@m13v/s4l 1.7.6-rc.8 → 1.7.6

package/mcp/dist/index.js

@@ -6,7 +6,7 @@
 //                     via the host create_scheduled_task. The autopilot then drafts
 //                     on its own (launchd kicker + queue worker); there is no manual
 //                     "draft now" tool.
-//   post_drafts     - post the drafts the user chose by number from a batch.
+//   approve_drafts     - post the drafts the user chose by number from a batch.
 //   get_stats    - read-only post + engagement stats.
 //
 // THIN wrapper. The pipeline brain (scan, score, drafting prompts, posting)
@@ -37,7 +37,7 @@ const PANEL_URI = "ui://social-autoposter/panel.html";
 const PRODUCT_LINK_URI = "ui://social-autoposter/product-link.html";
 // Stable id for the accumulating draft review queue. Each draft cycle appends its
 // drafts here (dedup by tweet URL) so the menu-bar cards PILE UP across a
-// continuous autopilot instead of each run overwriting the last; post_drafts posts
+// continuous autopilot instead of each run overwriting the last; approve_drafts posts
 // the approved subset and marks them posted (filtered out of the cards thereafter).
 const REVIEW_QUEUE_ID = "review-queue";
 // ---- Queue-backed drafting (2026-06-23) -----------------------------------
@@ -397,12 +397,12 @@ const server = new McpServer({
         "(configure the product project) -> `queue_setup` + " +
         "`create_scheduled_task` (set up the draft autopilot once) -> the autopilot then runs on its own " +
         "(scans, drafts via the queue + worker, and merges into the approval cards; nothing posts) -> the " +
-        "user approves in the menu bar -> `post_drafts` (post the approved ones) -> `get_stats` (see " +
+        "user approves in the menu bar -> `approve_drafts` (post the approved ones) -> `get_stats` (see " +
         "performance). Run `project_config` first; the other tools refuse until a " +
         "project is fully configured. To change anything about a project later, call `project_config` " +
         "again with the project's name and just the changed fields — there is no separate config editor.\n\n" +
         "RENDER THE DASHBOARD AFTER ACTIONS. After any state-changing or results-producing tool call " +
-        "(`post_drafts`, `get_stats`, `project_config`), end your turn by " +
+        "(`approve_drafts`, `get_stats`, `project_config`), end your turn by " +
         "calling the `dashboard` tool so the user sees the updated state visually. Do NOT call " +
         "`dashboard` after pure Q&A, config explanations, or status-only checks that changed nothing.\n\n" +
         "REPORT FIELD DIAGNOSES. Whenever an S4L setup, healing, or troubleshooting flow FAILS, or " +
@@ -421,7 +421,7 @@ const baseRegisterTool = server.registerTool.bind(server);
 // show a spinner + label while they run (either invocation path). draft_cycle is
 // NOT here — it writes finer scanning/drafting phases itself (see produceDrafts).
 const TOOL_ACTIVITY = {
-    post_drafts: "posting",
+    approve_drafts: "posting",
     get_stats: "stats…",
 };
 function toolActivityLabel(name, args) {
@@ -748,7 +748,7 @@ async function produceDrafts(project, onProgress) {
 }
 // Render every draft in a batch as a numbered, human-readable table. This IS the
 // review surface now: the model relays this table to the user and asks which
-// numbers to post / edit, then posts the chosen ones via the `post_drafts` tool.
+// numbers to post / edit, then posts the chosen ones via the `approve_drafts` tool.
 //
 // We used to gather approvals through MCP elicitation (a checkbox form), but the
 // desktop "Code tab" host doesn't advertise the `elicitation` capability (only
@@ -757,10 +757,12 @@ async function produceDrafts(project, onProgress) {
 function renderDraftsTable(plan) {
     const candidates = plan.candidates || [];
     return candidates
-        // Number by FULL-array index (matches post_drafts + the menu bar), then drop
+        // Number by FULL-array index (matches approve_drafts + the menu bar), then drop
         // already-finished entries so the cards only show what's still pending.
         .map((c, i) => ({ c, n: i + 1 }))
-        .filter((e) => e.c.posted !== true && e.c.terminal !== true && e.c.approved !== true)
+        // awaiting_review is the ONLY state the review surfaces present (same rule
+        // as the menubar cards and the review-request.json count).
+        .filter((e) => candidateState(e.c) === "awaiting_review")
         // The queue is append-only; newest drafts have the highest stable index.
         // Show those first so review starts with likely-live tweets instead of stale
         // low-number drafts that have been sitting around for hours.
@@ -771,7 +773,7 @@ function renderDraftsTable(plan) {
         const reply = c.reply_text ?? "(empty)";
         // The literal tail URL is NOT known yet: at post time a short link is minted
         // from this target (e.g. fazm.ai/cc -> s4l.ai/r/<code>). Approved drafts
-        // always carry the link (post_drafts forces TWITTER_TAIL_LINK_RATE=1.0), so
+        // always carry the link (approve_drafts forces TWITTER_TAIL_LINK_RATE=1.0), so
         // this is the target that WILL be appended. Show the TARGET only; never
         // pre-mint the real /r/ code (that would waste pool codes / split clicks).
         const link = c.link_url
@@ -846,40 +848,28 @@ function parsePostCandidateResults(stdout) {
     }
     return [...byId.values()];
 }
-// Resolve the configured posting handle the SAME way account_resolver.py does:
-// AUTOPOSTER_TWITTER_HANDLE env first, then config.json accounts.twitter.handle.
-// Returns the bare handle (no @) or null. The post preflight uses it so a missing
-// handle fails ONCE, loudly, instead of as N silent per-reply no_account_configured
-// skips (twitter_browser.py refuses to post with no handle — no impersonation).
