@m13v/s4l 1.7.6-rc.8 → 1.7.6

package/mcp/menubar/s4l_menubar.py

@@ -291,6 +291,12 @@ STOP_FLAG = os.path.join(st.state_dir(), "stopped.flag")
 # pauseFlagPath() in mcp/src/index.ts.
 PAUSE_FLAG = os.path.join(st.state_dir(), "paused.flag")
 
+# The launchd kicker label for the drafting pipeline (the twitter cycle: scan,
+# then draft). "Run drafting now" kickstarts it directly — Claude-independent, so
+# it works even when the MCP server / Desktop is closed. Keep in sync with
+# TWITTER_AUTOPILOT_LABEL in mcp/src/index.ts.
+TWITTER_CYCLE_LABEL = "com.m13v.social-twitter-cycle"
+
 # Autopilot scheduled tasks. Queue workers must RUN in a dedicated folder
 # (~/.s4l-worker) so their once-a-minute sessions don't flood the user's
 # interactive Claude Code history (Claude buckets sessions by cwd). s4l-worker
@@ -426,6 +432,43 @@ except Exception:
     AUTOPILOT_RUNNING_STALL_SECONDS = 1200
     DRAFT_STUCK_SECONDS = 1200
 
+# Scheduler-wedge escalation (2026-07-17): tick-freshness 'stalled' stays a quiet
+# diagnostic while drafts drain, but escalates to the ⚠ once the wedge is proven
+# real by THREE independent signals, none of which needs a job to already be
+# stuck (the wedge must be caught even on an idle queue, before any job is
+# harmed):
+#   1. PERSISTENT: no successful worker run for SCHED_WEDGE_ESCALATION_SECONDS.
+#      The per-minute task fires regardless of whether jobs exist, so a healthy
+#      scheduler never lets this age past ~1-2 min — demand-independent.
+#   2. ACTIVE: at least SCHED_WEDGE_MIN_SKIPS recordedSkips in the last hour —
+#      proof Claude Desktop is awake and refusing to fire. A closed lid or a
+#      sleeping box records no skips, so sleep can never trip it.
+#   3. NOT A LEGIT LONG RUN: no fresh claimed job in the queue's running/ dir.
+#      A real 20-40 min draft run holds the overlap guard closed and racks up
+#      per_task_limit skips exactly like the wedge does — but it leaves its
+#      claimed job file in running/. Exempting that case is what lets the
+#      window sit at 30 min instead of 1h without false positives. (A STALE
+#      running/ file past RUNNING_STALL_SECONDS is its own ⚠ via
+#      _autopilot_stalled, which takes priority anyway.)
+# Self-resets: the first successful run drops last_run_age below the bar within
+# one tick_stats refresh (≤60s). The 2026-07-09 flapping regime (83% skips with
+# runs still landing every few minutes) stays quiet forever: signal 1 never
+# accumulates.
+#
+# Thresholds are BACKTESTED, not guessed (2026-07-17, 12.2 days of operator-box
+# history: 9,576 worker sessions + 27,192 recordedSkips replayed per-minute).
+# Real no-fire outages split cleanly into two bands: transient ones (36-41 min,
+# self-recovered before a human could act) and true wedges (62 min to 6.4 h).
+# 45 min sits in the empty gap between the bands: the backtest alarms on all
+# four true wedges, zero transient blips, zero alarms across every healthy
+# hour (worst healthy fire-gap observed: 17 min), and both machine-asleep
+# multi-hour gaps stayed quiet on the zero-skips guard. At 30 min the two
+# transient blips produced 5-6 min nuisance alarms. Retune only with a fresh
+# replay (scripts in the 2026-07-17 session; data = worker-transcript mtimes
+# + registry recordedSkips).
+SCHED_WEDGE_ESCALATION_SECONDS = 2700
+SCHED_WEDGE_MIN_SKIPS = 20
+
 # A poll can read a transient "not stuck" moment (e.g. the activity file
 # between one dying worker attempt and the next claim on the same aged job)
 # even though the underlying episode never really cleared. Without this, each
@@ -537,7 +580,7 @@ class S4LMenuBar(rumps.App):
         self._review_unattended_notified = False
         self._review_unattended_captured = False
         # This session's card decisions, for store reconciliation: the MCP
-        # server's post_drafts rewrites the whole review store from a copy read
+        # server's approve_drafts rewrites the whole review store from a copy read
         # before a minutes-long posting run, so a decision stamped mid-drain can
         # be clobbered; the tick re-stamps anything missing (_reconcile_store).
         self._session_decisions = []
@@ -776,6 +819,51 @@ class S4LMenuBar(rumps.App):
             "that schedules the draft tasks for this account",
         )
 
