code-coordinator 0.5.128__tar.gz → 0.5.130__tar.gz

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.128
+Version: 0.5.130
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.128
+Version: 0.5.130
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.128",
+  "tag": "0.5.130",
   "distance": 0,
-  "node": "gdb3e5a50ffe1a0bb743d2cc2f791188761858441",
+  "node": "g14a2d9301195335040144bf7d82384aeddb54b2b",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-17"

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/coord/agent.py

@@ -785,6 +785,44 @@ def _git(cwd: Path, *args: str, timeout: float = 15.0) -> str:
     return result.stdout.strip()
 
 
+def _remote_already_has_head(
+    wt_path: Path, remote: str, branch: str, *, timeout: float = 30.0
+) -> bool:
+    """True when *remote*'s copy of *branch* already contains the worktree's
+    current ``HEAD`` as an ancestor (#2356).
+
+    Used by `_reap`'s belt-and-suspenders push-failure handling: an
+    auth-shaped failure pushing to *remote* does NOT necessarily mean the
+    worker's commits never reached it — a worker that hit the same broken
+    write-credential wall (e.g. an HTTPS credential helper with nothing to
+    expand in a non-interactive shell) may have already worked around it by
+    pushing the same commit over a different remote/protocol, most commonly
+    an explicit ``git@github.com:...`` SSH URL (the #2269 incident). That
+    push landed on the SAME GitHub-hosted branch this function now checks —
+    it never touches a second remote name in the worktree's own git config.
+
+    Fetching *branch* is a READ operation (``git fetch`` invokes
+    upload-pack, not receive-pack), which commonly still succeeds — via
+    anonymous access on a public repo, or a still-valid read-scoped
+    credential — even when the WRITE credential that just failed the push
+    is broken or missing entirely. So this is a meaningfully independent
+    signal from the push that just failed, not a re-run of the same failing
+    operation.
+
+    Returns ``False`` — never raises — on any git failure: the branch
+    missing on the remote, a network error, or `merge-base` reporting "not
+    an ancestor" all resolve to "unknown/genuinely behind", and an unknown
+    remote state must never suppress the real #1797 failure signal (nothing
+    ever reached the remote).
+    """
+    try:
+        _git(wt_path, "fetch", remote, branch, timeout=timeout)
+        _git(wt_path, "merge-base", "--is-ancestor", "HEAD", "FETCH_HEAD")
+        return True
+    except (_GitError, subprocess.TimeoutExpired):
+        return False
+
+
 def _is_linked_worktree(repo_path: Path) -> bool:
     """True when *repo_path* is a linked ``git worktree`` rather than the
     checkout that owns its ``.git`` directory (#1729, H-6's guard 2).
@@ -2988,7 +3026,14 @@ class AgentAssignment:
     # alongside `status == FAILED`; `None` on every other outcome —
     # including a push failure for an unrelated reason (no `origin`
     # configured, network blip), which stays non-fatal exactly as before
-    # this field was introduced.
+    # this field was introduced, AND (#2356) including an auth-shaped
+    # failure on THIS push that turns out to be superseded: when
+    # `_remote_already_has_head` confirms the content already reached
+    # `origin` via some other remote/protocol (e.g. the #2269 SSH-
+    # workaround case), the push failure is logged but this field stays
+    # `None` and the assignment keeps its normal (non-FAILED) outcome —
+    # the work is where it needs to be, so the failed push here is a
+    # non-event, not a signal.
     #
     # Exists to keep an auth break from being silently absorbed into either
     # DONE (worker had local commits that never reached origin) or the
@@ -8146,12 +8191,54 @@ class AgentServer:
                         # against repos with no `origin` at all (every test
                         # fixture, and any local-only deployment), and that
                         # failure mode must stay non-fatal exactly as before.
+                        #
+                        # #2356: an auth-shaped failure on THIS push doesn't
+                        # necessarily mean the content never reached origin
+                        # — a worker that hit the same broken-credential
+                        # wall may have already landed the same commit via
+                        # an alternate remote/protocol (#2269: an explicit
+                        # SSH URL, worked around a missing HTTPS
+                        # credential). Before promoting to FAILED, check
+                        # whether origin already has local HEAD as an
+                        # ancestor (`_remote_already_has_head` fetches — a
+                        # read, which commonly still works even when the
+                        # write credential just failed). Only genuinely
+                        # missing content — origin behind local HEAD, or the
+                        # check itself failing — is promoted, so #1797's
+                        # original "nothing ever reached origin" case is
+                        # unaffected.
                         _reason = str(e)
+                        _suppressed_as_already_pushed = False
                         if _is_auth_push_failure(_reason):
-                            _push_failure_reason = _reason
+                            _branch_for_check = (
+                                head if head and head != "HEAD" else None
+                            )
+                            if _branch_for_check and _remote_already_has_head(
+                                wt_path, "origin", _branch_for_check
+                            ):
+                                _suppressed_as_already_pushed = True
+                            else:
+                                _push_failure_reason = _reason
                         try:
                             with open(assignment.log_path, "a") as reopen:
-                                reopen.write(f"# reap: push failed ({_reason})\n")
+                                if _suppressed_as_already_pushed:
+                                    # Deliberately NOT the generic "push
+                                    # failed" line below: that line reads as
+                                    # a live failure signal, which this
+                                    # isn't — origin already has HEAD, so
+                                    # the failed push here is a non-event
+                                    # (#2356).
+                                    reopen.write(
+                                        "# reap: push failed but origin "
+                                        "already has HEAD as an ancestor "
+                                        "(pushed via another remote/"
+                                        "protocol?) — treating as success "
+                                        f"({_reason}) (#2356)\n"
+                                    )
+                                else:
+                                    reopen.write(
+                                        f"# reap: push failed ({_reason})\n"
+                                    )
                         except OSError:
                             pass
 

