@m13v/s4l 1.7.6-rc.6 → 1.7.6-rc.8

package/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { screencast, bringBrowserToFront } from "./screencast.js";
 import os from "node:os";
 import path from "node:path";
 import fs from "node:fs";
-import { repoDir, runPython, run, readPlan, writePlan, planPath, } from "./repo.js";
+import { repoDir, runPython, run, readPlan, writePlan, planPath, TMP_DIR, } from "./repo.js";
 import { applySetup, resolveProject, hasReadyProject, personaReady, listManagedProjectStatus, listProjectSettings, ensureShortLinksDefault, ensurePersonaProject, findPersonaProject, REQUIRED_FIELDS, RECOMMENDED_FIELDS, configPath, ensureConfigInStateDir, normalizeStringList, recordRedditAccount, } from "./setup.js";
 import { xStatus, xConnect, xDetectSources, xScanProfile, summarizeXAuth } from "./twitterAuth.js";
 import { redditStatus, redditConnect, redditDetectSources, summarizeRedditAuth, } from "./redditAuth.js";
@@ -929,7 +929,37 @@ function isSandboxCandidate(c) {
     const id = Number(c.candidate_id);
     return Number.isFinite(id) && id >= 900_000_000;
 }
-function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
+// Write field patches into the review-queue store UNDER ITS LOCK by shelling
+// to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
+// _store_update and merge_review_queue.py hold around their read-modify-write.
+// Node has no native flock, and this process writing the store directly was
+// the last unlocked writer (the race that erased posted stamps on 2026-07-17).
+// Returns false on any failure so callers can fall back to the legacy write.
+async function patchReviewStore(patches) {
+    if (!patches.length)
+        return true;
+    const tmp = path.join(TMP_DIR, `s4l-store-patches-${process.pid}-${Date.now()}.json`);
+    try {
+        fs.writeFileSync(tmp, JSON.stringify({ patches }), "utf-8");
+        const res = await runPython("scripts/store_patch.py", [tmp], {
+            timeoutMs: 30_000,
+            env: { S4L_REPO_DIR: repoDir(), PATH: pipelinePath() },
+        });
+        return res.code === 0;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // Merge posted/terminal stamps into a FRESH read of the store instead of
     // rewriting the whole plan from the copy taken minutes ago. The old
     // whole-file write was last-writer-wins: while a batch posted, the menubar
@@ -941,6 +971,46 @@ function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
     // overwrites a fresh `posted=true`. Fallback: candidates without a
     // candidate_id can't be matched into the fresh copy, so keep the legacy
     // whole-plan write for those older plans.
+    //
+    // Review-queue store: go through the LOCKED patch path (store_patch.py)
+    // first. The fresh-read merge below closes most of the race window but not
+    // all of it — a menubar decision landing between our readPlan and writePlan
+    // still gets erased. The locked path holds the store's flock for the whole
+    // read-mutate-replace, applies to every sibling row sharing a candidate_id,
+    // and enforces the same posted-sticky rules. Legacy path stays as the
+    // fallback and for per-batch /tmp plans (single writer, no lock needed).
+    try {
+        const mergeableForPatch = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
+        if (batchId === REVIEW_QUEUE_ID && mergeableForPatch) {
+            const patches = stamped.map((c) => {
+                const set = {};
+                const unset = [];
+                if (c.posted === true) {
+                    set.posted = true;
+                    set.terminal = false;
+                    if (c.our_url)
+                        set.our_url = c.our_url;
+                    unset.push("discard_reason");
+                }
+                else if (c.terminal === true) {
+                    set.terminal = true;
+                    set.terminal_reason = c.terminal_reason ?? null;
+                    // See the zombie-card note in the legacy branch below: a terminal
+                    // from a real post attempt must clear the overridable expiry stamp.
+                    unset.push("discard_reason");
+                }
+                if (typeof c.post_attempts === "number")
+                    set.post_attempts = c.post_attempts;
+                return { candidate_id: c.candidate_id, set, unset };
+            });
+            if (await patchReviewStore(patches))
+                return;
+            console.error("[post] store_patch.py failed; falling back to unlocked stamp merge");
+        }
+    }
+    catch {
+        /* fall through to the legacy write */
+    }
     try {
         const mergeable = stamped.every((c) => c.candidate_id !== undefined && c.candidate_id !== null);
         const fresh = mergeable ? readPlan(batchId) : null;
@@ -1290,7 +1360,7 @@ async function postApproved(batchId, plan) {
             };
         }
         if (approvedReddit.length)
-            mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
+            await mergeApprovedStampsIntoStore(batchId, plan, approvedReddit);
         return {
             attempted: approvedReddit.length,
             posted: redditPosted,
@@ -1560,7 +1630,7 @@ async function postApproved(batchId, plan) {
     // Reddit stamps (set in the reddit drain above) merge alongside the twitter
     // ones: `approved` here spans both platforms.
     if (touchedPlan || redditPosted || redditFailed) {
-        mergeApprovedStampsIntoStore(batchId, plan, approved);
+        await mergeApprovedStampsIntoStore(batchId, plan, approved);
     }
     // Post failures are HANDLED in the pipeline (it returns a count, never throws),
     // so they never reach Sentry on their own. Capture an explicit event whenever
@@ -2805,6 +2875,16 @@ tool("post_drafts", {
     const total = candidates.length;
     const warnings = [];
     const inRange = (n) => n >= 1 && n <= total;
+    // Review-queue store: snapshot every row now so the write below can be a
+    // field-level DIFF applied under the store lock (store_patch.py) instead
+    // of an unlocked whole-file replace. This function holds its in-memory
+    // plan across user think-time; a whole-file write here erased any menubar
+    // decision or merge that landed in between (the 2026-07-17 truth-loss
+    // family). Non-store batches keep the plain write: single writer.
+    const isStoreBatch = batch_id === REVIEW_QUEUE_ID;
+    const rowsBefore = isStoreBatch
+        ? candidates.map((c) => JSON.stringify(c))
+        : [];
     // ---- Rejections: durable + final --------------------------------------
     // A rejected draft is marked terminal so it NEVER re-appears for review and is
     // never posted. A reject overrides any earlier approve on the same card.
@@ -2941,7 +3021,40 @@ tool("post_drafts", {
         if (c)
             c.approved = true;
     });
-    writePlan(batch_id, plan);
+    // Persist the decision mutations. Store batch: diff each row against its
+    // snapshot and apply only the changed fields under the store lock, so a
+    // concurrent menubar decision or merge is never erased. Anything else
+    // (per-batch /tmp plans): plain write, single writer.
+    let storeWriteDone = false;
+    if (isStoreBatch) {
+        const patches = [];
+        candidates.forEach((c, i) => {
+            const beforeRaw = rowsBefore[i];
+            const afterRaw = JSON.stringify(c);
+            if (beforeRaw === afterRaw)
+                return;
+            const before = JSON.parse(beforeRaw ?? "{}");
+            const after = JSON.parse(afterRaw);
+            const set = {};
+            const unset = [];
+            for (const k of new Set([...Object.keys(before), ...Object.keys(after)])) {
+                if (!(k in after) || after[k] === undefined) {
+                    if (k in before)
+                        unset.push(k);
+                }
+                else if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) {
+                    set[k] = after[k];
+                }
+            }
+            if (Object.keys(set).length || unset.length)
+                patches.push({ candidate_id: c.candidate_id ?? null, n: i + 1, set, unset });
+        });
+        storeWriteDone = await patchReviewStore(patches);
+        if (!storeWriteDone)
+            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+    }
+    if (!storeWriteDone)
+        writePlan(batch_id, plan);
     if (approve.size === 0) {
         return jsonContent({
             batch_id,

