reply field.
+    Main thread only. Returns True if a card was focused."""
+    c = _active
+    if c is None or c._panel is None:
+        return False
+    try:
+        c.focusReply_(None)
+        return True
+    except Exception:
+        return False
+
+
 # ---- overall-feedback composer ----------------------------------------------
 # One small floating panel with a free-text field, for guidance that is about
 # the PIPELINE rather than any single draft ("less shilling", "more dev

package/mcp/menubar/s4l_menubar.py

@@ -439,6 +439,17 @@ REVIEW_HEAL_EVERY_SECONDS = float(
 )
 REVIEW_UNATTENDED_SENTRY_SECONDS = 3600.0
 
+# Review snooze (2026-07-09 customer feedback: cards interrupt focused work
+# with no way to defer them). Closing the card with undecided drafts, via the
+# cross or the title-bar "Snooze 1h" button, parks the WHOLE pending backlog
+# for REVIEW_SNOOZE_SECONDS: no auto-present, no watchdog heal (nothing is on
+# screen). Drafts stay in the store untouched; the menu's "Review N pending
+# drafts" clears the snooze early. Persisted so a menubar restart mid-snooze
+# doesn't re-pop the card. s4l_card._snooze_secs reads the same env var for
+# the button label; keep them in sync.
+REVIEW_SNOOZE_SECONDS = float(os.environ.get("S4L_REVIEW_SNOOZE_S", "3600"))
+SNOOZE_FILE = os.path.join(st.state_dir(), "review-snooze.json")
+
 
 def _label_elapsed_secs(label):
     """Parse the trailing duration the producer encodes in a drafting activity
@@ -519,6 +530,10 @@ class S4LMenuBar(rumps.App):
         self._post_worker = None
         self._review_lock = threading.Lock()
         self._panel_open = False
+        # Review snooze: epoch until which draft cards must not auto-present
+        # (0 = not snoozed). Loaded from disk so a menubar restart mid-snooze
+        # doesn't re-pop the card the user just put away.
+        self._review_snooze_until = self._read_snooze_until()
         # Unattended-review watchdog state (_maybe_heal_review).
         self._review_heal_at = 0.0
         self._review_unattended_notified = False
@@ -645,6 +660,11 @@ class S4LMenuBar(rumps.App):
         # Cached schedule state for the current account: 'missing'/'disabled'/'ok'/
         # 'unknown'. PRIMARY driver of the menu's attention section.
         self._schedule_state_cache = "ok"
+        # Tick-freshness diagnostics (schedule_state.tick_stats()) shown as the
+        # non-alarm "scheduler degraded" menu line while state == 'stalled'.
+        # None outside that state; refreshed at most once a minute (_tick).
+        self._tick_stats = None
+        self._tick_stats_at = 0.0
         self._reloc_timer = rumps.Timer(self._maybe_relocate_tasks, 90)
         self._reloc_timer.start()
         self._tick(None)
@@ -874,11 +894,15 @@ class S4LMenuBar(rumps.App):
               does NOT stay stale after recovery.
 
