@m13v/s4l 1.7.6-rc.2 → 1.7.6-rc.21

package/mcp/menubar/s4l_menubar.py

@@ -519,9 +519,11 @@ class S4LMenuBar(rumps.App):
         # Which review-surface module ("cards" | "canvas") is driving the
         # CURRENTLY open panel/window, None when nothing is open. Set at
         # presentation time from st.read_review_layout(); kept fixed for the
-        # life of that surface so switching the "View" submenu (Cards/Canvas)
-        # mid-session never talks to the wrong module for an already-open
-        # panel. See _review_mod().
+        # life of that surface so no call ever talks to the wrong module for
+        # an already-open panel. A "View Mode" (Cards/Canvas) switch while a
+        # surface is open dismisses it through this pin, then releases the
+        # pin and re-presents through the new module. See _review_mod() and
+        # _on_review_layout_preset().
         self._review_mod_name = None
         # Review snooze: epoch until which draft cards must not auto-present
         # (0 = not snoozed). Loaded from disk so a menubar restart mid-snooze
@@ -577,6 +579,12 @@ class S4LMenuBar(rumps.App):
         # a hitch every 5s tick.
         self._resumed = False
         self._loopback_check_due_at = 0.0
+        # Periodic approved-backlog drain cadence (2026-07-17): the menubar is
+        # the single drainer now that the MCP boot-time drain is gone. 10 min
+        # keeps a transiently-failed approval's retry latency reasonable while
+        # staying far below the old effective 5-min/multi-instance churn.
+        self.RESUME_PERIOD_S = 600.0
+        self._resume_due_at = 0.0
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
         # faithful reading (our launchd process identity, not a parent's). Logged
         # so menubar.err.log records whether keystroke posting will work.
@@ -1140,12 +1148,53 @@ class S4LMenuBar(rumps.App):
     def _on_review_layout_preset(self, layout, _sender=None):
         """Menu callback shim (mirrors _on_split_preset): rumps passes the
         clicked MenuItem last. Persisted (st.write_review_layout), so it
-        survives a restart; an already-open surface keeps driving through
-        whichever module it started with (_review_mod_name) -- this only
-        changes what the NEXT presentation uses. See _review_mod()."""
+        survives a restart. If a review surface is on screen when the mode
+        flips, swap it live: close the old surface WITHOUT firing its
+        callbacks (decisions already made were shipped per-card; the
+        undecided remainder must not be treated as a snoozed early-close)
+        and immediately re-present the same pending set through the new
+        module (2026-07-16, replacing the old next-presentation-only
+        behavior)."""
         if st.read_review_layout() == layout:
             return
         st.write_review_layout(layout)
+        if self._panel_open:
+            try:
+                # _review_mod() is still pinned to the module that owns the
+                # open surface (the pin releases below), so this dismisses
+                # the OLD surface, not the freshly-persisted preference.
+                _, mod = self._review_mod()
+
+                mod.dismiss_active()
+            except Exception as e:
+                sys.stderr.write(f"[s4l-menubar] view mode swap dismiss failed: {e}\n")
+                sys.stderr.flush()
+            with self._review_lock:
+                self._panel_open = False
+                self._review_mod_name = None
+                if self._posts_outstanding <= 0:
+                    self._review_active = False
+                    self._reset_posting_progress_locked()
+        # Changing the View Mode is a deliberate ask to see the pending drafts in
+        # the newly chosen surface, whether or not a panel was open at the time.
+        # When one was open we just dismissed it above; when none was (the user
+        # had closed/snoozed the stack, THEN switched mode) the old behavior left
+        # nothing on screen and the new surface never appeared until a separate
+        # "Review N pending drafts" click -- the 2026-07-17 Nhat report where a
+        # flip to Canvas seemed to do nothing. Present in the new surface either
+        # way, same posture as that menu click: focus=True clears the snooze and
+        # bypasses the reveal-cadence hold. Drop the dedup signature first so the
+        # same pending set presents fresh on the new surface. With no pending
+        # drafts _maybe_start_review no-ops, so setting the mode ahead of time
+        # still doesn't pop anything; if posting is draining it defers and the
+        # backlog presents on the new surface once the drain completes.
+        self._last_review_sig = None
+        try:
+            self._set_snooze(0.0)
+            self._maybe_start_review(focus=True)
+        except Exception as e:
+            sys.stderr.write(f"[s4l-menubar] view mode present failed: {e}\n")
+            sys.stderr.flush()
         self._sig = None
         try:
             self._tick(None)
@@ -1173,7 +1222,9 @@ class S4LMenuBar(rumps.App):
     # as drafts are ready). Manual mode.json edits can set any value; the
     # checkmark then lands on an exact match or none, same as the lane split.
     REVEAL_CADENCE_PRESETS = (
-        (0, "Immediately"),
+        # "Immediately" alone read as "clicking this pops cards right now";
+        # it only sets the pacing for when the NEXT draft lands (2026-07-16).