package/mcp/dist/telemetry.js

@@ -301,7 +301,8 @@ function collectStateSnapshot() {
         ["install_progress", "install-progress.json", 64_000],
         ["onboarding_progress", "onboarding-progress.json", 256_000],
         ["review_queue", "review-queue.json", 256_000],
-        ["approved_queue", "approved-queue.json", 256_000],
+        // approved-queue.json removed 2026-07-17: the ledger is gone; the review
+        // store is the only local decision record.
     ];
     for (const [key, file, cap] of stateFiles) {
         const val = readJsonCapped(path.join(stateDir, file), cap);

package/mcp/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.7.6-rc.6",
-  "installedAt": "2026-07-17T17:26:23.362Z"
+  "version": "1.7.6-rc.8",
+  "installedAt": "2026-07-17T17:51:37.267Z"
 }

package/mcp/manifest.json

@@ -2,7 +2,7 @@
   "dxt_version": "0.1",
   "name": "social-autoposter",
   "display_name": "S4L",
-  "version": "1.7.6-rc.6",
+  "version": "1.7.6-rc.8",
   "description": "Draft, review, approve, and autopilot X/Twitter posts.",
   "long_description": "## **⚠️ The disclaimer above is generic Claude boilerplate.** Anthropic shows the same warning on every plugin regardless of what it does; any plugin has the same level of access as any app you download from the internet.\n\nS4L is an open source product developed by Mediar.ai Incorporated, a VC-backed San Francisco-based startup.\n\nTo get started:\n\n1\\. Copy this prompt: **Set me up on S4L plugin end to end**\n\n2\\. Quit with CMD+Q, reopen Claude, paste into a new chat.\n\nWhat happens next:\n\n* About every 5 minutes S4L scans X for posts that match your topics and drafts replies in your voice.\n* Drafts show up as review cards, usually the first within a few minutes. Nothing is posted automatically; you approve each one.\n* Posting autopilot stays off until you explicitly turn it on.",
   "author": {