         NOTE: kept in sync with scripts/autopilot_stall_watch.py (the fleet Sentry
-        backstop). The menu-bar ⚠ itself is driven by _schedule_state, NOT this
-        method — the attention/⚠ path keys off schedule_state so a firing-but-
-        momentarily-empty queue stays green (an earlier drain-latch ⚠ stayed stale
-        after recovery and was deliberately removed). This method exists for the
-        watcher-parity contract and _stall_reason.
+        backstop). Since 2026-07-09 this method IS an attention/⚠ driver: _tick
+        ORs it in (with the reason from _stall_reason) alongside the structural
+        schedule states (missing/disabled) and the activity-label draft_stuck
+        check. A firing-but-momentarily-empty queue still stays green: an idle
+        queue has no pending job, running/ is empty, and the drain latch zeroes
+        on every successful consume (claude_job._mark_drain_success), so none of
+        the three signals can hold a stale True after recovery. Tick-freshness
+        'stalled' from schedule_state no longer flips the ⚠ at all — it renders
+        as a plain diagnostic line (see _build_menu).
         """
         qroot = os.path.join(st.state_dir(), "claude-queue")
         # (1) latched producer drain-status
@@ -2320,34 +2344,38 @@ class S4LMenuBar(rumps.App):
         blocker = (ob or {}).get("current_blocker")
         blocker_code = (blocker or {}).get("code")
         # --- Autopilot health (only meaningful once setup is complete) --------
-        # SINGLE signal: is the draft schedule registered AND firing for the live
-        # account (schedule_state)? 'ok' = the host is running the tasks -> healthy,
-        # NO warning (even if no draft has drained yet — that's just an empty queue
-        # between cycles, not a setup problem). 'missing'/'disabled' = not running
-        # for this account -> show re-arm. We deliberately do NOT drive the menu off
-        # the drain-status latch anymore: it stayed stale after recovery and made a
-        # firing, healthy autopilot look "not set up".
+        # TWO layers (2026-07-09 redesign):
+        #   STRUCTURAL (schedule_state): 'missing'/'disabled' = the schedule is
+        #     genuinely not registered/enabled for this account -> ⚠ + re-arm.
+        #   JOB LATENCY (_autopilot_stalled + the draft_stuck label check below):
+        #     a draft job sat unclaimed, wedged mid-run, or the producer's drain
+        #     latch tripped -> ⚠, because THAT is user-visible harm.
+        # Tick freshness ('stalled': task present + enabled but lastRunAt stale,
+        # the Desktop warm-session wedge) is DIAGNOSTIC ONLY, never the ⚠: under
+        # the wedge the per-minute tick can skip 70-90% of fires while the queue
+        # still drains every job (jobs arrive ~every 8 min vs 60 fires/hr), so
+        # lastRunAt staleness flip-flopped the icon against a healthy pipeline
+        # (observed on the operator box 2026-07-09: 83% ticks skipped, ~14
+        # posts/hr flowing, icon oscillating). _build_menu renders 'stalled' as
+        # a plain "scheduler degraded" detail line with tick_stats() numbers.
+        # The drain latch IS safe to alarm on now: claude_job._mark_drain_success
+        # zeroes it on every successful consume, so it self-clears (the old
+        # stayed-stale-after-recovery latch this comment used to warn about
+        # predates that reset).
         # Always read the REAL schedule state (no setup-gated "ok" fallback that
         # lied). The re-arm WARNING still only fires once setup is complete, so we
         # never nag the user mid-onboarding — only the value is now always honest.
         schedule_state = self._schedule_state()
         self._schedule_state_cache = schedule_state
-        # 'stalled' (task present + enabled FOR THE ACTIVE ACCOUNT, host
-        # scheduler stopped launching it: the Desktop warm-session wedge,
-        # Karol 2026-07-06) needs attention just like missing/disabled.
-        # schedule_state.py is account-scoped (2026-07-08): an account switch
-        # now correctly resolves to 'missing' (the active account genuinely
-        # has no registration), not 'stalled' — a stale OTHER account's
-        # registry is never consulted for the active account's health, so
-        # 'stalled' can no longer be misdiagnosed here.
-        attention = setup_complete and schedule_state in ("missing", "disabled", "stalled")
+        attention = setup_complete and schedule_state in ("missing", "disabled")
         # Routines-lane rate limit (429): the draft tasks ARE registered and firing
         # for this account, but every run dies on a Claude rate limit, so nothing