+        (0, "Immediately when a new draft is ready"),
         (1800, "Every 30 minutes"),
         (3600, "Every hour"),
         (14400, "Every 4 hours"),
@@ -1202,7 +1253,7 @@ class S4LMenuBar(rumps.App):
             if round(secs) == preset:
                 return label
         m = round(secs / 60)
-        return f"Every {m} min" if m else "Immediately"
+        return f"Every {m} min" if m else "Immediately when a new draft is ready"
 
     def _on_cadence_preset(self, secs, _sender=None):
         """Menu callback shim: rumps passes the clicked MenuItem last."""
@@ -2258,16 +2309,14 @@ class S4LMenuBar(rumps.App):
         never confirmed posted (the in-memory _post_q died with the old process).
         Skip any the plan already shows as posted, so a card that landed on X just
         before the kill — but whose status update was lost — isn't posted twice."""
-        # Store lane (canonical): approved-but-unposted rows in the review store.
-        # Legacy lane: pre-store approved-queue.json entries (read-only now; the
-        # ledger is no longer written). Union, store first, dedup by (batch, n).
+        # Store lane ONLY (2026-07-17): approved-but-unposted rows in the review
+        # store, the single source of truth. The legacy approved-queue.json lane
+        # (a read-only third truth source that the ledger stopped writing long
+        # ago) was removed — its entries could never settle, so it re-enqueued
+        # the same dead approvals on every resume forever. If a genuinely
+        # pre-store approval ever resurfaces, it is visible in the store lane
+        # or it is gone; do not re-add the union.
         pending = list(st.store_pending_posts())
-        seen = {(it.get("batch"), it.get("n")) for it in pending}
-        legacy = [
-            it for it in st.approved_queue_pending()
-            if (it.get("batch"), it.get("n")) not in seen
-        ]
-        pending.extend(legacy)
         if not pending:
             return
         posted_ns = set()
@@ -2284,7 +2333,6 @@ class S4LMenuBar(rumps.App):
         for it in pending:
             batch, n = it.get("batch"), it.get("n")
             if n in posted_ns:
-                st.approved_queue_set_status(batch, n, "posted")  # reconcile lost update
                 continue
             decision = {
                 "n": n,
@@ -2419,8 +2467,19 @@ class S4LMenuBar(rumps.App):
         if now >= self._loopback_check_due_at:
             self._loopback_check_due_at = now + 60.0
             if st.loopback_reachable():
-                if not self._resumed:
+                # Periodic backlog drain (2026-07-17): the menubar is now the
+                # SINGLE owner of approved-backlog recovery. The MCP server's
+                # boot-time drainApprovedBacklog was removed (each queue-worker
+                # session boots an MCP, so "boot-time" had become a 5-minute
+                # cron across concurrent instances). Here it runs on the one
+                # long-lived process instead: on loopback recovery and every
+                # RESUME_PERIOD_S thereafter, but only while nothing is
+                # in-flight (avoids enqueueing a card twice while an earlier
+                # drain still holds it in _post_q). _resume_approved_queue is
+                # idempotent against the store (skips posted/terminal rows).
+                if (not self._resumed or now >= self._resume_due_at) and self._posts_outstanding == 0:
                     self._resumed = True
+                    self._resume_due_at = now + self.RESUME_PERIOD_S
                     try:
                         self._resume_approved_queue()
                     except Exception as e:
@@ -2755,6 +2814,9 @@ class S4LMenuBar(rumps.App):
             # around HH:MM" line in _state_c).
             round(st.read_reveal_cadence()),
             int(self._reveal_hold_until(pending_count)),
+            # View mode: rebuilds when the review layout changes (checkmark
+            # in the "View Mode" submenu + whether the cadence item shows).
+            st.read_review_layout(),
         )
         if sig != self._sig:
             self._sig = sig
@@ -2878,6 +2940,14 @@ class S4LMenuBar(rumps.App):
         flight, and not snoozed (the snooze label and gate take precedence)."""
         if pending_count <= 0 or self._review_active:
             return 0.0
+        # Canvas never auto-pops (2026-07-17, user direction): the explicit
+        # "Review N pending drafts" click is the ONLY way to open it. Report
+        # the same indefinite hold as the cards-mode "Never" preset so the
+        # menu shows the courtesy line. The reveal cadence itself remains a
+        # cards-mode concept (its menu control is hidden in canvas mode,
+        # 2026-07-16), so a stale cadence value is never consulted here.