-function readConfiguredTwitterHandle() {
+// Resolve the posting @handle through the ONE resolver (scripts/account_resolver.py:
+// env AUTOPOSTER_TWITTER_HANDLE -> config.json accounts.twitter.handle -> the durable
+// connect-time cookie mirror). Deferring to it, instead of re-reading config.json here,
+// keeps a single resolution path shared with the poster (twitter_browser.our_handle),
+// and keeps the handle in a single durable home (the cookie mirror) rather than a
+// second copy in config.json. Returns the bare handle (no @) or null; the preflight
+// refuses loudly on null so a missing handle fails ONCE, not as N silent per-reply
+// no_account_configured skips (and never as a hardcoded impersonation fallback).
+async function resolvePostingHandle() {
     const env = (process.env.AUTOPOSTER_TWITTER_HANDLE || "").trim().replace(/^@/, "");
     if (env)
         return env;
     try {
-        const cfg = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
-        const h = cfg?.accounts?.twitter?.handle;
-        const s = (typeof h === "string" ? h : "").trim().replace(/^@/, "");
-        return s || null;
-    }
-    catch {
-        return null;
-    }
-}
-// Self-heal a missing handle: read the live logged-in @handle from the managed
-// Chrome and persist it to config.json accounts.twitter.handle. This is ground
-// truth (the poster posts through that exact session), NOT a guess — so it's safe
-// where a hardcoded fallback would not be. Closes the onboarding gap where
-// connect_x's best-effort handle capture silently no-op'd and left posting dead.
-// Best-effort; never throws — the caller re-checks and refuses loudly if still unset.
-async function ensurePostingHandle() {
-    try {
-        await runPython("scripts/setup_twitter_auth.py", ["resolve-handle"], {
-            timeoutMs: 60_000,
+        const r = await runPython("scripts/account_resolver.py", ["twitter"], {
+            timeoutMs: 30_000,
             env: ({ S4L_REPO_DIR: repoDir(), PATH: pipelinePath() }),
         });
+        const h = (r.stdout || "").trim().replace(/^@/, "");
+        return h || null;
     }
     catch {
-        /* best effort */
+        return null;
     }
 }
 async function ensureTwitterBrowserForPost() {
@@ -929,6 +919,17 @@ function isSandboxCandidate(c) {
     const id = Number(c.candidate_id);
     return Number.isFinite(id) && id >= 900_000_000;
 }
+function candidateState(c) {
+    if (c.posted === true)
+        return "posted";
+    if (c.terminal === true)
+        return "terminal";
+    if (c.post_failed)
+        return "post_failed";
+    if (c.approved === true)
+        return "approved";
+    return "awaiting_review";
+}
 // Write field patches into the review-queue store UNDER ITS LOCK by shelling
 // to scripts/store_patch.py, which takes the same fcntl.flock the menubar's
 // _store_update and merge_review_queue.py hold around their read-modify-write.
@@ -990,7 +991,12 @@ async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
                     set.terminal = false;
                     if (c.our_url)
                         set.our_url = c.our_url;
-                    unset.push("discard_reason");
+                    // Clear a stale failure stamp too: the menubar's per-card call can
+                    // see posted=0 (the batch drain posted it under a different call)
+                    // and stamp post_failed on a card that IS live (seen on 565462,
+                    // 2026-07-17). posted is the settled truth; the residue just adds a
+                    // false "didn't post" signal to dashboards/notifications.
+                    unset.push("discard_reason", "post_failed", "post_error");
                 }
                 else if (c.terminal === true) {
                     set.terminal = true;
@@ -1040,8 +1046,12 @@ async function mergeApprovedStampsIntoStore(batchId, plan, stamped) {
                         if (c.our_url)
                             f.our_url = c.our_url;
                         // A post outcome closes the card's history: the pre-approval
-                        // freshness stamp must not survive it.
+                        // freshness stamp must not survive it. Same for a stale
+                        // post_failed from a peer call's posted=0 misattribution (see
+                        // the locked-patch branch above).
                         delete f.discard_reason;
+                        delete f.post_failed;
+                        delete f.post_error;
                     }
                     else if (c.terminal === true && f.posted !== true) {
                         f.terminal = true;
@@ -1116,7 +1126,7 @@ async function postApproved(batchId, plan) {
                 attempted: 0,
                 exit_code: 0,
                 summary: "another posting drain has been running for 8+ minutes; approved cards stay " +
-                    "queued in the review store — re-run post_drafts once it finishes",
+                    "queued in the review store — re-run approve_drafts once it finishes",
             };
         }
         if (waited) {
@@ -1155,14 +1165,29 @@ async function postApproved(batchId, plan) {
     // An approved card whose only blocker is an overridable backend-expiry stamp is
     // included: approval outranks the freshness gate (see expiredStampOverridable),
     // and the stamp is cleared so every downstream terminal check agrees it's live.
-    const approved = (plan.candidates || []).filter((c) => c.approved === true &&
-        c.posted !== true &&
-        (c.terminal !== true || expiredStampOverridable(c)) &&
-        // Prompt-sandbox replays can never post (twitter_post_plan.py post_one()
-        // hard-refuses them), so draining one is pure churn: it burns a browser
-        // lock turn and, if its terminal stamp later loses a store-write race,
-        // loops forever. Exclude them here regardless of stamp state.
-        !isSandboxCandidate(c));
+    // Drain-eligible, in canonical state terms (candidateState — keep in lockstep
+    // with s4l_state.candidate_state). DELIBERATE deviations from a plain
+    // state === "approved" check, each load-bearing:
+    //   - post_failed cards DO drain again (the transient-retry path, bounded by
+    //     MAX_POST_ATTEMPTS at result time). The menubar's restart-resume path
+    //     (store_pending_posts) skips them by design; this drain is where they
+    //     get their bounded retries.