         # drafts. Re-arm can't fix that — surface it as its own ⚠ attention state
-        # with a "rate-limited" reason. Only meaningful when the schedule is firing
-        # ('ok'); the missing/disabled case already owns the ⚠. Throttled (~30s):
-        # scanning the worker-transcript bucket is glob-heavy and changes slowly.
-        if setup_complete and schedule_state == "ok":
+        # with a "rate-limited" reason. Meaningful whenever the schedule exists
+        # ('ok' or the degraded-but-firing 'stalled'); the missing/disabled case
+        # already owns the ⚠. Throttled (~30s): scanning the worker-transcript
+        # bucket is glob-heavy and changes slowly.
+        if setup_complete and schedule_state in ("ok", "stalled"):
             now_rl = time.time()
             if now_rl - getattr(self, "_rl_checked_at", 0.0) >= 30:
                 self._rl_checked_at = now_rl
@@ -2371,12 +2399,10 @@ class S4LMenuBar(rumps.App):
         # draft_stuck shadowed the missing/disabled branch in _build_menu — the user
         # saw "worker keeps getting killed" with NO Re-arm button instead of "Draft
         # tasks aren't scheduled on this account" + the one-click fix (Karol,
-        # 2026-07-06). "stalled" is deliberately included (2026-07-08): that
-        # branch's fix (Set up draft schedule / re-arm) works for it too, but a
-        # job that has sat this long — claimed-and-hung, OR never claimed at all
-        # (see the ⧖ prefix check below) — is more specific, direct evidence
-        # from the queue itself than the host's lastRunAt staleness, so it's
-        # worth surfacing as its own reason even under "stalled".
+        # 2026-07-06). "stalled" is deliberately included (2026-07-08): a job that
+        # has sat this long — claimed-and-hung, OR never claimed at all (see the ⧖
+        # prefix check below) — is direct evidence from the queue itself, exactly
+        # the layer the ⚠ keys off now that tick staleness alone is diagnostic.
         if (
             setup_complete
             and schedule_state in ("ok", "stalled")
@@ -2390,6 +2416,44 @@ class S4LMenuBar(rumps.App):
             ):
                 attention = True
                 self._stall_reason_info = ("draft_stuck", _act.get("label") or "")
+        # Queue-latency stall (the layer that measures actual user harm): a draft
+        # job sat unclaimed past AUTOPILOT_STALL_SECONDS, wedged in running/ past
+        # AUTOPILOT_RUNNING_STALL_SECONDS, or the producer's drain latch tripped
+        # (consecutive timeouts, zeroed on every successful consume). The activity-
+        # label draft_stuck check above needs a live producer narrating "drafting";
+        # this one works between cycles too (the latch persists the episode), so
+        # together they cover producer-alive and producer-gone stalls. Reason
+        # refines the one-click fix: 'orphaned' (no routine executed recently,
+        # re-arm helps) vs 'failing' (routines run but drafts die, Diagnose).
+        if (
+            setup_complete
+            and schedule_state in ("ok", "stalled")
+            and self._stall_reason_info[0] not in ("rate_limited", "draft_stuck")
+        ):
+            if self._autopilot_stalled():
+                _qreason, _qmsg = self._stall_reason()
+                attention = True
+                self._stall_reason_info = (_qreason, _qmsg)
+            elif self._stall_reason_info[0] in ("orphaned", "failing"):
+                # Queue recovered since the last tick: clear the stale reason
+                # now instead of waiting for the 30s rate-limit rescan to
+                # overwrite it (a lingering reason skews the diagnose prompt
+                # and churns the menu signature for nothing).
+                self._stall_reason_info = ("", "")
+        # Tick-freshness diagnostics for the non-alarm "scheduler degraded" menu
+        # line. Only computed while 'stalled' (it reads + parses the registry
+        # JSON, which can be hundreds of KB) and throttled to once a minute.
+        if schedule_state == "stalled":
+            _now_ts = time.time()
+            if _now_ts - getattr(self, "_tick_stats_at", 0.0) >= 60:
+                self._tick_stats_at = _now_ts
+                try:
+                    import schedule_state as _ss
+                    self._tick_stats = _ss.tick_stats()
+                except Exception:
+                    self._tick_stats = None
+        else:
+            self._tick_stats = None
         # Drop the stale "drafting" spinner while we need attention so the ⚠ shows.
         self._stalled = attention
 