+        if st.read_review_layout() != "cards":
+            return -1.0
         now = time.time()
         if now < self._review_snooze_until:
             return 0.0
@@ -2890,8 +2960,9 @@ class S4LMenuBar(rumps.App):
     def _review_mod(self):
         """Which review-surface module drives the review-drafts flow: the
         module that owns the currently open panel/window when one is open
-        (so a mid-session switch of the "View" submenu never talks to
-        the wrong surface for an already-open one), else the persisted
+        (so nothing ever talks to the wrong surface for an already-open
+        one; a "View Mode" switch swaps the open surface itself, see
+        _on_review_layout_preset), else the persisted
         st.read_review_layout() preference for a FRESH presentation. Both
         modules expose the exact same present_review*/extend_active/
         prune_active/active_status/heal_active/focus_active/dismiss_active
@@ -2997,7 +3068,20 @@ class S4LMenuBar(rumps.App):
         # card keeps growing live) and skipped for focus=True (the menu's
         # "Review N pending drafts" is an explicit ask). _last_review_sig is NOT
         # stamped on a hold, so the same set still presents fresh when due.
+        # No panel is open past the _review_active branch above, so the
+        # preference IS the layout that is about to present.
         if not focus:
+            if st.read_review_layout() != "cards":
+                # Canvas never auto-pops (2026-07-17, user direction): the
+                # explicit "Review N pending drafts" click (focus=True) is the
+                # ONLY way to open the canvas. The extend-open branch above
+                # still grows an already-open canvas live; _last_review_sig is
+                # NOT stamped here, so the whole backlog presents fresh on the
+                # click.
+                return
+            # Cards mode: pace fresh pop-ups by the reveal cadence. The
+            # cadence control is a cards-only concept (hidden while View Mode
+            # is Canvas, 2026-07-16), so it is never consulted for canvas.
             cadence = st.read_reveal_cadence()
             if cadence < 0:
                 # "Never" preset: cards never auto-pop, only an explicit
@@ -3286,8 +3370,7 @@ class S4LMenuBar(rumps.App):
         with self._review_lock:
             self._panel_open = False
             # The surface is confirmed gone: release the pin so the NEXT
-            # presentation re-resolves from st.read_review_layout() (picks up
-            # a "View" submenu switch made while this one was open).
+            # presentation re-resolves from st.read_review_layout().
             self._review_mod_name = None
             if self._posts_outstanding <= 0:
                 self._review_active = False
@@ -3510,7 +3593,6 @@ class S4LMenuBar(rumps.App):
                 # No "Posting draft N…" banner: the menu-bar spinner already shows
                 # live posting progress, so a Notification Center toast per approved
                 # card is pure noise. Only failures (below) raise a notification.
-                st.approved_queue_set_status(batch, n, "posting")
                 with self._review_lock:
                     activity_label = self._posting_activity_label_locked()
                 cl = [n] if decision.get("drop_link") else None
@@ -3542,32 +3624,25 @@ class S4LMenuBar(rumps.App):
                     # one registered). Unlike a real posting failure, nothing
                     # was ever attempted here — post_drafts never reached a
                     # server — so there's no double-post risk in retrying.
-                    # Deliberately do NOT call store_mark_post_failed / set
-                    # status "failed": both would exclude this card from
-                    # store_pending_posts()/approved_queue_pending(), which is
+                    # Deliberately do NOT call store_mark_post_failed: it would
+                    # exclude this card from store_pending_posts(), which is
                     # exactly what _resume_approved_queue() reads on the next
-                    # unreachable->reachable edge. Leaving it "queued" lets
-                    # that existing restart-recovery path retry it
-                    # automatically once a server re-registers, instead of
-                    # stranding it for manual dashboard retry.
-                    st.approved_queue_set_status(batch, n, "queued", error="loopback_unreachable")
+                    # unreachable->reachable edge. Leaving the store row
+                    # approved-unposted lets that existing restart-recovery
+                    # path retry it automatically once a server re-registers,
+                    # instead of stranding it for manual dashboard retry.
                     self._notify(
                         "S4L", "Server unreachable — will retry automatically once Claude Desktop reconnects."
                     )
                 else:
                     posted = res.get("posted") if isinstance(res, dict) else None
                     if posted == 0:
-                        st.approved_queue_set_status(batch, n, "failed", error="posted_0")
                         st.store_mark_post_failed(batch, n, decision.get("candidate_id"), "posted_0")
                         self._notify("S4L", f"Draft {n} didn't post — see the dashboard for why.")
-                    else:
-                        # Success is silent: the spinner + dashboard already reflect
-                        # it. No per-card "Posted draft N." banner. The server
-                        # stamps posted/our_url into the store itself; the legacy
-                        # set_status only settles pre-store ledger entries.
-                        st.approved_queue_set_status(batch, n, "posted")
+                    # Success is silent: the spinner + dashboard already reflect
+                    # it. No per-card "Posted draft N." banner. The server
+                    # stamps posted/our_url into the store itself.
             except Exception as e:
-                st.approved_queue_set_status(batch, n, "failed", error=str(e)[:200])
                 st.store_mark_post_failed(batch, n, decision.get("candidate_id"), str(e)[:200])
                 sys.stderr.write(f"[s4l-menubar] post draft {n} failed: {e}\n")
                 sys.stderr.flush()
@@ -3634,20 +3709,79 @@ class S4LMenuBar(rumps.App):
             pass
 
     def _render_title(self, setup_complete, ob, blocker, attention=False, pending_count=0):
-        if blocker or attention:
-            base = "S4L ⚠"  # warning (setup blocked OR autopilot needs attention)
-        elif not setup_complete and ob and not ob.get("complete"):
+        # Base label: onboarding progress ("S4L 2/5") while setup is still
+        # running, plain "S4L" once complete.
+        if not setup_complete and ob and not ob.get("complete"):
             done = sum(1 for m in ob["milestones"] if m.get("status") == "complete")
             base = f"S4L {done}/{len(ob['milestones'])}"
-        elif self._update_available:
-            base = "S4L ⬆"  # update available — open the menu to update
         else:
             base = "S4L"
+        # Status markers are INDEPENDENT — each appends its own glyph when active
+        # so a warning and an available update (and anything added later) surface
+        # at the same time (user request 2026-07-17). They used to be mutually
+        # exclusive if/elif branches, where a warning hid a pending update and an
+        # update hid the onboarding count. Order is fixed (warning before update)
+        # so the bar doesn't reshuffle its glyphs as states toggle.
+        if blocker or attention:
+            base += " ⚠"  # warning (setup blocked OR autopilot needs attention)
+        if self._update_available:
+            base += " ⬆"  # update available — open the menu to update
         # Concise inline backlog count, right on the bar (not just the dropdown's
         # "Review N pending drafts") — per user request 2026-07-15, most useful
         # when the reveal cadence is "Never" and this count is the only signal
         # that drafts are waiting.
+        # Setting self.title first lays down the PLAIN title (rumps clears any
+        # prior attributed title via setTitle_), so a backlog that drops back
+        # under the threshold automatically loses its highlight without extra
+        # bookkeeping. _highlight_title_count then re-decorates just the number
+        # when the backlog is large enough to warrant a colored pill.
         self.title = f"{base} · {pending_count}" if pending_count > 0 else base
+        if pending_count > 5:
+            self._highlight_title_count(base, pending_count)
+
+    def _highlight_title_count(self, base, pending_count):
+        """Draw a colored background pill behind the pending-draft NUMBER in the
+        menu-bar title once the backlog gets large: yellow for >5 (6-10), red
+        for >10 (11+). Per user request 2026-07-17 — a plain count is easy to
+        miss, a colored one pulls the eye when drafts are piling up. Applied as
+        an NSAttributedString on the status item's button; on any failure we
+        leave the plain title (already set by the caller) untouched."""
+        try:
+            from AppKit import (
+                NSColor,
+                NSMutableAttributedString,
+                NSForegroundColorAttributeName,
+                NSBackgroundColorAttributeName,
+            )
+            from Foundation import NSMakeRange
+
+            item = getattr(self._nsapp, "nsstatusitem", None)
+            if item is None:
+                return
+            button = item.button() if hasattr(item, "button") else None
+            if button is None:
+                return
+
+            if pending_count > 10:
+                bg = NSColor.systemRedColor()
+                fg = NSColor.whiteColor()
+            else:
+                bg = NSColor.systemYellowColor()
+                fg = NSColor.blackColor()
+
+            num = str(pending_count)
+            # Pad the number with hair spaces so the colored pill has a little
+            # breathing room around the digits instead of hugging them tight.
+            pill = f" {num} "
+            full = f"{base} · {pill}"
+            attr = NSMutableAttributedString.alloc().initWithString_(full)
+            start = full.rfind(pill)
+            rng = NSMakeRange(start, len(pill))
+            attr.addAttribute_value_range_(NSBackgroundColorAttributeName, bg, rng)
+            attr.addAttribute_value_range_(NSForegroundColorAttributeName, fg, rng)
+            button.setAttributedTitle_(attr)
+        except Exception:
+            pass
 
     # ---- menu construction ------------------------------------------------
     def _build_menu(self, runtime_ready, setup_complete, ob, blocker, snap, attention=False, schedule_state="ok", pending_count=0):
@@ -3811,21 +3945,37 @@ class S4LMenuBar(rumps.App):
                 split_menu.add(it)
             items.append(split_menu)
 
+        # View mode: which review surface presents drafts — the one-at-a-time
+        # corner card or the large centered multi-select canvas. ALWAYS
+        # visible (2026-07-16, moved out of _state_c where it only appeared
+        # with pending drafts) so the preference can be set ahead of time;
+        # flipping it while a surface is open swaps that surface live (see
+        # _on_review_layout_preset).
+        layout_now = st.read_review_layout()
+        view_menu = rumps.MenuItem("View Mode")
+        for key, label in (("cards", "Cards"), ("canvas", "Canvas")):
+            it = rumps.MenuItem(label, callback=functools.partial(self._on_review_layout_preset, key))
+            it.state = 1 if layout_now == key else 0
+            view_menu.add(it)
+        items.append(view_menu)
+
         # Reveal cadence: how often fresh draft cards may pop (the drafting
-        # pipeline is unchanged; this only paces the pop-up). Always offered:
-        # it is the "don't interrupt me every few minutes" control.
-        cadence = st.read_reveal_cadence()
-        cadence_menu = rumps.MenuItem(
-            f"Show draft cards: {self._cadence_label(cadence).lower()}"
-        )
-        for preset, label in self.REVEAL_CADENCE_PRESETS:
-            it = rumps.MenuItem(
-                label,
-                callback=functools.partial(self._on_cadence_preset, preset),
+        # pipeline is unchanged; this only paces the pop-up). Cards mode only
+        # (2026-07-16): the pacing control is about the corner card
+        # interrupting, so it is hidden while View Mode is Canvas.
+        if layout_now == "cards":
+            cadence = st.read_reveal_cadence()
+            cadence_menu = rumps.MenuItem(
+                f"Show draft cards: {self._cadence_label(cadence).lower()}"
             )
-            it.state = 1 if round(cadence) == preset else 0
-            cadence_menu.add(it)
-        items.append(cadence_menu)
+            for preset, label in self.REVEAL_CADENCE_PRESETS:
+                it = rumps.MenuItem(
+                    label,
+                    callback=functools.partial(self._on_cadence_preset, preset),
+                )
+                it.state = 1 if round(cadence) == preset else 0
+                cadence_menu.add(it)
+            items.append(cadence_menu)
 
         # Posting volume: server-side per-install throttle (virality bar).
         # read_posting_mode() is cached and non-blocking; unknown/unset shows
@@ -3973,20 +4123,8 @@ class S4LMenuBar(rumps.App):
                 callback=self._review_now,
             )
         ]
-        # Which review surface "Review N pending drafts" opens: the one-at-a-
-        # time corner card, or the large centered multi-select canvas
-        # (2026-07-15). A submenu of checkmarked options (same pattern as
-        # "Lane split" above), not a standalone on/off checkbox, and grouped
-        # with the review action itself rather than the always-visible
-        # engagement-lane toggles, since it only matters while there's
-        # something to review.
-        view_menu = rumps.MenuItem("View")
-        layout_now = st.read_review_layout()
-        for key, label in (("cards", "Cards"), ("canvas", "Canvas")):
-            it = rumps.MenuItem(label, callback=functools.partial(self._on_review_layout_preset, key))
-            it.state = 1 if layout_now == key else 0
-            view_menu.add(it)
-        items.append(view_menu)
+        # The review-surface picker ("View Mode") lives in _build_menu now
+        # (2026-07-16): always visible, not just while something is pending.
         if time.time() < self._review_snooze_until:
             items.append(
                 self._label(
@@ -4003,7 +4141,12 @@ class S4LMenuBar(rumps.App):
             # now regardless.
             hold_until = self._reveal_hold_until(pending_count)
             if hold_until < 0:
-                items.append(self._label("Cards hidden — see count in the menu bar"))
+                if st.read_review_layout() == "cards":
+                    items.append(self._label("Cards hidden — see count in the menu bar"))
+                else:
+                    # Canvas mode: it never auto-opens; the review item above
+                    # is the one way in.
+                    items.append(self._label("Canvas opens from the review item above"))
             elif hold_until:
                 items.append(
                     self._label(