+    def _restart_claude_for_wedge(self, _=None):
+        """One-click fix for the scheduler_wedged ⚠: fully quit and reopen
+        Claude Desktop. That clears the warm-session pileup behind the
+        scheduler's overlap guard (the per_task_limit skip ledger), which is
+        the known root cause — the task registration itself is fine, so no
+        scheduled-task changes here, unlike _rearm/_finish_schedule_setup.
+        Confirmed with a modal first (the restart closes the user's Claude
+        window), captured so fleet forensics can tie a recovery to the click."""
+        _activate_front()
+        choice = _show_alert(
+            title="Restart Claude Desktop?",
+            message=(
+                "Claude Desktop has stopped running the scheduled draft tasks "
+                "(a known Claude bug where finished sessions pile up and block "
+                "the scheduler). Restarting Claude clears it.\n\n"
+                "Claude's window will close and reopen in a moment; any chat "
+                "in progress will be interrupted."
+            ),
+            ok="Quit & restart Claude", cancel="Cancel",
+        )
+        if choice != 1:  # only default button (OK) proceeds
+            return
+        _capture_msg(
+            "S4L scheduler-wedge restart clicked",
+            phase="scheduler_wedge",
+            surface="menubar",
+            _extra={
+                "detail": (self._stall_reason_info or ("", ""))[1],
+                "registry": _registry_summary_for_capture(),
+            },
+        )
+        self._notify("S4L", "Restarting Claude to un-wedge the draft scheduler…")
+
+        def work():
+            # Capture custom --user-data-dir profiles while Claude is still
+            # alive (unreadable after the kill), same as the update flow.
+            try:
+                user_data_dirs = self._claude_user_data_dirs()
+            except Exception:
+                user_data_dirs = None
+            self._quit_claude_and_wait()
+            self._relaunch_claude(user_data_dirs)
+
+        threading.Thread(target=work, daemon=True).start()
+
     def _finish_schedule_setup(self, _=None):
         """One-click fix for schedule_state == 'missing' when
         scheduled_task_selfheal.can_create_for_active_account() confirms an
@@ -882,8 +970,10 @@ class S4LMenuBar(rumps.App):
         queue has no pending job, running/ is empty, and the drain latch zeroes
         on every successful consume (claude_job._mark_drain_success), so none of
         the three signals can hold a stale True after recovery. Tick-freshness
-        'stalled' from schedule_state no longer flips the ⚠ at all — it renders
-        as a plain diagnostic line (see _build_menu).
+        'stalled' from schedule_state no longer flips the ⚠ at onset — it
+        renders as a plain diagnostic line (see _build_menu) and only escalates
+        once the wedge is persistent AND active (see the SCHED_WEDGE_* block
+        in _tick).
         """
         qroot = os.path.join(st.state_dir(), "claude-queue")
         # (1) latched producer drain-status
@@ -1158,7 +1248,6 @@ class S4LMenuBar(rumps.App):
         if st.read_review_layout() == layout:
             return
         st.write_review_layout(layout)
-        swapped = False
         if self._panel_open:
             try:
                 # _review_mod() is still pinned to the module that owns the
@@ -1176,23 +1265,26 @@ class S4LMenuBar(rumps.App):
                 if self._posts_outstanding <= 0:
                     self._review_active = False
                     self._reset_posting_progress_locked()
-            # Drop the dedup signature so the same pending set presents
-            # fresh on the new surface instead of being suppressed as
-            # "already shown".
-            self._last_review_sig = None
-            swapped = True
-        if swapped:
-            # The user was mid-review and explicitly asked for the other
-            # surface: reopen right away (focus=True also bypasses the
-            # reveal-cadence hold, same as "Review N pending drafts"). If
-            # posting is still draining, _maybe_start_review defers and the
-            # backlog presents on the new surface once the drain completes.
-            try:
-                self._set_snooze(0.0)
-                self._maybe_start_review(focus=True)
-            except Exception as e:
-                sys.stderr.write(f"[s4l-menubar] view mode swap reopen failed: {e}\n")
-                sys.stderr.flush()
+        # Changing the View Mode is a deliberate ask to see the pending drafts in
+        # the newly chosen surface, whether or not a panel was open at the time.
+        # When one was open we just dismissed it above; when none was (the user
+        # had closed/snoozed the stack, THEN switched mode) the old behavior left
+        # nothing on screen and the new surface never appeared until a separate
+        # "Review N pending drafts" click -- the 2026-07-17 Nhat report where a
+        # flip to Canvas seemed to do nothing. Present in the new surface either
+        # way, same posture as that menu click: focus=True clears the snooze and
+        # bypasses the reveal-cadence hold. Drop the dedup signature first so the
+        # same pending set presents fresh on the new surface. With no pending
+        # drafts _maybe_start_review no-ops, so setting the mode ahead of time
+        # still doesn't pop anything; if posting is draining it defers and the
+        # backlog presents on the new surface once the drain completes.
+        self._last_review_sig = None
+        try:
+            self._set_snooze(0.0)
+            self._maybe_start_review(focus=True)
+        except Exception as e:
