@m13v/s4l 1.7.5 → 1.7.6-rc.10

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -909,12 +909,57 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
+// Give-up bound for approved cards whose post attempts keep failing
+// transiently (browser lock contention, timeouts). 5 attempts spans several
+// drain cycles — plenty for genuine transients to clear — while guaranteeing
+// no card can retry forever (2026-07-17 zombie-card incident).
+const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
         c.discard_reason === "backend_status_expired");
 }
-function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+// Prompt-sandbox replay cards (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE)
+// carry experiments.sandbox=true; older sandbox rows predate that stamp but all
+// use the synthetic >=900,000,000 id range twitter_prompt_sandbox.py assigns.
+function isSandboxCandidate(c) {
+    const exps = c.experiments;
+    if (exps && typeof exps === "object" && exps.sandbox)
+        return true;
+    const id = Number(c.candidate_id);
+    return Number.isFinite(id) && id >= 900_000_000;
+}
+// Write field patches into the review-queue store UNDER ITS LOCK by shelling
+// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
+// _store_update and merge_review_queue.py hold around their read-modify-write.
+// Node has no native flock, and this process writing the store directly was
+// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
+// Returns false on any failure so callers can fall back to the legacy write.
+async function patchReviewStore(patches) {
+    if (!patches.length)
+        return true;
+    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
+    try {
+        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
+        const res = await runPython("scripts/store_patch.py", [tmp], {
+            timeoutMs: 30_000,
+            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -926,28 +971,97 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
+    //
+    // Review-queue store: go through the LOCKED patch path (store_patch.py)
+    // first. The fresh-read merge below closes most of the race window but not
+    // all of it — a menubar decision landing between our readPlan and writePlan
+    // still gets erased. The locked path holds the store's flock for the whole
+    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
+    // and enforces the same posted-sticky rules. Legacy path stays as the
+    // fallback and for per-batch /tmp plans (single writer, no lock needed).
+    try {
+        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
+        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
+            const patches = stamped.map((c) => {
+                const set = {};
+                const unset = [];
+                if (c.posted === true) {
+                    set.posted = true;
+                    set.terminal = false;
+                    if (c.our_url)
+                        set.our_url = c.our_url;
+                    unset.push("discard_reason");
+                }
+                else if (c.terminal === true) {
+                    set.terminal = true;
+                    set.terminal_reason = c.terminal_reason ?? null;
+                    // See the zombie-card note in the legacy branch below: a terminal
+                    // from a real post attempt must clear the overridable expiry stamp.
+                    unset.push("discard_reason");
+                }
+                if (typeof c.post_attempts === "number")
+                    set.post_attempts = c.post_attempts;
+                return { candidate_id: c.candidate_id, set, unset };
+            });
+            if (await patchReviewStore(patches))
+                return;
+            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
+        }
+    }
+    catch {
+        /* fall through to the legacy write */
+    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
         if (fresh && Array.isArray(fresh.candidates)) {
+            // candidate_id is NOT unique in the review-queue store: sandbox reruns
+            // and re-merged drafts append sibling rows with the same id. Stamping
+            // only one sibling (the old Map single-slot) left the others matching
+            // the drain's approved && !posted && !terminal filter, so the backlog
+            // re-drained the same candidate every heartbeat forever (2026-07-17
+            // incident: 23-card loop at 60s cadence). Stamp EVERY row with the id.
             const freshById = new Map();
             fresh.candidates.forEach((c) => {
-                if (c.candidate_id !== undefined && c.candidate_id !== null)
-                    freshById.set(String(c.candidate_id), c);
+                if (c.candidate_id !== undefined && c.candidate_id !== null) {
+                    const key = String(c.candidate_id);
+                    const list = freshById.get(key);
+                    if (list)
+                        list.push(c);
+                    else
+                        freshById.set(key, [c]);
+                }
             });
             for (const c of stamped) {
-                const f = freshById.get(String(c.candidate_id));
-                if (!f)
-                    continue;
-                if (c.posted === true) {
-                    f.posted = true;
-                    f.terminal = false;
-                    if (c.our_url)
-                        f.our_url = c.our_url;
-                }
-                else if (c.terminal === true && f.posted !== true) {
-                    f.terminal = true;
-                    f.terminal_reason = c.terminal_reason;
+                for (const f of freshById.get(String(c.candidate_id)) ?? []) {
+                    if (c.posted === true) {
+                        f.posted = true;
+                        f.terminal = false;
+                        if (c.our_url)
+                            f.our_url = c.our_url;
+                        // A post outcome closes the card's history: the pre-approval
+                        // freshness stamp must not survive it.