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/coord/commands/milestone.py

@@ -3,10 +3,11 @@
 
 Thin CLI glue around ``coord/milestone_order.py`` (the pure DAG/frontier
 parser) and ``coord/milestone_dispatch.py`` (Phase 1's machine-picking +
-dispatch): fetches the tracking issue + milestone membership + issue
-terminal state from GitHub via ``coord.milestone_dispatch.
-fetch_milestone_context`` (shared by both subcommands so they see identical
-inputs), then hands that data to the pure functions and prints the result.
+dispatch, and #2335's work-order -> drive-queue translation): fetches the
+tracking issue + milestone membership + issue terminal state from GitHub via
+``coord.milestone_dispatch.fetch_milestone_context`` (shared by both
+subcommands so they see identical inputs), then hands that data to the pure
+functions and prints the result.
 """
 
 from __future__ import annotations
@@ -21,7 +22,6 @@ import httpx
 from coord.commands._common import _CONFIG_OPTION, _load_config
 from coord.milestone_dispatch import (
     DispatchOutcome,
-    MachinePick,
     MilestoneDispatchError,
     dispatch_entry,
     fetch_milestone_context,
@@ -29,6 +29,7 @@ from coord.milestone_dispatch import (
     is_milestone_complete,
     pick_machine,
     plan_dispatch,
+    plan_queue,
 )
 from coord.milestone_order import (
     TRACKING_ISSUE_LABEL,
@@ -859,11 +860,6 @@ def milestone_order_cmd(repo: str, tracking_issue: int, config_path: Path) -> No
             click.echo(f"  #{b.issue_number}: {b.reason}")
 