+    //   - an approved card whose ONLY terminal stamp is the freshness gate's
+    //     backend_status_expired is resurrected: the human approval outranks the
+    //     expiry (2 of 3 approvals lost on 2026-07-10 without this).
+    //   - sandbox replays never drain (twitter_post_plan.py post_one()
+    //     hard-refuses them, so draining one is pure churn and can loop forever
+    //     if its terminal stamp loses a store-write race).
+    const approved = (plan.candidates || []).filter((c) => {
+        if (isSandboxCandidate(c))
+            return false;
+        if (c.approved !== true)
+            return false;
+        const s = candidateState(c);
+        return (s === "approved" ||
+            s === "post_failed" ||
+            (s === "terminal" && expiredStampOverridable(c)));
+    });
     for (const c of approved) {
         if (c.terminal === true) {
             c.terminal = false;
@@ -1230,7 +1255,7 @@ async function postApproved(batchId, plan) {
                         redditFailed++;
                         continue;
                     }
-                    // The card's reply_text is the CANONICAL text (post_drafts edits write
+                    // The card's reply_text is the CANONICAL text (approve_drafts edits write
                     // there); the embedded decision still carries the draft-time original.
                     // Posting dec.text verbatim would silently discard a human edit.
                     const decPost = {
@@ -1304,7 +1329,7 @@ async function postApproved(batchId, plan) {
                     }
                     else {
                         // Leave the approval sticky (approved && !posted && !terminal) so the
-                        // next post_drafts call retries, mirroring twitter's failed-drain
+                        // next approve_drafts call retries, mirroring twitter's failed-drain
                         // semantics; only stamp terminal on a conclusive CDP refusal. This
                         // list MUST stay a superset of post_reddit.py's own
                         // _PERMANENT_CDP_ERRORS (account_blocked_in_sub, no_permalink) —
@@ -1373,9 +1398,8 @@ async function postApproved(batchId, plan) {
     // If onboarding never persisted it, self-heal from the live session; if even that
     // can't determine it, refuse here with a clear reason rather than launching a
     // poster that silently burns the whole batch.
-    if (!readConfiguredTwitterHandle())
-        await ensurePostingHandle();
-    if (!readConfiguredTwitterHandle()) {
+    const postingHandle = await resolvePostingHandle();
+    if (!postingHandle) {
         postingActive = false;
         stopPostingFlagHeartbeat();
         return {
@@ -1383,9 +1407,9 @@ async function postApproved(batchId, plan) {
             exit_code: 0,
             posted: 0,
             summary: "no_account_configured",
-            error: "X is connected but no posting @handle is configured, so every reply would be refused " +
-                "(no_account_configured). Re-run project_config action:'connect_x' to capture the handle, " +
-                "or set accounts.twitter.handle in config.json.",
+            error: "X is connected but no posting @handle could be resolved (env, config, or the " +
+                "connect-time cookie mirror), so every reply would be refused (no_account_configured). " +
+                "Re-run project_config action:'connect_x' to re-capture the handle.",
         };
     }
     // Mark posting active so the draft-cycle scan DEFERS launching any scan for the
@@ -1409,7 +1433,7 @@ async function postApproved(batchId, plan) {
         // we can write our own pid) — a pathological edge case, not the normal path.
         // Bail out rather than proceed without ever confirming we hold it. Approved
         // cards stay sticky (approved && !posted && !terminal), so the very next
-        // post_drafts call — the next approval, or this same tool retried — picks
+        // approve_drafts call — the next approval, or this same tool retried — picks
         // them straight back up; nothing is lost or re-queued.
         postingActive = false;
         stopPostingFlagHeartbeat();
@@ -1417,7 +1441,7 @@ async function postApproved(batchId, plan) {
             attempted: 0,
             exit_code: 0,
             summary: "couldn't pin down the twitter-browser lock after repeated attempts; approved cards " +
-                "stay queued — re-run post_drafts to retry",
+                "stay queued — re-run approve_drafts to retry",
         };
     }
     const approvedBatch = `${batchId}_approved`;
@@ -1473,9 +1497,9 @@ async function postApproved(batchId, plan) {
                     // are now no-ops for the normal path — every approved candidate
                     // already carries tail_link_variant by the time it reaches this MCP
                     // tool. They're left in place as a defense-in-depth fallback for the
-                    // rare case a candidate reaches post_drafts unstamped (e.g. a plan
+                    // rare case a candidate reaches approve_drafts unstamped (e.g. a plan
                     // already in flight from before this change): S4L_SKIP_LINK_TAIL=1
-                    // still guarantees post_drafts (a synchronous call the user is
+                    // still guarantees approve_drafts (a synchronous call the user is
                     // waiting on) never makes a blocking Claude/queue call at post time,
                     // no matter what.
                     TWITTER_TAIL_LINK_RATE: "1.0",
@@ -1517,7 +1541,7 @@ async function postApproved(batchId, plan) {
         const postLogDir = path.join(repoDir(), "skill", "logs");
         fs.mkdirSync(postLogDir, { recursive: true });
         const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-        fs.writeFileSync(path.join(postLogDir, `post-${stamp}.log`), `# post_drafts batch=${batchId} approved=${approvedTwitter.length} exit=${res.code} ` +
+        fs.writeFileSync(path.join(postLogDir, `post-${stamp}.log`), `# approve_drafts batch=${batchId} approved=${approvedTwitter.length} exit=${res.code} ` +
             `shell_lock=${heldShellLock}\n\n=== stdout ===\n${res.stdout}\n\n=== stderr ===\n${res.stderr}\n`);
     }
     catch {
@@ -1596,7 +1620,7 @@ async function postApproved(batchId, plan) {
                 // ... waited 45s, giving up."). None of those mean the draft is
                 // doomed, only that this attempt didn't get a turn with the shared
                 // browser. Leave the card sticky (approved && !posted && !terminal)
-                // so the next post_drafts call retries it, mirroring Reddit's
+                // so the next approve_drafts call retries it, mirroring Reddit's
                 // _TRANSIENT_CDP_ERRORS handling. Unconditionally marking terminal
                 // here (found 2026-07-16) silently and permanently discarded 7 real
                 // approved drafts on nothing worse than lock contention — Reddit's
@@ -1649,7 +1673,7 @@ async function postApproved(batchId, plan) {
     // actionable error on its own.