+            sys.stderr.write(f"[s4l-menubar] view mode present failed: {e}\n")
+            sys.stderr.flush()
         self._sig = None
         try:
             self._tick(None)
@@ -1287,7 +1379,9 @@ class S4LMenuBar(rumps.App):
                 "S4L posting volume",
                 f"Posting volume: {self._posting_mode_label(stored)}. Applies from the next cycle.",
             )
-        except Exception as e:
+        except (Exception, SystemExit) as e:
+            # http_api raises SystemExit on terminal network failure; it must
+            # not escape a rumps menu callback.
             sys.stderr.write(f"[s4l-menubar] posting-mode write failed: {e}\n")
             sys.stderr.flush()
             self._notify(
@@ -2530,13 +2624,18 @@ class S4LMenuBar(rumps.App):
         #     a draft job sat unclaimed, wedged mid-run, or the producer's drain
         #     latch tripped -> ⚠, because THAT is user-visible harm.
         # Tick freshness ('stalled': task present + enabled but lastRunAt stale,
-        # the Desktop warm-session wedge) is DIAGNOSTIC ONLY, never the ⚠: under
-        # the wedge the per-minute tick can skip 70-90% of fires while the queue
-        # still drains every job (jobs arrive ~every 8 min vs 60 fires/hr), so
-        # lastRunAt staleness flip-flopped the icon against a healthy pipeline
-        # (observed on the operator box 2026-07-09: 83% ticks skipped, ~14
-        # posts/hr flowing, icon oscillating). _build_menu renders 'stalled' as
-        # a plain "scheduler degraded" detail line with tick_stats() numbers.
+        # the Desktop warm-session wedge) is diagnostic at onset, never an
+        # instant ⚠: under the wedge the per-minute tick can skip 70-90% of
+        # fires while the queue still drains every job (jobs arrive ~every 8
+        # min vs 60 fires/hr), so lastRunAt staleness flip-flopped the icon
+        # against a healthy pipeline (observed on the operator box 2026-07-09:
+        # 83% ticks skipped, ~14 posts/hr flowing, icon oscillating).
+        # _build_menu renders young/intermittent 'stalled' as a plain detail
+        # line with tick_stats() numbers. It DOES escalate to the ⚠ once the
+        # wedge is proven persistent AND active (2026-07-17, see the
+        # SCHED_WEDGE_* constants + the escalation block below) — that regime
+        # (zero successful fires for an hour while awake) is disjoint from the
+        # flapping one, so the 07-09 fix is preserved.
         # The drain latch IS safe to alarm on now: claude_job._mark_drain_success
         # zeroes it on every successful consume, so it self-clears (the old
         # stayed-stale-after-recovery latch this comment used to warn about
@@ -2634,6 +2733,56 @@ class S4LMenuBar(rumps.App):
                     self._tick_stats = None
         else:
             self._tick_stats = None
+        # Scheduler-wedge escalation (2026-07-17): 'stalled' is quiet while the
+        # wedge is young or intermittent, but once all three wedge signals hold
+        # (persistent + awake + no legit run in flight — see the SCHED_WEDGE_*
+        # constants' comment), the degradation is real -> ⚠ with its own reason
+        # and a one-click, modal-confirmed Claude Desktop restart (the known
+        # cure for the warm-session overlap-guard wedge; the registration
+        # itself is fine, so re-arm is the wrong fix). Deliberately does NOT
+        # wait for a job to be stuck: an idle queue with a wedged scheduler
+        # must alarm too. Every more specific reason keeps priority;
+        # self-clears as soon as a run lands (tick_stats refresh ≤60s behind).
+        if setup_complete and schedule_state == "stalled" and not attention:
+            _ws = self._tick_stats or {}
+            _wage = _ws.get("last_run_age_s")
+            _wskips = _ws.get("skips_in_window") or 0
+            # Signal 3: a FRESH claimed job in running/ means a real (long)
+            # draft run legitimately holds the overlap guard closed — not a
+            # wedge. Stale running/ files past the running-stall bar are the
+            # queue layer's ⚠, which already took priority above.
+            _live_drain = False
+            try:
+                _wq = os.path.join(st.state_dir(), "claude-queue", "running")
+                for _jf in glob.glob(os.path.join(_wq, "*.json")):
+                    if _jf.endswith(".tmp"):
+                        continue
+                    try:
+                        if (time.time() - os.path.getmtime(_jf)) < AUTOPILOT_RUNNING_STALL_SECONDS:
+                            _live_drain = True
+                            break
+                    except OSError:
+                        continue
+            except Exception:
+                pass
+            if (
+                not _live_drain
+                and _wage is not None
+                and _wage >= SCHED_WEDGE_ESCALATION_SECONDS
+                and _wskips >= SCHED_WEDGE_MIN_SKIPS
+            ):
+                attention = True
+                self._stall_reason_info = (
+                    "scheduler_wedged",
+                    f"no run in {int(_wage) // 60}m, "
+                    f"{_wskips} of ~60 ticks skipped last hour",
+                )
+            elif self._stall_reason_info[0] == "scheduler_wedged":
+                # Recovered (a run landed) — clear immediately instead of
+                # waiting for the 30s rate-limit rescan to overwrite it.
+                self._stall_reason_info = ("", "")
+        elif self._stall_reason_info[0] == "scheduler_wedged":
+            self._stall_reason_info = ("", "")
         # Drop the stale "drafting" spinner while we need attention so the ⚠ shows.
         self._stalled = attention
 
