@m13v/s4l 1.7.2-rc.9 → 1.7.3

package/mcp/menubar/s4l_menubar.py

@@ -117,6 +117,19 @@ try:
 except Exception:
     pass
 
+# Ground-truth browser-foreground telemetry: whenever a MANAGED harness Chrome
+# becomes the frontmost app (fresh-launch activation, screencast bringToFront,
+# macOS clamping the off-screen window back on-screen, anything), ship one
+# structured line with context "browser-foreground" through the relay above.
+# Cause-agnostic OS-level observation; the causing sites (screencast.ts) log
+# their own attribution lines under the same context. Best-effort.
+try:
+    import s4l_browser_foreground  # noqa: E402
+
+    s4l_browser_foreground.install()
+except Exception:
+    pass
+
 
 def _capture(err, **tags):
     """Report a handled menu-bar error to Sentry (component=menubar) without ever
@@ -439,6 +452,17 @@ REVIEW_HEAL_EVERY_SECONDS = float(
 )
 REVIEW_UNATTENDED_SENTRY_SECONDS = 3600.0
 
+# Review snooze (2026-07-09 customer feedback: cards interrupt focused work
+# with no way to defer them). Closing the card with undecided drafts, via the
+# cross or the title-bar "Snooze 1h" button, parks the WHOLE pending backlog
+# for REVIEW_SNOOZE_SECONDS: no auto-present, no watchdog heal (nothing is on
+# screen). Drafts stay in the store untouched; the menu's "Review N pending
+# drafts" clears the snooze early. Persisted so a menubar restart mid-snooze
+# doesn't re-pop the card. s4l_card._snooze_secs reads the same env var for
+# the button label; keep them in sync.
+REVIEW_SNOOZE_SECONDS = float(os.environ.get("S4L_REVIEW_SNOOZE_S", "3600"))
+SNOOZE_FILE = os.path.join(st.state_dir(), "review-snooze.json")
+
 
 def _label_elapsed_secs(label):
     """Parse the trailing duration the producer encodes in a drafting activity
@@ -519,6 +543,10 @@ class S4LMenuBar(rumps.App):
         self._post_worker = None
         self._review_lock = threading.Lock()
         self._panel_open = False
+        # Review snooze: epoch until which draft cards must not auto-present
+        # (0 = not snoozed). Loaded from disk so a menubar restart mid-snooze
+        # doesn't re-pop the card the user just put away.
+        self._review_snooze_until = self._read_snooze_until()
         # Unattended-review watchdog state (_maybe_heal_review).
         self._review_heal_at = 0.0
         self._review_unattended_notified = False
@@ -645,6 +673,11 @@ class S4LMenuBar(rumps.App):
         # Cached schedule state for the current account: 'missing'/'disabled'/'ok'/
         # 'unknown'. PRIMARY driver of the menu's attention section.
         self._schedule_state_cache = "ok"
+        # Tick-freshness diagnostics (schedule_state.tick_stats()) shown as the
+        # non-alarm "scheduler degraded" menu line while state == 'stalled'.
+        # None outside that state; refreshed at most once a minute (_tick).
+        self._tick_stats = None
+        self._tick_stats_at = 0.0
         self._reloc_timer = rumps.Timer(self._maybe_relocate_tasks, 90)
         self._reloc_timer.start()
         self._tick(None)
@@ -874,11 +907,15 @@ class S4LMenuBar(rumps.App):
               does NOT stay stale after recovery.
 