@@ -2415,7 +2479,7 @@ class S4LMenuBar(rumps.App):
             # Once per episode (gated by _stall_notified), so it never spams.
             _reason = (
                 self._stall_reason_info[0]
-                or (schedule_state if schedule_state in ("disabled", "stalled") else "missing")
+                or ("disabled" if schedule_state == "disabled" else "missing")
             )
             _capture_msg(
                 f"S4L draft autopilot needs attention: {_reason}",
@@ -2447,19 +2511,26 @@ class S4LMenuBar(rumps.App):
                      "A worker claimed a draft job and never finished it. ")
                     + "Open the S4L menu → “Diagnose & fix in Claude…”.",
                 )
+            elif self._stall_reason_info[0] == "orphaned":
+                self._notify(
+                    "S4L drafts not draining",
+                    "Draft jobs are stuck in the queue and no routine has picked "
+                    "them up. Open the S4L menu, then click "
+                    "“Set up draft schedule”.",
+                )
+            elif self._stall_reason_info[0] == "failing":
+                self._notify(
+                    "S4L drafts not draining",
+                    "Draft jobs are stuck in the queue; runs start but never "
+                    "finish. Open the S4L menu, then click "
+                    "“Diagnose & fix in Claude…”.",
+                )
             elif schedule_state == "disabled":
                 self._notify(
                     "S4L draft tasks disabled",
                     "The draft tasks are scheduled but disabled. Open the S4L menu → "
                     "“Set up draft schedule” to re-enable.",
                 )
-            elif schedule_state == "stalled":
-                self._notify(
-                    "S4L drafts stopped",
-                    "Claude’s scheduler stopped running the draft tasks (a known "
-                    "Claude Desktop glitch). Open the S4L menu → “Set up draft "
-                    "schedule” to re-register it.",
-                )
             else:
                 can_selfheal = False
                 try:
@@ -2527,8 +2598,20 @@ class S4LMenuBar(rumps.App):
             attention,
             schedule_state,
             self._stall_reason_info,
+            # Degraded-scheduler skip count, bucketed by 5 so the diagnostic
+            # line refreshes every few minutes at most (not every poll — an
+            # open menu shouldn't be torn down under the cursor for a +1).
+            ((self._tick_stats or {}).get("skips_in_window", 0) // 5)
+            if self._tick_stats
+            else None,
             os.path.exists(PAUSE_FLAG),
             pending_count,
+            # Snooze end (0 = not snoozed): rebuilds the menu when a snooze is
+            # set, cleared, or lapses, so the "Snoozed until HH:MM" label and
+            # the review item stay honest.
+            int(self._review_snooze_until)
+            if time.time() < self._review_snooze_until
+            else 0,
         )
         if sig != self._sig:
             self._sig = sig
@@ -2602,7 +2685,51 @@ class S4LMenuBar(rumps.App):
         except Exception:
             return None, []
 