package/mcp/menubar/s4l_menubar.py

@@ -2331,7 +2331,6 @@ class S4LMenuBar(rumps.App):
         for it in pending:
             batch, n = it.get("batch"), it.get("n")
             if n in posted_ns:
-                st.approved_queue_set_status(batch, n, "posted")  # reconcile lost update
                 continue
             decision = {
                 "n": n,
@@ -2939,11 +2938,14 @@ class S4LMenuBar(rumps.App):
         flight, and not snoozed (the snooze label and gate take precedence)."""
         if pending_count <= 0 or self._review_active:
             return 0.0
-        # The reveal cadence is a cards-mode concept (its menu control is
-        # hidden in canvas mode, 2026-07-16); never hold canvas presentations
-        # on a stale cadence value the user can no longer see or change.
+        # Canvas never auto-pops (2026-07-17, user direction): the explicit
+        # "Review N pending drafts" click is the ONLY way to open it. Report
+        # the same indefinite hold as the cards-mode "Never" preset so the
+        # menu shows the courtesy line. The reveal cadence itself remains a
+        # cards-mode concept (its menu control is hidden in canvas mode,
+        # 2026-07-16), so a stale cadence value is never consulted here.
         if st.read_review_layout() != "cards":
-            return 0.0
+            return -1.0
         now = time.time()
         if now < self._review_snooze_until:
             return 0.0
@@ -3064,12 +3066,20 @@ class S4LMenuBar(rumps.App):
         # card keeps growing live) and skipped for focus=True (the menu's
         # "Review N pending drafts" is an explicit ask). _last_review_sig is NOT
         # stamped on a hold, so the same set still presents fresh when due.
-        # Cards mode only (2026-07-16): the cadence control is hidden while
-        # View Mode is Canvas, so a stale value must not silently pace or
-        # suppress canvas presentations. No panel is open past the
-        # _review_active branch above, so the preference IS the layout that
-        # is about to present.
-        if not focus and st.read_review_layout() == "cards":
+        # No panel is open past the _review_active branch above, so the
+        # preference IS the layout that is about to present.
+        if not focus:
+            if st.read_review_layout() != "cards":
+                # Canvas never auto-pops (2026-07-17, user direction): the
+                # explicit "Review N pending drafts" click (focus=True) is the
+                # ONLY way to open the canvas. The extend-open branch above
+                # still grows an already-open canvas live; _last_review_sig is
+                # NOT stamped here, so the whole backlog presents fresh on the
+                # click.
+                return
+            # Cards mode: pace fresh pop-ups by the reveal cadence. The
+            # cadence control is a cards-only concept (hidden while View Mode
+            # is Canvas, 2026-07-16), so it is never consulted for canvas.
             cadence = st.read_reveal_cadence()
             if cadence < 0:
                 # "Never" preset: cards never auto-pop, only an explicit
@@ -3581,7 +3591,6 @@ class S4LMenuBar(rumps.App):
                 # No "Posting draft N…" banner: the menu-bar spinner already shows
                 # live posting progress, so a Notification Center toast per approved
                 # card is pure noise. Only failures (below) raise a notification.
-                st.approved_queue_set_status(batch, n, "posting")
                 with self._review_lock:
                     activity_label = self._posting_activity_label_locked()
                 cl = [n] if decision.get("drop_link") else None
@@ -3613,32 +3622,25 @@ class S4LMenuBar(rumps.App):
                     # one registered). Unlike a real posting failure, nothing
                     # was ever attempted here — post_drafts never reached a
                     # server — so there's no double-post risk in retrying.
-                    # Deliberately do NOT call store_mark_post_failed / set
-                    # status "failed": both would exclude this card from
-                    # store_pending_posts()/approved_queue_pending(), which is
+                    # Deliberately do NOT call store_mark_post_failed: it would
+                    # exclude this card from store_pending_posts(), which is
                     # exactly what _resume_approved_queue() reads on the next
-                    # unreachable->reachable edge. Leaving it "queued" lets
-                    # that existing restart-recovery path retry it
-                    # automatically once a server re-registers, instead of
-                    # stranding it for manual dashboard retry.
-                    st.approved_queue_set_status(batch, n, "queued", error="loopback_unreachable")
+                    # unreachable->reachable edge. Leaving the store row
+                    # approved-unposted lets that existing restart-recovery
+                    # path retry it automatically once a server re-registers,
+                    # instead of stranding it for manual dashboard retry.
                     self._notify(
                         "S4L", "Server unreachable — will retry automatically once Claude Desktop reconnects."
                     )
                 else:
                     posted = res.get("posted") if isinstance(res, dict) else None
                     if posted == 0:
-                        st.approved_queue_set_status(batch, n, "failed", error="posted_0")
                         st.store_mark_post_failed(batch, n, decision.get("candidate_id"), "posted_0")
                         self._notify("S4L", f"Draft {n} didn't post — see the dashboard for why.")
-                    else:
-                        # Success is silent: the spinner + dashboard already reflect
-                        # it. No per-card "Posted draft N." banner. The server
-                        # stamps posted/our_url into the store itself; the legacy
-                        # set_status only settles pre-store ledger entries.
-                        st.approved_queue_set_status(batch, n, "posted")
+                    # Success is silent: the spinner + dashboard already reflect
+                    # it. No per-card "Posted draft N." banner. The server
+                    # stamps posted/our_url into the store itself.
             except Exception as e:
-                st.approved_queue_set_status(batch, n, "failed", error=str(e)[:200])
                 st.store_mark_post_failed(batch, n, decision.get("candidate_id"), str(e)[:200])
                 sys.stderr.write(f"[s4l-menubar] post draft {n} failed: {e}\n")
                 sys.stderr.flush()
@@ -4078,7 +4080,12 @@ class S4LMenuBar(rumps.App):
             # now regardless.
             hold_until = self._reveal_hold_until(pending_count)
             if hold_until < 0:
-                items.append(self._label("Cards hidden — see count in the menu bar"))
+                if st.read_review_layout() == "cards":
+                    items.append(self._label("Cards hidden — see count in the menu bar"))
+                else:
+                    # Canvas mode: it never auto-opens; the review item above
+                    # is the one way in.
+                    items.append(self._label("Canvas opens from the review item above"))
             elif hold_until:
                 items.append(
                     self._label(