         NOTE: kept in sync with scripts/autopilot_stall_watch.py (the fleet Sentry
-        backstop). The menu-bar ⚠ itself is driven by _schedule_state, NOT this
-        method — the attention/⚠ path keys off schedule_state so a firing-but-
-        momentarily-empty queue stays green (an earlier drain-latch ⚠ stayed stale
-        after recovery and was deliberately removed). This method exists for the
-        watcher-parity contract and _stall_reason.
+        backstop). Since 2026-07-09 this method IS an attention/⚠ driver: _tick
+        ORs it in (with the reason from _stall_reason) alongside the structural
+        schedule states (missing/disabled) and the activity-label draft_stuck
+        check. A firing-but-momentarily-empty queue still stays green: an idle
+        queue has no pending job, running/ is empty, and the drain latch zeroes
+        on every successful consume (claude_job._mark_drain_success), so none of
+        the three signals can hold a stale True after recovery. Tick-freshness
+        'stalled' from schedule_state no longer flips the ⚠ at all — it renders
+        as a plain diagnostic line (see _build_menu).
         """
         qroot = os.path.join(st.state_dir(), "claude-queue")
         # (1) latched producer drain-status
@@ -2320,34 +2357,38 @@ class S4LMenuBar(rumps.App):
         blocker = (ob or {}).get("current_blocker")
         blocker_code = (blocker or {}).get("code")
         # --- Autopilot health (only meaningful once setup is complete) --------
-        # SINGLE signal: is the draft schedule registered AND firing for the live
-        # account (schedule_state)? 'ok' = the host is running the tasks -> healthy,
-        # NO warning (even if no draft has drained yet — that's just an empty queue
-        # between cycles, not a setup problem). 'missing'/'disabled' = not running
-        # for this account -> show re-arm. We deliberately do NOT drive the menu off
-        # the drain-status latch anymore: it stayed stale after recovery and made a
-        # firing, healthy autopilot look "not set up".
+        # TWO layers (2026-07-09 redesign):
+        #   STRUCTURAL (schedule_state): 'missing'/'disabled' = the schedule is
+        #     genuinely not registered/enabled for this account -> ⚠ + re-arm.
+        #   JOB LATENCY (_autopilot_stalled + the draft_stuck label check below):
+        #     a draft job sat unclaimed, wedged mid-run, or the producer's drain
+        #     latch tripped -> ⚠, because THAT is user-visible harm.
+        # Tick freshness ('stalled': task present + enabled but lastRunAt stale,
+        # the Desktop warm-session wedge) is DIAGNOSTIC ONLY, never the ⚠: under
+        # the wedge the per-minute tick can skip 70-90% of fires while the queue
+        # still drains every job (jobs arrive ~every 8 min vs 60 fires/hr), so
+        # lastRunAt staleness flip-flopped the icon against a healthy pipeline
+        # (observed on the operator box 2026-07-09: 83% ticks skipped, ~14
+        # posts/hr flowing, icon oscillating). _build_menu renders 'stalled' as
+        # a plain "scheduler degraded" detail line with tick_stats() numbers.
+        # The drain latch IS safe to alarm on now: claude_job._mark_drain_success
+        # zeroes it on every successful consume, so it self-clears (the old
+        # stayed-stale-after-recovery latch this comment used to warn about
+        # predates that reset).
         # Always read the REAL schedule state (no setup-gated "ok" fallback that
         # lied). The re-arm WARNING still only fires once setup is complete, so we
         # never nag the user mid-onboarding — only the value is now always honest.
         schedule_state = self._schedule_state()
         self._schedule_state_cache = schedule_state
-        # 'stalled' (task present + enabled FOR THE ACTIVE ACCOUNT, host
-        # scheduler stopped launching it: the Desktop warm-session wedge,
-        # Karol 2026-07-06) needs attention just like missing/disabled.
-        # schedule_state.py is account-scoped (2026-07-08): an account switch
-        # now correctly resolves to 'missing' (the active account genuinely
-        # has no registration), not 'stalled' — a stale OTHER account's
-        # registry is never consulted for the active account's health, so
-        # 'stalled' can no longer be misdiagnosed here.
-        attention = setup_complete and schedule_state in ("missing", "disabled", "stalled")
+        attention = setup_complete and schedule_state in ("missing", "disabled")
         # Routines-lane rate limit (429): the draft tasks ARE registered and firing
         # for this account, but every run dies on a Claude rate limit, so nothing
         # drafts. Re-arm can't fix that — surface it as its own ⚠ attention state
-        # with a "rate-limited" reason. Only meaningful when the schedule is firing
-        # ('ok'); the missing/disabled case already owns the ⚠. Throttled (~30s):
-        # scanning the worker-transcript bucket is glob-heavy and changes slowly.
-        if setup_complete and schedule_state == "ok":
+        # with a "rate-limited" reason. Meaningful whenever the schedule exists
+        # ('ok' or the degraded-but-firing 'stalled'); the missing/disabled case
+        # already owns the ⚠. Throttled (~30s): scanning the worker-transcript
+        # bucket is glob-heavy and changes slowly.
+        if setup_complete and schedule_state in ("ok", "stalled"):
             now_rl = time.time()
             if now_rl - getattr(self, "_rl_checked_at", 0.0) >= 30:
                 self._rl_checked_at = now_rl
@@ -2371,12 +2412,10 @@ class S4LMenuBar(rumps.App):
         # draft_stuck shadowed the missing/disabled branch in _build_menu — the user
         # saw "worker keeps getting killed" with NO Re-arm button instead of "Draft
         # tasks aren't scheduled on this account" + the one-click fix (Karol,
-        # 2026-07-06). "stalled" is deliberately included (2026-07-08): that
-        # branch's fix (Set up draft schedule / re-arm) works for it too, but a
-        # job that has sat this long — claimed-and-hung, OR never claimed at all
-        # (see the ⧖ prefix check below) — is more specific, direct evidence
-        # from the queue itself than the host's lastRunAt staleness, so it's
-        # worth surfacing as its own reason even under "stalled".
+        # 2026-07-06). "stalled" is deliberately included (2026-07-08): a job that
+        # has sat this long — claimed-and-hung, OR never claimed at all (see the ⧖
+        # prefix check below) — is direct evidence from the queue itself, exactly
+        # the layer the ⚠ keys off now that tick staleness alone is diagnostic.
         if (
             setup_complete
             and schedule_state in ("ok", "stalled")
@@ -2390,6 +2429,44 @@ class S4LMenuBar(rumps.App):
             ):
                 attention = True
                 self._stall_reason_info = ("draft_stuck", _act.get("label") or "")
+        # Queue-latency stall (the layer that measures actual user harm): a draft
+        # job sat unclaimed past AUTOPILOT_STALL_SECONDS, wedged in running/ past
+        # AUTOPILOT_RUNNING_STALL_SECONDS, or the producer's drain latch tripped
+        # (consecutive timeouts, zeroed on every successful consume). The activity-
+        # label draft_stuck check above needs a live producer narrating "drafting";
+        # this one works between cycles too (the latch persists the episode), so
+        # together they cover producer-alive and producer-gone stalls. Reason
+        # refines the one-click fix: 'orphaned' (no routine executed recently,
+        # re-arm helps) vs 'failing' (routines run but drafts die, Diagnose).
+        if (
+            setup_complete
+            and schedule_state in ("ok", "stalled")
+            and self._stall_reason_info[0] not in ("rate_limited", "draft_stuck")
+        ):
+            if self._autopilot_stalled():
+                _qreason, _qmsg = self._stall_reason()
+                attention = True
+                self._stall_reason_info = (_qreason, _qmsg)
+            elif self._stall_reason_info[0] in ("orphaned", "failing"):
+                # Queue recovered since the last tick: clear the stale reason
+                # now instead of waiting for the 30s rate-limit rescan to
+                # overwrite it (a lingering reason skews the diagnose prompt
+                # and churns the menu signature for nothing).
+                self._stall_reason_info = ("", "")
+        # Tick-freshness diagnostics for the non-alarm "scheduler degraded" menu
+        # line. Only computed while 'stalled' (it reads + parses the registry
+        # JSON, which can be hundreds of KB) and throttled to once a minute.
+        if schedule_state == "stalled":
+            _now_ts = time.time()
+            if _now_ts - getattr(self, "_tick_stats_at", 0.0) >= 60:
+                self._tick_stats_at = _now_ts
+                try:
+                    import schedule_state as _ss
+                    self._tick_stats = _ss.tick_stats()
+                except Exception:
+                    self._tick_stats = None
+        else:
+            self._tick_stats = None
         # Drop the stale "drafting" spinner while we need attention so the ⚠ shows.
         self._stalled = attention
 
