code-coordinator 0.5.141__tar.gz → 0.5.143__tar.gz

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.141
+Version: 0.5.143
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.141
+Version: 0.5.143
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.141",
+  "tag": "0.5.143",
   "distance": 0,
-  "node": "gef1e71db0f0c6bc0d0346e3020abaeabac680993",
+  "node": "g5b8b819c6ba27f432a333e8d026cb66272211710",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-18"

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/coord/merge_queue.py

@@ -1588,6 +1588,43 @@ def _ci_unreadable_reason(failed: "list[CheckRun]") -> str | None:
     )
 
 
+# #2380: a bare check-list FETCH failure (`_ci_unreadable_reason`, above) has
+# TWO readings, exactly like `checks == []` already does (#1877): "GitHub is
+# genuinely unreachable right now" (real, self-healing — keep retrying), and
+# "this PR is DIRTY/CONFLICTING against its base, so GitHub can never build a
+# merge ref for it and `gh pr checks` has nothing to read" (definitive,
+# self-*never*-healing — no amount of retrying a CI read produces CI that
+# will never run). The two are indistinguishable from the check list alone;
+# GitHub's own `mergeable` field is the one thing that tells them apart, and
+# — unlike CI — it is always computable, conflict or not.
+def _pr_reports_conflicting(gh_ops, repo: str | None, number: int | None) -> bool:
+    """True only when GitHub's live ``mergeable`` field reads ``CONFLICTING``
+    for PR *number* — definitive, readable evidence a CI-unreadable park can
+    never resolve on its own (#2380).
+
+    Duck-typed the same way the sibling #1877 checks-absent conflict probe
+    (a few lines above each of this function's call sites) already is:
+    ``gh_ops`` on the board/plan read path may be a :class:`~coord.gate_
+    snapshot.GateSnapshot` with no ``check_pr_mergeable`` at all (#1336
+    Invariant 1 — no third-party I/O there), and any of "no probe available",
+    "the probe raised", or a ``True``/``None`` verdict (cleanly mergeable, or
+    GitHub still computing it) must read as "not confirmed conflicting" —
+    never as false evidence of one. This is intentionally narrower than the
+    design's "``mergeable == CONFLICTING`` or ``mergeStateStatus == DIRTY``"
+    framing: :func:`coord.github_ops.check_pr_mergeable` already reads GitHub's
+    ``mergeable`` field, which is exactly ``CONFLICTING`` whenever
+    ``mergeStateStatus`` would read ``DIRTY`` — one probe, one `gh` call,
+    same readable-and-definitive signal either way.
+    """
+    probe = getattr(gh_ops, "check_pr_mergeable", None)
+    if probe is None or not repo or number is None:
+        return False
+    try:
+        return probe(repo, number) is False
+    except Exception:  # noqa: BLE001 — inconclusive, not a confirmed conflict
+        return False
+
+
 def _ci_infra_reason(
     ci: "CiStore", repo: str, number: int, failed: "list[CheckRun]"
 ) -> str | None:
@@ -3820,21 +3857,36 @@ def _entry_gate_status(
             # `process()`'s own live reading.
             unreadable_reason = _ci_unreadable_reason(failed)
             if unreadable_reason is not None:
-                return PLAN_BLOCKED, unreadable_reason
-            summary = ", ".join(f"{c.name} ({c.conclusion})" for c in failed)
-            return PLAN_BLOCKED, f"CI failed: {summary}"
-        pending = in_flight_checks(checks)
-        if pending:
-            summary = ", ".join(c.name for c in pending)
-            return PLAN_BLOCKED, f"{CI_PENDING_PREFIX} {summary}"
-        if checks and _ci_checks_are_stale(
-            checks, gh_ops, entry.repo_github, entry.target_branch, smoke
-        ):
-            return (
-                PLAN_BLOCKED,
-                f"{CI_STALE_PREFIX} checks predate the current base — "
-                "re-run CI (`coord merge --revalidate`) before merging",
-            )
+                # #2380: a fetch failure this uniform (EVERY failing check is
+                # the synthetic unreadable stand-in) is ALSO exactly what a
+                # DIRTY/CONFLICTING PR produces — see
+                # :func:`_pr_reports_conflicting`'s docstring. Same "don't
+                # block, mirror `process()`, let the real conflict surface"
+                # response as the #1877 checks-absent case immediately above
+                # — deliberately NOT falling into the `pending`/staleness
+                # checks below, which assume (per `_ci_checks_are_stale`'s
+                # own docstring) a *non-empty, no-failed-entries* check list;
+                # this one is neither.
+                if not _pr_reports_conflicting(
+                    gh_ops, entry.repo_github, entry.pr_number
+                ):
+                    return PLAN_BLOCKED, unreadable_reason
+            else:
+                summary = ", ".join(f"{c.name} ({c.conclusion})" for c in failed)
+                return PLAN_BLOCKED, f"CI failed: {summary}"
+        else:
+            pending = in_flight_checks(checks)
+            if pending:
+                summary = ", ".join(c.name for c in pending)
+                return PLAN_BLOCKED, f"{CI_PENDING_PREFIX} {summary}"
+            if checks and _ci_checks_are_stale(
+                checks, gh_ops, entry.repo_github, entry.target_branch, smoke
+            ):
+                return (
+                    PLAN_BLOCKED,
+                    f"{CI_STALE_PREFIX} checks predate the current base — "
+                    "re-run CI (`coord merge --revalidate`) before merging",
+                )
     if gh_ops is not None and entry.pr_number:
         try:
             commit_messages = gh_ops.get_pr_commit_messages(
@@ -5176,6 +5228,25 @@ def process(
                             # checked first, mirroring the live path's
                             # ordering — see `_ci_unreadable_reason`.
                             unreadable_reason = _ci_unreadable_reason(failed)
+                            # #2380: mirror the real path's straight-to-
+                            # conflict routing — see the identical check a
+                            # few lines above (#1877) and the live path's own
+                            # `_pr_reports_conflicting` branch. Preview-only:
+                            # never mutates `entry.state`, same as every
+                            # other branch in this dry-run block.
+                            if unreadable_reason is not None and _pr_reports_conflicting(
+                                gh_ops, entry.repo_github, entry.pr_number
+                            ):
+                                events.append(MergeEvent(
+                                    entry, "conflict",
+                                    f"(dry run) {entry.branch} conflicts "
+                                    f"with {entry.target_branch} and its CI "
+                                    "check-list fetch fails for the same "
+                                    "reason — a real run would route to the "
+                                    "#241 conflict-fix path rather than park "
+                                    "on an unreadable CI retry (#2380)",
+                                ))
+                                continue
                             infra_reason = None if unreadable_reason else _ci_infra_reason(
                                 ci, entry.repo_github, entry.pr_number, failed
                             )
@@ -5528,6 +5599,39 @@ def process(
                     # to evaluate unconditionally, every time.
                     unreadable_reason = _ci_unreadable_reason(failed)
                     if unreadable_reason is not None:
+                        # #2380: a check-list fetch failure this uniform
+                        # (EVERY failing check is the synthetic unreadable
+                        # stand-in) is ALSO exactly what GitHub reports for a
+                        # DIRTY/CONFLICTING PR — it can never build a merge
+                        # ref, so `gh pr checks` has nothing to read either.
+                        # `_pr_reports_conflicting` tells the two apart the
+                        # same way the #1877 checks-absent branch above does:
+                        # GitHub's own `mergeable` field, definitive and
+                        # always computable, conflict or not. When it reads
+                        # CONFLICTING, retrying the CI read can never
+                        # succeed — route STRAIGHT to the same `conflict`
+                        # event / `_dispatch_conflict_fixes` path a readable
+                        # CONFLICT merge-queue status already triggers
+                        # (#1474/#241), instead of parking behind a read that
+                        # will never resolve.
+                        if _pr_reports_conflicting(
+                            gh_ops, entry.repo_github, entry.pr_number
+                        ):
+                            msg = (
+                                f"merge conflict: GitHub reports PR "
+                                f"#{entry.pr_number} ({entry.branch}) as "
+                                f"CONFLICTING against {entry.target_branch} "
+                                "— no CI ever ran because GitHub cannot "
+                                "build a merge ref for a conflicting PR, so "
+                                "the check-list fetch failure was never a "
+                                "transient GitHub outage (#2380). Rebase "
+                                f"the branch onto {entry.target_branch} and "
+                                "resolve."
+                            )
+                            entry.state = CONFLICT
+                            entry.error = msg
+                            events.append(MergeEvent(entry, "conflict", msg))
+                            continue  # #292: skip, don't halt the group
                         if entry.ci_unreadable_reruns < MAX_CI_UNREADABLE_RERUNS:
                             entry.ci_unreadable_reruns += 1
                             _log.info(