     const hasRealFailure = res.code !== 0 || Boolean(summObj?.failure_reasons);
     if (hasRealFailure) {
-        captureError(new Error(`post_drafts: ${realPosted}/${approvedTwitter.length} posted (exit=${res.code})`), {
+        captureError(new Error(`approve_drafts: ${realPosted}/${approvedTwitter.length} posted (exit=${res.code})`), {
             component: "post",
             exit_code: String(res.code),
             attempted: String(approvedTwitter.length),
@@ -2467,6 +2491,7 @@ tool("project_config", {
         const r = await redditConnect(args.reddit_source, args.reddit_manual_login);
         let verified = false;
         let configNote;
+        let redditKicker;
         if (r.connected) {
             completeOnboardingMilestone("reddit_connected", { state: r.state });
             // Persist the discovered username through the server's config-write
@@ -2491,11 +2516,18 @@ tool("project_config", {
                 });
             }
             // Reddit is live: install the discovery kicker (idempotent; gated on
-            // runtime + project readiness inside, and it never touches a
-            // hand-built plist pointing outside the managed package).
-            void ensureRedditKickerInstalled()
-                .then((res) => console.error(`[reddit-kicker] post-connect install: ${res.ok ? "ok" : "skip"} (${res.detail})`))
-                .catch((e) => console.error("[reddit-kicker] post-connect install failed:", e?.message || e));
+            // runtime + draftable-lane readiness inside, and it never touches a
+            // hand-built plist pointing outside the managed package). Await it and
+            // surface the result on the response so a skip (e.g. no ready project AND
+            // no active persona) is VISIBLE instead of failing silently to stderr.
+            try {
+                redditKicker = await ensureRedditKickerInstalled();
+                console.error(`[reddit-kicker] post-connect install: ${redditKicker.ok ? "ok" : "skip"} (${redditKicker.detail})`);
+            }
+            catch (e) {
+                redditKicker = { ok: false, detail: e?.message || String(e) };
+                console.error("[reddit-kicker] post-connect install failed:", e?.message || e);
+            }
         }
         else {
             blockOnboardingMilestone("reddit_connected", `reddit_${r.state || "not_connected"}`, r.error || r.note || summarizeRedditAuth(r), { state: r.state || "not_connected" });
@@ -2516,11 +2548,20 @@ tool("project_config", {
             summary: summarizeRedditAuth(r),
             note: r.note,
             attempts: r.attempts,
+            // The launchd discovery kicker's install result (or skip reason), so the
+            // agent can SEE whether reddit drafting is actually scheduled rather than
+            // assuming "connected" means "producing drafts".
+            discovery_job: redditKicker,
             onboarding: onboardingSnapshot(),
             next_step: r.connected
-                ? "Reddit is connected. The reddit discovery job installs itself once a project is " +
-                    "configured; drafts flow into the same review cards as X and nothing posts without " +
-                    "approval." +
+                ? (redditKicker?.ok
+                    ? "Reddit is connected and the discovery job is scheduled (runs every ~15 min); " +
+                        "drafts flow into the same review cards as X and nothing posts without approval."
+                    : "Reddit is connected, but the discovery job is NOT scheduled yet (" +
+                        (redditKicker?.detail || "unknown") + "). It installs automatically once a product " +
+                        "project is ready OR personal_brand mode is on with a ready persona; until then no " +
+                        "reddit drafts will appear. Drafts, once flowing, land in the same review cards as X " +
+                        "and nothing posts without approval.") +
                     (r.warning ? " Relay the `warning` field to the user so expectations are set." : "")
                 : r.state === "needs_login"
                     ? "The user must finish signing in to reddit.com in the Chrome window that opened. Tell " +
@@ -2822,11 +2863,11 @@ tool("project_config", {
         return textContent(`Setup failed: ${e.message}`);
     }
 });
-// ---- post_drafts: post the user's chosen drafts from a batch ---------------
+// ---- approve_drafts: post the user's chosen drafts from a batch ---------------
 // Second half of the manual loop. The user reviewed the menu-bar cards a draft
 // cycle produced and said which numbers to post / edit; this posts exactly those.
 // Editing a draft implies posting it. Indices are 1-based, matching the table.
-tool("post_drafts", {
+tool("approve_drafts", {
     title: "Post chosen drafts",
     description: "Post the drafts the user approved from a draft cycle. Pass the batch_id from the " +
         "approval cards and the user's decision by NUMBER (1-based, matching the table): `post` is " +
@@ -2895,7 +2936,7 @@ tool("post_drafts", {
             return;
         }
         const c = candidates[n - 1];
-        if (c.posted === true) {
+        if (candidateState(c) === "posted") {
             warnings.push(`#${n} already posted; not rejecting`);
             return;
         }
@@ -3013,7 +3054,7 @@ tool("post_drafts", {
     }
     // STICKY approve: record the approval DURABLY and never clear another card's
     // prior approval. The old `c.approved = approve.has(i+1)` reset every card on
-    // each call, so a later post_drafts for a different card dropped a
+    // each call, so a later approve_drafts for a different card dropped a
     // restart-interrupted approved card back into "pending". postApproved filters
     // posted/terminal, so the approved set only ever drains what's genuinely left.