+                        delete f.discard_reason;
+                    }
+                    else if (c.terminal === true && f.posted !== true) {
+                        f.terminal = true;
+                        f.terminal_reason = c.terminal_reason;
+                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
+                        // 5 days): a stale discard_reason="backend_status_expired" left on
+                        // the fresh copy makes expiredStampOverridable() treat THIS
+                        // post-outcome terminal as overridable, so every later drain
+                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
+                        // forever. A terminal that came from an actual post attempt is
+                        // final; delete the expiry stamp so the override can never fire
+                        // on it again. (The drain's own `delete c.discard_reason` happens
+                        // on an in-memory copy that is never the write source; this line
+                        // is the one that persists.)
+                        delete f.discard_reason;
+                    }
+                    // Carry the retry counter so the give-up bound survives across
+                    // drains (each drain reads the store fresh).
+                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
+                        f.post_attempts = c.post_attempts;
                 }
             }
             writePlan(batchId, fresh);
@@ -1043,7 +1157,12 @@ async function postApproved(batchId, plan) {
     // and the stamp is cleared so every downstream terminal check agrees it's live.
     const approved = (plan.candidates || []).filter((c) => c.approved === true &&
         c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)));
+        (c.terminal !== true || expiredStampOverridable(c)) &&
+        // Prompt-sandbox replays can never post (twitter_post_plan.py post_one()
+        // hard-refuses them), so draining one is pure churn: it burns a browser
+        // lock turn and, if its terminal stamp later loses a store-write race,
+        // loops forever. Exclude them here regardless of stamp state.
+        !isSandboxCandidate(c));
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -1241,7 +1360,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1482,6 +1601,21 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
+                //
+                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
+                // unbounded retry is a zombie generator (one card retried 438 times
+                // over 5 days on the Nhat install). Count the transient failures and
+                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
+                // the last failure visible so the give-up is diagnosable, and the
+                // on-disk post-events trail records it for forensics.
+                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
+                c.post_attempts = attempts;
+                if (attempts >= MAX_POST_ATTEMPTS) {
+                    c.terminal = true;
+                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
+                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
+                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
+                }
                 touchedPlan = true;
             }
         });
@@ -1496,7 +1630,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        mergeApprovedStampsIntoStore(batchId, plan, approved);
+        await mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2741,6 +2875,16 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
+    // Review-queue store: snapshot every row now so the write below can be a
+    // field-level DIFF applied under the store lock (store_patch.py) instead
+    // of an unlocked whole-file replace. This function holds its in-memory
+    // plan across user think-time; a whole-file write here erased any menubar
+    // decision or merge that landed in between (the 2026-07-17 truth-loss
+    // family). Non-store batches keep the plain write: single writer.
+    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
+    const rowsBefore = isStoreBatch
+        ? candidates.map((c) => JSON.stringify(c))
+        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -2877,7 +3021,40 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    writePlan(batch_id, plan);
+    // Persist the decision mutations. Store batch: diff each row against its
+    // snapshot and apply only the changed fields under the store lock, so a
+    // concurrent menubar decision or merge is never erased. Anything else
+    // (per-batch /tmp plans): plain write, single writer.