package/mcp/menubar/s4l_state.py

@@ -43,10 +43,6 @@ try:
 except Exception:
     pass
 
-# Serializes read-modify-write on approved-queue.json. The menu bar's main thread
-# (approve click / restart resume) and the post-worker thread (status updates)
-# both mutate it; without this a concurrent interleave would drop an approval.
-_approved_lock = threading.Lock()
 
 # Mirrors shared/onboarding-ledger.cjs MILESTONES (same order). The ledger's
 # OPTIONAL milestones (reddit_connected / reddit_verified) are deliberately NOT
@@ -982,89 +978,23 @@ def review_queue_posted_count():
     return sum(1 for c in cands if candidate_state(c) == "posted")
 
 
-def _plan_generation(batch):
-    """created_at of the CURRENT review plan for this batch (stamped by
-    merge_review_queue.py when it starts a fresh plan), or None for plans
-    written before generation stamping existed.
-
-    Why this matters: the plan lives in /tmp and dies on every reboot or tmp
-    sweep, and its candidate numbering restarts at 1, while approved-queue.json
-    lives in the state dir forever. Without a generation marker, ledger entries
-    from a dead plan match the new plan's low indices and every fresh draft is
-    treated as already-decided: the 2026-07-03 "unapproved cards never show up"
-    bug (30 stale entries silently swallowed a whole day of drafts)."""
-    try:
-        p = Path(store_path())
-        if not p.exists():
-            base = os.environ.get("S4L_TMP_DIR") or "/tmp"
-            p = Path(base) / f"twitter_cycle_plan_{batch}.json"
-        return json.loads(p.read_text()).get("created_at") or None
-    except Exception:
-        return None
-
-
-def _ts_before(a, b):
-    """True when iso timestamp a is strictly before b. Tolerates the two stamp
-    shapes in play ('...Z' from merge_review_queue, '+00:00' from time_iso)."""
-    try:
-        import datetime
-
-        def parse(s):
-            return datetime.datetime.fromisoformat(str(s).replace("Z", "+00:00"))
-
-        return parse(a) < parse(b)
-    except Exception:
-        return False
-
-
-def _stale_for_plan(it, gen):
-    """A ledger item that predates the current plan generation refers to a DEAD
-    plan's numbering; its `n` must never match against the live plan."""
-    return bool(gen) and bool(it.get("ts")) and _ts_before(it.get("ts"), gen)
-
-
-def _ledger_items_for_plan(batch, gen):
-    """Decided ledger items that belong to the CURRENT plan generation."""
-    return [
-        it
-        for it in read_approved_queue()["items"]
-        if it.get("batch") == batch
-        and it.get("status") in ("queued", "posting", "posted", "failed", "rejected")
-        and not _stale_for_plan(it, gen)
-    ]
-
-
 def review_drafts(plan, batch="review-queue"):
     """Flatten a plan into the card model: only UNDECIDED candidates. A card that's
     posted, terminal (rejected/dead), or already approved is a settled decision and
     must never be re-presented for review (approved ones proceed to post).
 
-    Also excludes cards with ANY durable decision (approved, edited, rejected, or a
-    decided-but-failed post) via _ledger_items_for_plan() below. approve/reject/edit
-    each write a durable local record via store_stamp_decision() the INSTANT the
-    user clicks (see s4l_menubar.py::_on_card_decision), so a
-    decided card never re-presents even if the loopback (Claude Desktop) is down
-    when the decision's plan-flag write is attempted. The main plan's
-    `approved`/`terminal`/`posted` flags are only stamped once the loopback write
-    lands, so without this a card the user just decided would re-present (the exact
-    "I already decided these" bug)."""
-    gen = (plan or {}).get("created_at") or _plan_generation(batch)
-    items = _ledger_items_for_plan(batch, gen)
-    settled_ids = {
-        it.get("candidate_id") for it in items if it.get("candidate_id") is not None
-    }
-    settled_ns = {it.get("n") for it in items if it.get("candidate_id") is None}
+    Decision durability lives in the store itself: approve/reject/edit each
+    write approved/terminal + the decision payload via store_stamp_decision()
+    the INSTANT the user clicks (see s4l_menubar.py::_on_card_decision), under
+    the store lock, so candidate_state() alone decides what re-presents. The
+    legacy approved-queue.json ledger cross-check that used to live here was
+    removed 2026-07-17 along with the rest of that third state store."""
     out = []
     for i, c in enumerate(((plan or {}).get("candidates") or [])):
         # Only awaiting_review rows become cards. This also skips post_failed
         # rows (decided-but-failed is settled per the docstring above).
         if candidate_state(c) != "awaiting_review":
             continue
-        cid = c.get("candidate_id")
-        if cid is not None and cid in settled_ids:
-            continue
-        if (i + 1) in settled_ns:
-            continue
         out.append(
             {
                 "n": i + 1,  # 1-based, matches post_drafts numbering
@@ -1132,35 +1062,13 @@ def review_drafts(plan, batch="review-queue"):
     return out
 
 
-# ---- durable approved-card queue ------------------------------------------
-# Card approvals MUST survive a menu bar / Claude restart. The in-memory post
-# queue does not: a restart strands every approved-but-unposted card, which then
-# re-presents for approval (the system had no record the user already approved
-# it). This file is the durable record, owned SOLELY by the menu bar — persisting
-# the approval in the main plan instead would race with the autopilot, which
-# rewrites that plan continuously and would silently drop the flag. Status flow:
-# queued -> posting -> posted | failed. review_drafts() excludes queued/posting
-# so an approved card is never re-shown while it drains; a restart re-enqueues
-# queued/posting items instead of re-presenting them.
-APPROVED_QUEUE = "approved-queue.json"
-
-
-def read_approved_queue():
-    d = read_json(APPROVED_QUEUE)
-    if not isinstance(d, dict) or not isinstance(d.get("items"), list):
-        return {"items": []}
-    return d
-
-
-def _write_approved_queue(d):
-    try:
-        p = Path(state_dir()) / APPROVED_QUEUE
-        p.parent.mkdir(parents=True, exist_ok=True)
-        tmp = p.with_suffix(".json.tmp")
-        tmp.write_text(json.dumps(d))
-        os.replace(str(tmp), str(p))  # atomic: a crash never leaves a half file
-    except Exception:
-        pass
+# ---- durable approved-card queue: REMOVED (2026-07-17) ---------------------
+# approved-queue.json was a second local ledger from before the review store
+# stamped decisions durably itself (store_stamp_decision, under the store
+# lock). Once decisions lived in the store, nothing appended to the ledger,
+# every status write was a no-op over a frozen item list, and its read lane
+# re-enqueued dead approvals forever. The review store is the ONLY local
+# decision record now; do not add a second one back.
 
 
 # ---- Engagement mode (2026-06-26, dual-flag 2026-06-29) -------------------
@@ -1422,22 +1330,10 @@ def toggle_lane(lane):
     return write_flags(f["personal_brand"], f["promotion"])
 
 
-def approved_queue_set_status(batch, n, status, error=None):
-    with _approved_lock:
-        d = read_approved_queue()
-        changed = False
-        for it in d["items"]:
-            if it.get("batch") == batch and it.get("n") == n:
-                it.update(status=status, error=error, ts=time_iso())
-                changed = True
-        if changed:
-            _write_approved_queue(d)
-
-
-# approved_queue_pending() REMOVED (2026-07-17): the legacy approved-queue.json
-# resume lane was a third source of truth whose entries could never settle (the
-# ledger stopped being written), so it re-enqueued dead approvals forever. The
-# store lane (store_pending_posts) is the only resume source now.
+# approved_queue_set_status() / approved_queue_pending() REMOVED (2026-07-17):
+# the legacy approved-queue.json ledger is gone entirely — see the removal note
+# above read-approved-queue's old location. The store lane (store_stamp_decision
+# + store_pending_posts) is the only decision record and resume source now.
 
 
 def post_drafts(batch_id, post=None, edits=None, reject=None, clear_link=None, timeout=900, activity_label=None):

package/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l-mcp",
-  "version": "1.7.6-rc.6",
+  "version": "1.7.6-rc.8",
   "private": true,
   "description": "Desktop MCP client for social-autoposter (X/Twitter rail): manual draft/review/approve loop, autopilot control, and stats. Thin wrapper over the existing pipeline scripts.",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m13v/s4l",
-  "version": "1.7.6-rc.6",
+  "version": "1.7.6-rc.8",
   "description": "Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.",
   "bin": {
     "social-autoposter": "bin/cli.js",

package/scripts/merge_review_queue.py

@@ -383,137 +383,156 @@ def main() -> int:
     # cycle process and only that process knows them.
 