     approve.forEach((n) => {
@@ -3051,7 +3092,7 @@ tool("post_drafts", {
         });
         storeWriteDone = await patchReviewStore(patches);
         if (!storeWriteDone)
-            console.error("[post_drafts] store_patch.py failed; falling back to unlocked plan write");
+            console.error("[approve_drafts] store_patch.py failed; falling back to unlocked plan write");
     }
     if (!storeWriteDone)
         writePlan(batch_id, plan);
@@ -3326,6 +3367,71 @@ tool("restart_menubar", {
         menubar_running: running,
     });
 });
+// ---- run_drafting: run the drafting pipeline immediately -------------------
+// The drafting pipeline (the twitter cycle) is what the user triggers: it SCANS
+// for threads first, then hands off to the drafter, so from the user's view this
+// is "run drafting now". It runs on the launchd kicker's fixed StartInterval;
+// this nudges launchd to fire it RIGHT NOW via `launchctl kickstart` — the EXACT
+// same mechanism the first-run onboarding kick uses (ensureQueueKickerInstalled):
+// the job runs THROUGH launchd with its full baked env + the run-*-singleton.sh
+// lock, so it is NOT a bare `bash run-twitter-cycle.sh` (which would leave an
+// empty-plan artifact). launchd keeps a single instance, so if a run is already
+// underway this is a harmless no-op; while paused the kicker is unloaded, so we
+// report that rather than kick nothing.
+//
+// This is deliberately NOT the removed run_draft_cycle / draft_cycle tool: it
+// spawns no warm in-chat Claude draft session, it only asks launchd to run the
+// already-scheduled cycle one interval early. Do NOT re-introduce a draft_cycle.
+tool("run_drafting", {
+    title: "Run the drafting pipeline now",
+    description: "Run the drafting pipeline ONE time immediately instead of waiting for the next scheduled run. " +
+        "The pipeline scans for threads and then drafts replies, so this is the 'run now' control behind " +
+        "the menu bar + dashboard button. It nudges the existing launchd job to run one interval early; " +
+        "it does NOT change the schedule. If a run is already underway it's a no-op, and if S4L is paused " +
+        "it reports that (nothing runs while paused). Use when the user asks to run drafting, draft now, " +
+        "run the pipeline, run now, or check for new threads immediately.",
+    inputSchema: {},
+}, async () => {
+    if (isPaused()) {
+        return jsonContent({
+            ok: false,
+            paused: true,
+            detail: "S4L is paused — resume it first, then drafting can run.",
+        });
+    }
+    const uid = process.getuid ? process.getuid() : 0;
+    const kick = await run("launchctl", ["kickstart", `gui/${uid}/${TWITTER_AUTOPILOT_LABEL}`], { timeoutMs: 15_000 });
+    const ok = kick.code === 0;
+    return jsonContent({
+        ok,
+        detail: ok
+            ? "Drafting started — new drafts land in a few minutes."
+            : `Could not start drafting (launchctl rc=${kick.code}).`,
+    });
+});
+// ---- drafting_status: live pipeline status + next-run countdown ------------
+// A cheap, pure READ the dashboard widget polls (~5s) to keep its drafting status
+// pill + countdown live between heavier snapshot refreshes. Returns the SAME
+// fields the menu bar renders (scripts/live_status.py — activity_state,
+// next_run_secs, …), plus `paused`, so the two surfaces can't drift. No side
+// effects: safe to poll and to replay over the loopback /tool/ endpoint.
+tool("drafting_status", {
+    title: "Live drafting-pipeline status + next-run countdown",
+    description: "Read-only: what the drafting pipeline is doing right now (scanning/drafting/posting/idle) and " +
+        "how many seconds until the next scheduled run. Backs the dashboard's live status pill + " +
+        "countdown. Pure read; safe to poll frequently.",
+    inputSchema: {},
+}, async () => {
+    let live = {};
+    try {
+        const res = await runPython("scripts/live_status.py", [], { timeoutMs: 10_000 });
+        live = JSON.parse((res.stdout || "").trim().split("\n").slice(-1)[0] || "{}");
+    }
+    catch {
+        live = {};
+    }
+    return jsonContent({ ...live, paused: isPaused() });
+});
 // ---- posting_volume: per-install posting-volume mode (virality bar) --------
 // Server-side throttle (2026-07-13): installations.posting_mode maps to a
 // virality-bar percentile on the API (high~0.90, medium~0.97, low~0.995) and
@@ -3946,12 +4052,12 @@ function queueWorkerAllowedTools() {
         "Grep",
         // This server's tools, both namespaces (manifest name + protocol name).
         "mcp__social-autoposter__queue_setup",
-        "mcp__social-autoposter__post_drafts",
+        "mcp__social-autoposter__approve_drafts",
         "mcp__social-autoposter__project_config",
         "mcp__social-autoposter__get_stats",
         "mcp__social-autoposter__dashboard",
         "mcp__S4L__queue_setup",
-        "mcp__S4L__post_drafts",
+        "mcp__S4L__approve_drafts",
         "mcp__S4L__project_config",
         "mcp__S4L__get_stats",
         "mcp__S4L__dashboard",
@@ -4157,31 +4263,45 @@ function kickerEnv() {
         // The persona lane exports =0 per cycle via s4l_mode.py env (link-free
         // organic replies); promotion cycles keep the script's own default so
         // draft-only-OFF posts carry the project link per the A/B gate, and card posts
-        // still force =1.0 inside post_drafts.
+        // still force =1.0 inside approve_drafts.
         // Virality bar percentile is NOT set here: it is hardcoded to 0.90 in
         // skill/run-twitter-cycle.sh (single source of truth, no env dependency).