@@ -2764,6 +2913,19 @@ class S4LMenuBar(rumps.App):
         self._channel = snap.get("channel") or "stable"
         self._latest_tag = snap.get("latest_tag")
 
+        # Live drafting-pipeline status + next-run countdown — ONE shared module
+        # (scripts/live_status.py) the dashboard widget reads via snapshot.py too,
+        # so the tray and the widget can't drift. Cheap (two small file reads),
+        # computed fresh here rather than off the 4s-cached snap so the countdown
+        # stays honest. Best-effort: any failure leaves an empty dict and the menu
+        # simply omits the drafting status/countdown lines.
+        try:
+            import live_status as _live_status
+
+            self._live = _live_status.compute()
+        except Exception:
+            self._live = {}
+
         # Only rebuild the menu when something user-visible changed, so an open
         # menu isn't torn down under the user's cursor every poll.
         done = (
@@ -2801,20 +2963,22 @@ class S4LMenuBar(rumps.App):
             else None,
             os.path.exists(PAUSE_FLAG),
             pending_count,
-            # Snooze end (0 = not snoozed): rebuilds the menu when a snooze is
-            # set, cleared, or lapses, so the "Snoozed until HH:MM" label and
-            # the review item stay honest.
-            int(self._review_snooze_until)
-            if time.time() < self._review_snooze_until
-            else 0,
             # Reveal cadence: rebuilds when the preset changes (checkmark +
-            # submenu title) and when a hold starts or lapses (the "Next cards
-            # around HH:MM" line in _state_c).
+            # submenu title). The snooze-end and reveal-hold rebuild triggers
+            # were dropped with the _state_c courtesy sublines they drove
+            # (2026-07-17) — nothing visible depends on them anymore.
             round(st.read_reveal_cadence()),
-            int(self._reveal_hold_until(pending_count)),
             # View mode: rebuilds when the review layout changes (checkmark
             # in the "View Mode" submenu + whether the cadence item shows).
             st.read_review_layout(),
+            # Drafting status + countdown (State C): rebuild when the live
+            # pipeline verb changes (idle <-> scanning/drafting/posting) and
+            # when the next-run countdown crosses a 15s bucket — bucketed so an
+            # open menu isn't torn down every second for a -1s tick.
+            self._live.get("activity_state", "idle"),
+            (self._live.get("next_run_secs") // 15)
+            if isinstance(self._live.get("next_run_secs"), int)
+            else None,
         )
         if sig != self._sig:
             self._sig = sig
@@ -2850,7 +3014,7 @@ class S4LMenuBar(rumps.App):
     def _posting_activity_label_locked(self):
         """Progress for the current menu-bar approval burst.
 