@@ -2415,7 +2492,7 @@ class S4LMenuBar(rumps.App):
             # Once per episode (gated by _stall_notified), so it never spams.
             _reason = (
                 self._stall_reason_info[0]
-                or (schedule_state if schedule_state in ("disabled", "stalled") else "missing")
+                or ("disabled" if schedule_state == "disabled" else "missing")
             )
             _capture_msg(
                 f"S4L draft autopilot needs attention: {_reason}",
@@ -2447,19 +2524,26 @@ class S4LMenuBar(rumps.App):
                      "A worker claimed a draft job and never finished it. ")
                     + "Open the S4L menu → “Diagnose & fix in Claude…”.",
                 )
+            elif self._stall_reason_info[0] == "orphaned":
+                self._notify(
+                    "S4L drafts not draining",
+                    "Draft jobs are stuck in the queue and no routine has picked "
+                    "them up. Open the S4L menu, then click "
+                    "“Set up draft schedule”.",
+                )
+            elif self._stall_reason_info[0] == "failing":
+                self._notify(
+                    "S4L drafts not draining",
+                    "Draft jobs are stuck in the queue; runs start but never "
+                    "finish. Open the S4L menu, then click "
+                    "“Diagnose & fix in Claude…”.",
+                )
             elif schedule_state == "disabled":
                 self._notify(
                     "S4L draft tasks disabled",
                     "The draft tasks are scheduled but disabled. Open the S4L menu → "
                     "“Set up draft schedule” to re-enable.",
                 )
-            elif schedule_state == "stalled":
-                self._notify(
-                    "S4L drafts stopped",
-                    "Claude’s scheduler stopped running the draft tasks (a known "
-                    "Claude Desktop glitch). Open the S4L menu → “Set up draft "
-                    "schedule” to re-register it.",
-                )
             else:
                 can_selfheal = False
                 try:
@@ -2527,8 +2611,20 @@ class S4LMenuBar(rumps.App):
             attention,
             schedule_state,
             self._stall_reason_info,
+            # Degraded-scheduler skip count, bucketed by 5 so the diagnostic
+            # line refreshes every few minutes at most (not every poll — an
+            # open menu shouldn't be torn down under the cursor for a +1).
+            ((self._tick_stats or {}).get("skips_in_window", 0) // 5)
+            if self._tick_stats
+            else None,
             os.path.exists(PAUSE_FLAG),
             pending_count,
+            # Snooze end (0 = not snoozed): rebuilds the menu when a snooze is
+            # set, cleared, or lapses, so the "Snoozed until HH:MM" label and
+            # the review item stay honest.
+            int(self._review_snooze_until)
+            if time.time() < self._review_snooze_until
+            else 0,
         )
         if sig != self._sig:
             self._sig = sig
@@ -2602,7 +2698,51 @@ class S4LMenuBar(rumps.App):
         except Exception:
             return None, []
 