     };
 }
+// Shared draftability gate for BOTH autopilot kickers (X queue + Reddit search).
+// A launchd discovery/draft kicker only makes sense to schedule when SOMETHING is
+// draftable, and the definition of "draftable" is identical across platforms — so
+// it lives here as the single source of truth. Two paths qualify:
+//   (a) a managed product project is ready (promotion lane), OR
+//   (b) personal_brand mode is on AND the persona is ready (self-promo lane).
+// Path (b) is easy to miss: the persona is deliberately excluded from the
+// managed-products scope (see ensurePersonaProject), so a personal-brand-only
+// install has an empty managedProjects() and a product-only check is always
+// false. That gap silently sank the X kicker (fixed 2026-06-30) and then the
+// Reddit kicker (fixed 2026-07-16, which reused the product-only check instead of
+// this persona-aware one). Keeping both kickers on this ONE helper means the
+// personal-brand path can never regress on one platform but not the other.
+function draftableLaneStatus() {
+    const productReady = listManagedProjectStatus().some((p) => p.ready);
+    if (productReady)
+        return { draftable: true, detail: "ready project" };
+    const personaActive = currentFlags().personal_brand && personaReady();
+    if (personaActive) {
+        return { draftable: true, detail: "active persona (personal_brand)" };
+    }
+    return { draftable: false, detail: "no ready project or active persona yet" };
+}
 async function ensureQueueKickerInstalled() {
     try {
         if (process.platform !== "darwin")
             return { ok: false, detail: "not macOS" };
         if (!runtimeReady())
             return { ok: false, detail: "runtime not ready" };
-        // Gate: install the kicker when SOMETHING is draftable. Two paths qualify:
-        //   (a) a managed product project is ready (promotion lane), OR
-        //   (b) personal_brand mode is on AND the persona is ready (self-promo lane).
-        // Path (b) was the 2026-06-30 gap: a personal-brand-only setup has no managed
-        // project, so the old `anyReady` check was always false and the kicker never
-        // installed (no drafts, no first-run kick). The persona is excluded from
-        // managed scope by design, so check it explicitly.
-        const productReady = listManagedProjectStatus().some((p) => p.ready);
-        const personaActive = currentFlags().personal_brand && personaReady();
-        if (!productReady && !personaActive) {
-            return {
-                ok: false,
-                detail: "no ready project or active persona yet",
-            };
+        // Gate: install the kicker only when SOMETHING is draftable (product lane OR
+        // active persona). See draftableLaneStatus — shared with the Reddit kicker.
+        const lane = draftableLaneStatus();
+        if (!lane.draftable) {
+            return { ok: false, detail: lane.detail };
         }
         // Additional gate: X must be connected and verified before autopilot starts.
         // This prevents wasted cycles against a logged-out x.com if X connection didn't
@@ -4299,9 +4419,14 @@ async function ensureRedditKickerInstalled() {
             return { ok: false, detail: "not macOS" };
         if (!runtimeReady())
             return { ok: false, detail: "runtime not ready" };
-        const productReady = listManagedProjectStatus().some((p) => p.ready);
-        if (!productReady)
-            return { ok: false, detail: "no ready project yet" };
+        // Gate: install the kicker only when SOMETHING is draftable. Mirror the X
+        // queue kicker EXACTLY via the shared draftableLaneStatus — a personal-brand-
+        // only install has no managed product, so the old product-only check here made
+        // this kicker permanently uninstallable (no reddit drafts) even with a ready
+        // persona (2026-07-16 bug). Both kickers now share the one persona-aware gate.
+        const lane = draftableLaneStatus();
+        if (!lane.draftable)
+            return { ok: false, detail: lane.detail };
         // Reddit session gate. status is read-only (never launches Chrome): a live
         // me.json validation when the harness is up, the on-disk profile cookie
         // check (connected_idle) when it isn't.
@@ -4590,15 +4715,15 @@ async function ensureMemorySnapshotInstalled() {
 }
 // ---- pause/resume: stop drafting/posting without touching Claude Desktop ---
 // Unlike Quit (which kills + relaunches Claude Desktop and deletes the draft
-// schedule), Pause only unloads the launchd jobs that actually DO work — the
-// kicker that scans/drafts/posts (TWITTER_AUTOPILOT_LABEL) plus its reaper,
-// stall-watch, and memory-snapshot support daemons — while leaving Claude
-// Desktop, the tray, and the Claude-native s4l-worker scheduled task alone.
-// The scheduled task still fires on its own cadence; claude_job.py's `next`
-// checks the same flag file and reports "no work" instantly instead of
+// schedule), Pause only unloads the launchd jobs that actually DO work — every
+// pipeline kicker (X cycle, Reddit discovery) plus the reaper, stall-watch, and
+// memory-snapshot support daemons — while leaving Claude Desktop, the tray, and
+// the Claude-native s4l-worker scheduled task alone. The scheduled task still
+// fires on its own cadence; claude_job.py's `next` checks the same flag file
+// (at entry AND on every poll iteration) and reports "no work" instead of
 // draining the queue, so nothing drafts or posts while paused even if a
 // worker session wakes up mid-pause. A flag file (nothing is deleted) is what
-// makes Resume a plain reinstall of the same 4 daemons — see resumeS4L.
+// makes Resume a plain reinstall of the same daemons — see resumeS4L.
 function pauseFlagPath() {
     return path.join(s4lStateDir(), "paused.flag");
 }
@@ -4610,15 +4735,38 @@ function isPaused() {
         return false;
     }
 }
+// THE single registry of pausable pipeline daemons. Pause unloads exactly this
+// set, Resume reinstalls exactly this set (each ensure re-applies its own
+// install gates: draftable lane, reddit connected, etc.), boot skips exactly
+// this set while paused, and the label list is mirrored to
+// <state>/pause-targets.json so the menubar's Python pause button
+// (mcp/menubar/s4l_state.py) acts on the same set without a second hardcoded
+// list. Add a new pipeline daemon HERE and every pause surface picks it up.