 
-def _echo_pick(pick: MachinePick) -> None:
-    suffix = f"  (group {pick.entry.group})" if pick.entry.group else ""
-    click.echo(f"  #{pick.entry.issue_number} -> {pick.machine.name}{suffix}")
-
-
 def _echo_outcome(outcome: DispatchOutcome) -> None:
     if outcome.ok:
         click.echo(
@@ -883,13 +879,18 @@ def _echo_outcome(outcome: DispatchOutcome) -> None:
 @milestone_group.command(
     "dispatch",
     help=(
-        "Promote a milestone into the pipeline: dispatch its ready frontier "
-        "in parallel (up to idle/capable machines), then keep draining it as "
-        "declared-order dependencies complete. REPO is the local repo name "
-        "from coordinator.yml; TRACKING_ISSUE is the GH issue number of the "
-        "tracking issue (its body holds the `## Work order` block). This is "
-        "the single explicit approval for the whole declared work order — "
-        "it does not expand scope beyond what `## Work order` lists."
+        "Promote a milestone into the pipeline: derive the dependency order "
+        "from the `## Work order` DAG and queue every still-open issue into "
+        "the drive-queue (`coord drive-queue add --after ...`) in that order "
+        "(#2335) — the DQ-4 tick then launches each issue as its pre-reqs "
+        "land, with #2247 file-overlap prediction, durable board-backed "
+        "state, and `coord drive-queue list/status` observability. `--next` "
+        "keeps the lighter direct single-dispatch path. REPO is the local "
+        "repo name from coordinator.yml; TRACKING_ISSUE is the GH issue "
+        "number of the tracking issue (its body holds the `## Work order` "
+        "block). This is the single explicit approval for the whole declared "
+        "work order — it does not expand scope beyond what `## Work order` "
+        "lists."
     ),
 )
 @click.argument("repo")
@@ -902,8 +903,9 @@ def _echo_outcome(outcome: DispatchOutcome) -> None:
     "--next", "next_", is_flag=True,
     help=(
         "Single-pick mode: show up to 3 ready-frontier items and dispatch "
-        "only the one you choose. Lighter-weight than draining the whole "
-        "milestone — does not register for daemon auto-drain."
+        "only the one you choose — directly, not via the drive-queue. "
+        "Lighter-weight than bulk mode's whole-DAG drive-queue enqueue "
+        "(#2335)."
     ),
 )
 @click.option(
@@ -1003,14 +1005,15 @@ def milestone_dispatch_cmd(
         click.echo(f"#{tracking_issue}: no `## Work order` block found")
         return
 
-    board = board_service.read_board()
-    plan = plan_dispatch(ctx.work_order, board, cfg, repo_entry, ctx.terminal_issues)
-
     click.echo(
         f"Work order for #{tracking_issue} (milestone #{ctx.milestone_number}):"
     )
 
     if next_:
+        board = board_service.read_board()
+        plan = plan_dispatch(
+            ctx.work_order, board, cfg, repo_entry, ctx.terminal_issues
+        )
         if not plan.to_dispatch:
             click.echo("No ready frontier item can dispatch right now.")
             if plan.skipped:
@@ -1075,54 +1078,93 @@ def milestone_dispatch_cmd(
             sys.exit(1)
         return
 
-    # Bulk mode: dispatch the entire current ready frontier.
-    click.echo("Will dispatch now:")
-    if plan.to_dispatch:
-        for pick in plan.to_dispatch:
-            _echo_pick(pick)
-    else:
-        click.echo("  (none)")
-
-    if plan.skipped:
-        click.echo()
-        click.echo("Ready but no idle machine:")
-        for s in plan.skipped:
-            click.echo(f"  #{s.entry.issue_number}: {s.reason}")
+    # Bulk mode (#2335): queue the whole declared work order into the
+    # drive-queue rather than dispatching the ready frontier directly. Before
+    # #2335 this path called `dispatch_entry` per frontier pick and registered
+    # the milestone for daemon auto-drain — bypassing the drive-queue
+    # entirely: no #2247 overlap prediction, no durable queue entry surviving
+    # a coordinator restart, nothing in `coord drive-queue list/status`. The
+    # queue's `after=` edges now carry the DAG, so the DQ-4 tick launches each
+    # issue as its pre-reqs land; that also makes `register_milestone_drain`
+    # redundant here (the queue IS the durable drain, and registering would
+    # have the daemon's direct-dispatch drain racing it).
+    queue_plan = plan_queue(ctx.work_order, ctx.terminal_issues, repo_entry.name)
+
+    if not queue_plan:
+        click.echo("Nothing to queue — every work-order node is already closed.")
+        return
 
-    if plan.waiting:
-        click.echo()
-        click.echo("Waiting:")
-        for b in plan.waiting:
-            click.echo(f"  #{b.issue_number}: {b.reason}")
+    click.echo("Will queue (drive-queue), in dependency order:")
+    for qe in queue_plan:
+        bits = []
+        if qe.group:
+            bits.append(f"group {qe.group}")
+        if qe.after:
+            bits.append("after " + ", ".join(qe.after))
+        suffix = f"  ({'; '.join(bits)})" if bits else ""
+        click.echo(f"  #{qe.issue_number}{suffix}")
 
     if dry_run:
         click.echo()
-        click.echo("(dry run — not dispatched)")
+        click.echo("(dry run — nothing queued)")
         return
 
-    if not plan.to_dispatch:
-        click.echo()
-        click.echo("Nothing to dispatch right now.")
-        return
+    # Reuse `coord drive-queue add`'s own helpers so a milestone enqueue is
+    # byte-identical to N manual `add` calls: same pre-write validation, same
+    # #2247 overlap prediction (auto-`after` edges recorded to the audit log),
+    # same upsert semantics for an issue already queued.
+    from coord.commands.drive_queue import (  # noqa: PLC0415
+        _applicable_auto_after,
+        _predict_overlap,
+        _record_overlap_prediction,
+    )
+    from coord.drive_queue import (  # noqa: PLC0415
+        QueueError,
+        entries_from_rows,
+        entry_key,
+        validate_enqueue,
+    )
+    from coord.state import enqueue_drive_queue, list_drive_queue  # noqa: PLC0415
 
     click.echo()
     failures = 0
-    for pick in plan.to_dispatch:
-        outcome = dispatch_entry(pick, repo_entry, cfg, board, tracking_issue=tracking_issue)
-        _echo_outcome(outcome)
-        if not outcome.ok:
+    queued = 0
+    for qe in queue_plan:
+        # Re-read per entry so each add validates (and overlap-predicts)
+        # against the queue as its just-added siblings left it.
+        existing = entries_from_rows(list_drive_queue())
+        after = list(qe.after)
+        key = entry_key(repo_entry.name, qe.issue_number)
+        try:
+            validate_enqueue(existing, repo_entry.name, qe.issue_number, after)
+        except QueueError as exc:
+            click.echo(f"  {key}: not queued: {exc}", err=True)
             failures += 1
+            continue
+        prediction = _predict_overlap(
+            config_path, repo_entry.name, qe.issue_number, existing
+        )
+        auto_after = _applicable_auto_after(
+            existing, repo_entry.name, qe.issue_number, after, prediction
+        )
+        after = [*after, *auto_after]
+        enqueue_drive_queue(repo_entry.name, qe.issue_number, after=after)
+        if auto_after:
+            _record_overlap_prediction(
+                repo_entry.name, qe.issue_number, prediction, auto_after
+            )
+        suffix = f" after {', '.join(after)}" if after else ""
+        overlap_note = f"\n     {prediction.reason}" if auto_after else ""
+        click.echo(f"  queued {key}{suffix}{overlap_note}")
+        queued += 1
 
-    if not is_milestone_complete(ctx):
-        from coord.state import register_milestone_drain
-
-        register_milestone_drain(repo_name=repo_entry.name, tracking_issue=tracking_issue)
+    if queued:
         click.echo()
         click.echo(
-            f"Milestone #{tracking_issue} registered for daemon auto-drain "
-            "(requires `milestone.auto_dispatch: true` in coordinator.yml + a "
-            "daemon restart to activate; `coord milestone dispatch` still "
-            "works as a manual re-drain either way)."
+            f"{queued} issue(s) queued — `coord drive-queue tick` (the DQ-4 "
+            "timer, or run it manually) launches them in dependency order; "
+            "`coord drive-queue list` shows the queue. Entries are durable "
+            "across coordinator restarts."
         )
 
     if failures:

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/coord/milestone_dispatch.py

@@ -16,7 +16,10 @@ not an LLM judgment call like ``coord.brain.propose``.
 Three call sites share this module:
 
 - ``coord milestone dispatch`` (``coord/commands/milestone.py``) — the
-  one-shot CLI dispatch (bulk or ``--next`` single-pick).
+  ``--next`` single-pick still dispatches directly through
+  :func:`plan_dispatch`/:func:`dispatch_entry`; bulk mode instead derives
+  drive-queue enqueues from the work order via :func:`plan_queue` (#2335),
+  so the DQ-4 tick owns the actual launches.
 - The daemon's auto-drain tick (``coord.serve_app._milestone_drain_tick``,
   opt-in via ``coordinator.yml`` ``milestone.auto_dispatch``) — re-runs the
   same fetch → plan → dispatch sequence for milestones registered via a
@@ -38,6 +41,7 @@ from coord.milestone_order import (
     FrontierEntry,
     WorkOrder,
     WorkOrderError,
+    WorkOrderNode,
     parse_work_order,
     ready_frontier,
     validate_milestone_membership,
@@ -64,6 +68,8 @@ __all__ = [
     "NoMachineAvailable",
     "MilestonePlan",
     "plan_dispatch",
+    "QueuePlanEntry",
+    "plan_queue",
     "DispatchOutcome",
     "dispatch_entry",
     "is_milestone_complete",
@@ -684,6 +690,74 @@ def plan_dispatch(
     )
 
 
+@dataclass(frozen=True)
+class QueuePlanEntry:
+    """One drive-queue enqueue derived from a work-order node (#2335)."""
+
+    issue_number: int
+    #: Fully-qualified pre-req keys (``"repo#N"``) for the drive-queue's
+    #: ``after=`` edge list — the node's declared ``{after: #N}`` targets,
+    #: minus any that are already terminal (closed issues never enter the
+    #: queue, so an edge at one would read as unsatisfiable to the tick's
+    #: ``_resolve_prereqs`` rather than as "already done").
+    after: tuple[str, ...] = ()
+    group: str | None = None
+
+
+def plan_queue(
+    work_order: WorkOrder,
+    terminal_issues: frozenset[int] | set[int],
+    repo_name: str,
+) -> tuple[QueuePlanEntry, ...]:
+    """Translate the work order's DAG into drive-queue enqueues (#2335).
+
+    Pure — no GitHub, no board, no side effects. One entry per non-terminal
+    node, in dependency order: a stable topological sort seeded by declared
+    order, so independent nodes keep the operator's declared sequence while a
+    node declared *before* its own pre-req still queues after it (queue
+    position is the tick's tie-break among eligible entries; the ``after``
+    edges are what actually gate launches).
+
+    Each entry's ``after`` carries the node's declared ``{after: #N}`` edges
+    as fully-qualified ``repo#N`` keys — the same format ``coord drive-queue
+    add --after`` parses — filtered to pre-reqs that are still open.
+    :func:`~coord.milestone_order.parse_work_order` already refused cycles,
+    self-edges, and edges to undeclared nodes, so the sort always terminates;
+    the defensive tail below only fires on inputs constructed outside it.
+    """
+    from coord.drive_queue import entry_key  # noqa: PLC0415
+
+    terminal = set(terminal_issues)
+    remaining: dict[int, WorkOrderNode] = {
+        n.issue_number: n for n in work_order.nodes if n.issue_number not in terminal
+    }
+    open_set = set(remaining)
+    placed: set[int] = set()
+    ordered: list[WorkOrderNode] = []
+    while remaining:
+        progressed = False
+        for number, node in list(remaining.items()):
+            if any(d in open_set and d not in placed for d in node.after):
+                continue
+            ordered.append(node)
+            placed.add(number)
+            del remaining[number]
+            progressed = True
+        if not progressed:  # cycle — unreachable via parse_work_order; see above
+            ordered.extend(remaining.values())
+            break
+    return tuple(
+        QueuePlanEntry(
+            issue_number=n.issue_number,
+            after=tuple(
+                entry_key(repo_name, d) for d in n.after if d not in terminal
+            ),
+            group=n.group,
+        )
+        for n in ordered
+    )
+
+
 @dataclass(frozen=True)
 class DispatchOutcome:
     """The result of one :func:`dispatch_entry` call."""

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/coord/serve_app.py

@@ -1283,8 +1283,11 @@ def _milestone_drain_tick(config: Config) -> list:
 
     Called by ``_tick_loop`` when ``milestone.auto_dispatch: true`` is set in
     ``coordinator.yml`` (default-off). For each ``(repo_name, tracking_issue)``
-    registered via a non-dry-run ``coord milestone dispatch`` (``coord.state.
-    register_milestone_drain``), re-fetches the tracking issue, recomputes the
+    registered via ``coord.state.register_milestone_drain`` (historically the
+    non-dry-run ``coord milestone dispatch`` bulk path — since #2335 that
+    path enqueues the work order into the drive-queue instead and registers
+    nothing, so only pre-#2335 registrations feed this tick), re-fetches the
+    tracking issue, recomputes the
     ready frontier (:func:`coord.milestone_dispatch.plan_dispatch`), and
     dispatches any newly-unblocked entries — the same mechanism a manual
     ``coord milestone dispatch`` uses, so a fix that lands and merges for one

{code_coordinator-0.5.128 → code_coordinator-0.5.130}/docs/ARCHITECTURE.md

@@ -167,7 +167,7 @@ The auto-loop above sequences a *single* issue. For work that spans many issues,
 
 Layering is deliberate: `evaluate_gate(gate, probes)` is **pure** (gate name + a `GateProbes` value in, one `GateStep` out — no board, no GitHub, no clock), so every edge in the machine is decided in exactly one place and any edge is testable without I/O; `probe_milestone()` is the I/O half and reuses the *existing* readers (`milestone_dispatch.gate_a_status`, `gate_b.latest_gate_b_verdict`) so the gate walk and the manual CLI can never disagree about whether a gate is satisfied. `work` is the only state with a side effect, and it delegates to `plan_dispatch` + `dispatch_entry` rather than adding a second dispatch path. Every other edge is currently an explicit, logged **hold** — the machine reports why it cannot advance and stays put. There is no silent fall-through anywhere in the module; that is the failure mode that produced the 240-minute advisory spin in the per-issue driver.
 
-**`drive` vs. `milestone.auto_dispatch` — mutually exclusive per milestone, gate driving wins.** `milestone.auto_dispatch` gates the *legacy standalone drain* (`_milestone_drain_tick`): a milestone registered by `coord milestone dispatch` whose frontier the daemon re-drains with no gate walk around it. A milestone with a gate record is driven by `_milestone_gate_tick` instead, which owns the drain as its `work` state — so `_milestone_drain_tick` **skips** any `(repo_name, tracking_issue)` that has a gate record. Without that exclusion a milestone parked at Gate A could still have its frontier dispatched by the independently-gated drain path. Gate driving is consequently its own per-milestone opt-in (`coord milestone drive`) and `_milestone_gate_tick` is *not* behind the global flag — hiding it there would make `drive` silently no-op.
+**`drive` vs. `milestone.auto_dispatch` — mutually exclusive per milestone, gate driving wins.** `milestone.auto_dispatch` gates the *legacy standalone drain* (`_milestone_drain_tick`): a milestone registered by a pre-#2335 `coord milestone dispatch` whose frontier the daemon re-drains with no gate walk around it. (Since #2335 the bulk `coord milestone dispatch` path enqueues the whole `## Work order` DAG into the drive-queue — `after=` edges carry the dependencies, the DQ-4 tick launches, and nothing new registers for this drain.) A milestone with a gate record is driven by `_milestone_gate_tick` instead, which owns the drain as its `work` state — so `_milestone_drain_tick` **skips** any `(repo_name, tracking_issue)` that has a gate record. Without that exclusion a milestone parked at Gate A could still have its frontier dispatched by the independently-gated drain path. Gate driving is consequently its own per-milestone opt-in (`coord milestone drive`) and `_milestone_gate_tick` is *not* behind the global flag — hiding it there would make `drive` silently no-op.
 
 **Exactly one overseer, structurally (#1930).** The gate tick is the sole owner of a gate-controlled milestone's `work` drain. `coord milestone drive` only ever writes/re-persists the `GateRecord` — it never calls `apply_step` or dispatches, so running it twice (any operator, any machine) is inert, not a race. `coord milestone dispatch`, the manual non-gate CLI, now refuses outright against a milestone with a gate record — before #1930 it had no way to know one existed and would dispatch the same frontier the gate tick's `work` state owns, the same "two gates disagreeing about whether work may start" shape #1870 fixed for the drive queue, reached from an operator's keyboard instead of a second host's timer.