-    def _maybe_start_review(self):
+    def _read_snooze_until(self):
+        try:
+            with open(SNOOZE_FILE) as f:
+                return float((json.load(f) or {}).get("until") or 0.0)
+        except Exception:
+            return 0.0
+
+    def _set_snooze(self, until, pending=0):
+        """Set (or clear, until<=now) the review snooze, mirrored to disk."""
+        self._review_snooze_until = until
+        try:
+            if until <= time.time():
+                try:
+                    os.remove(SNOOZE_FILE)
+                except FileNotFoundError:
+                    pass
+            else:
+                with open(SNOOZE_FILE, "w") as f:
+                    json.dump(
+                        {"until": until, "set_at": time.time(), "pending": pending},
+                        f,
+                    )
+        except Exception:
+            pass
+
+    def _review_now(self, _=None):
+        """Menu: bring the pending draft cards up right now. Clears any snooze;
+        this is the one presentation path that may take keyboard focus (the
+        user explicitly asked for the cards)."""
+        self._set_snooze(0.0)
+        try:
+            import s4l_card
+
+            if s4l_card.active_status():
+                # A card is already on screen (user clicked while one is up,
+                # perhaps parked on another display): bring it to them instead.
+                s4l_card.heal_active()
+                s4l_card.focus_active()
+                return
+        except Exception:
+            pass
+        self._last_review_sig = None
+        self._maybe_start_review(focus=True)
+
+    def _maybe_start_review(self, focus=False):
         req = st.read_review_request()
         if not req:
             return
@@ -2618,6 +2758,12 @@ class S4LMenuBar(rumps.App):
             self._last_review_sig = None
             st.clear_review_request()
             return
+        # Snoozed (the user closed the card with drafts still undecided): leave
+        # the backlog in the store untouched and present nothing until the
+        # snooze lapses. New drafts keep accumulating silently; the menu's
+        # "Review N pending drafts" clears this early.
+        if time.time() < self._review_snooze_until:
+            return
         # De-dup on the CONTENT of the pending set (each draft's plan index + reply
         # text), not the constant batch_id. This means: re-present whenever NEW
         # drafts arrive (the signature changes), but don't re-pop the identical
@@ -2632,6 +2778,13 @@ class S4LMenuBar(rumps.App):
         #    live. This is the fix for the "card froze at 1 of 4 while 137 piled
         #    up" bug — drafts that arrived after the card opened used to be
         #    stranded because this method returned early on _review_active.
+        #    Also prune the other direction: any `n` this same stack used to
+        #    carry but that dropped out of the fresh `drafts` list (merge_review_
+        #    queue.py's backend sync just marked it terminal, most commonly the
+        #    freshness gate expiring it) is removed from the not-yet-reached part
+        #    of the stack, so an old card can't sit there waiting to be approved
+        #    into a silent no-op (see the 2026-07-09 "approved 3, nothing
+        #    posted" investigation).
         #  - Posting is DRAINING with no panel up (_review_active but not
         #    _panel_open): leave the signature untouched so the full pending set
         #    is presented fresh once the drain completes (don't pop a card mid-post).
@@ -2640,6 +2793,11 @@ class S4LMenuBar(rumps.App):
                 try:
                     import s4l_card
 
+                    prev_ns = {n for n, _ in (self._last_review_sig or ())}
+                    cur_ns = {d.get("n") for d in drafts}
+                    vanished = prev_ns - cur_ns
+                    if vanished:
+                        s4l_card.prune_active(vanished)
                     s4l_card.extend_active(drafts)
                 except Exception as e:
                     sys.stderr.write(f"[s4l-menubar] extend cards failed: {e}\n")
@@ -2655,12 +2813,16 @@ class S4LMenuBar(rumps.App):
 
             # present_feedback (the menu bar's feedback item) falls back to
             # the module-level default handler; register ours before any
-            # card shows.
+            # card shows. Same pattern for the title bar's "Discard all…"
+            # button (moved out of the dropdown 2026-07-10), which reuses the
+            # bulk-discard handler wholesale, confirmation alert included.
             s4l_card.set_feedback_handler(self._on_feedback_text)
+            s4l_card.set_discard_all_handler(self._discard_all_pending)
             s4l_card.present_review(
                 drafts,
                 on_decision=lambda d: self._on_card_decision(batch, d),
                 on_complete=lambda decisions: self._on_review_closed(batch, decisions),
+                focus=focus,
             )
             # Record as shown only AFTER the cards are actually up, so a transient
             # card-UI failure never permanently suppresses this pending set.
@@ -2886,6 +3048,20 @@ class S4LMenuBar(rumps.App):
             remaining = 0
         if remaining <= 0:
             st.clear_review_request()
+        else:
+            # Undecided drafts left = the user closed the card early (cross or
+            # the title-bar Snooze button): park the backlog instead of
+            # re-popping it on the next tick, which made the card impossible
+            # to put away (2026-07-09 customer feedback). The signature drop
+            # below still runs, so after the snooze lapses the leftover
+            # presents fresh rather than being suppressed as "already shown".
+            until = time.time() + REVIEW_SNOOZE_SECONDS
+            self._set_snooze(until, remaining)
+            sys.stderr.write(
+                f"[s4l-menubar] review snoozed: {remaining} pending until "
+                f"{time.strftime('%H:%M', time.localtime(until))}\n"
+            )
+            sys.stderr.flush()
         # Drop the dedup signature so whatever is left is presented fresh (not
         # suppressed as "already shown") once posting finishes draining.
         self._last_review_sig = None
@@ -2895,7 +3071,15 @@ class S4LMenuBar(rumps.App):
             st.flush_review_events_async()
         except Exception:
             pass
-        if not any(d.get("approved") for d in decisions):
+        if remaining > 0:
+            plural = "s" if remaining != 1 else ""
+            self._notify(
+                "S4L",
+                f"Snoozed {remaining} pending draft{plural} until "
+                f"{time.strftime('%H:%M', time.localtime(self._review_snooze_until))}. "
+                "Review sooner from the S4L menu.",
+            )
+        elif not any(d.get("approved") for d in decisions):
             self._notify("S4L", "No drafts approved — nothing posted.")
 
     def _discard_all_pending(self, _=None):
@@ -3123,26 +3307,21 @@ class S4LMenuBar(rumps.App):
                     "   " + (self._stall_reason_info[1] or "drafting") + " — no result yet"
                 ))
                 items.append(rumps.MenuItem("Diagnose & fix in Claude…", callback=self._diagnose_fix))
+            elif self._stall_reason_info[0] == "orphaned":
+                # Queue-latency stall, no routine executing (no recent worker
+                # transcript): draft jobs sit unclaimed. Re-arm re-registers the
+                # schedule through the real create_scheduled_task path, the one
+                # mechanical fix that addresses "nothing is picking jobs up".
+                items.append(self._label("⚠ Draft jobs stuck, no routine picking them up"))
+                items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
+            elif self._stall_reason_info[0] == "failing":
+                # Queue-latency stall but routines DO execute: runs start and
+                # die before draining. Re-arm can't fix that; Diagnose can.
+                items.append(self._label("⚠ Draft jobs stuck, runs start but don't finish"))
+                items.append(rumps.MenuItem("Diagnose & fix in Claude…", callback=self._diagnose_fix))
             elif schedule_state == "disabled":
                 items.append(self._label("⚠ Draft tasks are scheduled but disabled"))
                 items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
-            elif schedule_state == "stalled":
-                # Task registered + enabled FOR THE ACTIVE ACCOUNT (schedule_state.py
-                # is account-scoped, 2026-07-08 — see its module docstring) but the
-                # host stopped launching it: the Claude Desktop warm-session wedge
-                # (finished worker sessions never exit; the overlap guard skips
-                # every fire). Re-arm goes through the same real create_scheduled_task
-                # path as onboarding — a verified fix the user has seen work —
-                # rather than a silent Claude Desktop quit/relaunch with no visible
-                # feedback, which field evidence (2026-07-08) showed doesn't
-                # reliably clear the underlying stall (that field incident turned
-                # out to be a DIFFERENT bug: schedule_state.py was reading a stale,
-                # no-longer-active account's registry — now fixed, so "stalled"
-                # here means what it says: same account, task present, just not
-                # firing). Distinct label from the "aren't scheduled" case below
-                # since the task DOES exist here; same one-click remedy either way.
-                items.append(self._label("⚠ Drafts stopped — Claude’s scheduler is stuck"))
-                items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             else:
                 items.append(self._label("⚠ Draft tasks aren’t scheduled on this account"))
                 # Prefer the automatic fix (2026-07-08): if the active account
@@ -3172,6 +3351,29 @@ class S4LMenuBar(rumps.App):
                 else:
                     items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
             items.append(rumps.separator)
+        elif setup_complete and schedule_state == "stalled":
+            # NON-ALARM diagnostic (2026-07-09): the task is registered + enabled
+            # for the active account but the host's per-minute tick is stale or
+            # mostly skipped (Desktop warm-session wedge). The queue checks above
+            # would have flipped ⚠ if jobs were actually stuck, so reaching here
+            # means drafts still drain; say so with numbers instead of alarming.
+            # tick_stats is cached by _tick (refreshed ≤ once/min, None outside
+            # 'stalled').
+            _ts = self._tick_stats or {}
+            _skips = _ts.get("skips_in_window")
+            _age = _ts.get("last_run_age_s")
+            _bits = []
+            if _skips is not None:
+                _bits.append(f"{_skips} of ~60 ticks skipped last hour")
+            if _age is not None:
+                _bits.append(f"last run {max(0, int(_age)) // 60}m ago")
+            items.append(self._label("Scheduler degraded (drafts still running)"))
+            if _bits:
+                items.append(self._label("   " + ", ".join(_bits)))
+            # Keep the one-click remedy reachable without dressing it as urgent:
+            # re-registering through create_scheduled_task un-wedges the host.
+            items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
+            items.append(rumps.separator)
 