+// Feedback-digest is deliberately absent: it only distills past review
+// decisions, not drafting/posting, so it keeps running while paused.
 const PAUSE_TARGETS = [
-    { label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST },
-    { label: REAPER_LABEL, plist: REAPER_PLIST },
-    { label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST },
-    { label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST },
+    { tag: "queue-worker", label: TWITTER_AUTOPILOT_LABEL, plist: TWITTER_AUTOPILOT_PLIST, ensure: ensureQueueKickerInstalled },
+    { tag: "reddit-kicker", label: REDDIT_SEARCH_LABEL, plist: REDDIT_SEARCH_PLIST, ensure: ensureRedditKickerInstalled },
+    { tag: "claude-reaper", label: REAPER_LABEL, plist: REAPER_PLIST, ensure: ensureClaudeReaperInstalled },
+    { tag: "stall-watch", label: STALL_WATCH_LABEL, plist: STALL_WATCH_PLIST, ensure: ensureStallWatchInstalled },
+    { tag: "memory-snapshot", label: MEMORY_SNAPSHOT_LABEL, plist: MEMORY_SNAPSHOT_PLIST, ensure: ensureMemorySnapshotInstalled },
 ];
+// Mirror the pausable label set into the state dir for the menubar's Python
+// pause/resume (which can't import this module). Written at boot and on every
+// pause/resume so the two surfaces can't drift.
+function writePauseTargetsManifest() {
+    try {
+        fs.mkdirSync(s4lStateDir(), { recursive: true });
+        fs.writeFileSync(path.join(s4lStateDir(), "pause-targets.json"), JSON.stringify({ labels: PAUSE_TARGETS.map((t) => t.label) }) + "\n", "utf-8");
+    }
+    catch {
+        /* best-effort */
+    }
+}
 async function pauseS4L() {
     if (isPaused())
         return { ok: true, detail: "already paused" };
+    writePauseTargetsManifest();
     try {
         fs.mkdirSync(path.dirname(pauseFlagPath()), { recursive: true });
         fs.writeFileSync(pauseFlagPath(), `paused at ${new Date().toISOString()}\n`, "utf-8");
@@ -4646,17 +4794,18 @@ async function resumeS4L() {
     catch {
         /* best-effort */
     }
-    const kicker = await ensureQueueKickerInstalled();
-    const reaper = await ensureClaudeReaperInstalled();
-    const stall = await ensureStallWatchInstalled();
-    const mem = await ensureMemorySnapshotInstalled();
-    const detail = [
-        `kicker: ${kicker.ok ? "ok" : "skip"} (${kicker.detail})`,
-        `reaper: ${reaper.ok ? "ok" : "skip"} (${reaper.detail})`,
-        `stall-watch: ${stall.ok ? "ok" : "skip"} (${stall.detail})`,
-        `memory-snapshot: ${mem.ok ? "ok" : "skip"} (${mem.detail})`,
-    ].join("; ");
-    return { ok: true, detail };
+    writePauseTargetsManifest();
+    const results = [];
+    for (const t of PAUSE_TARGETS) {
+        try {
+            const r = await t.ensure();
+            results.push(`${t.tag}: ${r.ok ? "ok" : "skip"} (${r.detail})`);
+        }
+        catch (e) {
+            results.push(`${t.tag}: ${e?.message || e}`);
+        }
+    }
+    return { ok: true, detail: results.join("; ") };
 }
 // Install/refresh the on-screen overlay watcher launchd job. Promotes the
 // harness status overlay from a best-effort, fired-from-other-tools nicety to a
@@ -5344,7 +5493,7 @@ function persistStatusSummary(snap) {
 // chat-table review path is unchanged and still works; this just ALSO lets the
 // corner cards drive review (both surfaces de-dup via the plan's `posted` flag).
 // The menu bar reads review-request.json, presents the cards, posts via the
-// loopback post_drafts tool, then clears the file. Best-effort: a write failure
+// loopback approve_drafts tool, then clears the file. Best-effort: a write failure
 // just means no pop-ups this batch (chat review still works).
 function writeReviewRequest(req) {
     try {
@@ -5528,7 +5677,7 @@ function sigkillAllScans() {
 }
 // ---- Lock grace-hold: hold the /tmp lock CONTINUOUSLY across per-card posts ----
 // The plist pipeline acquires the browser lock ONCE and holds it through the whole
-// posting phase. The MCP posts per approved card (separate post_drafts calls), and
+// posting phase. The MCP posts per approved card (separate approve_drafts calls), and
 // the old code acquired+released the lock PER CARD — leaving a release window
 // BETWEEN every card that a parked scan stale-reclaimed (the hijack). Instead we
 // keep the lock and only release it after SHELL_LOCK_GRACE_MS of no posting, so the
@@ -5683,7 +5832,7 @@ appTool("dashboard", {
         "connection, autopilot state, and 7-day stats, with buttons to set up the schedule, connect X, " +
         "and refresh. Use when the user asks to see the dashboard, panel, " +
         "status, or controls. ALSO call this at the end of any state-changing or results-producing " +
-        "action (post_drafts, get_stats, project_config) so the user sees the " +
+        "action (approve_drafts, get_stats, project_config) so the user sees the " +
         "updated dashboard. Hosts without UI support get the same data as text.",
     inputSchema: {},
     // fallback_url is set only when the host can't render the ui:// resource and
@@ -5697,7 +5846,7 @@ appTool("dashboard", {
         (snap.update_available && snap.latest_version ? ` (update to ${snap.latest_version})` : "") +
         ` — projects ${snap.projects_ready}/${snap.projects_total} ready, ` +
         `X ${snap.x_connected ? "connected" : "not connected"}, ` +
-        `autopilot ${snap.autopilot_on ? "on" : "off"}.`;
+        `autopilot ${snap.paused ? "PAUSED" : snap.autopilot_on ? "on" : "off"}.`;
     const base = {
         content: [{ type: "text", text: human }],
         structuredContent: { snapshot: JSON.stringify(snap) },
@@ -5949,70 +6098,34 @@ async function main() {
     catch (e) {
         console.error(`[queue-worker] could not create worker folder: ${e?.message || e}`);
     }
-    // The 4 pipeline daemons (kicker, reaper, stall-watch, memory-snapshot) are
-    // skipped at boot while paused.flag is present, so a Claude Desktop restart
+    // Pausable pipeline daemons — one loop over the SAME registry pause/resume
+    // use (PAUSE_TARGETS: X kicker, reddit kicker, reaper, stall-watch,
+    // memory-snapshot), so boot can never install a daemon Pause doesn't cover.