-        The server receives one post_drafts call per approved card, so its native
+        The server receives one approve_drafts call per approved card, so its native
         view is always 1/1. The menu bar owns the burst queue and can show the
         useful progress: current approved post / total approved so far.
         """
@@ -3327,7 +3491,7 @@ class S4LMenuBar(rumps.App):
 
             def _persist_reject():
                 try:
-                    st.post_drafts(batch, reject=[n], timeout=30)
+                    st.approve_drafts(batch, reject=[n], timeout=30)
                 except Exception:
                     pass
 
@@ -3447,7 +3611,7 @@ class S4LMenuBar(rumps.App):
 
         def _persist_discard():
             try:
-                st.post_drafts(batch, reject=ns, timeout=60)
+                st.approve_drafts(batch, reject=ns, timeout=60)
             except Exception:
                 pass
             try:
@@ -3582,7 +3746,7 @@ class S4LMenuBar(rumps.App):
     def _post_worker_loop(self):
         # Serialized poster: one approved card at a time so two posts never drive
         # the shared harness Chrome simultaneously. The menu bar passes a burst
-        # progress label into post_drafts, so the spinner shows e.g. "posting 17/95"
+        # progress label into approve_drafts, so the spinner shows e.g. "posting 17/95"
         # even though each server call is still one approved draft.
         while True:
             batch, decision = self._post_q.get()  # blocks until a card is approved
@@ -3599,7 +3763,7 @@ class S4LMenuBar(rumps.App):
                 # through edits=[...] even with no hand-typed change, so the
                 # candidate's style/assigned_style/assigned_mode switch to
                 # match whichever draft is actually posting (mcp/src/index.ts
-                # post_drafts applies both from the same entry). Without
+                # approve_drafts applies both from the same entry). Without
                 # this, a card where the human accepted the recommended
                 # draft as-is (edited=False) would still need its variant
                 # tag carried through for consistency with a later switch.
@@ -3608,19 +3772,19 @@ class S4LMenuBar(rumps.App):
                     edit = {"n": n, "text": decision.get("text") or ""}
                     if draft_variant:
                         edit["variant"] = draft_variant
-                    res = st.post_drafts(
+                    res = st.approve_drafts(
                         batch,
                         edits=[edit],
                         clear_link=cl,
                         activity_label=activity_label,
                     )
                 else:
-                    res = st.post_drafts(batch, post=[n], clear_link=cl, activity_label=activity_label)
+                    res = st.approve_drafts(batch, post=[n], clear_link=cl, activity_label=activity_label)
                 if res is None:
                     # Loopback unreachable (Claude closed, mid-restart, or an
                     # account switch tore down the old MCP server before a new
                     # one registered). Unlike a real posting failure, nothing
-                    # was ever attempted here — post_drafts never reached a
+                    # was ever attempted here — approve_drafts never reached a
                     # server — so there's no double-post risk in retrying.
                     # Deliberately do NOT call store_mark_post_failed: it would
                     # exclude this card from store_pending_posts(), which is
@@ -3707,20 +3871,79 @@ class S4LMenuBar(rumps.App):
             pass
 