     dst = store_path()
-    existing = []
-    plan_created_at = None
-    if os.path.exists(dst):
-        try:
-            with open(dst) as f:
-                prev = json.load(f)
-            existing = prev.get("candidates") or []
-            plan_created_at = prev.get("created_at")
-        except Exception:
-            existing = []
-            plan_created_at = None
-    # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
-    # written by old code after a reboot) so no pending draft or decision flag
-    # is lost, then ensure_store_symlink() below replaces it with the link.
-    legacy = plan_path(REVIEW_QUEUE_ID)
-    if os.path.exists(legacy) and not os.path.islink(legacy):
+    # ---- store lock ---------------------------------------------------
+    # Hold the SAME fcntl.flock the menubar's _store_update and the MCP's
+    # store_patch.py take, for the whole read->merge->write span. Without
+    # it this function was a last-writer-wins whole-file rewrite: a card
+    # decision stamped between our read (below) and _atomic_write was
+    # silently erased (the 2026-07-17 truth-loss family, including the
+    # resurrected sandbox approval that posted for real). The lock covers
+    # one bulk API call (_sync_with_backend); worst case a menubar decision
+    # write blocks for a few seconds once per cycle, which beats losing it.
+    import fcntl
+    _lk = open(dst + ".lock", "w")
+    fcntl.flock(_lk, fcntl.LOCK_EX)
+    try:
+        existing = []
+        plan_created_at = None
+        if os.path.exists(dst):
+            try:
+                with open(dst) as f:
+                    prev = json.load(f)
+                existing = prev.get("candidates") or []
+                plan_created_at = prev.get("created_at")
+            except Exception:
+                existing = []
+                plan_created_at = None
+        # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
+        # written by old code after a reboot) so no pending draft or decision flag
+        # is lost, then ensure_store_symlink() below replaces it with the link.
+        legacy = plan_path(REVIEW_QUEUE_ID)
+        if os.path.exists(legacy) and not os.path.islink(legacy):
+            try:
+                with open(legacy) as f:
+                    lp = json.load(f)
+                lc = lp.get("candidates") or []
+                have = {_dedup_key(c) for c in existing}
+                absorbed = [c for c in lc if _dedup_key(c) not in have]
+                existing.extend(absorbed)
+                plan_created_at = plan_created_at or lp.get("created_at")
+                if absorbed:
+                    print(
+                        f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
+                        "from legacy /tmp plan into the durable store",
+                        file=sys.stderr,
+                    )
+            except Exception as e:
+                print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
+        # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
+        # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
+        # approved-queue ledger uses this to ignore decisions that belong to a dead
+        # plan generation; without it, stale (batch, n) entries silently swallow
+        # every new draft after a reset. An existing unstamped plan is left
+        # unstamped: back-stamping it "now" would invalidate live decisions.
+        if not existing and not plan_created_at:
+            plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+        seen = {_dedup_key(c) for c in existing}
+        added = 0
+        merged = list(existing)
+        for c in new_cands:
+            k = _dedup_key(c)
+            if k in seen:
+                continue
+            seen.add(k)
+            merged.append(c)
+            added += 1
+
+        stamped, pruned = _sync_with_backend(merged)
+        if stamped:
+            print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
+        if pruned:
+            print(
+                f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
+                "backend (expired/etc.) before they were reviewed",
+                file=sys.stderr,
+            )
+
+        plan_obj = {"candidates": merged}
+        if plan_created_at:
+            plan_obj["created_at"] = plan_created_at
+
+        # This is the actual delivery: if anything below throws, the cycle's drafts
+        # were computed but never reached the store the menu bar reads, and the
+        # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
+        # stderr with `|| true`, so a crash here previously vanished into a local
+        # log nothing central reads — the exact blind spot that cost the 2026-07-08
+        # Karol investigation its root cause. Report it like any other handled
+        # pipeline failure (see twitter_post_plan.py's post-failure capture).
         try:
-            with open(legacy) as f:
-                lp = json.load(f)
-            lc = lp.get("candidates") or []
-            have = {_dedup_key(c) for c in existing}
-            absorbed = [c for c in lc if _dedup_key(c) not in have]
-            existing.extend(absorbed)
-            plan_created_at = plan_created_at or lp.get("created_at")
-            if absorbed:
-                print(
-                    f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
-                    "from legacy /tmp plan into the durable store",
-                    file=sys.stderr,
-                )
+            _atomic_write(dst, plan_obj)
+            ensure_store_symlink()
+
+            # Refresh the review-request marker the menu bar polls. count = cards
+            # actually awaiting review (mirrors s4l_state.candidate_state()'s