+    // Each is skipped while paused.flag is present, so a Claude Desktop restart
     // during a Pause doesn't silently un-pause the pipeline — see pauseS4L/
-    // resumeS4L. Feedback-digest is NOT gated: it only distills past review
-    // decisions, not drafting/posting, so it's harmless to keep running.
-    if (!isPaused()) {
-        void ensureQueueKickerInstalled()
-            .then((r) => console.error(`[queue-worker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[queue-worker] kicker install failed:", e?.message || e));
-    }
-    else {
-        console.error("[queue-worker] launchd kicker: skip (paused)");
-    }
-    // Reddit discovery kicker (optional platform): installs only when reddit is
-    // connected AND a project is ready; a box that never connected reddit is a
-    // cheap no-op skip. Paused-gated like the X kicker (it produces drafts).
-    if (!isPaused()) {
-        void ensureRedditKickerInstalled()
-            .then((r) => console.error(`[reddit-kicker] launchd kicker: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[reddit-kicker] kicker install failed:", e?.message || e));
-    }
-    else {
-        console.error("[reddit-kicker] launchd kicker: skip (paused)");
-    }
-    // Self-healing reaper for the agent-mode session leak the queue autopilot
-    // produces (finished `claude` worker sessions Desktop never tears down). A
-    // standalone guardrail; install unconditionally so it caps memory even on a
-    // box whose project isn't ready yet. Best-effort; must never block boot.
-    if (!isPaused()) {
-        void ensureClaudeReaperInstalled()
-            .then((r) => console.error(`[claude-reaper] launchd reaper: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[claude-reaper] reaper install failed:", e?.message || e));
-    }
-    else {
-        console.error("[claude-reaper] launchd reaper: skip (paused)");
+    // resumeS4L. Each ensure keeps its own install gates (draftable lane, reddit
+    // connected, etc.); a box that never connected reddit is a cheap no-op skip.
+    // The boot-time call also SELF-HEALS installs broken by older gates: once a
+    // gate passes, the plist lands on the next boot. All best-effort; never block
+    // boot.
+    writePauseTargetsManifest();
+    for (const t of PAUSE_TARGETS) {
+        if (isPaused()) {
+            console.error(`[${t.tag}] launchd ${t.label}: skip (paused)`);
+            continue;
+        }
+        void t.ensure()
+            .then((r) => console.error(`[${t.tag}] launchd: ${r.ok ? "ok" : "skip"} (${r.detail})`))
+            .catch((e) => console.error(`[${t.tag}] launchd install failed:`, e?.message || e));
     }
     // Feedback digest: hourly distillation of the user's card approve/reject
     // decisions into learned_preferences (see scripts/feedback_digest.py).
-    // Best-effort; a box with no review events runs a no-op.
+    // Best-effort; a box with no review events runs a no-op. NOT pause-gated (and
+    // not in PAUSE_TARGETS): it only distills past review decisions, not
+    // drafting/posting, so it's harmless to keep running.
     void ensureFeedbackDigestInstalled()
         .then((r) => console.error(`[feedback-digest] launchd digest: ${r.ok ? "ok" : "skip"} (${r.detail})`))
         .catch((e) => console.error("[feedback-digest] digest install failed:", e?.message || e));
-    // Autopilot stall watchdog: fleet-side Sentry alert when the draft routines stop
-    // draining (most often an account switch orphaning them). The menu bar shows the
-    // user the Re-arm action; this is the part we see. Best-effort; never blocks boot.
-    if (!isPaused()) {
-        void ensureStallWatchInstalled()
-            .then((r) => console.error(`[stall-watch] launchd watchdog: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[stall-watch] watchdog install failed:", e?.message || e));
-    }
-    else {
-        console.error("[stall-watch] launchd watchdog: skip (paused)");
-    }
-    // Periodic host-resource sampler (memory/process snapshot -> local JSONL). Gives
-    // us per-box resource history to diagnose RAM blowups (e.g. the agent-mode
-    // session leak). Best-effort; never blocks boot. Disable with S4L_MEMORY_SNAPSHOT=0.
-    if (!isPaused()) {
-        void ensureMemorySnapshotInstalled()
-            .then((r) => console.error(`[memory-snapshot] launchd sampler: ${r.ok ? "ok" : "skip"} (${r.detail})`))
-            .catch((e) => console.error("[memory-snapshot] sampler install failed:", e?.message || e));
-    }
-    else {
-        console.error("[memory-snapshot] launchd sampler: skip (paused)");
-    }
     // On-screen overlay watcher supervisor. The harness status overlay only renders
     // while the watcher process is alive, and that watcher had no supervisor — when
     // it died nothing respawned it and the overlay silently vanished. Install it as