     def _render_title(self, setup_complete, ob, blocker, attention=False, pending_count=0):
-        if blocker or attention:
-            base = "S4L ⚠"  # warning (setup blocked OR autopilot needs attention)
-        elif not setup_complete and ob and not ob.get("complete"):
+        # Base label: onboarding progress ("S4L 2/5") while setup is still
+        # running, plain "S4L" once complete.
+        if not setup_complete and ob and not ob.get("complete"):
             done = sum(1 for m in ob["milestones"] if m.get("status") == "complete")
             base = f"S4L {done}/{len(ob['milestones'])}"
-        elif self._update_available:
-            base = "S4L ⬆"  # update available — open the menu to update
         else:
             base = "S4L"
+        # Status markers are INDEPENDENT — each appends its own glyph when active
+        # so a warning and an available update (and anything added later) surface
+        # at the same time (user request 2026-07-17). They used to be mutually
+        # exclusive if/elif branches, where a warning hid a pending update and an
+        # update hid the onboarding count. Order is fixed (warning before update)
+        # so the bar doesn't reshuffle its glyphs as states toggle.
+        if blocker or attention:
+            base += " ⚠"  # warning (setup blocked OR autopilot needs attention)
+        if self._update_available:
+            base += " ⬆"  # update available — open the menu to update
         # Concise inline backlog count, right on the bar (not just the dropdown's
         # "Review N pending drafts") — per user request 2026-07-15, most useful
         # when the reveal cadence is "Never" and this count is the only signal
         # that drafts are waiting.
+        # Setting self.title first lays down the PLAIN title (rumps clears any
+        # prior attributed title via setTitle_), so a backlog that drops back
+        # under the threshold automatically loses its highlight without extra
+        # bookkeeping. _highlight_title_count then re-decorates just the number
+        # when the backlog is large enough to warrant a colored pill.
         self.title = f"{base} · {pending_count}" if pending_count > 0 else base
+        if pending_count > 5:
+            self._highlight_title_count(base, pending_count)
+
+    def _highlight_title_count(self, base, pending_count):
+        """Draw a colored background pill behind the pending-draft NUMBER in the
+        menu-bar title once the backlog gets large: yellow for >5 (6-10), red
+        for >10 (11+). Per user request 2026-07-17 — a plain count is easy to
+        miss, a colored one pulls the eye when drafts are piling up. Applied as
+        an NSAttributedString on the status item's button; on any failure we
+        leave the plain title (already set by the caller) untouched."""
+        try:
+            from AppKit import (
+                NSColor,
+                NSMutableAttributedString,
+                NSForegroundColorAttributeName,
+                NSBackgroundColorAttributeName,
+            )
+            from Foundation import NSMakeRange
+
+            item = getattr(self._nsapp, "nsstatusitem", None)
+            if item is None:
+                return
+            button = item.button() if hasattr(item, "button") else None
+            if button is None:
+                return
+
+            if pending_count > 10:
+                bg = NSColor.systemRedColor()
+                fg = NSColor.whiteColor()
+            else:
+                bg = NSColor.systemYellowColor()
+                fg = NSColor.blackColor()
+
+            num = str(pending_count)
+            # Pad the number with hair spaces so the colored pill has a little
+            # breathing room around the digits instead of hugging them tight.
+            pill = f" {num} "
+            full = f"{base} · {pill}"
+            attr = NSMutableAttributedString.alloc().initWithString_(full)
+            start = full.rfind(pill)
+            rng = NSMakeRange(start, len(pill))
+            attr.addAttribute_value_range_(NSBackgroundColorAttributeName, bg, rng)
+            attr.addAttribute_value_range_(NSForegroundColorAttributeName, fg, rng)
+            button.setAttributedTitle_(attr)
+        except Exception:
+            pass
 