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/coord/reconcile.py

@@ -1242,6 +1242,28 @@ def _reassign(
     repo_path = machine.repo_path(failed.repo_name)
 
     retry_model = model if model is not None else failed.model
+    # #2383: `failed.model` can name a model an operator has since REMOVED
+    # from `models.escalation` (e.g. a run auto-escalated onto it before the
+    # ladder was edited) — inheriting it here forever, on every subsequent
+    # auto-reassign of the same lineage, would silently keep dispatching a
+    # model the current config no longer sanctions. Only the inherited
+    # (`model is None`) path needs this: an explicit caller-supplied `model`
+    # is a deliberate choice and passes through unclamped. And only a
+    # CLAUDE-family retry needs it — `models.escalation` is a claude-only
+    # concept (#2323's "the claude escalation ladder means nothing to
+    # another provider"), so an opencode/other-provider model like
+    # `opencode/glm-5.2` must never be walked onto the claude ladder just
+    # because it doesn't happen to appear on it.
+    if (
+        model is None
+        and resolved_provider_name == "claude"
+        and retry_model not in (*config.models.escalation, config.models.default)
+    ):
+        retry_model = (
+            config.models.escalation[-1]
+            if config.models.escalation
+            else config.models.default
+        )
     # The Assignment keeps the alias for legibility; the wire payload is
     # resolved through models.versions when an exact id is pinned.
     retry_model_wire = config.models.resolve(retry_model)