-    def _maybe_start_review(self):
+    def _read_snooze_until(self):
+        try:
+            with open(SNOOZE_FILE) as f:
+                return float((json.load(f) or {}).get("until") or 0.0)
+        except Exception:
+            return 0.0
+
+    def _set_snooze(self, until, pending=0):
+        """Set (or clear, until<=now) the review snooze, mirrored to disk."""
+        self._review_snooze_until = until
+        try:
+            if until <= time.time():
+                try:
+                    os.remove(SNOOZE_FILE)
+                except FileNotFoundError:
+                    pass
+            else:
+                with open(SNOOZE_FILE, "w") as f:
+                    json.dump(
+                        {"until": until, "set_at": time.time(), "pending": pending},
+                        f,
+                    )
+        except Exception:
+            pass
+
+    def _review_now(self, _=None):
+        """Menu: bring the pending draft cards up right now. Clears any snooze;
+        this is the one presentation path that may take keyboard focus (the
+        user explicitly asked for the cards)."""
+        self._set_snooze(0.0)
+        try:
+            import s4l_card
+
+            if s4l_card.active_status():
+                # A card is already on screen (user clicked while one is up,
+                # perhaps parked on another display): bring it to them instead.
+                s4l_card.heal_active()
+                s4l_card.focus_active()
+                return
+        except Exception:
+            pass
+        self._last_review_sig = None
+        self._maybe_start_review(focus=True)
+
+    def _maybe_start_review(self, focus=False):
         req = st.read_review_request()
         if not req:
             return
@@ -2618,6 +2745,12 @@ class S4LMenuBar(rumps.App):
             self._last_review_sig = None
             st.clear_review_request()
             return
+        # Snoozed (the user closed the card with drafts still undecided): leave
+        # the backlog in the store untouched and present nothing until the
+        # snooze lapses. New drafts keep accumulating silently; the menu's
+        # "Review N pending drafts" clears this early.
+        if time.time() < self._review_snooze_until:
+            return
         # De-dup on the CONTENT of the pending set (each draft's plan index + reply
         # text), not the constant batch_id. This means: re-present whenever NEW
         # drafts arrive (the signature changes), but don't re-pop the identical
@@ -2673,6 +2806,7 @@ class S4LMenuBar(rumps.App):
                 drafts,
                 on_decision=lambda d: self._on_card_decision(batch, d),
                 on_complete=lambda decisions: self._on_review_closed(batch, decisions),
+                focus=focus,
             )
             # Record as shown only AFTER the cards are actually up, so a transient
             # card-UI failure never permanently suppresses this pending set.
@@ -2898,6 +3032,20 @@ class S4LMenuBar(rumps.App):
             remaining = 0
         if remaining <= 0:
             st.clear_review_request()
+        else:
+            # Undecided drafts left = the user closed the card early (cross or
+            # the title-bar Snooze button): park the backlog instead of
+            # re-popping it on the next tick, which made the card impossible
+            # to put away (2026-07-09 customer feedback). The signature drop
+            # below still runs, so after the snooze lapses the leftover
+            # presents fresh rather than being suppressed as "already shown".
+            until = time.time() + REVIEW_SNOOZE_SECONDS
+            self._set_snooze(until, remaining)
+            sys.stderr.write(
+                f"[s4l-menubar] review snoozed: {remaining} pending until "
+                f"{time.strftime('%H:%M', time.localtime(until))}\n"
+            )
+            sys.stderr.flush()
         # Drop the dedup signature so whatever is left is presented fresh (not
         # suppressed as "already shown") once posting finishes draining.
         self._last_review_sig = None
@@ -2907,7 +3055,15 @@ class S4LMenuBar(rumps.App):
             st.flush_review_events_async()
         except Exception:
             pass
-        if not any(d.get("approved") for d in decisions):
+        if remaining > 0:
+            plural = "s" if remaining != 1 else ""
+            self._notify(
+                "S4L",
+                f"Snoozed {remaining} pending draft{plural} until "
+                f"{time.strftime('%H:%M', time.localtime(self._review_snooze_until))}. "
+                "Review sooner from the S4L menu.",
+            )
+        elif not any(d.get("approved") for d in decisions):
             self._notify("S4L", "No drafts approved — nothing posted.")
 