     # ---- menu construction ------------------------------------------------
     def _build_menu(self, runtime_ready, setup_complete, ob, blocker, snap, attention=False, schedule_state="ok", pending_count=0):
@@ -3795,6 +4018,20 @@ class S4LMenuBar(rumps.App):
                 # die before draining. Re-arm can't fix that; Diagnose can.
                 items.append(self._label("⚠ Draft jobs stuck, runs start but don't finish"))
                 items.append(rumps.MenuItem("Diagnose & fix in Claude…", callback=self._diagnose_fix))
+            elif self._stall_reason_info[0] == "scheduler_wedged":
+                # Persistent Desktop scheduler wedge: the task is registered +
+                # enabled but the host has refused every per-minute fire for an
+                # hour+ (warm-session overlap guard, recordedSkips
+                # per_task_limit). The registration is fine, so re-arm is the
+                # wrong fix; the one mechanical cure is a full Claude Desktop
+                # restart, which clears the warm-session pileup. Label is
+                # honest about the disruption before the click (house rule).
+                items.append(self._label("⚠ Claude has stopped running draft tasks"))
+                items.append(self._label("   " + (self._stall_reason_info[1] or "scheduler wedged")))
+                items.append(rumps.MenuItem(
+                    "Fix by restarting Claude Desktop",
+                    callback=self._restart_claude_for_wedge,
+                ))
             elif schedule_state == "disabled":
                 items.append(self._label("⚠ Draft tasks are scheduled but disabled"))
                 items.append(rumps.MenuItem("Set up draft schedule for this account", callback=self._rearm))
@@ -3830,10 +4067,12 @@ class S4LMenuBar(rumps.App):
             # NON-ALARM diagnostic (2026-07-09): the task is registered + enabled
             # for the active account but the host's per-minute tick is stale or
             # mostly skipped (Desktop warm-session wedge). The queue checks above
-            # would have flipped ⚠ if jobs were actually stuck, so reaching here
-            # means drafts still drain; say so with numbers instead of alarming.
-            # tick_stats is cached by _tick (refreshed ≤ once/min, None outside
-            # 'stalled').
+            # would have flipped ⚠ if jobs were actually stuck, and _tick's
+            # scheduler-wedge escalation owns the persistent-wedge ⚠, so reaching
+            # here means drafts still drain; the label says exactly that (the old
+            # "Scheduler degraded" wording read as broken while everything worked,
+            # reworded 2026-07-17). tick_stats is cached by _tick (refreshed ≤
+            # once/min, None outside 'stalled').
             _ts = self._tick_stats or {}
             _skips = _ts.get("skips_in_window")
             _age = _ts.get("last_run_age_s")
@@ -3842,7 +4081,7 @@ class S4LMenuBar(rumps.App):
                 _bits.append(f"{_skips} of ~60 ticks skipped last hour")
             if _age is not None:
                 _bits.append(f"last run {max(0, int(_age)) // 60}m ago")
-            items.append(self._label("Scheduler degraded (drafts still running)"))
+            items.append(self._label("Scheduler skipping runs (drafts unaffected)"))
             if _bits:
                 items.append(self._label("   " + ", ".join(_bits)))
             # Keep the one-click remedy reachable without dressing it as urgent:
@@ -3856,6 +4095,38 @@ class S4LMenuBar(rumps.App):
             items += self._state_b(ob, blocker)
         else:
             items += self._state_c(snap, pending_count)
+            # Drafting-pipeline control (post-setup, every State-C menu regardless
+            # of pending drafts): ONE line — the action is the phrase, the live
+            # state is in brackets. The pipeline scans first, then hands off to the
+            # drafter; this mirrors the dashboard widget, both reading
+            # scripts/live_status.py so the surfaces can't drift.
+            #   idle    -> "Run drafting now (next run in 42s)"  [clickable]
+            #   running -> "Run drafting now (drafting…)"        [greyed]
+            #   paused  -> "Run drafting now (paused)"           [greyed]
+            # Clickable only when idle & not paused: while a run is in flight
+            # launchd would just no-op the single instance, and while paused the
+            # kicker is unloaded so nothing would run.
+            live = getattr(self, "_live", {}) or {}
+            act_state = live.get("activity_state", "idle")
+            running = act_state in ("scanning", "drafting", "posting")
+            paused = os.path.exists(PAUSE_FLAG)
+            if paused:
+                _bracket = "paused"
+            elif running:
+                _bracket = f"{act_state}…"
+            else:
+                _secs = live.get("next_run_secs")
+                _bracket = (
+                    f"next run in {self._fmt_countdown(_secs)}"
+                    if isinstance(_secs, int)
+                    else "next run within a minute"
+                )
+            _text = f"Run drafting now ({_bracket})"
+            items.append(rumps.separator)
+            if paused or running:
+                items.append(self._label(_text))  # greyed: can't run right now
+            else:
+                items.append(rumps.MenuItem(_text, callback=self._run_drafting))
 
         # Engagement lanes — ALWAYS visible (every state), not just post-setup, so
         # the user can see + flip either lane any time. Two INDEPENDENT checkmarks
@@ -3917,9 +4188,10 @@ class S4LMenuBar(rumps.App):
             items.append(cadence_menu)
 
         # Posting volume: server-side per-install throttle (virality bar).
-        # read_posting_mode() is cached and non-blocking; unknown/unset shows
-        # as Steady (the server resolves unset the same way), corrected on the
-        # rebuild after the first refresh lands.
+        # read_posting_mode() is cached and non-blocking; the cache is seeded
+        # from the on-disk last-known copy at boot, so a restart keeps showing
+        # the user's chosen mode. Genuinely unset shows as Steady (the server
+        # resolves unset the same way), corrected after the first refresh.
         pv_mode = st.read_posting_mode() or "medium"
         pv_menu = rumps.MenuItem(
             f"Posting volume: {self._posting_mode_label(pv_mode).split(' (')[0].lower()}"
@@ -3995,6 +4267,45 @@ class S4LMenuBar(rumps.App):
         item.set_callback(None)
         return item
 