         if not runtime_ready:
             items += self._state_a()
@@ -3329,12 +3531,26 @@ class S4LMenuBar(rumps.App):
     def _state_c(self, snap, pending_count=0):
         if pending_count <= 0:
             return []
-        return [
+        plural = "s" if pending_count != 1 else ""
+        items = [
             rumps.MenuItem(
-                f"Discard {pending_count} pending draft{'s' if pending_count != 1 else ''}…",
-                callback=self._discard_all_pending,
+                f"Review {pending_count} pending draft{plural}",
+                callback=self._review_now,
             )
         ]
+        if time.time() < self._review_snooze_until:
+            items.append(
+                self._label(
+                    "Snoozed until "
+                    + time.strftime(
+                        "%H:%M", time.localtime(self._review_snooze_until)
+                    )
+                )
+            )
+        # No bulk-discard item here anymore: "Discard all…" lives in the
+        # review card's title bar (2026-07-10). Reaching it with no card open
+        # is "Review N pending drafts" -> Discard all, two clicks.
+        return items
 
 
 if __name__ == "__main__":

package/mcp/menubar/s4l_state.py

@@ -736,6 +736,37 @@ def _match_candidate(data, n, candidate_id):
     return None
 
 
+def candidate_state(c):
+    """Canonical lifecycle state of ONE review-queue candidate. Use this instead
+    of ad hoc flag checks — "not posted" is NOT "awaiting review".
+
+    The review queue (review-queue.json) is an APPEND-FOREVER LEDGER: handled
+    candidates are never removed, they are flag-stamped in place, so most rows
+    in an old queue are retired. States, in precedence order:
+
+      posted          — approved and successfully posted (our_url set).
+      terminal        — retired without a post; terminal_reason says why
+                        (rejected, human_rejected, human_discarded_all,
+                        duplicate_thread_pre_post, ...; None on older rows).
+      post_failed     — approved but the post attempt errored (post_error says
+                        why). Settled from the cards' point of view; the resume
+                        path retries only after a fresh approval clears it.
+      approved        — human approved, post not yet attempted/confirmed.
+      awaiting_review — none of the above. The ONLY state cards present, and
+                        the only honest "pending" count (review-request.json's
+                        .count mirrors it at merge time).
+    """
+    if c.get("posted") is True:
+        return "posted"
+    if c.get("terminal") is True:
+        return "terminal"
+    if c.get("post_failed"):
+        return "post_failed"
+    if c.get("approved") is True:
+        return "approved"
+    return "awaiting_review"
+
+
 def store_stamp_decision(batch, decision):
     """Write a card decision INTO the store the instant the user clicks. This is
     the durable record (the old approved-queue.json ledger is no longer
@@ -784,7 +815,7 @@ def discard_all_pending(drafts):
         done = 0
         for d in drafts:
             c = _match_candidate(data, d.get("n"), d.get("candidate_id"))
-            if c is None or c.get("posted") is True or c.get("terminal") is True:
+            if c is None or candidate_state(c) in ("posted", "terminal"):
                 continue
             c["terminal"] = True
             c["terminal_reason"] = "human_discarded_all"
@@ -865,7 +896,7 @@ def store_pending_posts(batch="review-queue"):
     plan = read_plan(store_path())
     out = []
     for i, c in enumerate((plan or {}).get("candidates") or []):
-        if not c.get("approved") or c.get("posted") or c.get("terminal") or c.get("post_failed"):
+        if candidate_state(c) != "approved":
             continue
         d = c.get("decision") or {}
         out.append(
@@ -932,7 +963,7 @@ def review_queue_posted_count():
     cands = (plan or {}).get("candidates")
     if not cands:
         return None
-    return sum(1 for c in cands if c.get("posted") is True)
+    return sum(1 for c in cands if candidate_state(c) == "posted")
 
 
 def _plan_generation(batch):
@@ -1008,7 +1039,9 @@ def review_drafts(plan, batch="review-queue"):
     settled_ns = {it.get("n") for it in items if it.get("candidate_id") is None}
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
-        if c.get("posted") is True or c.get("terminal") is True or c.get("approved") is True:
+        # Only awaiting_review rows become cards. This also skips post_failed
+        # rows (decided-but-failed is settled per the docstring above).
+        if candidate_state(c) != "awaiting_review":
             continue
         cid = c.get("candidate_id")
         if cid is not None and cid in settled_ids:

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.2-rc.9",
+  "version": "1.7.3",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.2-rc.9",
+  "version": "1.7.3",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",