+    let storeWriteDone = false;
+    if (isStoreBatch) {
+        const patches = [];
+        candidates.forEach((c, i) => {
+            const beforeRaw = rowsBefore[i];
+            const afterRaw = JSON.stringify(c);
+            if (beforeRaw === afterRaw)
+                return;
+            const before = JSON.parse(beforeRaw ?? "{}");
+            const after = JSON.parse(afterRaw);
+            const set = {};
+            const unset = [];
+            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
+                if (!(k in after) || after[k] === undefined) {
+                    if (k in before)
+                        unset.push(k);
+                }
+                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
+                    set[k] = after[k];
+                }
+            }
+            if (Object.keys(set).length || unset.length)
+                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
+        });
+        storeWriteDone = await patchReviewStore(patches);
+        if (!storeWriteDone)
+            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+    }
+    if (!storeWriteDone)
+        writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,
@@ -3468,8 +3645,8 @@ async function autopilotLoaded() {
 // fires every minute, claims ONE job, runs the pipeline's own prompt as its
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
-const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 240s -> 900s (see QUEUE_WORKER_POLL_SECONDS); version bump forces the prompt refresh that carries the new --wait-seconds onto existing installs. v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v10 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
 // sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
 // within one continuous worker session) instead of drafting inline. Validated
 // via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
@@ -3478,19 +3655,26 @@ const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_jo
 // notification) or the host kills the whole parent+child chain in 1-3 min.
 // Never live-fire tested against a real production job. Full design, what's
 // validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
-// Bump this constant to 9 only once that plan is actually implemented.
+// Bump this constant to 10 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
-// 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
-// live on 2026-07-06, and covers a meaningful chunk of the ~8min average
-// real job inter-arrival gap measured on the box, while still keeping each
-// worker session bounded. The cron's `* * * * *` cadence remains the outer
-// safety net for whatever the poll window doesn't catch.
+// 900s (15 min, per Matthew 2026-07-17, up from 240s): sits AT the single-
+// Bash-call survival ceiling verified live on 2026-07-06 (the host's ~90s
+// inactivity kill fires only on model silence, and one in-flight tool call
+// survived a full 900s probe). This covers the ~8min average real job
+// inter-arrival gap outright, so most jobs are claimed by an already-polling
+// session instead of paying a fresh spin-up, and MCP boot side effects
+// (backfill checks, backlog drains) run 1/15min instead of 1/5min. Watch
+// point: 900s has zero margin below the verified ceiling — if workers start
+// dying mid-poll with no reaper kill recorded, the host clipped the call;
+// back off to 600s. The cron's `* * * * *` cadence remains the outer safety
+// net for whatever the poll window doesn't catch.
 // COUPLING: scripts/reap_stale_claude_sessions.py's S4L_REAPER_CLAIM_GRACE_SEC
 // default MUST stay >= this value + margin — a claimless session inside this
 // poll window is legitimately still working, not a husk, and a too-tight
 // claim_grace would SIGTERM it mid-poll before it ever gets to claim.
-const QUEUE_WORKER_POLL_SECONDS = 240;
+// (Bumped to 1020s alongside this change.)
+const QUEUE_WORKER_POLL_SECONDS = 900;
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -5684,30 +5868,18 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// Post any cards the user APPROVED that never landed — e.g. a restart killed the
-// batch mid-way. "Proceed to post the already-approved items." postApproved is
-// idempotent (it filters posted/terminal), so this only drains the genuine
-// backlog and never double-posts. Best-effort; never throws.
-async function drainApprovedBacklog() {
-    try {
-        const plan = readPlan(REVIEW_QUEUE_ID);
-        const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true &&
-            c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)));
-        if (!backlog.length)
-            return;
-        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
-        await postApproved(REVIEW_QUEUE_ID, plan);
-    }
-    catch (e) {
-        console.error("[post] drainApprovedBacklog error:", e?.message || e);
-        // Same reasoning as the other postApproved call site: don't let an
-        // escaped exception leave the cross-instance posting flag stuck true.
-        postingActive = false;
-        stopPostingFlagHeartbeat();
-    }
-}
+// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
+// which was sane when boots meant "user launched Claude Desktop" — but each
+// queue-worker session boots its own MCP server, so the drain had silently
+// become a ~5-minute cron running across up to 4 concurrent MCP instances.
+// Combined with universal posting preemption, every drain wakeup SIGKILLed
+// whatever held the twitter-browser lock (profile scans included), and any
+// stamp bug turned into an infinite retry loop (438 retries over 5 days on
+// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
+// the menubar's _resume_approved_queue, which runs on loopback-reachable and
+// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
+// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
+// it and its resume covers the backlog.
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -5883,13 +6055,9 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
-    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
-    {
-        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
-        if (typeof t.unref === "function")
-            t.unref();
-    }
+    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
+    // here is gone — backlog recovery is owned by the menubar's periodic
+    // _resume_approved_queue (single drainer; see the removal note above).
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.

package/mcp/dist/telemetry.js

@@ -301,7 +301,8 @@ function collectStateSnapshot() {
         ["install_progress", "install-progress.json", 64_000],
         ["onboarding_progress", "onboarding-progress.json", 256_000],
         ["review_queue", "review-queue.json", 256_000],
-        ["approved_queue", "approved-queue.json", 256_000],
+        // approved-queue.json removed 2026-07-17: the ledger is gone; the review
+        // store is the only local decision record.
     ];
     for (const [key, file, cap] of stateFiles) {
         const val = readJsonCapped(path.join(stateDir, file), cap);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.5",
-  "installedAt": "2026-07-17T00:02:11.441Z"
+  "version": "1.7.6-rc.10",
+  "installedAt": "2026-07-17T18:19:18.200Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.5",
+  "version": "1.7.6-rc.10",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_card.py

@@ -801,6 +801,31 @@ def _label(frame, text, *, size=12, bold=False, muted=False, truncates=False):
     return f
 
 
+class _TileScroll(NSScrollView):
+    """Scroll box that yields the wheel to an enclosing canvas grid. Inside
+    the canvas (s4l_card_canvas.py) most of a tile's area is one of these
+    boxes, and AppKit routes the whole wheel gesture (momentum included) to
+    the innermost scroll view under the pointer -- so the canvas simply
+    would not scroll whenever the pointer sat over a thread quote or draft
+    editor (2026-07-16 user report). Forward the event to the outer scroll
+    view instead, UNLESS this box's own text view holds the caret (the
+    reviewer clicked into it, so inner scrolling is what they want). In the
+    corner card there is no enclosing scroll view and behavior is unchanged."""
+
+    def scrollWheel_(self, event):
+        try:
+            outer = self.enclosingScrollView()
+            if outer is not None:
+                win = self.window()
+                fr = win.firstResponder() if win is not None else None
+                if fr is None or fr is not self.documentView():
+                    outer.scrollWheel_(event)
+                    return
+        except Exception:
+            pass
+        objc.super(_TileScroll, self).scrollWheel_(event)
+
+
 def _editable_scroll(frame, text=""):
     """Rounded-rect scrollable text editor (hairline border, solid text
     background over the frosted panel; falls back to the old square bezel when
@@ -809,7 +834,7 @@ def _editable_scroll(frame, text=""):
     outer frame the text runs underneath the scroller. The scroller itself
     auto-hides so it only appears when the text overflows.
     Returns (scroll, textview)."""
-    scroll = NSScrollView.alloc().initWithFrame_(frame)
+    scroll = _TileScroll.alloc().initWithFrame_(frame)
     scroll.setHasVerticalScroller_(True)
     scroll.setAutohidesScrollers_(True)
     if _round_rect(scroll):
@@ -902,6 +927,7 @@ class _ReviewController(NSObject):
         self._eye_btn = None
         self._details_btn = None
         self._stats_popover = None
+        self._pending_hover_kind = None
         self._age_expiry_label = None
         self._age_expiry_timer = None
         # Per-card telemetry, reset when a NEW card renders (not on the
@@ -1378,6 +1404,7 @@ class _ReviewController(NSObject):
             _label(NSMakeRect(M, H - 70, 78, 18), "Replying to", size=12, bold=True, muted=True)
         )
         right_x = W - M
+        self._cancel_pending_hover()
         self._close_stats_popover()
         self._stop_age_expiry_timer()
         self._eye_btn = None
@@ -1511,7 +1538,7 @@ class _ReviewController(NSObject):