+            # awaiting_review bucket): approved-unposted and post_failed rows are
+            # settled decisions, counting them inflated the badge and misled every
+            # human/agent reading the marker.
+            pending_count = len(
+                [
+                    c
+                    for c in merged
+                    if not c.get("posted")
+                    and not c.get("terminal")
+                    and not c.get("post_failed")
+                    and not c.get("approved")
+                ]
+            )
+            project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
+            _atomic_write(
+                review_request_path(),
+                {
+                    "batch_id": REVIEW_QUEUE_ID,
+                    "project": project,
+                    "count": pending_count,
+                    "plan_path": dst,
+                    "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+                },
+            )
         except Exception as e:
-            print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
-    # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
-    # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
-    # approved-queue ledger uses this to ignore decisions that belong to a dead
-    # plan generation; without it, stale (batch, n) entries silently swallow
-    # every new draft after a reset. An existing unstamped plan is left
-    # unstamped: back-stamping it "now" would invalidate live decisions.
-    if not existing and not plan_created_at:
-        plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-
-    seen = {_dedup_key(c) for c in existing}
-    added = 0
-    merged = list(existing)
-    for c in new_cands:
-        k = _dedup_key(c)
-        if k in seen:
-            continue
-        seen.add(k)
-        merged.append(c)
-        added += 1
-
-    stamped, pruned = _sync_with_backend(merged)
-    if stamped:
-        print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
-    if pruned:
+            print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+            try:
+                import sentry_init
+
+                sentry_init.init()
+                sentry_init.capture_message(
+                    f"merge_review_queue delivery failed: {e}",
+                    level="error",
+                    tags={"component": "merge_review_queue", "added": str(added)},
+                    extra={"plan_src": src},
+                )
+                sentry_init.flush(2.0)
+            except Exception:
+                pass
+            return 1
+
         print(
-            f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
-            "backend (expired/etc.) before they were reviewed",
+            f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
+            f"({pending_count} pending total) from {os.path.basename(src)}",
             file=sys.stderr,
         )
-
-    plan_obj = {"candidates": merged}
-    if plan_created_at:
-        plan_obj["created_at"] = plan_created_at
-
-    # This is the actual delivery: if anything below throws, the cycle's drafts
-    # were computed but never reached the store the menu bar reads, and the
-    # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
-    # stderr with `|| true`, so a crash here previously vanished into a local
-    # log nothing central reads — the exact blind spot that cost the 2026-07-08
-    # Karol investigation its root cause. Report it like any other handled
-    # pipeline failure (see twitter_post_plan.py's post-failure capture).
-    try:
-        _atomic_write(dst, plan_obj)
-        ensure_store_symlink()
-
-        # Refresh the review-request marker the menu bar polls. count = cards
-        # actually awaiting review (mirrors s4l_state.candidate_state()'s
-        # awaiting_review bucket): approved-unposted and post_failed rows are
-        # settled decisions, counting them inflated the badge and misled every
-        # human/agent reading the marker.
-        pending_count = len(
-            [
-                c
-                for c in merged
-                if not c.get("posted")
-                and not c.get("terminal")
-                and not c.get("post_failed")
-                and not c.get("approved")
-            ]
-        )
-        project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
-        _atomic_write(
-            review_request_path(),
-            {
-                "batch_id": REVIEW_QUEUE_ID,
-                "project": project,
-                "count": pending_count,
-                "plan_path": dst,
-                "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            },
-        )
-    except Exception as e:
-        print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+        # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
         try:
-            import sentry_init
-
-            sentry_init.init()
-            sentry_init.capture_message(
-                f"merge_review_queue delivery failed: {e}",
-                level="error",
-                tags={"component": "merge_review_queue", "added": str(added)},
-                extra={"plan_src": src},
-            )
-            sentry_init.flush(2.0)
+            os.remove(src)
         except Exception:
             pass
-        return 1
-
-    print(
-        f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
-        f"({pending_count} pending total) from {os.path.basename(src)}",
-        file=sys.stderr,
-    )
-    # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
-    try:
-        os.remove(src)
-    except Exception:
-        pass
-    return 0
+        return 0
+    finally:
+        try:
+            fcntl.flock(_lk, fcntl.LOCK_UN)
+        except Exception:
+            pass
+        _lk.close()
 