     def _discard_all_pending(self, _=None):
@@ -3135,26 +3291,21 @@ class S4LMenuBar(rumps.App):
                     "   " + (self._stall_reason_info[1] or "drafting") + " — no result yet"
                 ))
                 items.append(rumps.MenuItem("Diagnose & fix in Claude…", callback=self._diagnose_fix))
+            elif self._stall_reason_info[0] == "orphaned":
+                # Queue-latency stall, no routine executing (no recent worker
+                # transcript): draft jobs sit unclaimed. Re-arm re-registers the
+                # schedule through the real create_scheduled_task path, the one
+                # mechanical fix that addresses "nothing is picking jobs up".
+                items.append(self._label("⚠ Draft jobs stuck, no routine picking them up"))
+                items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
+            elif self._stall_reason_info[0] == "failing":
+                # Queue-latency stall but routines DO execute: runs start and
+                # die before draining. Re-arm can't fix that; Diagnose can.
+                items.append(self._label("⚠ Draft jobs stuck, runs start but don't finish"))
+                items.append(rumps.MenuItem("Diagnose & fix in Claude…", callback=self._diagnose_fix))
             elif schedule_state == "disabled":
                 items.append(self._label("⚠ Draft tasks are scheduled but disabled"))
                 items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
-            elif schedule_state == "stalled":
-                # Task registered + enabled FOR THE ACTIVE ACCOUNT (schedule_state.py
-                # is account-scoped, 2026-07-08 — see its module docstring) but the
-                # host stopped launching it: the Claude Desktop warm-session wedge
-                # (finished worker sessions never exit; the overlap guard skips
-                # every fire). Re-arm goes through the same real create_scheduled_task
-                # path as onboarding — a verified fix the user has seen work —
-                # rather than a silent Claude Desktop quit/relaunch with no visible
-                # feedback, which field evidence (2026-07-08) showed doesn't
-                # reliably clear the underlying stall (that field incident turned
-                # out to be a DIFFERENT bug: schedule_state.py was reading a stale,
-                # no-longer-active account's registry — now fixed, so "stalled"
-                # here means what it says: same account, task present, just not
-                # firing). Distinct label from the "aren't scheduled" case below
-                # since the task DOES exist here; same one-click remedy either way.
-                items.append(self._label("⚠ Drafts stopped — Claude’s scheduler is stuck"))
-                items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             else:
                 items.append(self._label("⚠ Draft tasks aren’t scheduled on this account"))
                 # Prefer the automatic fix (2026-07-08): if the active account
@@ -3184,6 +3335,29 @@ class S4LMenuBar(rumps.App):
                 else:
                     items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             items.append(rumps.separator)
+        elif setup_complete and schedule_state == "stalled":
+            # NON-ALARM diagnostic (2026-07-09): the task is registered + enabled
+            # for the active account but the host's per-minute tick is stale or
+            # mostly skipped (Desktop warm-session wedge). The queue checks above
+            # would have flipped ⚠ if jobs were actually stuck, so reaching here
+            # means drafts still drain; say so with numbers instead of alarming.
+            # tick_stats is cached by _tick (refreshed ≤ once/min, None outside
+            # 'stalled').
+            _ts = self._tick_stats or {}
+            _skips = _ts.get("skips_in_window")
+            _age = _ts.get("last_run_age_s")
+            _bits = []
+            if _skips is not None:
+                _bits.append(f"{_skips} of ~60 ticks skipped last hour")
+            if _age is not None:
+                _bits.append(f"last run {max(0, int(_age)) // 60}m ago")
+            items.append(self._label("Scheduler degraded (drafts still running)"))
+            if _bits:
+                items.append(self._label("   " + ", ".join(_bits)))
+            # Keep the one-click remedy reachable without dressing it as urgent:
+            # re-registering through create_scheduled_task un-wedges the host.
+            items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
+            items.append(rumps.separator)
 