         # direction); the box scrolls instead of shrinking the text to fit,
         # and the link sits at the START so it's always visible regardless
         # of scroll position or thread length.
-        thread_scroll = NSScrollView.alloc().initWithFrame_(
+        thread_scroll = _TileScroll.alloc().initWithFrame_(
             NSMakeRect(M, H - 150, W - 2 * M, 74)
         )
         thread_scroll.setHasVerticalScroller_(True)
@@ -1847,10 +1874,12 @@ class _ReviewController(NSObject):
         pop.setBehavior_(NSPopoverBehaviorApplicationDefined)
         pop.setContentViewController_(vc)
         pop.setContentSize_((pw, ph))
-        try:
-            NSApp.activateIgnoringOtherApps_(True)
-        except Exception:
-            pass
+        # No activateIgnoringOtherApps_ here (removed 2026-07-16): with
+        # ApplicationDefined behavior the popover shows fine from an inactive
+        # accessory app, and yanking app activation on a HOVER (these popovers
+        # open from mouseEntered_) stole focus from whatever the user was
+        # doing -- worst on the canvas, where scrolling sweeps anchors under
+        # the pointer.
         # Anchor to the eye's frame in the (non-flipped) content view, where
         # NSRectEdge 1 = NSMinYEdge is unambiguously the BOTTOM edge, so the
         # popover reliably opens below the icon. Anchoring to the button's own
@@ -1948,13 +1977,18 @@ class _ReviewController(NSObject):
         if kind == "draft":
             self._draft_hover_open[slot] = time.time()
             return
-        _log(f"{kind} eye hover enter" if kind != "expiry" else "expiry label hover enter")
-        if kind == "details":
-            self._show_details_popover()
-        elif kind == "expiry":
-            self._show_expiry_popover()
-        else:
-            self._show_stats_popover()
+        # Dwell-gated (2026-07-16 canvas scroll-perf fix): scrolling the
+        # canvas sweeps these tracking areas under a stationary pointer,
+        # and opening a popover synchronously per enter event (text
+        # measurement + NSPopover build) hitched the scroll. A short
+        # delayed perform only fires if the pointer actually STAYS on the
+        # anchor; enter/exit pairs from content moving underneath cancel
+        # out. Bonus: the delayed perform is queued in the default run-loop
+        # mode, which does not run during a wheel gesture (event-tracking
+        # mode), so a popover can never open mid-scroll at all.
+        self._cancel_pending_hover()
+        self._pending_hover_kind = kind
+        self.performSelector_withObject_afterDelay_("showHoverPopover:", kind, 0.2)
 
     def mouseExited_(self, event):
         kind, slot = self._hover_info(event)
@@ -1965,9 +1999,41 @@ class _ReviewController(NSObject):
                     (time.time() - started) * 1000
                 )
             return
-        _log("eye hover exit")
+        self._cancel_pending_hover()
         self._close_stats_popover()
 
+    @objc.python_method
+    def _cancel_pending_hover(self):
+        pending = getattr(self, "_pending_hover_kind", None)
+        if pending is not None:
+            try:
+                NSObject.cancelPreviousPerformRequestsWithTarget_selector_object_(
+                    self, "showHoverPopover:", pending
+                )
+            except Exception:
+                pass
+            self._pending_hover_kind = None
+
+    def showHoverPopover_(self, kind):
+        """Delayed-perform target for a dwelled hover (see mouseEntered_)."""
+        self._pending_hover_kind = None
+        kind = str(kind)
+        try:
+            _log(
+                f"{kind} eye hover enter" if kind != "expiry" else "expiry label hover enter"
+            )
+            if kind == "details":
+                self._show_details_popover()
+            elif kind == "expiry":
+                self._show_expiry_popover()
+            else:
+                self._show_stats_popover()
+        except Exception:
+            # The card may have re-rendered (anchor replaced) between the
+            # hover and the dwell firing; a popover that can't anchor is
+            # simply skipped.
+            pass
+
     @objc.python_method
     def _flush_draft_hovers(self):
         """Bank any hover still in progress (pointer inside a draft box at
@@ -2481,6 +2547,7 @@ class _ReviewController(NSObject):
     @objc.python_method
     def _finish(self):
         global _active
+        self._cancel_pending_hover()
         self._close_stats_popover()
         self._stop_age_expiry_timer()
         if self._host_view is not None: