@m13v/s4l 1.7.6-rc.5 → 1.7.6-rc.7

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -909,6 +909,11 @@ async function ensureTwitterBrowserForPost() {
 // thread still exists. Without this override, a card approved while (or just
 // before) the sync stamped it is refused as already-decided and the approval
 // silently no-ops (2 of 3 approvals lost on 2026-07-10).
+// Give-up bound for approved cards whose post attempts keep failing
+// transiently (browser lock contention, timeouts). 5 attempts spans several
+// drain cycles — plenty for genuine transients to clear — while guaranteeing
+// no card can retry forever (2026-07-17 zombie-card incident).
+const MAX_POST_ATTEMPTS = 5;
 function expiredStampOverridable(c) {
     return (c.terminal === true &&
         c.posted !== true &&
@@ -924,7 +929,37 @@ function isSandboxCandidate(c) {
     const id = Number(c.candidate_id);
     return Number.isFinite(id) && id >= 900_000_000;
 }
-function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+// Write field patches into the review-queue store UNDER ITS LOCK by shelling
+// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
+// _store_update and merge_review_queue.py hold around their read-modify-write.
+// Node has no native flock, and this process writing the store directly was
+// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
+// Returns false on any failure so callers can fall back to the legacy write.
+async function patchReviewStore(patches) {
+    if (!patches.length)
+        return true;
+    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
+    try {
+        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
+        const res = await runPython("scripts/store_patch.py", [tmp], {
+            timeoutMs: 30_000,
+            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -936,6 +971,46 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
+    //
+    // Review-queue store: go through the LOCKED patch path (store_patch.py)
+    // first. The fresh-read merge below closes most of the race window but not
+    // all of it — a menubar decision landing between our readPlan and writePlan
+    // still gets erased. The locked path holds the store's flock for the whole
+    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
+    // and enforces the same posted-sticky rules. Legacy path stays as the
+    // fallback and for per-batch /tmp plans (single writer, no lock needed).
+    try {
+        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
+        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
+            const patches = stamped.map((c) => {
+                const set = {};
+                const unset = [];
+                if (c.posted === true) {
+                    set.posted = true;
+                    set.terminal = false;
+                    if (c.our_url)
+                        set.our_url = c.our_url;
+                    unset.push("discard_reason");
+                }
+                else if (c.terminal === true) {
+                    set.terminal = true;
+                    set.terminal_reason = c.terminal_reason ?? null;
+                    // See the zombie-card note in the legacy branch below: a terminal
+                    // from a real post attempt must clear the overridable expiry stamp.
+                    unset.push("discard_reason");
+                }
+                if (typeof c.post_attempts === "number")
+                    set.post_attempts = c.post_attempts;
+                return { candidate_id: c.candidate_id, set, unset };
+            });
+            if (await patchReviewStore(patches))
+                return;
+            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
+        }
+    }
+    catch {
+        /* fall through to the legacy write */
+    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
@@ -964,11 +1039,29 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
                         f.terminal = false;
                         if (c.our_url)
                             f.our_url = c.our_url;
+                        // A post outcome closes the card's history: the pre-approval
+                        // freshness stamp must not survive it.
+                        delete f.discard_reason;
                     }
                     else if (c.terminal === true && f.posted !== true) {
                         f.terminal = true;
                         f.terminal_reason = c.terminal_reason;
+                        // CRITICAL (2026-07-17 Nhat zombie-card incident, 438 retries over
+                        // 5 days): a stale discard_reason="backend_status_expired" left on
+                        // the fresh copy makes expiredStampOverridable() treat THIS
+                        // post-outcome terminal as overridable, so every later drain
+                        // resurrects the card, re-posts, dedup-skips, and re-stamps —
+                        // forever. A terminal that came from an actual post attempt is
+                        // final; delete the expiry stamp so the override can never fire
+                        // on it again. (The drain's own `delete c.discard_reason` happens
+                        // on an in-memory copy that is never the write source; this line
+                        // is the one that persists.)
+                        delete f.discard_reason;
                     }
+                    // Carry the retry counter so the give-up bound survives across
+                    // drains (each drain reads the store fresh).
+                    if (typeof c.post_attempts === "number" && c.post_attempts > (f.post_attempts || 0))
+                        f.post_attempts = c.post_attempts;
                 }
             }
             writePlan(batchId, fresh);
@@ -1267,7 +1360,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1508,6 +1601,21 @@ async function postApproved(batchId, plan) {
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
                 // equivalent transient failures self-healed on the very next drain.
+                //
+                // BOUNDED (2026-07-17): sticky is right, sticky-forever is not — an
+                // unbounded retry is a zombie generator (one card retried 438 times
+                // over 5 days on the Nhat install). Count the transient failures and
+                // give up loudly after MAX_POST_ATTEMPTS; the terminal_reason keeps
+                // the last failure visible so the give-up is diagnosable, and the
+                // on-disk post-events trail records it for forensics.
+                const attempts = (typeof c.post_attempts === "number" ? c.post_attempts : 0) + 1;
+                c.post_attempts = attempts;
+                if (attempts >= MAX_POST_ATTEMPTS) {
+                    c.terminal = true;
+                    c.terminal_reason = `gave_up_after_${attempts}_failed_attempts:${r.reason || "failed"}`;
+                    console.error(`[post] giving up on candidate ${r.candidate_id} after ${attempts} failed attempts (last: ${r.reason || "failed"})`);
+                    logPostEvent(`retry_budget_exhausted candidate=${r.candidate_id} attempts=${attempts} last=${r.reason || "failed"}`);
+                }
                 touchedPlan = true;
             }
         });
@@ -1522,7 +1630,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        mergeApprovedStampsIntoStore(batchId, plan, approved);
+        await mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2767,6 +2875,16 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
+    // Review-queue store: snapshot every row now so the write below can be a
+    // field-level DIFF applied under the store lock (store_patch.py) instead
+    // of an unlocked whole-file replace. This function holds its in-memory
+    // plan across user think-time; a whole-file write here erased any menubar
+    // decision or merge that landed in between (the 2026-07-17 truth-loss
+    // family). Non-store batches keep the plain write: single writer.
+    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
+    const rowsBefore = isStoreBatch
+        ? candidates.map((c) => JSON.stringify(c))
+        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -2903,7 +3021,40 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    writePlan(batch_id, plan);
+    // Persist the decision mutations. Store batch: diff each row against its
+    // snapshot and apply only the changed fields under the store lock, so a
+    // concurrent menubar decision or merge is never erased. Anything else
+    // (per-batch /tmp plans): plain write, single writer.
+    let storeWriteDone = false;
+    if (isStoreBatch) {
+        const patches = [];
+        candidates.forEach((c, i) => {
+            const beforeRaw = rowsBefore[i];
+            const afterRaw = JSON.stringify(c);
+            if (beforeRaw === afterRaw)
+                return;
+            const before = JSON.parse(beforeRaw ?? "{}");
+            const after = JSON.parse(afterRaw);
+            const set = {};
+            const unset = [];
+            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
+                if (!(k in after) || after[k] === undefined) {
+                    if (k in before)
+                        unset.push(k);
+                }
+                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
+                    set[k] = after[k];
+                }
+            }
+            if (Object.keys(set).length || unset.length)
+                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
+        });
+        storeWriteDone = await patchReviewStore(patches);
+        if (!storeWriteDone)
+            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+    }
+    if (!storeWriteDone)
+        writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,
@@ -5717,33 +5868,18 @@ registerAppResource(server, "S4L product link", PRODUCT_LINK_URI, { mimeType: RE
         },
     ],
 }));
-// Post any cards the user APPROVED that never landed — e.g. a restart killed the
-// batch mid-way. "Proceed to post the already-approved items." postApproved is
-// idempotent (it filters posted/terminal), so this only drains the genuine
-// backlog and never double-posts. Best-effort; never throws.
-async function drainApprovedBacklog() {
-    try {
-        const plan = readPlan(REVIEW_QUEUE_ID);
-        const cands = plan?.candidates || [];
-        const backlog = cands.filter((c) => c.approved === true &&
-            c.posted !== true &&
-            (c.terminal !== true || expiredStampOverridable(c)) &&
-            // Same sandbox exclusion as postApproved's own filter: a sandbox
-            // replay can never post, so it must never count as backlog.
-            !isSandboxCandidate(c));
-        if (!backlog.length)
-            return;
-        console.error(`[post] draining ${backlog.length} approved-but-unposted card(s) left from before`);
-        await postApproved(REVIEW_QUEUE_ID, plan);
-    }
-    catch (e) {
-        console.error("[post] drainApprovedBacklog error:", e?.message || e);
-        // Same reasoning as the other postApproved call site: don't let an
-        // escaped exception leave the cross-instance posting flag stuck true.
-        postingActive = false;
-        stopPostingFlagHeartbeat();
-    }
-}
+// REMOVED (2026-07-17): drainApprovedBacklog. It ran 30s after EVERY MCP boot,
+// which was sane when boots meant "user launched Claude Desktop" — but each
+// queue-worker session boots its own MCP server, so the drain had silently
+// become a ~5-minute cron running across up to 4 concurrent MCP instances.
+// Combined with universal posting preemption, every drain wakeup SIGKILLed
+// whatever held the twitter-browser lock (profile scans included), and any
+// stamp bug turned into an infinite retry loop (438 retries over 5 days on
+// one Nhat card). Backlog recovery is now owned by ONE long-lived process:
+// the menubar's _resume_approved_queue, which runs on loopback-reachable and
+// periodically thereafter (mcp/menubar/s4l_menubar.py). Do NOT re-add a
+// boot-time drain here; if the menubar is dead, ensureMenubar() below revives
+// it and its resume covers the backlog.
 async function main() {
     initSentry();
     // Detect a self-update (old_version -> new_version) as the very first thing
@@ -5919,13 +6055,9 @@ async function main() {
     void startLocalPanel()
         .then((url) => console.error(`[social-autoposter-mcp] panel loopback ready at ${url}`))
         .catch((e) => console.error("[social-autoposter-mcp] panel loopback start failed:", e?.message || e));
-    // Resume posting any approved-but-unposted cards a prior run/restart left behind.
-    // Delayed so the runtime + harness Chrome have settled; never blocks boot.
-    {
-        const t = setTimeout(() => void drainApprovedBacklog(), 30_000);
-        if (typeof t.unref === "function")
-            t.unref();
-    }
+    // NOTE (2026-07-17): the boot-time drainApprovedBacklog() call that lived
+    // here is gone — backlog recovery is owned by the menubar's periodic
+    // _resume_approved_queue (single drainer; see the removal note above).
     // Ensure the macOS menu bar mini-dashboard is installed + running. Idempotent
     // and cheap when already present, so existing installs pick it up on the next
     // Claude restart without re-provisioning. Best-effort: never blocks boot.

package/mcp/dist/telemetry.js

@@ -301,7 +301,8 @@ function collectStateSnapshot() {
         ["install_progress", "install-progress.json", 64_000],
         ["onboarding_progress", "onboarding-progress.json", 256_000],
         ["review_queue", "review-queue.json", 256_000],
-        ["approved_queue", "approved-queue.json", 256_000],
+        // approved-queue.json removed 2026-07-17: the ledger is gone; the review
+        // store is the only local decision record.
     ];
     for (const [key, file, cap] of stateFiles) {
         const val = readJsonCapped(path.join(stateDir, file), cap);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.5",
-  "installedAt": "2026-07-17T17:09:56.264Z"
+  "version": "1.7.6-rc.7",
+  "installedAt": "2026-07-17T17:41:44.516Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.7",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -579,6 +579,12 @@ class S4LMenuBar(rumps.App):
         # a hitch every 5s tick.
         self._resumed = False
         self._loopback_check_due_at = 0.0
+        # Periodic approved-backlog drain cadence (2026-07-17): the menubar is
+        # the single drainer now that the MCP boot-time drain is gone. 10 min
+        # keeps a transiently-failed approval's retry latency reasonable while
+        # staying far below the old effective 5-min/multi-instance churn.
+        self.RESUME_PERIOD_S = 600.0
+        self._resume_due_at = 0.0
         # Reliable self-check of our own Accessibility (TCC) grant — this is the
         # faithful reading (our launchd process identity, not a parent's). Logged
         # so menubar.err.log records whether keystroke posting will work.
@@ -2301,16 +2307,14 @@ class S4LMenuBar(rumps.App):
         never confirmed posted (the in-memory _post_q died with the old process).
         Skip any the plan already shows as posted, so a card that landed on X just
         before the kill — but whose status update was lost — isn't posted twice."""
-        # Store lane (canonical): approved-but-unposted rows in the review store.
-        # Legacy lane: pre-store approved-queue.json entries (read-only now; the
-        # ledger is no longer written). Union, store first, dedup by (batch, n).
+        # Store lane ONLY (2026-07-17): approved-but-unposted rows in the review
+        # store, the single source of truth. The legacy approved-queue.json lane
+        # (a read-only third truth source that the ledger stopped writing long
+        # ago) was removed — its entries could never settle, so it re-enqueued
+        # the same dead approvals on every resume forever. If a genuinely
+        # pre-store approval ever resurfaces, it is visible in the store lane
+        # or it is gone; do not re-add the union.
         pending = list(st.store_pending_posts())
-        seen = {(it.get("batch"), it.get("n")) for it in pending}
-        legacy = [
-            it for it in st.approved_queue_pending()
-            if (it.get("batch"), it.get("n")) not in seen
-        ]
-        pending.extend(legacy)
         if not pending:
             return
         posted_ns = set()
@@ -2327,7 +2331,6 @@ class S4LMenuBar(rumps.App):
         for it in pending:
             batch, n = it.get("batch"), it.get("n")
             if n in posted_ns:
-                st.approved_queue_set_status(batch, n, "posted")  # reconcile lost update
                 continue
             decision = {
                 "n": n,
@@ -2462,8 +2465,19 @@ class S4LMenuBar(rumps.App):
         if now >= self._loopback_check_due_at:
             self._loopback_check_due_at = now + 60.0
             if st.loopback_reachable():
-                if not self._resumed:
+                # Periodic backlog drain (2026-07-17): the menubar is now the
+                # SINGLE owner of approved-backlog recovery. The MCP server's
+                # boot-time drainApprovedBacklog was removed (each queue-worker
+                # session boots an MCP, so "boot-time" had become a 5-minute
+                # cron across concurrent instances). Here it runs on the one
+                # long-lived process instead: on loopback recovery and every
+                # RESUME_PERIOD_S thereafter, but only while nothing is
+                # in-flight (avoids enqueueing a card twice while an earlier
+                # drain still holds it in _post_q). _resume_approved_queue is
+                # idempotent against the store (skips posted/terminal rows).
+                if (not self._resumed or now >= self._resume_due_at) and self._posts_outstanding == 0:
                     self._resumed = True
+                    self._resume_due_at = now + self.RESUME_PERIOD_S
                     try:
                         self._resume_approved_queue()
                     except Exception as e:
@@ -3566,7 +3580,6 @@ class S4LMenuBar(rumps.App):
                 # No "Posting draft N…" banner: the menu-bar spinner already shows
                 # live posting progress, so a Notification Center toast per approved
                 # card is pure noise. Only failures (below) raise a notification.
-                st.approved_queue_set_status(batch, n, "posting")
                 with self._review_lock:
                     activity_label = self._posting_activity_label_locked()
                 cl = [n] if decision.get("drop_link") else None
@@ -3598,32 +3611,25 @@ class S4LMenuBar(rumps.App):
                     # one registered). Unlike a real posting failure, nothing
                     # was ever attempted here — post_drafts never reached a
                     # server — so there's no double-post risk in retrying.
-                    # Deliberately do NOT call store_mark_post_failed / set
-                    # status "failed": both would exclude this card from
-                    # store_pending_posts()/approved_queue_pending(), which is
+                    # Deliberately do NOT call store_mark_post_failed: it would
+                    # exclude this card from store_pending_posts(), which is
                     # exactly what _resume_approved_queue() reads on the next
-                    # unreachable->reachable edge. Leaving it "queued" lets
-                    # that existing restart-recovery path retry it
-                    # automatically once a server re-registers, instead of
-                    # stranding it for manual dashboard retry.
-                    st.approved_queue_set_status(batch, n, "queued", error="loopback_unreachable")
+                    # unreachable->reachable edge. Leaving the store row
+                    # approved-unposted lets that existing restart-recovery
+                    # path retry it automatically once a server re-registers,
+                    # instead of stranding it for manual dashboard retry.
                     self._notify(
                         "S4L", "Server unreachable — will retry automatically once Claude Desktop reconnects."
                     )
                 else:
                     posted = res.get("posted") if isinstance(res, dict) else None
                     if posted == 0:
-                        st.approved_queue_set_status(batch, n, "failed", error="posted_0")
                         st.store_mark_post_failed(batch, n, decision.get("candidate_id"), "posted_0")
                         self._notify("S4L", f"Draft {n} didn't post — see the dashboard for why.")
-                    else:
-                        # Success is silent: the spinner + dashboard already reflect
-                        # it. No per-card "Posted draft N." banner. The server
-                        # stamps posted/our_url into the store itself; the legacy
-                        # set_status only settles pre-store ledger entries.
-                        st.approved_queue_set_status(batch, n, "posted")
+                    # Success is silent: the spinner + dashboard already reflect
+                    # it. No per-card "Posted draft N." banner. The server
+                    # stamps posted/our_url into the store itself.
             except Exception as e:
-                st.approved_queue_set_status(batch, n, "failed", error=str(e)[:200])
                 st.store_mark_post_failed(batch, n, decision.get("candidate_id"), str(e)[:200])
                 sys.stderr.write(f"[s4l-menubar] post draft {n} failed: {e}\n")
                 sys.stderr.flush()

package/mcp/menubar/s4l_state.py

@@ -43,10 +43,6 @@ try:
 except Exception:
     pass
 
-# Serializes read-modify-write on approved-queue.json. The menu bar's main thread
-# (approve click / restart resume) and the post-worker thread (status updates)
-# both mutate it; without this a concurrent interleave would drop an approval.
-_approved_lock = threading.Lock()
 
 # Mirrors shared/onboarding-ledger.cjs MILESTONES (same order). The ledger's
 # OPTIONAL milestones (reddit_connected / reddit_verified) are deliberately NOT
@@ -982,89 +978,23 @@ def review_queue_posted_count():
     return sum(1 for c in cands if candidate_state(c) == "posted")
 
 
-def _plan_generation(batch):
-    """created_at of the CURRENT review plan for this batch (stamped by
-    merge_review_queue.py when it starts a fresh plan), or None for plans
-    written before generation stamping existed.
-
-    Why this matters: the plan lives in /tmp and dies on every reboot or tmp
-    sweep, and its candidate numbering restarts at 1, while approved-queue.json
-    lives in the state dir forever. Without a generation marker, ledger entries
-    from a dead plan match the new plan's low indices and every fresh draft is
-    treated as already-decided: the 2026-07-03 "unapproved cards never show up"
-    bug (30 stale entries silently swallowed a whole day of drafts)."""
-    try:
-        p = Path(store_path())
-        if not p.exists():
-            base = os.environ.get("S4L_TMP_DIR") or "/tmp"
-            p = Path(base) / f"twitter_cycle_plan_{batch}.json"
-        return json.loads(p.read_text()).get("created_at") or None
-    except Exception:
-        return None
-
-
-def _ts_before(a, b):
-    """True when iso timestamp a is strictly before b. Tolerates the two stamp
-    shapes in play ('...Z' from merge_review_queue, '+00:00' from time_iso)."""
-    try:
-        import datetime
-
-        def parse(s):
-            return datetime.datetime.fromisoformat(str(s).replace("Z", "+00:00"))
-
-        return parse(a) < parse(b)
-    except Exception:
-        return False
-
-
-def _stale_for_plan(it, gen):
-    """A ledger item that predates the current plan generation refers to a DEAD
-    plan's numbering; its `n` must never match against the live plan."""
-    return bool(gen) and bool(it.get("ts")) and _ts_before(it.get("ts"), gen)
-
-
-def _ledger_items_for_plan(batch, gen):
-    """Decided ledger items that belong to the CURRENT plan generation."""
-    return [
-        it
-        for it in read_approved_queue()["items"]
-        if it.get("batch") == batch
-        and it.get("status") in ("queued", "posting", "posted", "failed", "rejected")
-        and not _stale_for_plan(it, gen)
-    ]
-
-
 def review_drafts(plan, batch="review-queue"):
     """Flatten a plan into the card model: only UNDECIDED candidates. A card that's
     posted, terminal (rejected/dead), or already approved is a settled decision and
     must never be re-presented for review (approved ones proceed to post).
 
-    Also excludes cards with ANY durable decision (approved, edited, rejected, or a
-    decided-but-failed post) via _ledger_items_for_plan() below. approve/reject/edit
-    each write a durable local record via store_stamp_decision() the INSTANT the
-    user clicks (see s4l_menubar.py::_on_card_decision), so a
-    decided card never re-presents even if the loopback (Claude Desktop) is down
-    when the decision's plan-flag write is attempted. The main plan's
-    `approved`/`terminal`/`posted` flags are only stamped once the loopback write
-    lands, so without this a card the user just decided would re-present (the exact
-    "I already decided these" bug)."""
-    gen = (plan or {}).get("created_at") or _plan_generation(batch)
-    items = _ledger_items_for_plan(batch, gen)
-    settled_ids = {
-        it.get("candidate_id") for it in items if it.get("candidate_id") is not None
-    }
-    settled_ns = {it.get("n") for it in items if it.get("candidate_id") is None}
+    Decision durability lives in the store itself: approve/reject/edit each
+    write approved/terminal + the decision payload via store_stamp_decision()
+    the INSTANT the user clicks (see s4l_menubar.py::_on_card_decision), under
+    the store lock, so candidate_state() alone decides what re-presents. The
+    legacy approved-queue.json ledger cross-check that used to live here was
+    removed 2026-07-17 along with the rest of that third state store."""
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
         # Only awaiting_review rows become cards. This also skips post_failed
         # rows (decided-but-failed is settled per the docstring above).
         if candidate_state(c) != "awaiting_review":
             continue
-        cid = c.get("candidate_id")
-        if cid is not None and cid in settled_ids:
-            continue
-        if (i + 1) in settled_ns:
-            continue
         out.append(
             {
                 "n": i + 1,  # 1-based, matches post_drafts numbering
@@ -1132,35 +1062,13 @@ def review_drafts(plan, batch="review-queue"):
     return out
 
 
-# ---- durable approved-card queue ------------------------------------------
-# Card approvals MUST survive a menu bar / Claude restart. The in-memory post
-# queue does not: a restart strands every approved-but-unposted card, which then
-# re-presents for approval (the system had no record the user already approved
-# it). This file is the durable record, owned SOLELY by the menu bar — persisting
-# the approval in the main plan instead would race with the autopilot, which
-# rewrites that plan continuously and would silently drop the flag. Status flow:
-# queued -> posting -> posted | failed. review_drafts() excludes queued/posting
-# so an approved card is never re-shown while it drains; a restart re-enqueues
-# queued/posting items instead of re-presenting them.
-APPROVED_QUEUE = "approved-queue.json"
-
-
-def read_approved_queue():
-    d = read_json(APPROVED_QUEUE)
-    if not isinstance(d, dict) or not isinstance(d.get("items"), list):
-        return {"items": []}
-    return d
-
-
-def _write_approved_queue(d):
-    try:
-        p = Path(state_dir()) / APPROVED_QUEUE
-        p.parent.mkdir(parents=True, exist_ok=True)
-        tmp = p.with_suffix(".json.tmp")
-        tmp.write_text(json.dumps(d))
-        os.replace(str(tmp), str(p))  # atomic: a crash never leaves a half file
-    except Exception:
-        pass
+# ---- durable approved-card queue: REMOVED (2026-07-17) ---------------------
+# approved-queue.json was a second local ledger from before the review store
+# stamped decisions durably itself (store_stamp_decision, under the store
+# lock). Once decisions lived in the store, nothing appended to the ledger,
+# every status write was a no-op over a frozen item list, and its read lane
+# re-enqueued dead approvals forever. The review store is the ONLY local
+# decision record now; do not add a second one back.
 
 
 # ---- Engagement mode (2026-06-26, dual-flag 2026-06-29) -------------------
@@ -1422,23 +1330,10 @@ def toggle_lane(lane):
     return write_flags(f["personal_brand"], f["promotion"])
 
 
-def approved_queue_set_status(batch, n, status, error=None):
-    with _approved_lock:
-        d = read_approved_queue()
-        changed = False
-        for it in d["items"]:
-            if it.get("batch") == batch and it.get("n") == n:
-                it.update(status=status, error=error, ts=time_iso())
-                changed = True
-        if changed:
-            _write_approved_queue(d)
-
-
-def approved_queue_pending():
-    """Approvals not yet confirmed posted (queued or posting). Re-enqueued by the
-    menu bar on startup so a restart RESUMES the drain instead of re-presenting."""
-    return [it for it in read_approved_queue()["items"]
-            if it.get("status") in ("queued", "posting")]
+# approved_queue_set_status() / approved_queue_pending() REMOVED (2026-07-17):
+# the legacy approved-queue.json ledger is gone entirely — see the removal note
+# above read-approved-queue's old location. The store lane (store_stamp_decision
+# + store_pending_posts) is the only decision record and resume source now.
 
 
 def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.7",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.5",
+  "version": "1.7.6-rc.7",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/merge_review_queue.py

@@ -383,137 +383,156 @@ def main() -> int:
     # cycle process and only that process knows them.
 
     dst = store_path()
-    existing = []
-    plan_created_at = None
-    if os.path.exists(dst):
-        try:
-            with open(dst) as f:
-                prev = json.load(f)
-            existing = prev.get("candidates") or []
-            plan_created_at = prev.get("created_at")
-        except Exception:
-            existing = []
-            plan_created_at = None
-    # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
-    # written by old code after a reboot) so no pending draft or decision flag
-    # is lost, then ensure_store_symlink() below replaces it with the link.
-    legacy = plan_path(REVIEW_QUEUE_ID)
-    if os.path.exists(legacy) and not os.path.islink(legacy):
+    # ---- store lock ---------------------------------------------------
+    # Hold the SAME fcntl.flock the menubar's _store_update and the MCP's
+    # store_patch.py take, for the whole read->merge->write span. Without
+    # it this function was a last-writer-wins whole-file rewrite: a card
+    # decision stamped between our read (below) and _atomic_write was
+    # silently erased (the 2026-07-17 truth-loss family, including the
+    # resurrected sandbox approval that posted for real). The lock covers
+    # one bulk API call (_sync_with_backend); worst case a menubar decision
+    # write blocks for a few seconds once per cycle, which beats losing it.
+    import fcntl
+    _lk = open(dst + ".lock", "w")
+    fcntl.flock(_lk, fcntl.LOCK_EX)
+    try:
+        existing = []
+        plan_created_at = None
+        if os.path.exists(dst):
+            try:
+                with open(dst) as f:
+                    prev = json.load(f)
+                existing = prev.get("candidates") or []
+                plan_created_at = prev.get("created_at")
+            except Exception:
+                existing = []
+                plan_created_at = None
+        # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
+        # written by old code after a reboot) so no pending draft or decision flag
+        # is lost, then ensure_store_symlink() below replaces it with the link.
+        legacy = plan_path(REVIEW_QUEUE_ID)
+        if os.path.exists(legacy) and not os.path.islink(legacy):
+            try:
+                with open(legacy) as f:
+                    lp = json.load(f)
+                lc = lp.get("candidates") or []
+                have = {_dedup_key(c) for c in existing}
+                absorbed = [c for c in lc if _dedup_key(c) not in have]
+                existing.extend(absorbed)
+                plan_created_at = plan_created_at or lp.get("created_at")
+                if absorbed:
+                    print(
+                        f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
+                        "from legacy /tmp plan into the durable store",
+                        file=sys.stderr,
+                    )
+            except Exception as e:
+                print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
+        # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
+        # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
+        # approved-queue ledger uses this to ignore decisions that belong to a dead
+        # plan generation; without it, stale (batch, n) entries silently swallow
+        # every new draft after a reset. An existing unstamped plan is left
+        # unstamped: back-stamping it "now" would invalidate live decisions.
+        if not existing and not plan_created_at:
+            plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+        seen = {_dedup_key(c) for c in existing}
+        added = 0
+        merged = list(existing)
+        for c in new_cands:
+            k = _dedup_key(c)
+            if k in seen:
+                continue
+            seen.add(k)
+            merged.append(c)
+            added += 1
+
+        stamped, pruned = _sync_with_backend(merged)
+        if stamped:
+            print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
+        if pruned:
+            print(
+                f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
+                "backend (expired/etc.) before they were reviewed",
+                file=sys.stderr,
+            )
+
+        plan_obj = {"candidates": merged}
+        if plan_created_at:
+            plan_obj["created_at"] = plan_created_at
+
+        # This is the actual delivery: if anything below throws, the cycle's drafts
+        # were computed but never reached the store the menu bar reads, and the
+        # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
+        # stderr with `|| true`, so a crash here previously vanished into a local
+        # log nothing central reads — the exact blind spot that cost the 2026-07-08
+        # Karol investigation its root cause. Report it like any other handled
+        # pipeline failure (see twitter_post_plan.py's post-failure capture).
         try:
-            with open(legacy) as f:
-                lp = json.load(f)
-            lc = lp.get("candidates") or []
-            have = {_dedup_key(c) for c in existing}
-            absorbed = [c for c in lc if _dedup_key(c) not in have]
-            existing.extend(absorbed)
-            plan_created_at = plan_created_at or lp.get("created_at")
-            if absorbed:
-                print(
-                    f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
-                    "from legacy /tmp plan into the durable store",
-                    file=sys.stderr,
-                )
+            _atomic_write(dst, plan_obj)
+            ensure_store_symlink()
+
+            # Refresh the review-request marker the menu bar polls. count = cards
+            # actually awaiting review (mirrors s4l_state.candidate_state()'s
+            # awaiting_review bucket): approved-unposted and post_failed rows are
+            # settled decisions, counting them inflated the badge and misled every
+            # human/agent reading the marker.
+            pending_count = len(
+                [
+                    c
+                    for c in merged
+                    if not c.get("posted")
+                    and not c.get("terminal")
+                    and not c.get("post_failed")
+                    and not c.get("approved")
+                ]
+            )
+            project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
+            _atomic_write(
+                review_request_path(),
+                {
+                    "batch_id": REVIEW_QUEUE_ID,
+                    "project": project,
+                    "count": pending_count,
+                    "plan_path": dst,
+                    "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+                },
+            )
         except Exception as e:
-            print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
-    # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
-    # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
-    # approved-queue ledger uses this to ignore decisions that belong to a dead
-    # plan generation; without it, stale (batch, n) entries silently swallow
-    # every new draft after a reset. An existing unstamped plan is left
-    # unstamped: back-stamping it "now" would invalidate live decisions.
-    if not existing and not plan_created_at:
-        plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-
-    seen = {_dedup_key(c) for c in existing}
-    added = 0
-    merged = list(existing)
-    for c in new_cands:
-        k = _dedup_key(c)
-        if k in seen:
-            continue
-        seen.add(k)
-        merged.append(c)
-        added += 1
-
-    stamped, pruned = _sync_with_backend(merged)
-    if stamped:
-        print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
-    if pruned:
+            print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+            try:
+                import sentry_init
+
+                sentry_init.init()
+                sentry_init.capture_message(
+                    f"merge_review_queue delivery failed: {e}",
+                    level="error",
+                    tags={"component": "merge_review_queue", "added": str(added)},
+                    extra={"plan_src": src},
+                )
+                sentry_init.flush(2.0)
+            except Exception:
+                pass
+            return 1
+
         print(
-            f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
-            "backend (expired/etc.) before they were reviewed",
+            f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
+            f"({pending_count} pending total) from {os.path.basename(src)}",
             file=sys.stderr,
         )
-
-    plan_obj = {"candidates": merged}
-    if plan_created_at:
-        plan_obj["created_at"] = plan_created_at
-
-    # This is the actual delivery: if anything below throws, the cycle's drafts
-    # were computed but never reached the store the menu bar reads, and the
-    # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
-    # stderr with `|| true`, so a crash here previously vanished into a local
-    # log nothing central reads — the exact blind spot that cost the 2026-07-08
-    # Karol investigation its root cause. Report it like any other handled
-    # pipeline failure (see twitter_post_plan.py's post-failure capture).
-    try:
-        _atomic_write(dst, plan_obj)
-        ensure_store_symlink()
-
-        # Refresh the review-request marker the menu bar polls. count = cards
-        # actually awaiting review (mirrors s4l_state.candidate_state()'s
-        # awaiting_review bucket): approved-unposted and post_failed rows are
-        # settled decisions, counting them inflated the badge and misled every
-        # human/agent reading the marker.
-        pending_count = len(
-            [
-                c
-                for c in merged
-                if not c.get("posted")
-                and not c.get("terminal")
-                and not c.get("post_failed")
-                and not c.get("approved")
-            ]
-        )
-        project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
-        _atomic_write(
-            review_request_path(),
-            {
-                "batch_id": REVIEW_QUEUE_ID,
-                "project": project,
-                "count": pending_count,
-                "plan_path": dst,
-                "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            },
-        )
-    except Exception as e:
-        print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+        # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
         try:
-            import sentry_init
-
-            sentry_init.init()
-            sentry_init.capture_message(
-                f"merge_review_queue delivery failed: {e}",
-                level="error",
-                tags={"component": "merge_review_queue", "added": str(added)},
-                extra={"plan_src": src},
-            )
-            sentry_init.flush(2.0)
+            os.remove(src)
         except Exception:
             pass
-        return 1
-
-    print(
-        f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
-        f"({pending_count} pending total) from {os.path.basename(src)}",
-        file=sys.stderr,
-    )
-    # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
-    try:
-        os.remove(src)
-    except Exception:
-        pass
-    return 0
+        return 0
+    finally:
+        try:
+            fcntl.flock(_lk, fcntl.LOCK_UN)
+        except Exception:
+            pass
+        _lk.close()
 
 
 if __name__ == "__main__":

package/scripts/store_patch.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Locked field-patcher for the review-queue store.
+
+The review store (review-queue.json) has three writers: the menubar
+(s4l_state._store_update), merge_review_queue.py, and the MCP server. The
+first two hold an fcntl.flock on `<store>.lock` around their read-modify-write;
+the MCP server is Node, which has no native flock, so it routes its store
+writes through THIS script instead of writing the file itself. That closes the
+last unlocked writer (the last-writer-wins race that erased posted stamps on
+2026-07-17 — six live replies rendered as duplicate_thread_pre_post kills).
+
+Protocol-compatible with s4l_state._store_update: same lock file, LOCK_EX for
+the whole read-mutate-replace span, atomic os.replace. fcntl (not an O_EXCL
+lockfile) on purpose: the kernel drops the lock when the holder dies, so there
+is no stale-lock stealing logic to get wrong.
+
+Usage: store_patch.py <patches.json>   (or '-' to read the JSON from stdin)
+
+Input shape:
+  {"patches": [
+      {"candidate_id": 123,          # match ALL rows with this id (ids are NOT
+                                     # unique: sandbox reruns/variant drafts
+                                     # append sibling rows; a stamp that hits
+                                     # only one sibling leaves a drainable twin)
+       "n": 4,                       # 1-based index fallback when candidate_id
+                                     # is absent/None (legacy rows)
+       "set":   {"approved": true},  # fields to assign
+       "unset": ["discard_reason"]}  # fields to delete
+  ]}
+
+Merge rules (mirror mergeApprovedStampsIntoStore):
+  - posted is sticky: a patch may set posted=true, but `set.terminal=true` is
+    ignored on a row whose posted is already true, and posted is never unset.
+Prints {"ok": true, "patched": N} on stdout. Exit 0 even when N=0 (a patch
+matching nothing is not an error; the row may have been absorbed elsewhere).
+"""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import sys
+
+
+def store_path() -> str:
+    state_dir = os.environ.get("S4L_STATE_DIR") or os.path.join(
+        os.path.expanduser("~"), ".social-autoposter-mcp"
+    )
+    return os.path.join(state_dir, "review-queue.json")
+
+
+def _match_rows(cands: list, patch: dict) -> list:
+    cid = patch.get("candidate_id")
+    if cid is not None:
+        rows = [c for c in cands if c.get("candidate_id") == cid]
+        if rows:
+            return rows
+    n = patch.get("n")
+    if isinstance(n, int) and 1 <= n <= len(cands):
+        return [cands[n - 1]]
+    return []
+
+
+def apply_patches(data: dict, patches: list) -> int:
+    cands = data.get("candidates") or []
+    patched = 0
+    for p in patches:
+        for c in _match_rows(cands, p):
+            sets = dict(p.get("set") or {})
+            if c.get("posted") is True:
+                sets.pop("terminal", None)
+                sets.pop("terminal_reason", None)
+            for k, v in sets.items():
+                if k == "posted" and v is not True and c.get("posted") is True:
+                    continue  # posted is sticky
+                c[k] = v
+            for k in p.get("unset") or []:
+                if k == "posted":
+                    continue
+                c.pop(k, None)
+            patched += 1
+    return patched
+
+
+def main() -> int:
+    src = sys.argv[1] if len(sys.argv) > 1 else "-"
+    raw = sys.stdin.read() if src == "-" else open(src).read()
+    patches = (json.loads(raw) or {}).get("patches") or []
+    sp = store_path()
+    with open(sp + ".lock", "w") as lk:
+        fcntl.flock(lk, fcntl.LOCK_EX)
+        try:
+            try:
+                with open(sp) as f:
+                    data = json.load(f)
+            except Exception:
+                data = {"candidates": []}
+            patched = apply_patches(data, patches)
+            tmp = f"{sp}.tmp.{os.getpid()}"
+            with open(tmp, "w") as f:
+                json.dump(data, f, indent=2)
+            os.replace(tmp, sp)
+        finally:
+            fcntl.flock(lk, fcntl.LOCK_UN)
+    print(json.dumps({"ok": True, "patched": patched}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skill/archive-old-logs.sh

@@ -33,6 +33,30 @@ log "=== archive-old-logs starting (DAYS=$DAYS) ==="
 find "$LOG_DIR" -maxdepth 1 -type f -mtime +"$DAYS" ! -name "$(basename "$RUN_LOG")" -print0 \
   | xargs -0 -I{} mv {} "$ARCHIVE_DIR/" 2>&1 | tee -a "$RUN_LOG" >/dev/null || true
 
+# --- Size-based rotation for live launchd-*.log files (2026-07-17) -----------
+# launchd holds these fds open and appends forever, so the mtime sweep above
+# never touches them: their mtime is always fresh. Found in the wild at 1.9GB
+# (launchd-linkedin-stdout.log) and 694MB (launchd-engage-twitter-stdout.log),
+# which made "grep the logs" surface months-stale content as if it were
+# current (the 2026-07-17 Neon-hostname false alarm).
+# Copy-truncate: gzip the current content into logs-archive with a timestamp,
+# then truncate IN PLACE (same inode) so the launchd fd keeps appending.
+# Lines appended during the gzip window are lost on truncate; acceptable for
+# logs, and the window is seconds. Threshold tunable via ROTATE_MAX_MB.
+ROTATE_MAX_MB="${ROTATE_MAX_MB:-10}"
+find "$LOG_DIR" -maxdepth 1 -type f -name "launchd-*.log" -size +"${ROTATE_MAX_MB}M" -print0 \
+  | while IFS= read -r -d '' f; do
+      base=$(basename "$f" .log)
+      dest="$ARCHIVE_DIR/${base}-$(date +%Y%m%d-%H%M%S).log.gz"
+      if gzip -c "$f" > "$dest" 2>>"$RUN_LOG"; then
+        : > "$f"
+        log "rotated $(basename "$f") -> $(basename "$dest") ($(du -h "$dest" | cut -f1) compressed)"
+      else
+        rm -f "$dest"
+        log "WARN: rotate failed for $f (left untouched)"
+      fi
+    done
+
 remaining=$(find "$LOG_DIR" -maxdepth 1 -type f | wc -l | tr -d ' ')
 archived=$(find "$ARCHIVE_DIR" -maxdepth 1 -type f | wc -l | tr -d ' ')