+    @staticmethod
+    def _fmt_countdown(secs):
+        """Compact 'Ns' / 'm:ss' for the next-scan countdown line."""
+        try:
+            s = max(0, int(secs))
+        except Exception:
+            return "under a minute"
+        if s < 60:
+            return f"{s}s"
+        return f"{s // 60}:{s % 60:02d}"
+
+    def _run_drafting(self, _=None):
+        """Run the drafting pipeline ONE time immediately by kickstarting the
+        launchd kicker (com.m13v.social-twitter-cycle). Same mechanism the MCP's
+        run_drafting tool and the first-run onboarding kick use — the job runs
+        THROUGH launchd with its full baked env + singleton lock, so it is NOT a
+        bare hand-run of the cycle. Done directly here (not via the loopback tool)
+        so it works even when Claude Desktop / the MCP server is closed.
+        Best-effort + off the UI thread so a slow launchctl never freezes the
+        tray."""
+        def work():
+            try:
+                r = subprocess.run(
+                    ["launchctl", "kickstart", f"gui/{os.getuid()}/{TWITTER_CYCLE_LABEL}"],
+                    capture_output=True,
+                    timeout=15,
+                )
+                if r.returncode == 0:
+                    self._notify("S4L", "Drafting started — new drafts land in a few minutes.")
+                else:
+                    self._notify("S4L", "Couldn’t start drafting. Try again in a moment.")
+            except Exception:
+                self._notify("S4L", "Couldn’t start drafting. Try again in a moment.")
+            # Repaint promptly so the status line flips to "Scanning now…" without
+            # waiting for the next natural rebuild.
+            self._sig = None
+
+        threading.Thread(target=work, daemon=True).start()
+
     # State A — runtime not installed yet.
     def _state_a(self):
         return [
@@ -4056,47 +4367,21 @@ class S4LMenuBar(rumps.App):
         if pending_count <= 0:
             return []
         plural = "s" if pending_count != 1 else ""
-        items = [
+        # Just the clickable review item — no secondary grey subline. The old
+        # snooze / reveal-cadence courtesy lines ("Snoozed until…", "Next cards
+        # around…", "Cards hidden…", "Canvas opens from the review item above")
+        # were removed per user request (2026-07-17): "Review N pending drafts"
+        # opens them right now regardless of the pop-up pacing, so the extra line
+        # only restated the click behavior. The reveal-cadence + snooze controls
+        # still live in _build_menu; this just drops the redundant readout.
+        # No bulk-discard item here either: "Discard all…" lives in the review
+        # card's title bar (2026-07-10).
+        return [
             rumps.MenuItem(
                 f"Review {pending_count} pending draft{plural}",
                 callback=self._review_now,
             )
         ]
-        # The review-surface picker ("View Mode") lives in _build_menu now
-        # (2026-07-16): always visible, not just while something is pending.
-        if time.time() < self._review_snooze_until:
-            items.append(
-                self._label(
-                    "Snoozed until "
-                    + time.strftime(
-                        "%H:%M", time.localtime(self._review_snooze_until)
-                    )
-                )
-            )
-        else:
-            # Reveal-cadence hold: the backlog exists but the pop-up is being
-            # paced, or suppressed entirely ("Never"). Same courtesy line as
-            # the snooze; "Review N pending drafts" above shows them right
-            # now regardless.
-            hold_until = self._reveal_hold_until(pending_count)
-            if hold_until < 0:
-                if st.read_review_layout() == "cards":
-                    items.append(self._label("Cards hidden — see count in the menu bar"))
-                else:
-                    # Canvas mode: it never auto-opens; the review item above
-                    # is the one way in.
-                    items.append(self._label("Canvas opens from the review item above"))
-            elif hold_until:
-                items.append(
-                    self._label(
-                        "Next cards around "
-                        + time.strftime("%H:%M", time.localtime(hold_until))
-                    )
-                )
-        # No bulk-discard item here anymore: "Discard all…" lives in the
-        # review card's title bar (2026-07-10). Reaching it with no card open
-        # is "Review N pending drafts" -> Discard all, two clicks.
-        return items
 
 
 if __name__ == "__main__":