@m13v/s4l 1.7.1 → 1.7.2-rc.10

package/scripts/claude_job.py

@@ -60,7 +60,6 @@ except Exception:  # pragma: no cover - cosmetic only
 
 # script_tag -> queue type. ONLY pure text->JSON claude calls belong here.
 TAG_TO_TYPE = {
-    "run-twitter-cycle-queries": "twitter-query",
     "run-twitter-cycle-prep": "twitter-prep",
     "feedback-digest": "feedback-digest",
     # Topic-invention lane (queue-native since 2026-07-06; invent_topics.py
@@ -75,11 +74,10 @@ TAG_TO_TYPE = {
 }
 
 # queue type -> (activity state, label) the menu bar shows while the job is in
-# flight. Phase-1 queries drive the X search ("finding threads"); Phase-2b prep is
-# the reply drafting. Both the launchd provider (which blocks for minutes) and the
-# scheduled-task worker (which does the LLM turn) narrate from this one map.
+# flight. Phase-2b prep is the reply drafting. Both the launchd provider (which
+# blocks for minutes) and the scheduled-task worker (which does the LLM turn)
+# narrate from this one map.
 TYPE_TO_ACTIVITY = {
-    "twitter-query": ("scanning", "search"),
     "twitter-prep": ("drafting", "draft"),
     "feedback-digest": ("learning", "feedback"),
     "invent-topic": ("learning", "new topic"),
@@ -335,6 +333,32 @@ def heartbeat_path() -> str:
     return os.path.join(queue_root(), "worker-heartbeat.json")
 
 
+def _arm_deathwatch(job_id: str, qtype: str, batch: str) -> None:
+    """Best-effort dead-man's-switch (2026-07-08): arm scripts/producer_deathwatch.py
+    to flag an UNEXPECTED death (SIGKILL/OOM/hard crash) of THIS process while
+    it's blocked in the cmd_provider() poll loop below — the exact gap that
+    made orphaned salvage results ("worker drafted, no card") unexplainable.
+    Every normal return path in cmd_provider() calls _disarm_deathwatch()
+    first, so a clean exit never produces a report. Shared with
+    run_claude.sh's direct-exec path (every non-queue platform), which calls
+    producer_deathwatch.py's `arm`/`disarm` CLI directly instead of through
+    this Python wrapper — see that file for the single implementation both
+    callers share."""
+    try:
+        import producer_deathwatch as pdw
+        pdw.arm(os.getpid(), job_id, qtype, batch, call_path="queue")
+    except Exception:
+        pass
+
+
+def _disarm_deathwatch(job_id: str) -> None:
+    try:
+        import producer_deathwatch as pdw
+        pdw.disarm(job_id)
+    except Exception:
+        pass
+
+
 def _stamp_heartbeat(event: str, qtype: str | None = None) -> None:
     """Best-effort: never let a heartbeat write failure break the queue."""
     try:
@@ -690,6 +714,7 @@ def cmd_provider(ns) -> int:
     running_path = os.path.join(running_dir(), fname)
     _atomic_write(pending_path, job)
     _plog(f"enqueued {qtype} job {job_id} batch={batch}; waiting for a scheduled task (timeout {ns.timeout}s)")
+    _arm_deathwatch(job_id, qtype, batch)
     # Narrate the (multi-minute) block to the menu bar. The launchd draft lane has
     # no other activity writer, so without this the box looks idle while it works.
     # Cleared by run-draft-and-publish.sh's exit trap at cycle end (and by the
@@ -732,6 +757,7 @@ def cmd_provider(ns) -> int:
             os.remove(res_path)
             if res.get("status") == "error":
                 _plog(f"job {job_id} returned error: {res.get('error', 'unknown')}")
+                _disarm_deathwatch(job_id)
                 return 1
             obj = res.get("result")
             # Emit a claude `--output-format json` shaped envelope so the
@@ -759,6 +785,7 @@ def cmd_provider(ns) -> int:
             except Exception:
                 _ncand = "?"
             _plog(f"consumed result for job {job_id} batch={batch} ({qtype}); {_ncand} candidates -> producer assembles the plan")
+            _disarm_deathwatch(job_id)
             return 0
         time.sleep(POLL_INTERVAL_S)
 
@@ -779,6 +806,7 @@ def cmd_provider(ns) -> int:
     # flicker the ⚠ off). Cleared only when a draft actually drains.
     _bump_drain_timeout()
     _plog(f"timed out after {ns.timeout}s waiting for job {job_id} batch={batch} ({qtype}); removed the job")
+    _disarm_deathwatch(job_id)
     return 79  # mirror run_claude.sh's "blocked, skip cleanly" exit code
 
 

package/scripts/merge_review_queue.py

@@ -129,16 +129,31 @@ STATS_KEYS = (
 )
 
 
-def _enrich_with_stats(cands: list) -> int:
-    """Stamp a `stats` sidecar onto plan candidates that lack one, from the
-    twitter_candidates rows the discovery pipeline already wrote. ONE listing
-    call (/api/v1/twitter-candidates?tweet_urls=...) covers the whole queue.
-    Best-effort: any failure (offline box, missing identity, API error) leaves
-    candidates unstamped and NEVER blocks card delivery. Returns count stamped."""
-    want = [c for c in cands if not c.get("stats") and not c.get("posted") and _thread_url(c)]
-    if not want:
-        return 0
-    urls = sorted({_thread_url(c) for c in want})[:500]
+def _sync_with_backend(cands: list) -> tuple[int, int]:
+    """One bulk /api/v1/twitter-candidates lookup for every still-open candidate
+    (not posted, not terminal), used for two things:
+
+      - stamp the discovery-time `stats` sidecar the card renders (candidates
+        that already have one are left alone), same as the old
+        _enrich_with_stats this replaces.
+      - notice when the backend has ALREADY retired a candidate this plan
+        still thinks is 'pending' (most commonly the Phase 0 freshness gate
+        flipping status='expired' after FRESHNESS_HOURS — see
+        skill/run-twitter-cycle.sh) and mark it terminal here too, same as a
+        human "discard all pending" would. Without this, a card can sit in
+        the review queue as an approvable draft long after the backend has
+        moved on; approving it later silently no-ops (post_drafts returns
+        posted:0, no browser ever launches, no post-*.log — see the
+        2026-07-09 "approved 3 cards, nothing posted" investigation).
+
+    Runs on EVERY merge (every cycle), not just once per candidate, so status
+    drift after the initial stamp is still caught while a card is still
+    pending. Best-effort: any API failure leaves every candidate untouched
+    (fail open, same as before). Returns (stamped_count, pruned_count)."""
+    pending = [c for c in cands if not c.get("posted") and not c.get("terminal") and _thread_url(c)]
+    if not pending:
+        return 0, 0
+    urls = sorted({_thread_url(c) for c in pending})[:500]
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         from http_api import api_get
@@ -149,17 +164,24 @@ def _enrich_with_stats(cands: list) -> int:
         )
         rows = (resp.get("data") or {}).get("candidates") or []
     except BaseException as e:  # http_api raises SystemExit on terminal failure
-        print(f"[merge_review_queue] stats enrichment skipped: {e}", file=sys.stderr)
-        return 0
+        print(f"[merge_review_queue] backend sync skipped: {e}", file=sys.stderr)
+        return 0, 0
     by_url = {str(r.get("tweet_url")): r for r in rows if r.get("tweet_url")}
     stamped = 0
-    for c in want:
+    pruned = 0
+    for c in pending:
         row = by_url.get(_thread_url(c))
         if not row:
             continue
-        c["stats"] = {k: row.get(k) for k in STATS_KEYS}
-        stamped += 1
-    return stamped
+        if not c.get("stats"):
+            c["stats"] = {k: row.get(k) for k in STATS_KEYS}
+            stamped += 1
+        status = row.get("status")
+        if status and status != "pending":
+            c["terminal"] = True
+            c["discard_reason"] = f"backend_status_{status}"
+            pruned += 1
+    return stamped, pruned
 
 
 def main() -> int:
@@ -255,9 +277,15 @@ def main() -> int:
         merged.append(c)
         added += 1
 
-    stamped = _enrich_with_stats(merged)
+    stamped, pruned = _sync_with_backend(merged)
     if stamped:
         print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
+    if pruned:
+        print(
+            f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
+            "backend (expired/etc.) before they were reviewed",
+            file=sys.stderr,
+        )
 
     plan_obj = {"candidates": merged}
     if plan_created_at:
@@ -274,15 +302,17 @@ def main() -> int:
         _atomic_write(dst, plan_obj)
         ensure_store_symlink()
 
-        # Refresh the review-request marker the menu bar polls (count = pending, not posted).
-        pending = len([c for c in merged if not c.get("posted")])
+        # Refresh the review-request marker the menu bar polls (count = pending,
+        # not posted, not terminal -- a just-pruned expired card must not still
+        # inflate the badge).
+        pending_count = len([c for c in merged if not c.get("posted") and not c.get("terminal")])
         project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
         _atomic_write(
             review_request_path(),
             {
                 "batch_id": REVIEW_QUEUE_ID,
                 "project": project,
-                "count": pending,
+                "count": pending_count,
                 "plan_path": dst,
                 "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
             },
@@ -306,7 +336,7 @@ def main() -> int:
 
     print(
         f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
-        f"({pending} pending total) from {os.path.basename(src)}",
+        f"({pending_count} pending total) from {os.path.basename(src)}",
         file=sys.stderr,
     )
     # Clean up the consumed batch plan so /tmp doesn't fill with orphans.

package/scripts/producer_deathwatch.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""producer_deathwatch.py — dead-man's-switch for every Claude-calling
+producer process in the pipeline.
+
+Watches a single PID: either scripts/claude_job.py's blocking provider wait
+(cmd_provider, the queue path used by twitter-prep/feedback-digest/etc.), or
+scripts/run_claude.sh's direct `claude -p` exec (every other platform:
+reddit, linkedin, github, moltbook, instagram, dm-outreach-*, ...). If that
+PID disappears while its arm marker still exists, something killed it
+(SIGKILL / OOM / hard crash) rather than a normal return — a clean return
+always disarms first. This is the exact gap that made orphaned salvage
+results ("worker drafted, no card") unexplainable: the dying process can
+never log its own death, and salvage only sees the aftermath up to
+--max-age-hours later.
+
+On an unexpected death this:
+  1. Snapshots memory pressure + related processes.
+  2. Appends a structured JSON line to producer-deathwatch.jsonl (local,
+     box-only, for offline/box-local debugging).
+  3. POSTs the same event to /api/v1/producer-death-events so it's queryable
+     across every install from Postgres, not just grep-able on one box (see
+     migrations/2026-07-09-producer-death-events.sql).
+  4. Emits a one-line summary via claude_job._plog() into provider.log,
+     which scripts/relay_provider_log.py already ships to Cloud Logging.
+
+Three subcommands, so both Python (claude_job.py) and bash (run_claude.sh)
+callers share one implementation:
+  arm     — write the marker + spawn `watch` detached (start_new_session=True,
+            so it survives being in the same process group as the watched
+            pid if that group gets signaled). Called right before a caller
+            starts blocking on the watched pid.
+  disarm  — remove the marker. Called on every normal return path AND from
+            a signal-trap cleanup (e.g. run_claude.sh's _sa_cleanup, which
+            itself SIGKILLs the watched process group as part of ordinary
+            TERM/INT/HUP handling — that must disarm too, or a normal
+            watchdog-triggered shutdown would misreport as an unexpected
+            death).
+  watch   — the actual poll loop (internal; `arm` spawns this, nothing else
+            should call it directly).
+
+Best-effort throughout: this is diagnostics only, never allowed to affect
+the real job either way.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+from claude_job import queue_root, _plog  # noqa: E402
+
+POLL_S = 5.0
+
+
+def arm_path(job_id: str) -> str:
+    return os.path.join(queue_root(), f"deathwatch-armed-{job_id}.marker")
+
+
+def arm(watch_pid: int, job_id: str, qtype: str, batch: str, call_path: str) -> None:
+    """Write the marker and spawn a detached `watch` subprocess. Best-effort:
+    any failure here must never block the real caller."""
+    try:
+        marker = arm_path(job_id)
+        os.makedirs(queue_root(), exist_ok=True)
+        with open(marker, "w") as f:
+            f.write(str(watch_pid))
+        subprocess.Popen(
+            [sys.executable, os.path.abspath(__file__), "watch",
+             "--watch-pid", str(watch_pid), "--job-id", job_id,
+             "--qtype", qtype, "--batch", batch, "--call-path", call_path],
+            start_new_session=True,
+            stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+    except Exception:
+        pass
+
+
+def disarm(job_id: str) -> None:
+    try:
+        os.remove(arm_path(job_id))
+    except Exception:
+        pass
+
+
+def _snapshot() -> tuple[str, str]:
+    try:
+        vm = subprocess.run(["vm_stat"], capture_output=True, text=True, timeout=5).stdout.strip()
+    except Exception as e:
+        vm = f"(vm_stat failed: {e})"
+    try:
+        procs = subprocess.run(
+            ["/bin/ps", "-axo", "pid=,ppid=,%mem=,%cpu=,command="],
+            capture_output=True, text=True, timeout=5,
+        ).stdout
+        related = "\n".join(
+            ln for ln in procs.splitlines()
+            if "claude" in ln or "run-twitter-cycle" in ln or "run_claude" in ln
+        ) or "(none matching claude/run-twitter-cycle/run_claude)"
+    except Exception as e:
+        related = f"(ps failed: {e})"
+    # Cap length: this rides into a Postgres text column and a JSON line;
+    # keep it bounded so a busy box's ps dump can't balloon either.
+    return vm[:4000], related[:4000]
+
+
+def _report_to_db(event: dict) -> None:
+    """Best-effort POST to /api/v1/producer-death-events. Catches
+    BaseException, not just Exception: http_api._request raises SystemExit
+    on a terminal 4xx/5xx, which must never be allowed to break the
+    diagnostic path (mirrors autopilot_stall_watch.py's same guard)."""
+    try:
+        import http_api  # noqa: E402 (sibling module, HERE already on sys.path)
+        http_api.api_post("/api/v1/producer-death-events", {
+            "watch_pid": event["watch_pid"],
+            "job_id": event["job_id"],
+            "batch_id": event["batch"] if event["batch"] != "-" else None,
+            "qtype": event["qtype"],
+            "call_path": event["call_path"],
+            "vm_stat_summary": event["vm_stat"],
+            "related_processes": event["related_processes"],
+        })
+    except BaseException:
+        pass
+
+
+def watch(watch_pid: int, job_id: str, qtype: str, batch: str, call_path: str) -> int:
+    marker = arm_path(job_id)
+    while True:
+        if not os.path.exists(marker):
+            return 0  # disarmed: the caller returned cleanly, nothing to report
+        try:
+            os.kill(watch_pid, 0)
+        except ProcessLookupError:
+            break  # pid gone but still armed -> unexpected death
+        except PermissionError:
+            pass  # exists, just not signalable from here; keep watching
+        except Exception:
+            pass
+        time.sleep(POLL_S)
+
+    ts = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    vm, related = _snapshot()
+    event = {
+        "ts": ts,
+        "event": "unexpected_death",
+        "watch_pid": watch_pid,
+        "job_id": job_id,
+        "qtype": qtype,
+        "batch": batch,
+        "call_path": call_path,
+        "vm_stat": vm,
+        "related_processes": related,
+    }
+    try:
+        os.makedirs(queue_root(), exist_ok=True)
+        with open(os.path.join(queue_root(), "producer-deathwatch.jsonl"), "a") as f:
+            f.write(json.dumps(event) + "\n")
+    except Exception:
+        pass
+    _report_to_db(event)
+    try:
+        _plog(f"[deathwatch] UNEXPECTED DEATH watch_pid={watch_pid} job={job_id} "
+              f"type={qtype} batch={batch} path={call_path} -> see producer-deathwatch.jsonl")
+    except Exception:
+        pass
+    try:
+        os.remove(marker)
+    except Exception:
+        pass
+    return 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    pa = sub.add_parser("arm")
+    pa.add_argument("--watch-pid", type=int, required=True)
+    pa.add_argument("--job-id", required=True)
+    pa.add_argument("--qtype", default="?")
+    pa.add_argument("--batch", default="-")
+    pa.add_argument("--call-path", default="queue", choices=["queue", "direct"])
+
+    pd = sub.add_parser("disarm")
+    pd.add_argument("--job-id", required=True)
+
+    pw = sub.add_parser("watch")
+    pw.add_argument("--watch-pid", type=int, required=True)
+    pw.add_argument("--job-id", required=True)
+    pw.add_argument("--qtype", default="?")
+    pw.add_argument("--batch", default="-")
+    pw.add_argument("--call-path", default="queue", choices=["queue", "direct"])
+
+    ns = ap.parse_args()
+    if ns.cmd == "arm":
+        arm(ns.watch_pid, ns.job_id, ns.qtype, ns.batch, ns.call_path)
+        return 0
+    if ns.cmd == "disarm":
+        disarm(ns.job_id)
+        return 0
+    return watch(ns.watch_pid, ns.job_id, ns.qtype, ns.batch, ns.call_path)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/run_claude.sh

@@ -200,6 +200,16 @@ _sa_cleanup() {
     rm -f "$SIDE_LOG"
     rm -f "$ACTIVE_FILE"
 
+    # Disarm the deathwatch (see the arm call in the retry loop below). This
+    # path SIGKILLs $CLAUDE_PG's process group a few lines down as ordinary
+    # TERM/INT/HUP handling (e.g. the watchdog killing a genuinely hung run),
+    # so it must disarm too — otherwise a normal forced shutdown would
+    # misreport as an unexpected death once that kill lands.
+    if [ -n "${_SA_DW_JOB:-}" ]; then
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" disarm --job-id "$_SA_DW_JOB" \
+            >/dev/null 2>&1 || true
+    fi
+
     # Sweep orphan claude descendants. Process groups survive the parent's
     # death (kids reparented to launchd keep their PGID), so killing
     # `kill -- -PGID` reaches every grandchild, including ones reparented
@@ -308,8 +318,31 @@ EOF
         { claude --session-id "$SESSION_ID" ${MODEL_ARGS[@]+"${MODEL_ARGS[@]}"} "$@" | tee -a "$SIDE_LOG"; exit "${PIPESTATUS[0]}"; } &
         CLAUDE_PG=$!
         set +m
+        # Dead-man's-switch (2026-07-09): every non-queue-routed tag (reddit,
+        # linkedin, github, moltbook, instagram, dm-outreach-*, ...) blocks
+        # here exactly like claude_job.py's queue provider does, with the
+        # same silent-death risk (SIGKILL/OOM/hard crash while waiting).
+        # Watches THIS SCRIPT's own pid ($$), not $CLAUDE_PG: if only the
+        # claude child dies, `wait` unblocks normally and this script keeps
+        # running (RC-checked, logged, retried) — no observability gap.
+        # The gap is when the WHOLE TREE (this script included) is killed
+        # together, which is what actually happened in the salvage-orphan
+        # cases this was built for. Arm per-attempt (job id includes
+        # $CLAUDE_PG so a retry never collides with a still-unwinding prior
+        # attempt's watcher); disarm right after `wait` returns AND from
+        # _sa_cleanup's trap (that path SIGKILLs $CLAUDE_PG's group as
+        # ordinary TERM/INT/HUP handling, which must disarm too or a normal
+        # watchdog-triggered shutdown would misreport as an unexpected
+        # death). See scripts/producer_deathwatch.py.
+        _SA_DW_JOB="${SESSION_ID}-${CLAUDE_PG}"
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" arm \
+            --watch-pid "$$" --job-id "$_SA_DW_JOB" --qtype "$SCRIPT_TAG" \
+            --batch "${BATCH_ID:-${SA_CYCLE_ID:--}}" --call-path direct \
+            >/dev/null 2>&1 || true
         wait "$CLAUDE_PG"
         RC=$?
+        python3 "$REPO_DIR/scripts/producer_deathwatch.py" disarm --job-id "$_SA_DW_JOB" \
+            >/dev/null 2>&1 || true
         if [ "$RC" -ne 127 ]; then
             break
         fi

package/scripts/salvage_orphaned_prep_results.py

@@ -18,10 +18,14 @@ Safe by construction:
   - Best-effort: any single failure is logged and skipped; never raises.
 
 Degradation vs a normal cycle: salvaged candidates skip the cycle's post-provider
-top-N selection (so MORE cards, which is fine) and lack the tail-link / experiments
-arm stamp that run-twitter-cycle.sh's plan writer adds after the provider returns.
-The reply text itself is complete. A salvaged card is strictly better than a lost
-draft.
+top-N selection (so MORE cards, which is fine), lack the tail-link / experiments
+arm stamp that run-twitter-cycle.sh's plan writer adds after the provider returns,
+and (two-draft schema only) lack assigned_style/assigned_mode, which live in the
+cycle's shell variables, not the model output. The reply text itself IS complete
+end-to-end (_mirror_two_draft_fields backfills reply_text/drafts from
+draft_a_text/draft_b_text for the post-2026-07-07/08 two-draft schema, since the
+model output alone has no reply_text field to check for completeness). A salvaged
+card is strictly better than a lost draft.
 
 Usage:
     python3 scripts/salvage_orphaned_prep_results.py            # automated (safe age gate)
@@ -59,15 +63,73 @@ except Exception:  # standalone fallbacks
             pass
 
 
+def _mirror_two_draft_fields(candidates):
+    """Backfill reply_text/drafts for two-draft-schema candidates (2026-07-07/08
+    redesign) that reach salvage. The normal cycle path (run-twitter-cycle.sh)
+    mirrors draft_a_text onto reply_text/engagement_style/drafts right after the
+    model returns, but salvage bypasses that shell-side step entirely, so an
+    orphaned post-redesign result reached review cards with NEITHER field set.
+    The menubar card (s4l_card.py) reads d.get("drafts") first, then falls back
+    to d.get("reply_text") or "", so those cards rendered the thread with a
+    completely empty editable reply box despite draft_a_text/draft_b_text
+    holding real, already-drafted content (root-caused 2026-07-09 via
+    candidate 374925 and 4 siblings, all missing 'experiments' too, confirming
+    they came through this salvage path rather than a normal cycle write).
+
+    assigned_style/assigned_mode are deliberately left OUT (not set to None,
+    just absent): the picker's per-cycle style assignment lives only in
+    run-twitter-cycle.sh's shell variables, not in the model's JSON output, so
+    it can't be recovered here. twitter_post_plan.py already has a documented
+    fallback for that ("assigned_mode key absent" -> use the plan-level
+    assignment, itself None for a salvaged plan), so leaving the keys out is
+    the safe, already-supported degradation, same class as the existing
+    no-experiments-stamp degradation.
+    """
+    for c in candidates:
+        if not isinstance(c, dict) or "draft_a_text" not in c or "reply_text" in c:
+            continue
+        c["reply_text"] = c.get("draft_a_text") or ""
+        c["engagement_style"] = c.get("draft_a_style") or ""
+        c["new_style"] = c.get("draft_a_new_style")
+        if c.get("draft_a_text_en"):
+            c["reply_text_en"] = c["draft_a_text_en"]
+        draft_b_text = c.get("draft_b_text")
+        if not c.get("is_reused_draft") and draft_b_text:
+            c["drafts"] = [
+                {
+                    "variant": "a", "text": c.get("draft_a_text") or "",
+                    "style": c.get("draft_a_style") or "",
+                    "text_en": c.get("draft_a_text_en"),
+                },
+                {
+                    "variant": "b", "text": draft_b_text,
+                    "style": c.get("draft_b_style") or "",
+                    "text_en": c.get("draft_b_text_en"),
+                },
+            ]
+
+
 def _is_prep_result(obj):
-    """True iff obj looks like a twitter-prep result (candidates with reply_text)."""
+    """True iff obj looks like a twitter-prep result (drafted candidates).
+
+    "reply_text" was the single-draft field before the 2026-07-07/08 two-draft
+    redesign (draft_a_text/draft_b_text per candidate, no single recommended
+    reply). Checking only "reply_text" made every post-redesign orphaned
+    result silently misclassified as non-prep and marked .skipped instead of
+    recovered — the exact "worker drafted but no card" bug this script exists
+    to prevent. Accept either field so both old and current schema results
+    are recognized.
+    """
     if not isinstance(obj, dict):
         return False
     cands = obj.get("candidates")
     if not isinstance(cands, list) or not cands:
         return False
     c0 = cands[0]
-    return isinstance(c0, dict) and "reply_text" in c0 and ("candidate_url" in c0 or "candidate_id" in c0)
+    if not isinstance(c0, dict):
+        return False
+    has_text = "reply_text" in c0 or "draft_a_text" in c0
+    return has_text and ("candidate_url" in c0 or "candidate_id" in c0)
 
 
 def main():
@@ -130,6 +192,7 @@ def main():
                     pass
             continue
 
+        _mirror_two_draft_fields(obj["candidates"])
         n = len(obj["candidates"])
         age_min = (now - st.st_mtime) / 60.0
         _plog(f"[salvage] ORPHAN prep result job {job_id}: producer never consumed it "

package/scripts/scheduled_task_selfheal.py

@@ -266,6 +266,32 @@ def heal() -> dict:
     return summary
 
 
+def can_create_for_active_account() -> bool:
+    """Read-only: would fix 5 (see heal()) actually be able to create a fresh
+    registration right now? True only if the active account (resolved the same
+    way heal() does, via schedule_state's config.json lookup) has at least one
+    EXISTING session directory to write into — fix 5 never fabricates one.
+    Used by callers (the menu bar) to decide whether to offer an automatic
+    "restart to finish setup" action or fall back to the manual re-arm prompt,
+    BEFORE committing to a restart that would turn out to fix nothing."""
+    try:
+        for cfg in schedule_state._config_json_paths():
+            root = os.path.dirname(cfg)
+            uuid = schedule_state._active_account_uuid(cfg)
+            if not uuid:
+                continue
+            account_dir = os.path.join(root, "claude-code-sessions", uuid)
+            session_dirs = [
+                p for p in glob.glob(os.path.join(account_dir, "*"))
+                if os.path.isdir(p)
+            ]
+            if session_dirs:
+                return True
+    except Exception:
+        pass
+    return False
+
+
 def main() -> int:
     out = heal()
     print(json.dumps(out))