         if not runtime_ready:
             items += self._state_a()
@@ -3341,12 +3515,29 @@ class S4LMenuBar(rumps.App):
     def _state_c(self, snap, pending_count=0):
         if pending_count <= 0:
             return []
-        return [
+        plural = "s" if pending_count != 1 else ""
+        items = [
             rumps.MenuItem(
-                f"Discard {pending_count} pending draft{'s' if pending_count != 1 else ''}…",
-                callback=self._discard_all_pending,
+                f"Review {pending_count} pending draft{plural}",
+                callback=self._review_now,
             )
         ]
+        if time.time() < self._review_snooze_until:
+            items.append(
+                self._label(
+                    "Snoozed until "
+                    + time.strftime(
+                        "%H:%M", time.localtime(self._review_snooze_until)
+                    )
+                )
+            )
+        items.append(
+            rumps.MenuItem(
+                f"Discard {pending_count} pending draft{plural}…",
+                callback=self._discard_all_pending,
+            )
+        )
+        return items
 
 
 if __name__ == "__main__":

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.2-rc.14",
+  "version": "1.7.2-rc.18",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.2-rc.14",
+  "version": "1.7.2-rc.18",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/merge_review_queue.py

@@ -149,8 +149,24 @@ def _sync_with_backend(cands: list) -> tuple[int, int]:
     Runs on EVERY merge (every cycle), not just once per candidate, so status
     drift after the initial stamp is still caught while a card is still
     pending. Best-effort: any API failure leaves every candidate untouched
-    (fail open, same as before). Returns (stamped_count, pruned_count)."""
-    pending = [c for c in cands if not c.get("posted") and not c.get("terminal") and _thread_url(c)]
+    (fail open, same as before). Returns (stamped_count, pruned_count).
+
+    APPROVED cards are exempt from the prune: an approval is a settled human
+    decision awaiting its serialized post, and stamping terminal on it makes
+    post_drafts refuse it as already-decided (posted:0). That exact race ate
+    2 of 3 approvals on 2026-07-10 (approved 04:30:02Z, merge stamped
+    backend_status_expired 04:32:33Z, poster refused both). The freshness
+    gate exists to stop stale UNDECIDED drafts from burning review attention;
+    once a human has said "post it", the only honest gate left is the
+    poster's own at-post-time tweet_unavailable check."""
+    pending = [
+        c
+        for c in cands
+        if not c.get("posted")
+        and not c.get("terminal")
+        and not c.get("approved")
+        and _thread_url(c)
+    ]
     if not pending:
         return 0, 0
     urls = sorted({_thread_url(c) for c in pending})[:500]

package/scripts/schedule_state.py

@@ -38,6 +38,12 @@ States:
                now correctly resolves to 'missing' (below), since the account
                scoping means an orphaned OTHER account's registry is never
                consulted for the active account's health.
+               DIAGNOSTIC-ONLY for the menu bar ⚠ since 2026-07-09: under the
+               wedge the tick can skip 70-90% of fires while the queue still
+               drains every job (jobs arrive ~every 8 min vs 60 fires/hr), so
+               a point-in-time lastRunAt check flip-flops against a healthy
+               pipeline. The menu bar alarms on queue latency instead and
+               renders 'stalled' as a plain detail line via tick_stats().
   'missing'  — the ACTIVE account has no registry with a complete worker set
                (deleted / never scheduled / orphaned by an account switch)
                -> the dashboard offers "Set up draft schedule". Consumers
@@ -270,6 +276,53 @@ def _detail(glob_pattern: str | None = None) -> dict:
     return {"glob": patterns, "registries": regs}
 
 
+def tick_stats(window_s: int = 3600, glob_pattern: str | None = None) -> dict:
+    """Diagnostic tick-level stats for the active account's worker set: how many
+    per-minute fires the host SKIPPED inside the last window_s (the registry's
+    recordedSkips ledger — under the Desktop warm-session wedge these carry
+    reason per_task_limit) plus the age of the newest successful run. Powers the
+    menu bar's non-alarm "scheduler degraded" detail line when compute() returns
+    'stalled'. NEVER a health verdict on its own: a box skipping 80% of ticks
+    can still drain every job (jobs arrive ~every 8 min vs 60 fires/hr), which
+    is exactly why tick staleness stopped driving the attention ⚠ (2026-07-09).
+    Same account scoping as compute(); pass glob_pattern only for tests."""
+    patterns = [glob_pattern] if glob_pattern is not None else _active_registry_glob_patterns()
+    now = time.time()
+    skips = 0
+    last_skip_epoch = None
+    newest_epoch = None
+    for pattern in patterns:
+        for f in glob.glob(pattern):
+            try:
+                with open(f) as fh:
+                    d = json.load(fh)
+            except Exception:
+                continue
+            by_id = {t.get("id"): t for t in (d.get("scheduledTasks") or [])}
+            recs = _registry_worker_recs(by_id)
+            if recs is None:
+                continue
+            epochs = [_iso_to_epoch(r.get("lastRunAt")) for r in recs]
+            e = max([x for x in epochs if x is not None], default=None)
+            if e is not None and (newest_epoch is None or e > newest_epoch):
+                newest_epoch = e
+            recorded = d.get("recordedSkips") or {}
+            for tid in WORKER_TASK_IDS:
+                for s in recorded.get(tid) or []:
+                    at = _ms_to_epoch((s or {}).get("at"))
+                    if at is None or (now - at) > window_s:
+                        continue
+                    skips += 1
+                    if last_skip_epoch is None or at > last_skip_epoch:
+                        last_skip_epoch = at
+    return {
+        "skips_in_window": skips,
+        "window_s": window_s,
+        "last_run_age_s": int(now - newest_epoch) if newest_epoch is not None else None,
+        "last_skip_age_s": int(now - last_skip_epoch) if last_skip_epoch is not None else None,
+    }
+
+
 def main() -> int:
     out = {}
     try: