@m13v/s4l 1.7.6-rc.2 → 1.7.6-rc.21

package/scripts/merge_review_queue.py

@@ -168,6 +168,14 @@ def _reddit_plan_to_candidates(plan: dict) -> list:
             "thread_url": d.get("thread_url"),
             "thread_author": d.get("thread_author"),
             "thread_text": d.get("thread_title") or "",
+            # Reddit threads carry a title (thread_text, above) AND a body
+            # (selftext). Both matter to a reviewer: the title alone often
+            # can't be judged without the post body it heads. The card renders
+            # the title bold and the selftext beneath it in the same quote box
+            # (2026-07-17 user direction). Link posts / title-only threads have
+            # an empty selftext, so the card falls back to title-only. Decisions
+            # carry it as `selftext` (from the candidate) or `thread_selftext`.
+            "thread_selftext": d.get("selftext") or d.get("thread_selftext") or "",
             "matched_project": plan.get("project_name"),
             "reply_text": d.get("text"),
             "engagement_style": d.get("engagement_style"),
@@ -265,17 +273,45 @@ def _sync_with_backend(cands: list) -> tuple[int, int]:
         and not (c.get("experiments") or {}).get("sandbox")
         and _thread_url(c)
     ]
-    if not pending:
+    # Approved-but-unposted cards get the INVERSE sync: never pruned (the
+    # approval is a settled human decision, see docstring above), but if the
+    # backend row says the reply already LANDED (status='posted'), stamp
+    # posted=True here so the store agrees with the database. Without this
+    # there is no path that ever corrects a lost posted stamp: the drain's
+    # in-process stamp can lose a whole-file write race against the menubar
+    # or a peer drain, after which the card shows failed/terminal forever
+    # while the reply is live on X (2026-07-17 incident: 6 posted replies
+    # rendered as duplicate_thread_pre_post kills).
+    approved_open = [
+        c
+        for c in cands
+        if c.get("approved")
+        and not c.get("posted")
+        and c.get("platform") != "reddit"
+        and not (c.get("experiments") or {}).get("sandbox")
+        and _thread_url(c)
+    ]
+    if not pending and not approved_open:
         return 0, 0
-    urls = sorted({_thread_url(c) for c in pending})[:500]
+    urls = sorted({_thread_url(c) for c in pending} | {_thread_url(c) for c in approved_open})[:500]
     try:
         sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
         from http_api import api_get
 
-        resp = api_get(
-            "/api/v1/twitter-candidates",
-            query={"tweet_urls": ",".join(urls), "limit": 500},
-        )
+        # Scope to OUR candidate rows: the bulk GET has no tenant isolation,
+        # so without install_id another install's row for the same tweet_url
+        # (e.g. two customers discovering one viral thread) could be read
+        # back as "our" status and mis-stamp posted/terminal on our card.
+        query = {"tweet_urls": ",".join(urls), "limit": 500}
+        try:
+            from identity import get_identity
+
+            own_install = (get_identity() or {}).get("install_id")
+            if own_install:
+                query["install_id"] = own_install
+        except Exception:
+            pass  # fail open: unscoped lookup, same behavior as before
+        resp = api_get("/api/v1/twitter-candidates", query=query)
         rows = (resp.get("data") or {}).get("candidates") or []
     except BaseException as e:  # http_api raises SystemExit on terminal failure
         print(f"[merge_review_queue] backend sync skipped: {e}", file=sys.stderr)
@@ -295,6 +331,14 @@ def _sync_with_backend(cands: list) -> tuple[int, int]:
             c["terminal"] = True
             c["discard_reason"] = f"backend_status_{status}"
             pruned += 1
+    for c in approved_open:
+        row = by_url.get(_thread_url(c))
+        if row and row.get("status") == "posted":
+            c["posted"] = True
+            c["terminal"] = False
+            c.pop("post_failed", None)
+            c.pop("post_error", None)
+            stamped += 1
     return stamped, pruned
 
 
@@ -347,137 +391,156 @@ def main() -> int:
     # cycle process and only that process knows them.
 
     dst = store_path()
-    existing = []
-    plan_created_at = None
-    if os.path.exists(dst):
-        try:
-            with open(dst) as f:
-                prev = json.load(f)
-            existing = prev.get("candidates") or []
-            plan_created_at = prev.get("created_at")
-        except Exception:
-            existing = []
-            plan_created_at = None
-    # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
-    # written by old code after a reboot) so no pending draft or decision flag
-    # is lost, then ensure_store_symlink() below replaces it with the link.
-    legacy = plan_path(REVIEW_QUEUE_ID)
-    if os.path.exists(legacy) and not os.path.islink(legacy):
+    # ---- store lock ---------------------------------------------------
+    # Hold the SAME fcntl.flock the menubar's _store_update and the MCP's
+    # store_patch.py take, for the whole read->merge->write span. Without
+    # it this function was a last-writer-wins whole-file rewrite: a card
+    # decision stamped between our read (below) and _atomic_write was
+    # silently erased (the 2026-07-17 truth-loss family, including the
+    # resurrected sandbox approval that posted for real). The lock covers
+    # one bulk API call (_sync_with_backend); worst case a menubar decision
+    # write blocks for a few seconds once per cycle, which beats losing it.
+    import fcntl
+    _lk = open(dst + ".lock", "w")
+    fcntl.flock(_lk, fcntl.LOCK_EX)
+    try:
+        existing = []
+        plan_created_at = None
+        if os.path.exists(dst):
+            try:
+                with open(dst) as f:
+                    prev = json.load(f)
+                existing = prev.get("candidates") or []
+                plan_created_at = prev.get("created_at")
+            except Exception:
+                existing = []
+                plan_created_at = None
+        # Absorb a REAL file at the legacy /tmp location (pre-upgrade store, or one
+        # written by old code after a reboot) so no pending draft or decision flag
+        # is lost, then ensure_store_symlink() below replaces it with the link.
+        legacy = plan_path(REVIEW_QUEUE_ID)
+        if os.path.exists(legacy) and not os.path.islink(legacy):
+            try:
+                with open(legacy) as f:
+                    lp = json.load(f)
+                lc = lp.get("candidates") or []
+                have = {_dedup_key(c) for c in existing}
+                absorbed = [c for c in lc if _dedup_key(c) not in have]
+                existing.extend(absorbed)
+                plan_created_at = plan_created_at or lp.get("created_at")
+                if absorbed:
+                    print(
+                        f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
+                        "from legacy /tmp plan into the durable store",
+                        file=sys.stderr,
+                    )
+            except Exception as e:
+                print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
+        # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
+        # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
+        # approved-queue ledger uses this to ignore decisions that belong to a dead
+        # plan generation; without it, stale (batch, n) entries silently swallow
+        # every new draft after a reset. An existing unstamped plan is left
+        # unstamped: back-stamping it "now" would invalidate live decisions.
+        if not existing and not plan_created_at:
+            plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+        seen = {_dedup_key(c) for c in existing}
+        added = 0
+        merged = list(existing)
+        for c in new_cands:
+            k = _dedup_key(c)
+            if k in seen:
+                continue
+            seen.add(k)
+            merged.append(c)
+            added += 1
+
+        stamped, pruned = _sync_with_backend(merged)
+        if stamped:
+            print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
+        if pruned:
+            print(
+                f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
+                "backend (expired/etc.) before they were reviewed",
+                file=sys.stderr,
+            )
+
+        plan_obj = {"candidates": merged}
+        if plan_created_at:
+            plan_obj["created_at"] = plan_created_at
+
+        # This is the actual delivery: if anything below throws, the cycle's drafts
+        # were computed but never reached the store the menu bar reads, and the
+        # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
+        # stderr with `|| true`, so a crash here previously vanished into a local
+        # log nothing central reads — the exact blind spot that cost the 2026-07-08
+        # Karol investigation its root cause. Report it like any other handled
+        # pipeline failure (see twitter_post_plan.py's post-failure capture).
         try:
-            with open(legacy) as f:
-                lp = json.load(f)
-            lc = lp.get("candidates") or []
-            have = {_dedup_key(c) for c in existing}
-            absorbed = [c for c in lc if _dedup_key(c) not in have]
-            existing.extend(absorbed)
-            plan_created_at = plan_created_at or lp.get("created_at")
-            if absorbed:
-                print(
-                    f"[merge_review_queue] absorbed {len(absorbed)} candidate(s) "
-                    "from legacy /tmp plan into the durable store",
-                    file=sys.stderr,
-                )
+            _atomic_write(dst, plan_obj)
+            ensure_store_symlink()
+
+            # Refresh the review-request marker the menu bar polls. count = cards
+            # actually awaiting review (mirrors s4l_state.candidate_state()'s
+            # awaiting_review bucket): approved-unposted and post_failed rows are
+            # settled decisions, counting them inflated the badge and misled every
+            # human/agent reading the marker.
+            pending_count = len(
+                [
+                    c
+                    for c in merged
+                    if not c.get("posted")
+                    and not c.get("terminal")
+                    and not c.get("post_failed")
+                    and not c.get("approved")
+                ]
+            )
+            project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
+            _atomic_write(
+                review_request_path(),
+                {
+                    "batch_id": REVIEW_QUEUE_ID,
+                    "project": project,
+                    "count": pending_count,
+                    "plan_path": dst,
+                    "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+                },
+            )
         except Exception as e:
-            print(f"[merge_review_queue] legacy plan absorb failed: {e}", file=sys.stderr)
-    # Generation stamp: set ONLY when starting a fresh plan (the /tmp plan dies
-    # on reboot/tmp-sweep and numbering restarts at 1). The menu bar's durable
-    # approved-queue ledger uses this to ignore decisions that belong to a dead
-    # plan generation; without it, stale (batch, n) entries silently swallow
-    # every new draft after a reset. An existing unstamped plan is left
-    # unstamped: back-stamping it "now" would invalidate live decisions.
-    if not existing and not plan_created_at:
-        plan_created_at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-
-    seen = {_dedup_key(c) for c in existing}
-    added = 0
-    merged = list(existing)
-    for c in new_cands:
-        k = _dedup_key(c)
-        if k in seen:
-            continue
-        seen.add(k)
-        merged.append(c)
-        added += 1
-
-    stamped, pruned = _sync_with_backend(merged)
-    if stamped:
-        print(f"[merge_review_queue] stamped stats on {stamped} candidate(s)", file=sys.stderr)
-    if pruned:
+            print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+            try:
+                import sentry_init
+
+                sentry_init.init()
+                sentry_init.capture_message(
+                    f"merge_review_queue delivery failed: {e}",
+                    level="error",
+                    tags={"component": "merge_review_queue", "added": str(added)},
+                    extra={"plan_src": src},
+                )
+                sentry_init.flush(2.0)
+            except Exception:
+                pass
+            return 1
+
         print(
-            f"[merge_review_queue] pruned {pruned} candidate(s) already retired by the "
-            "backend (expired/etc.) before they were reviewed",
+            f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
+            f"({pending_count} pending total) from {os.path.basename(src)}",
             file=sys.stderr,
         )
-
-    plan_obj = {"candidates": merged}
-    if plan_created_at:
-        plan_obj["created_at"] = plan_created_at
-
-    # This is the actual delivery: if anything below throws, the cycle's drafts
-    # were computed but never reached the store the menu bar reads, and the
-    # wrapper (run-draft-and-publish.sh) captures this process's whole stdout+
-    # stderr with `|| true`, so a crash here previously vanished into a local
-    # log nothing central reads — the exact blind spot that cost the 2026-07-08
-    # Karol investigation its root cause. Report it like any other handled
-    # pipeline failure (see twitter_post_plan.py's post-failure capture).
-    try:
-        _atomic_write(dst, plan_obj)
-        ensure_store_symlink()
-
-        # Refresh the review-request marker the menu bar polls. count = cards
-        # actually awaiting review (mirrors s4l_state.candidate_state()'s
-        # awaiting_review bucket): approved-unposted and post_failed rows are
-        # settled decisions, counting them inflated the badge and misled every
-        # human/agent reading the marker.
-        pending_count = len(
-            [
-                c
-                for c in merged
-                if not c.get("posted")
-                and not c.get("terminal")
-                and not c.get("post_failed")
-                and not c.get("approved")
-            ]
-        )
-        project = ns.project or batch.get("project") or (new_cands[0].get("matched_project") if new_cands else None)
-        _atomic_write(
-            review_request_path(),
-            {
-                "batch_id": REVIEW_QUEUE_ID,
-                "project": project,
-                "count": pending_count,
-                "plan_path": dst,
-                "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-            },
-        )
-    except Exception as e:
-        print(f"[merge_review_queue] delivery failed (drafts NOT merged into cards): {e}", file=sys.stderr)
+        # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
         try:
-            import sentry_init
-
-            sentry_init.init()
-            sentry_init.capture_message(
-                f"merge_review_queue delivery failed: {e}",
-                level="error",
-                tags={"component": "merge_review_queue", "added": str(added)},
-                extra={"plan_src": src},
-            )
-            sentry_init.flush(2.0)
+            os.remove(src)
         except Exception:
             pass
-        return 1
-
-    print(
-        f"[merge_review_queue] merged {added} new draft(s) into {REVIEW_QUEUE_ID} "
-        f"({pending_count} pending total) from {os.path.basename(src)}",
-        file=sys.stderr,
-    )
-    # Clean up the consumed batch plan so /tmp doesn't fill with orphans.
-    try:
-        os.remove(src)
-    except Exception:
-        pass
-    return 0
+        return 0
+    finally:
+        try:
+            fcntl.flock(_lk, fcntl.LOCK_UN)
+        except Exception:
+            pass
+        _lk.close()
 
 
 if __name__ == "__main__":

package/scripts/platform_strike_events.py

@@ -106,12 +106,20 @@ def _venue(post: dict) -> str | None:
     return None
 
 
-def _removed_event(post: dict) -> dict:
+def _removed_event(post: dict, venue_count: int = 0) -> dict:
     venue = _venue(post)
     is_own_thread = bool(post.get("thread_url")) and post.get("thread_url") == post.get("our_url")
     kind = "top-level post" if is_own_thread else "comment/reply"
     posted = str(post.get("posted_at") or "")[:10]
     detected = str(post.get("status_checked_at") or "")[:10]
+    # venue_count = how many of our posts were removed in this same venue inside
+    # the sweep window. Surfaces clustering (one venue removing many of our
+    # posts is a venue-fit lesson, not N unrelated content lessons) directly in
+    # the note the digest reads.
+    cluster = ""
+    if venue and venue_count > 1:
+        cluster = (f" This is 1 of {venue_count} of our posts removed in"
+                   f" {venue} in the recent window (a venue-level pattern).")
     note = (
         f"Platform moderation strike: our {post.get('platform')} {kind}"
         f"{' in ' + venue if venue else ''} is now status='{post.get('status')}'"
@@ -120,6 +128,7 @@ def _removed_event(post: dict) -> dict:
         f" account {post.get('our_account')}."
         f" Machine-derived signal, not a human card decision: a moderator or"
         f" platform filter judged this content unwelcome in that venue."
+        f"{cluster}"
     )
     return {
         "event_uuid": str(uuid.uuid5(EVENT_NS, f"platform_removed:post:{post['id']}")),
@@ -156,7 +165,7 @@ def _ban_event(entry: dict) -> dict:
     }
 
 
-def collect_events(window_days: int) -> tuple[list[dict], int, int]:
+def collect_events(window_days: int, dry_run: bool = False) -> tuple[list[dict], int, int]:
     """Returns (events, removed_count, ban_count)."""
     cfg = _load_config()
     local_projects = {p.get("name") for p in (cfg.get("projects") or []) if p.get("name")}
@@ -170,7 +179,7 @@ def collect_events(window_days: int) -> tuple[list[dict], int, int]:
     })
     posts = ((resp or {}).get("data") or {}).get("posts") or []
 
-    removed_events = []
+    fresh = []
     for p in posts:
         if p.get("project_name") not in local_projects:
             continue
@@ -179,7 +188,47 @@ def collect_events(window_days: int) -> tuple[list[dict], int, int]:
         detected = _parse_ts(p.get("status_checked_at"))
         if detected is None or detected < cutoff:
             continue
-        removed_events.append(_removed_event(p))
+        fresh.append(p)
+
+    # Per-venue removal counts (clustering signal surfaced in each event note).
+    venue_counts: dict[str, int] = {}
+    for p in fresh:
+        v = _venue(p)
+        if v:
+            venue_counts[v] = venue_counts.get(v, 0) + 1
+    removed_events = [_removed_event(p, venue_counts.get(_venue(p) or "", 0))
+                      for p in fresh]
+
+    # Deterministic community-ban detection (2026-07-17): before reading the
+    # ban denylist, inspect the logged-in ban state of every reddit subreddit
+    # that struck us this window and persist newly-confirmed bans (reason
+    # 'account_blocked_in_sub'). This is what turns a pile of per-post removals
+    # into a single platform_banned learning signal, and upgrades weak manual
+    # denylist entries so their ban event can finally fire. Read-only browser
+    # attach; no-ops gracefully (returns unknown) on installs without a live
+    # Reddit session, and can be disabled with S4L_STRIKE_BAN_CHECK=0.
+    if os.environ.get("S4L_STRIKE_BAN_CHECK", "1") not in ("0", "false", "no"):
+        reddit_subs = sorted({
+            re.search(r"reddit\.com/r/([^/]+)/", (p.get("thread_url") or p.get("our_url") or "")).group(1)
+            for p in fresh
+            if re.search(r"reddit\.com/r/([^/]+)/", (p.get("thread_url") or p.get("our_url") or ""))
+        })
+        if reddit_subs:
+            try:
+                import reddit_ban_check
+                if dry_run:
+                    # read-only: detect and report, never persist
+                    st = reddit_ban_check.banned_state(reddit_subs)
+                    banned = [s for s, v in st.items() if v is True]
+                    log(f"ban_check (dry run) subs={len(reddit_subs)} banned={banned}")
+                else:
+                    res = reddit_ban_check.record_confirmed_bans(reddit_subs)
+                    log(f"ban_check subs={len(reddit_subs)} banned={len(res.get('banned') or [])}"
+                        f" recorded={res.get('recorded')} upgraded={res.get('upgraded')}")
+                    if res.get("recorded") or res.get("upgraded"):
+                        cfg = _load_config()  # reload so new ban entries below are seen
+            except Exception as e:
+                log(f"ban_check_error (non-fatal): {e}")
 
     ban_events = []
     for entry in ((cfg.get("subreddit_bans") or {}).get("comment_blocked") or []):
@@ -194,7 +243,7 @@ def collect_events(window_days: int) -> tuple[list[dict], int, int]:
 
 
 def sweep(window_days: int = 14, dry_run: bool = False) -> dict:
-    events, n_removed, n_banned = collect_events(window_days)
+    events, n_removed, n_banned = collect_events(window_days, dry_run=dry_run)
     inserted = 0
     duplicates = 0
     if dry_run:

package/scripts/post_reddit.py

@@ -438,6 +438,12 @@ def _db_pick_salvage_candidates(batch_id, limit=1):
             return None
         return {
             "project_name": data.get("project_name") or "general",
+            # batch_id must ride the plan file into --phase draft: the
+            # snapshot filename, the prompt's top_performers --invoked-by,
+            # and the proposed_excludes 2-distinct-batch activation gate all
+            # read plan["batch_id"] there (it was silently None before
+            # 2026-07-17, which defeated the excludes gate's distinctness).
+            "batch_id": batch_id,
             "decisions": data.get("decisions") or [],
             "cost": float(data.get("cost") or 0.0),
             "salvaged": bool(data.get("salvaged", True)),
@@ -2243,7 +2249,11 @@ def _discover_iteration(args, config, reddit_username, already_picked):
             except Exception as e:
                 print(f"[post_reddit] WARNING: seed backfill failed: {e}", file=sys.stderr)
 
+    # batch_id rides the plan file into --phase draft (snapshot filename,
+    # top_performers --invoked-by, proposed_excludes activation gate). Same
+    # reason as the salvage plan's batch_id above.
     return {"project_name": project_name, "decisions": selected,
+            "batch_id": queue_batch,
             "cost": 0.0, "session_id": None,
             "phase": "discover"}
 

package/scripts/preview_reddit_card.py

@@ -0,0 +1,38 @@
+# Scratch preview: renders one Reddit review card with a title + selftext,
+# to visually verify the bold-title-over-body thread box (2026-07-17).
+import os, sys
+os.environ["S4L_STATE_DIR"] = "/tmp/s4l-card-preview-state"
+os.makedirs("/tmp/s4l-card-preview-state", exist_ok=True)
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "mcp", "menubar"))
+from AppKit import NSApplication
+import s4l_card
+
+drafts = [{
+    "n": 1,
+    "platform": "reddit",
+    "thread_author": "SureThing07",
+    "thread_text": "Im fu**ed. I've realised the whole game is a placeholder",
+    "thread_selftext": (
+        "I've been building this solo for eight months and I just opened the "
+        "codebase after a week off. Half of it is stubs I meant to come back "
+        "to. The save system? Placeholder. The combat? Placeholder wired to a "
+        "real animation so it LOOKED done. I genuinely can't tell how much of "
+        "this game actually exists anymore. How do you all deal with this?"
+    ),
+    "reply_text": (
+        "my rule of thumb from solo projects: by month six, maybe a third of "
+        "the code is actually load-bearing and the rest is scaffolding you "
+        "forgot you wrote."
+    ),
+    "thread_url": "https://www.reddit.com/r/gamedev/comments/abc123/placeholder/",
+    "candidate_id": "rd-preview1",
+    "project": "podlog",
+    "engagement_style": "empathize",
+    "search_topic": "solo dev burnout",
+    "stats": {"replies": 34, "author_followers": 0,
+              "tweet_posted_at": "2026-07-17T14:00:00Z"},
+}]
+app = NSApplication.sharedApplication()
+s4l_card.present_review(drafts, on_decision=lambda d: None,
+                        on_complete=lambda ds: app.terminate_(None))
+app.run()

package/scripts/reap_stale_claude_sessions.py

@@ -820,12 +820,13 @@ def main() -> int:
     # (it stays in pending), never a lost draft — a DRAFTING session is protected by
     # claim_pids, not by grace, so no grace value can kill a real draft.
     #
-    # Default 300s (2026-07-06): QUEUE_WORKER_POLL_SECONDS (240s) + ~60s margin for
-    # cold agent-mode boot (skill load + MCP init) and this reaper's own ps-scan
-    # latency. COUPLING: must stay >= QUEUE_WORKER_POLL_SECONDS + margin — if that
-    # constant grows, bump this default (or S4L_REAPER_CLAIM_GRACE_SEC) to match, or
-    # the reaper will SIGTERM a legitimately-polling worker before it ever claims.
-    claim_grace = _env_int("S4L_REAPER_CLAIM_GRACE_SEC", 300)
+    # Default 1020s (2026-07-17): QUEUE_WORKER_POLL_SECONDS (900s) + ~120s margin
+    # for cold agent-mode boot (skill load + MCP init) and this reaper's own
+    # ps-scan latency. COUPLING: must stay >= QUEUE_WORKER_POLL_SECONDS + margin;
+    # if that constant grows, bump this default (or S4L_REAPER_CLAIM_GRACE_SEC) to
+    # match, or the reaper will SIGTERM a legitimately-polling worker before it
+    # ever claims. (Was 300s while the poll window was 240s.)
+    claim_grace = _env_int("S4L_REAPER_CLAIM_GRACE_SEC", 1020)
 
     inflight = count_running_jobs()  # None => queue unreadable => age-gate fallback
     claim_pids = running_claim_pids()  # agent-session pids actively holding a claim