 
 if __name__ == "__main__":

package/scripts/store_patch.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Locked field-patcher for the review-queue store.
+
+The review store (review-queue.json) has three writers: the menubar
+(s4l_state._store_update), merge_review_queue.py, and the MCP server. The
+first two hold an fcntl.flock on `<store>.lock` around their read-modify-write;
+the MCP server is Node, which has no native flock, so it routes its store
+writes through THIS script instead of writing the file itself. That closes the
+last unlocked writer (the last-writer-wins race that erased posted stamps on
+2026-07-17 — six live replies rendered as duplicate_thread_pre_post kills).
+
+Protocol-compatible with s4l_state._store_update: same lock file, LOCK_EX for
+the whole read-mutate-replace span, atomic os.replace. fcntl (not an O_EXCL
+lockfile) on purpose: the kernel drops the lock when the holder dies, so there
+is no stale-lock stealing logic to get wrong.
+
+Usage: store_patch.py <patches.json>   (or '-' to read the JSON from stdin)
+
+Input shape:
+  {"patches": [
+      {"candidate_id": 123,          # match ALL rows with this id (ids are NOT
+                                     # unique: sandbox reruns/variant drafts
+                                     # append sibling rows; a stamp that hits
+                                     # only one sibling leaves a drainable twin)
+       "n": 4,                       # 1-based index fallback when candidate_id
+                                     # is absent/None (legacy rows)
+       "set":   {"approved": true},  # fields to assign
+       "unset": ["discard_reason"]}  # fields to delete
+  ]}
+
+Merge rules (mirror mergeApprovedStampsIntoStore):
+  - posted is sticky: a patch may set posted=true, but `set.terminal=true` is
+    ignored on a row whose posted is already true, and posted is never unset.
+Prints {"ok": true, "patched": N} on stdout. Exit 0 even when N=0 (a patch
+matching nothing is not an error; the row may have been absorbed elsewhere).
+"""
+
+from __future__ import annotations
+
+import fcntl
+import json
+import os
+import sys
+
+
+def store_path() -> str:
+    state_dir = os.environ.get("S4L_STATE_DIR") or os.path.join(
+        os.path.expanduser("~"), ".social-autoposter-mcp"
+    )
+    return os.path.join(state_dir, "review-queue.json")
+
+
+def _match_rows(cands: list, patch: dict) -> list:
+    cid = patch.get("candidate_id")
+    if cid is not None:
+        rows = [c for c in cands if c.get("candidate_id") == cid]
+        if rows:
+            return rows
+    n = patch.get("n")
+    if isinstance(n, int) and 1 <= n <= len(cands):
+        return [cands[n - 1]]
+    return []
+
+
+def apply_patches(data: dict, patches: list) -> int:
+    cands = data.get("candidates") or []
+    patched = 0
+    for p in patches:
+        for c in _match_rows(cands, p):
+            sets = dict(p.get("set") or {})
+            if c.get("posted") is True:
+                sets.pop("terminal", None)
+                sets.pop("terminal_reason", None)
+            for k, v in sets.items():
+                if k == "posted" and v is not True and c.get("posted") is True:
+                    continue  # posted is sticky
+                c[k] = v
+            for k in p.get("unset") or []:
+                if k == "posted":
+                    continue
+                c.pop(k, None)
+            patched += 1
+    return patched
+
+
+def main() -> int:
+    src = sys.argv[1] if len(sys.argv) > 1 else "-"
+    raw = sys.stdin.read() if src == "-" else open(src).read()
+    patches = (json.loads(raw) or {}).get("patches") or []
+    sp = store_path()
+    with open(sp + ".lock", "w") as lk:
+        fcntl.flock(lk, fcntl.LOCK_EX)
+        try:
+            try:
+                with open(sp) as f:
+                    data = json.load(f)
+            except Exception:
+                data = {"candidates": []}
+            patched = apply_patches(data, patches)
+            tmp = f"{sp}.tmp.{os.getpid()}"
+            with open(tmp, "w") as f:
+                json.dump(data, f, indent=2)
+            os.replace(tmp, sp)
+        finally:
+            fcntl.flock(lk, fcntl.LOCK_UN)
+    print(json.dumps({"ok": True, "patched": patched}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skill/archive-old-logs.sh

@@ -33,6 +33,30 @@ log "=== archive-old-logs starting (DAYS=$DAYS) ==="
 find "$LOG_DIR" -maxdepth 1 -type f -mtime +"$DAYS" ! -name "$(basename "$RUN_LOG")" -print0 \
   | xargs -0 -I{} mv {} "$ARCHIVE_DIR/" 2>&1 | tee -a "$RUN_LOG" >/dev/null || true
 
+# --- Size-based rotation for live launchd-*.log files (2026-07-17) -----------
+# launchd holds these fds open and appends forever, so the mtime sweep above
+# never touches them: their mtime is always fresh. Found in the wild at 1.9GB
+# (launchd-linkedin-stdout.log) and 694MB (launchd-engage-twitter-stdout.log),
+# which made "grep the logs" surface months-stale content as if it were
+# current (the 2026-07-17 Neon-hostname false alarm).
+# Copy-truncate: gzip the current content into logs-archive with a timestamp,
+# then truncate IN PLACE (same inode) so the launchd fd keeps appending.
+# Lines appended during the gzip window are lost on truncate; acceptable for
+# logs, and the window is seconds. Threshold tunable via ROTATE_MAX_MB.
+ROTATE_MAX_MB="${ROTATE_MAX_MB:-10}"
+find "$LOG_DIR" -maxdepth 1 -type f -name "launchd-*.log" -size +"${ROTATE_MAX_MB}M" -print0 \
+  | while IFS= read -r -d '' f; do
+      base=$(basename "$f" .log)
+      dest="$ARCHIVE_DIR/${base}-$(date +%Y%m%d-%H%M%S).log.gz"
+      if gzip -c "$f" > "$dest" 2>>"$RUN_LOG"; then
+        : > "$f"
+        log "rotated $(basename "$f") -> $(basename "$dest") ($(du -h "$dest" | cut -f1) compressed)"
+      else
+        rm -f "$dest"
+        log "WARN: rotate failed for $f (left untouched)"
+      fi
+    done
+
 remaining=$(find "$LOG_DIR" -maxdepth 1 -type f | wc -l | tr -d ' ')
 archived=$(find "$ARCHIVE_DIR" -maxdepth 1 -type f | wc -l | tr -d ' ')