@m13v/s4l 1.7.6-rc.3 → 1.7.6-rc.30

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -760,7 +760,9 @@ function renderDraftsTable(plan) {
         // Number by FULL-array index (matches post_drafts + the menu bar), then drop
         // already-finished entries so the cards only show what's still pending.
         .map((c, i) => ({ c, n: i + 1 }))
-        .filter((e) => e.c.posted !== true && e.c.terminal !== true && e.c.approved !== true)
+        // awaiting_review is the ONLY state the review surfaces present (same rule
+        // as the menubar cards and the review-request.json count).
+        .filter((e) => candidateState(e.c) === "awaiting_review")
         // The queue is append-only; newest drafts have the highest stable index.
         // Show those first so review starts with likely-live tweets instead of stale
         // low-number drafts that have been sitting around for hours.
@@ -846,40 +848,28 @@ function parsePostCandidateResults(stdout) {
     }
     return [...byId.values()];
 }
-// Resolve the configured posting handle the SAME way account_resolver.py does:
-// AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
-// Returns the bare handle (no @) or null. The post preflight uses it so a missing
-// handle fails ONCE, loudly, instead of as N silent per-reply no_account_configured
-// skips (twitter_browser.py refuses to post with no handle — no impersonation).
-function readConfiguredTwitterHandle() {
+// Resolve the posting @handle through the ONE resolver (scripts/account_resolver.py:
+// env AUTOPOSTER_TWITTER_HANDLE -> config.json accounts.twitter.handle -> the durable
+// connect-time cookie mirror). Deferring to it, instead of re-reading config.json here,
+// keeps a single resolution path shared with the poster (twitter_browser.our_handle),
+// and keeps the handle in a single durable home (the cookie mirror) rather than a
+// second copy in config.json. Returns the bare handle (no @) or null; the preflight
+// refuses loudly on null so a missing handle fails ONCE, not as N silent per-reply
+// no_account_configured skips (and never as a hardcoded impersonation fallback).
+async function resolvePostingHandle() {
     const env = (process.env.AUTOPOSTER_TWITTER_HANDLE || "").trim().replace(/^@/, "");
     if (env)
         return env;
     try {
-        const cfg = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
-        const h = cfg?.accounts?.twitter?.handle;
-        const s = (typeof h === "string" ? h : "").trim().replace(/^@/, "");
-        return s || null;
-    }
-    catch {
-        return null;
-    }
-}
-// Self-heal a missing handle: read the live logged-in @handle from the managed
-// Chrome and persist it to config.json accounts.twitter.handle. This is ground
-// truth (the poster posts through that exact session), NOT a guess — so it's safe
-// where a hardcoded fallback would not be. Closes the onboarding gap where
-// connect_x's best-effort handle capture silently no-op'd and left posting dead.
-// Best-effort; never throws — the caller re-checks and refuses loudly if still unset.
-async function ensurePostingHandle() {
-    try {
-        await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
-            timeoutMs: 60_000,
+        const r = await runPython("scripts/account_resolver.py", ["twitter"], {
+            timeoutMs: 30_000,
             env: ({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
         });
+        const h = (r.stdout || "").trim().replace(/^@/, "");
+        return h || null;
     }
     catch {
-        /* best effort */
+        return null;
     }
 }
 async function ensureTwitterBrowserForPost() {
@@ -909,12 +899,68 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
+// Give-up bound for approved cards whose post attempts keep failing
+// transiently (browser lock contention, timeouts). 5 attempts spans several
+// drain cycles — plenty for genuine transients to clear — while guaranteeing
+// no card can retry forever (2026-07-17 zombie-card incident).
+const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
         c.discard_reason === "backend_status_expired");
 }
-function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+// Prompt-sandbox replay cards (run-twitter-cycle.sh S4L_SANDBOX_CANDIDATES_FILE)
+// carry experiments.sandbox=true; older sandbox rows predate that stamp but all
+// use the synthetic >=900,000,000 id range twitter_prompt_sandbox.py assigns.
+function isSandboxCandidate(c) {
+    const exps = c.experiments;
+    if (exps && typeof exps === "object" && exps.sandbox)
+        return true;
+    const id = Number(c.candidate_id);
+    return Number.isFinite(id) && id >= 900_000_000;
+}
+function candidateState(c) {
+    if (c.posted === true)
+        return "posted";
+    if (c.terminal === true)
+        return "terminal";
+    if (c.post_failed)
+        return "post_failed";
+    if (c.approved === true)
+        return "approved";
+    return "awaiting_review";
+}
+// Write field patches into the review-queue store UNDER ITS LOCK by shelling
+// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
+// _store_update and merge_review_queue.py hold around their read-modify-write.
+// Node has no native flock, and this process writing the store directly was
+// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
+// Returns false on any failure so callers can fall back to the legacy write.
+async function patchReviewStore(patches) {
+    if (!patches.length)
+        return true;
+    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
+    try {
+        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
+        const res = await runPython("scripts/store_patch.py", [tmp], {
+            timeoutMs: 30_000,
+            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -926,28 +972,106 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
+    //
+    // Review-queue store: go through the LOCKED patch path (store_patch.py)
+    // first. The fresh-read merge below closes most of the race window but not
+    // all of it — a menubar decision landing between our readPlan and writePlan
+    // still gets erased. The locked path holds the store's flock for the whole
+    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
+    // and enforces the same posted-sticky rules. Legacy path stays as the
+    // fallback and for per-batch /tmp plans (single writer, no lock needed).
+    try {
+        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
+        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
+            const patches = stamped.map((c) => {
+                const set = {};
+                const unset = [];
+                if (c.posted === true) {
+                    set.posted = true;
+                    set.terminal = false;
+                    if (c.our_url)
+                        set.our_url = c.our_url;
+                    // Clear a stale failure stamp too: the menubar's per-card call can
+                    // see posted=0 (the batch drain posted it under a different call)
+                    // and stamp post_failed on a card that IS live (seen on 565462,
+                    // 2026-07-17). posted is the settled truth; the residue just adds a
+                    // false "didn't post" signal to dashboards/notifications.
+                    unset.push("discard_reason", "post_failed", "post_error");
+                }
+                else if (c.terminal === true) {
+                    set.terminal = true;
+                    set.terminal_reason = c.terminal_reason ?? null;
+                    // See the zombie-card note in the legacy branch below: a terminal
+                    // from a real post attempt must clear the overridable expiry stamp.
+                    unset.push("discard_reason");
+                }
+                if (typeof c.post_attempts === "number")
+                    set.post_attempts = c.post_attempts;
+                return { candidate_id: c.candidate_id, set, unset };
+            });
+            if (await patchReviewStore(patches))
+                return;
+            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
+        }
+    }
+    catch {
+        /* fall through to the legacy write */
+    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
         if (fresh && Array.isArray(fresh.candidates)) {
+            // candidate_id is NOT unique in the review-queue store: sandbox reruns
+            // and re-merged drafts append sibling rows with the same id. Stamping
+            // only one sibling (the old Map single-slot) left the others matching
+            // the drain's approved && !posted && !terminal filter, so the backlog
+            // re-drained the same candidate every heartbeat forever (2026-07-17
+            // incident: 23-card loop at 60s cadence). Stamp EVERY row with the id.
             const freshById = new Map();
             fresh.candidates.forEach((c) => {
-                if (c.candidate_id !== undefined && c.candidate_id !== null)
-                    freshById.set(String(c.candidate_id), c);
+                if (c.candidate_id !== undefined && c.candidate_id !== null) {
+                    const key = String(c.candidate_id);
+                    const list = freshById.get(key);
+                    if (list)
+                        list.push(c);
+                    else
+                        freshById.set(key, [c]);
+                }
             });
             for (const c of stamped) {
-                const f = freshById.get(String(c.candidate_id));
-                if (!f)
-                    continue;
-                if (c.posted === true) {
-                    f.posted = true;
-                    f.terminal = false;
-                    if (c.our_url)
-                        f.our_url = c.our_url;
-                }
-                else if (c.terminal === true && f.posted !== true) {
-                    f.terminal = true;
-                    f.terminal_reason = c.terminal_reason;
+                for (const f of freshById.get(String(c.candidate_id)) ?? []) {
+                    if (c.posted === true) {
+                        f.posted = true;
+                        f.terminal = false;
+                        if (c.our_url)
+                            f.our_url = c.our_url;
+                        // A post outcome closes the card's history: the pre-approval
+                        // freshness stamp must not survive it. Same for a stale
+                        // post_failed from a peer call's posted=0 misattribution (see
+                        // the locked-patch branch above).
+                        delete f.discard_reason;
+                        delete f.post_failed;
+                        delete f.post_error;
+                    }
+                    else if (c.terminal === true && f.posted !== true) {
+                        f.terminal = true;
+                        f.terminal_reason = c.terminal_reason;
+                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
+                        // 5 days): a stale discard_reason="backend_status_expired" left on
+                        // the fresh copy makes expiredStampOverridable() treat THIS
+                        // post-outcome terminal as overridable, so every later drain
+                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
+                        // forever. A terminal that came from an actual post attempt is
+                        // final; delete the expiry stamp so the override can never fire
+                        // on it again. (The drain's own `delete c.discard_reason` happens
+                        // on an in-memory copy that is never the write source; this line
+                        // is the one that persists.)
+                        delete f.discard_reason;
+                    }
+                    // Carry the retry counter so the give-up bound survives across
+                    // drains (each drain reads the store fresh).
+                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
+                        f.post_attempts = c.post_attempts;
                 }
             }
             writePlan(batchId, fresh);
@@ -1041,9 +1165,29 @@ async function postApproved(batchId, plan) {
     // An approved card whose only blocker is an overridable backend-expiry stamp is
     // included: approval outranks the freshness gate (see expiredStampOverridable),
     // and the stamp is cleared so every downstream terminal check agrees it's live.
-    const approved = (plan.candidates || []).filter((c) => c.approved === true &&
-        c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)));
+    // Drain-eligible, in canonical state terms (candidateState — keep in lockstep
+    // with s4l_state.candidate_state). DELIBERATE deviations from a plain
+    // state === "approved" check, each load-bearing:
+    //   - post_failed cards DO drain again (the transient-retry path, bounded by
+    //     MAX_POST_ATTEMPTS at result time). The menubar's restart-resume path
+    //     (store_pending_posts) skips them by design; this drain is where they
+    //     get their bounded retries.
+    //   - an approved card whose ONLY terminal stamp is the freshness gate's
+    //     backend_status_expired is resurrected: the human approval outranks the
+    //     expiry (2 of 3 approvals lost on 2026-07-10 without this).
+    //   - sandbox replays never drain (twitter_post_plan.py post_one()
+    //     hard-refuses them, so draining one is pure churn and can loop forever
+    //     if its terminal stamp loses a store-write race).
+    const approved = (plan.candidates || []).filter((c) => {
+        if (isSandboxCandidate(c))
+            return false;
+        if (c.approved !== true)
+            return false;
+        const s = candidateState(c);
+        return (s === "approved" ||
+            s === "post_failed" ||
+            (s === "terminal" && expiredStampOverridable(c)));
+    });
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -1241,7 +1385,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1254,9 +1398,8 @@ async function postApproved(batchId, plan) {
     // If onboarding never persisted it, self-heal from the live session; if even that
     // can't determine it, refuse here with a clear reason rather than launching a
     // poster that silently burns the whole batch.
-    if (!readConfiguredTwitterHandle())
-        await ensurePostingHandle();
-    if (!readConfiguredTwitterHandle()) {
+    const postingHandle = await resolvePostingHandle();
+    if (!postingHandle) {
         postingActive = false;
         stopPostingFlagHeartbeat();
         return {
@@ -1264,9 +1407,9 @@ async function postApproved(batchId, plan) {
             exit_code: 0,
             posted: 0,
             summary: "no_account_configured",
-            error: "X is connected but no posting @handle is configured, so every reply would be refused " +
-                "(no_account_configured). Re-run project_config action:'connect_x' to capture the handle, " +
-                "or set accounts.twitter.handle in config.json.",
+            error: "X is connected but no posting @handle could be resolved (env, config, or the " +
+                "connect-time cookie mirror), so every reply would be refused (no_account_configured). " +
+                "Re-run project_config action:'connect_x' to re-capture the handle.",
         };
     }
     // Mark posting active so the draft-cycle scan DEFERS launching any scan for the
@@ -1482,6 +1625,21 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
+                //
+                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
+                // unbounded retry is a zombie generator (one card retried 438 times
+                // over 5 days on the Nhat install). Count the transient failures and
+                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
+                // the last failure visible so the give-up is diagnosable, and the
+                // on-disk post-events trail records it for forensics.
+                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
+                c.post_attempts = attempts;
+                if (attempts >= MAX_POST_ATTEMPTS) {
+                    c.terminal = true;
+                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
+                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
+                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
+                }
                 touchedPlan = true;
             }
         });
@@ -1496,7 +1654,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        mergeApprovedStampsIntoStore(batchId, plan, approved);
+        await mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2333,6 +2491,7 @@ tool("project_config", {
         const r = await redditConnect(args.reddit_source, args.reddit_manual_login);
         let verified = false;
         let configNote;
+        let redditKicker;
         if (r.connected) {
             completeOnboardingMilestone("reddit_connected", { state: r.state });
             // Persist the discovered username through the server's config-write
@@ -2357,11 +2516,18 @@ tool("project_config", {
                 });
             }
             // Reddit is live: install the discovery kicker (idempotent; gated on
-            // runtime + project readiness inside, and it never touches a
-            // hand-built plist pointing outside the managed package).
-            void ensureRedditKickerInstalled()
-                .then((res) => console.error(`[reddit-kicker] post-connect install: ${res.ok ? "ok" : "skip"} (${res.detail})`))
-                .catch((e) => console.error("[reddit-kicker] post-connect install failed:", e?.message || e));
+            // runtime + draftable-lane readiness inside, and it never touches a
+            // hand-built plist pointing outside the managed package). Await it and
+            // surface the result on the response so a skip (e.g. no ready project AND
+            // no active persona) is VISIBLE instead of failing silently to stderr.
+            try {
+                redditKicker = await ensureRedditKickerInstalled();
+                console.error(`[reddit-kicker] post-connect install: ${redditKicker.ok ? "ok" : "skip"} (${redditKicker.detail})`);
+            }
+            catch (e) {
+                redditKicker = { ok: false, detail: e?.message || String(e) };
+                console.error("[reddit-kicker] post-connect install failed:", e?.message || e);
+            }
         }
         else {
             blockOnboardingMilestone("reddit_connected", `reddit_${r.state || "not_connected"}`, r.error || r.note || summarizeRedditAuth(r), { state: r.state || "not_connected" });
@@ -2382,11 +2548,20 @@ tool("project_config", {
             summary: summarizeRedditAuth(r),
             note: r.note,
             attempts: r.attempts,
+            // The launchd discovery kicker's install result (or skip reason), so the
+            // agent can SEE whether reddit drafting is actually scheduled rather than
+            // assuming "connected" means "producing drafts".
+            discovery_job: redditKicker,
             onboarding: onboardingSnapshot(),
             next_step: r.connected
-                ? "Reddit is connected. The reddit discovery job installs itself once a project is " +
-                    "configured; drafts flow into the same review cards as X and nothing posts without " +
-                    "approval." +
+                ? (redditKicker?.ok
+                    ? "Reddit is connected and the discovery job is scheduled (runs every ~15 min); " +
+                        "drafts flow into the same review cards as X and nothing posts without approval."
+                    : "Reddit is connected, but the discovery job is NOT scheduled yet (" +
+                        (redditKicker?.detail || "unknown") + "). It installs automatically once a product " +
+                        "project is ready OR personal_brand mode is on with a ready persona; until then no " +
+                        "reddit drafts will appear. Drafts, once flowing, land in the same review cards as X " +
+                        "and nothing posts without approval.") +
                     (r.warning ? " Relay the `warning` field to the user so expectations are set." : "")
                 : r.state === "needs_login"
                     ? "The user must finish signing in to reddit.com in the Chrome window that opened. Tell " +
@@ -2741,6 +2916,16 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
+    // Review-queue store: snapshot every row now so the write below can be a
+    // field-level DIFF applied under the store lock (store_patch.py) instead
+    // of an unlocked whole-file replace. This function holds its in-memory
+    // plan across user think-time; a whole-file write here erased any menubar
+    // decision or merge that landed in between (the 2026-07-17 truth-loss
+    // family). Non-store batches keep the plain write: single writer.
+    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
+    const rowsBefore = isStoreBatch
+        ? candidates.map((c) => JSON.stringify(c))
+        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -2751,7 +2936,7 @@ tool("post_drafts", {
             return;
         }
         const c = candidates[n - 1];
-        if (c.posted === true) {
+        if (candidateState(c) === "posted") {
             warnings.push(`#${n} already posted; not rejecting`);
             return;
         }
@@ -2877,7 +3062,40 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    writePlan(batch_id, plan);
+    // Persist the decision mutations. Store batch: diff each row against its
+    // snapshot and apply only the changed fields under the store lock, so a
+    // concurrent menubar decision or merge is never erased. Anything else
+    // (per-batch /tmp plans): plain write, single writer.
+    let storeWriteDone = false;
+    if (isStoreBatch) {
+        const patches = [];
+        candidates.forEach((c, i) => {
+            const beforeRaw = rowsBefore[i];
+            const afterRaw = JSON.stringify(c);
+            if (beforeRaw === afterRaw)
+                return;
+            const before = JSON.parse(beforeRaw ?? "{}");
+            const after = JSON.parse(afterRaw);
+            const set = {};
+            const unset = [];
+            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
+                if (!(k in after) || after[k] === undefined) {
+                    if (k in before)
+                        unset.push(k);
+                }
+                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
+                    set[k] = after[k];
+                }
+            }
+            if (Object.keys(set).length || unset.length)
+                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
+        });
+        storeWriteDone = await patchReviewStore(patches);
+        if (!storeWriteDone)
+            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+    }
+    if (!storeWriteDone)
+        writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,
@@ -3149,6 +3367,70 @@ tool("restart_menubar", {
         menubar_running: running,
     });
 });
+// ---- scan_now: fire one scanner cycle immediately --------------------------
+// The scanner (the twitter scan+draft cycle) is what drives the whole pipeline;
+// it runs on the launchd kicker's fixed StartInterval. This nudges launchd to
+// fire it RIGHT NOW via `launchctl kickstart` — the EXACT same mechanism the
+// first-run onboarding kick uses (ensureQueueKickerInstalled): the job runs
+// THROUGH launchd with its full baked env + the run-*-singleton.sh lock, so it
+// is NOT a bare `bash run-twitter-cycle.sh` (which would leave an empty-plan
+// artifact). launchd keeps a single instance, so if a cycle is already running
+// this is a harmless no-op; while paused the kicker is unloaded, so we report
+// that rather than kick nothing.
+//
+// This is deliberately NOT the removed run_draft_cycle / draft_cycle tool: it
+// spawns no warm in-chat Claude draft session, it only asks launchd to run the
+// already-scheduled cycle one interval early. Do NOT re-introduce a draft_cycle.
+tool("scan_now", {
+    title: "Run the scanner now",
+    description: "Fire ONE scanner cycle immediately instead of waiting for the next scheduled run. The scanner " +
+        "(the twitter scan+draft cycle) is what discovers threads and kicks off drafting, so this is the " +
+        "'run now' control behind the menu bar + dashboard button. It nudges the existing launchd job to " +
+        "run one interval early; it does NOT change the schedule. If a cycle is already running it's a " +
+        "no-op, and if S4L is paused it reports that (nothing runs while paused). Use when the user asks " +
+        "to scan now, run the scanner, run now, or check for new threads immediately.",
+    inputSchema: {},
+}, async () => {
+    if (isPaused()) {
+        return jsonContent({
+            ok: false,
+            paused: true,
+            detail: "S4L is paused — resume it first, then the scanner can run.",
+        });
+    }
+    const uid = process.getuid ? process.getuid() : 0;
+    const kick = await run("launchctl", ["kickstart", `gui/${uid}/${TWITTER_AUTOPILOT_LABEL}`], { timeoutMs: 15_000 });
+    const ok = kick.code === 0;
+    return jsonContent({
+        ok,
+        detail: ok
+            ? "Scanner cycle kicked off — new drafts land in a few minutes."
+            : `Could not start the scanner (launchctl rc=${kick.code}).`,
+    });
+});
+// ---- scan_status: live pipeline status + next-scanner-run countdown --------
+// A cheap, pure READ the dashboard widget polls (~5s) to keep its scanner status
+// pill + countdown live between heavier snapshot refreshes. Returns the SAME
+// fields the menu bar renders (scripts/live_status.py — activity_state,
+// next_run_secs, …), plus `paused`, so the two surfaces can't drift. No side
+// effects: safe to poll and to replay over the loopback /tool/ endpoint.
+tool("scan_status", {
+    title: "Live scanner status + next-run countdown",
+    description: "Read-only: what the pipeline is doing right now (scanning/drafting/posting/idle) and how many " +
+        "seconds until the next scanner run. Backs the dashboard's live status pill + countdown. Pure " +
+        "read; safe to poll frequently.",
+    inputSchema: {},
+}, async () => {
+    let live = {};
+    try {
+        const res = await runPython("scripts/live_status.py", [], { timeoutMs: 10_000 });
+        live = JSON.parse((res.stdout || "").trim().split("\n").slice(-1)[0] || "{}");
+    }
+    catch {
+        live = {};
+    }
+    return jsonContent({ ...live, paused: isPaused() });
+});
 // ---- posting_volume: per-install posting-volume mode (virality bar) --------
 // Server-side throttle (2026-07-13): installations.posting_mode maps to a
 // virality-bar percentile on the API (high~0.90, medium~0.97, low~0.995) and
@@ -3468,8 +3750,8 @@ async function autopilotLoaded() {
 // fires every minute, claims ONE job, runs the pipeline's own prompt as its
 // Claude turn, writes the result back, and stops.
 // ===========================================================================
-const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
-// v9 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
+const QUEUE_WORKER_PROMPT_VERSION = 9; // v9 (2026-07-17): poll window widened 240s -> 900s (see QUEUE_WORKER_POLL_SECONDS); version bump forces the prompt refresh that carries the new --wait-seconds onto existing installs. v8: worker polls internally (claude_job.py next --wait-seconds) instead of single-shot check-then-die. Empirically verified (2026-07-06) that a single long-running Bash call survives well past the host's ~90s between-tool-call inactivity kill — that timer only fires on MODEL silence, not on one in-flight tool call — so one Bash call can safely poll for QUEUE_WORKER_POLL_SECONDS before giving up. This cuts the every-minute spin-up-empty-then-die husk cycle down to roughly one session per poll window instead of one per cron tick. v7: universal type-blind worker. ONE task claims `--type any`; per-type execution notes (e.g. the v6 incremental-draft pacing for twitter-prep) moved into claude_job.py TYPE_TO_WORKER_NOTES and ride the prompt sidecar, so the worker prompt never mentions job types. Legacy per-type tasks get this same body on refresh and become interchangeable universal workers.
+// v10 (PLANNED, NOT IMPLEMENTED): delegate the actual drafting to a fresh
 // sub-agent per claimed job (claim -> delegate -> wait -> claim next, looped
 // within one continuous worker session) instead of drafting inline. Validated
 // via throwaway probe tasks 2026-07-07/08 (10 loop iterations, ~210s of real
@@ -3478,19 +3760,26 @@ const QUEUE_WORKER_PROMPT_VERSION = 8; // v8: worker polls internally (claude_jo
 // notification) or the host kills the whole parent+child chain in 1-3 min.
 // Never live-fire tested against a real production job. Full design, what's
 // validated vs not, and the implementation steps: docs/queue-worker-delegation-plan.md
-// Bump this constant to 9 only once that plan is actually implemented.
+// Bump this constant to 10 only once that plan is actually implemented.
 const QUEUE_WORKER_PROMPT_MARKER = "s4l_queue_worker_prompt_version";
 // How long ONE `next --wait-seconds` call polls before giving up and exiting.
-// 240s (4 min): comfortably inside the 900s single-Bash-call survival verified
-// live on 2026-07-06, and covers a meaningful chunk of the ~8min average
-// real job inter-arrival gap measured on the box, while still keeping each
-// worker session bounded. The cron's `* * * * *` cadence remains the outer
-// safety net for whatever the poll window doesn't catch.
+// 900s (15 min, per Matthew 2026-07-17, up from 240s): sits AT the single-
+// Bash-call survival ceiling verified live on 2026-07-06 (the host's ~90s
+// inactivity kill fires only on model silence, and one in-flight tool call
+// survived a full 900s probe). This covers the ~8min average real job
+// inter-arrival gap outright, so most jobs are claimed by an already-polling
+// session instead of paying a fresh spin-up, and MCP boot side effects
+// (backfill checks, backlog drains) run 1/15min instead of 1/5min. Watch
+// point: 900s has zero margin below the verified ceiling — if workers start
+// dying mid-poll with no reaper kill recorded, the host clipped the call;
+// back off to 600s. The cron's `* * * * *` cadence remains the outer safety
+// net for whatever the poll window doesn't catch.
 // COUPLING: scripts/reap_stale_claude_sessions.py's S4L_REAPER_CLAIM_GRACE_SEC
 // default MUST stay >= this value + margin — a claimless session inside this
 // poll window is legitimately still working, not a husk, and a too-tight
 // claim_grace would SIGTERM it mid-poll before it ever gets to claim.
-const QUEUE_WORKER_POLL_SECONDS = 240;
+// (Bumped to 1020s alongside this change.)
+const QUEUE_WORKER_POLL_SECONDS = 900;
 // One spec per worker task. queueType MUST match scripts/claude_job.py TAG_TO_TYPE.
 const QUEUE_WORKERS = [
     { taskId: WORKER_TASK_ID, queueType: "any", human: "universal queue" },
@@ -3978,26 +4267,40 @@ function kickerEnv() {
         // skill/run-twitter-cycle.sh (single source of truth, no env dependency).
     };
 }
+// Shared draftability gate for BOTH autopilot kickers (X queue + Reddit search).
+// A launchd discovery/draft kicker only makes sense to schedule when SOMETHING is
+// draftable, and the definition of "draftable" is identical across platforms — so
+// it lives here as the single source of truth. Two paths qualify:
+//   (a) a managed product project is ready (promotion lane), OR
+//   (b) personal_brand mode is on AND the persona is ready (self-promo lane).
+// Path (b) is easy to miss: the persona is deliberately excluded from the
+// managed-products scope (see ensurePersonaProject), so a personal-brand-only
+// install has an empty managedProjects() and a product-only check is always
+// false. That gap silently sank the X kicker (fixed 2026-06-30) and then the
+// Reddit kicker (fixed 2026-07-16, which reused the product-only check instead of
+// this persona-aware one). Keeping both kickers on this ONE helper means the
+// personal-brand path can never regress on one platform but not the other.
+function draftableLaneStatus() {
+    const productReady = listManagedProjectStatus().some((p) => p.ready);
+    if (productReady)
+        return { draftable: true, detail: "ready project" };
+    const personaActive = currentFlags().personal_brand && personaReady();
+    if (personaActive) {
+        return { draftable: true, detail: "active persona (personal_brand)" };
+    }
+    return { draftable: false, detail: "no ready project or active persona yet" };
+}
 async function ensureQueueKickerInstalled() {
     try {
         if (process.platform !== "darwin")
             return { ok: false, detail: "not macOS" };
         if (!runtimeReady())
             return { ok: false, detail: "runtime not ready" };
-        // Gate: install the kicker when SOMETHING is draftable. Two paths qualify:
-        //   (a) a managed product project is ready (promotion lane), OR
-        //   (b) personal_brand mode is on AND the persona is ready (self-promo lane).
-        // Path (b) was the 2026-06-30 gap: a personal-brand-only setup has no managed
-        // project, so the old `anyReady` check was always false and the kicker never
-        // installed (no drafts, no first-run kick). The persona is excluded from
-        // managed scope by design, so check it explicitly.
-        const productReady = listManagedProjectStatus().some((p) => p.ready);
-        const personaActive = currentFlags().personal_brand && personaReady();
-        if (!productReady && !personaActive) {
-            return {
-                ok: false,
-                detail: "no ready project or active persona yet",
-            };
+        // Gate: install the kicker only when SOMETHING is draftable (product lane OR
+        // active persona). See draftableLaneStatus — shared with the Reddit kicker.
+        const lane = draftableLaneStatus();
+        if (!lane.draftable) {
+            return { ok: false, detail: lane.detail };
         }
         // Additional gate: X must be connected and verified before autopilot starts.
         // This prevents wasted cycles against a logged-out x.com if X connection didn't
@@ -4115,9 +4418,14 @@ async function ensureRedditKickerInstalled() {
             return { ok: false, detail: "not macOS" };
         if (!runtimeReady())
             return { ok: false, detail: "runtime not ready" };
-        const productReady = listManagedProjectStatus().some((p) => p.ready);
-        if (!productReady)
-            return { ok: false, detail: "no ready project yet" };
+        // Gate: install the kicker only when SOMETHING is draftable. Mirror the X
+        // queue kicker EXACTLY via the shared draftableLaneStatus — a personal-brand-
+        // only install has no managed product, so the old product-only check here made
+        // this kicker permanently uninstallable (no reddit drafts) even with a ready
+        // persona (2026-07-16 bug). Both kickers now share the one persona-aware gate.
+        const lane = draftableLaneStatus();
+        if (!lane.draftable)
+            return { ok: false, detail: lane.detail };
         // Reddit session gate. status is read-only (never launches Chrome): a live
         // me.json validation when the harness is up, the on-disk profile cookie
         // check (connected_idle) when it isn't.
@@ -5684,30 +5992,18 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// Post any cards the user APPROVED that never landed — e.g. a restart killed the
-// batch mid-way. "Proceed to post the already-approved items." postApproved is
-// idempotent (it filters posted/terminal), so this only drains the genuine
-// backlog and never double-posts. Best-effort; never throws.
-async function drainApprovedBacklog() {
-    try {
-        const plan = readPlan(REVIEW_QUEUE_ID);
-        const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true &&
-            c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)));
-        if (!backlog.length)
-            return;
-        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
-        await postApproved(REVIEW_QUEUE_ID, plan);
-    }
-    catch (e) {
-        console.error("[post] drainApprovedBacklog error:", e?.message || e);
-        // Same reasoning as the other postApproved call site: don't let an
-        // escaped exception leave the cross-instance posting flag stuck true.
-        postingActive = false;
-        stopPostingFlagHeartbeat();
-    }
-}
+// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
+// which was sane when boots meant "user launched Claude Desktop" — but each
+// queue-worker session boots its own MCP server, so the drain had silently
+// become a ~5-minute cron running across up to 4 concurrent MCP instances.
+// Combined with universal posting preemption, every drain wakeup SIGKILLed
+// whatever held the twitter-browser lock (profile scans included), and any
+// stamp bug turned into an infinite retry loop (438 retries over 5 days on
+// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
+// the menubar's _resume_approved_queue, which runs on loopback-reachable and
+// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
+// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
+// it and its resume covers the backlog.
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -5791,8 +6087,11 @@ async function main() {
         console.error("[queue-worker] launchd kicker: skip (paused)");
     }
     // Reddit discovery kicker (optional platform): installs only when reddit is
-    // connected AND a project is ready; a box that never connected reddit is a
-    // cheap no-op skip. Paused-gated like the X kicker (it produces drafts).
+    // connected AND a draftable lane exists (product ready OR active persona, via
+    // the shared draftableLaneStatus). A box that never connected reddit is a cheap
+    // no-op skip. This boot-time call also SELF-HEALS installs broken by the old
+    // product-only gate: once the gate passes, the plist lands on the next boot
+    // (worker sessions boot ~1/min). Paused-gated like the X kicker (produces drafts).
     if (!isPaused()) {
         void ensureRedditKickerInstalled()
             .then((r) => console.error(`[reddit-kicker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
@@ -5883,13 +6182,9 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
-    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
-    {
-        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
-        if (typeof t.unref === "function")
-            t.unref();
-    }
+    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
+    // here is gone — backlog recovery is owned by the menubar's periodic
+    // _resume_approved_queue (single drainer; see the removal note above).
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.