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/tests/test_cli_drive_queue.py

@@ -1724,17 +1724,29 @@ def live_ci_backend(monkeypatch):
     """Fake the live `ci_store`/`github_ops` seam #2182's re-check calls.
 
     Patches `coord.ci_store.build_ci_store` (what constructs the live
-    backend) and the two `coord.github_ops` functions the CI gate reaches
+    backend) and the three `coord.github_ops` functions the CI gate reaches
     for once the checks themselves resolve (`get_branch_commit_timestamp`
     for the #1851 staleness check, `get_pr_commit_messages` for the #1318
-    epic-closing-keyword gate) — the same seams `tests/test_board_read_
-    path.py` fakes for the equivalent `/board`-side gate. Returns a setter,
-    `live_ci_backend(checks)`.
+    epic-closing-keyword gate, and `check_pr_mergeable` for the #1877 /
+    #2380 "is this PR actually CONFLICTING?" disambiguation) — the same
+    seams `tests/test_board_read_path.py` fakes for the equivalent
+    `/board`-side gate. Returns a setter, `live_ci_backend(checks,
+    mergeable=...)`.
+
+    `mergeable` defaults to `None` — GitHub's own "still computing /
+    unknown" verdict, which every gate treats as inconclusive, so the
+    default leaves the pre-#2380 reading of every scenario here untouched.
+    Pass `mergeable=False` for the #2380 case (a DIRTY/CONFLICTING PR,
+    whose `gh pr checks` fetch fails because GitHub can never build a merge
+    ref for it). Faking it matters beyond convenience: `launches`
+    monkeypatches `subprocess.run` process-wide, so an unfaked probe would
+    (a) really shell out to `gh` from a unit test and (b) land in
+    `launches` as a phantom extra "launch".
     """
     import coord.ci_store as ci_store_module
     import coord.github_ops as github_ops
 
-    state: dict = {"checks": []}
+    state: dict = {"checks": [], "mergeable": None}
     monkeypatch.setattr(
         ci_store_module, "build_ci_store", lambda t: _FakeLiveCi(state)
     )
@@ -1744,9 +1756,13 @@ def live_ci_backend(monkeypatch):
         github_ops, "get_branch_commit_timestamp", lambda repo, branch: 1.0
     )
     monkeypatch.setattr(github_ops, "get_pr_commit_messages", lambda repo, n: [])
+    monkeypatch.setattr(
+        github_ops, "check_pr_mergeable", lambda repo, n: state["mergeable"]
+    )
 
-    def _set(checks: list) -> None:
+    def _set(checks: list, *, mergeable: bool | None = None) -> None:
         state["checks"] = checks
+        state["mergeable"] = mergeable
 
     return _set
 
@@ -1885,6 +1901,40 @@ def test_a_parked_entrys_reason_is_corrected_when_github_is_unreachable(
     assert queued(2159)["state"] == "running"
 
 
+def test_a_parked_entry_whose_pr_is_confirmed_conflicting_stops_waiting_on_ci(
+    cli_no_gates, seed, launches, coord_db, live_ci_backend,
+):
+    """#2380 at the drive-queue tick: the SAME unreadable check list as the
+    #2347 test above, but GitHub's `mergeable` field reads CONFLICTING.
+
+    That combination is not a transient outage and never becomes readable
+    on its own — GitHub cannot build a merge ref for a conflicting PR, so
+    `gh pr checks` has nothing to read, forever. Parking on "retry the CI
+    read" therefore wedges the entry until the 45-minute ceiling, every
+    ceiling, with zero forward progress (the live incident: claude-
+    coordinator#2375 / PR #2379 parked 6x). The live re-check must stop
+    treating it as still-blocked-on-CI and let the entry move again, so the
+    merge path can route it to the #241 conflict-fix dispatch.
+    """
+    _park_with_pr(cli_no_gates, seed, coord_db)
+    assert queued(2159)["state"] == "parked"
+    assert len(launches) == 1, launches
+
+    from coord.ci_github import _unreadable_check
+    live_ci_backend(
+        [_unreadable_check(REPO, 2159, "HTTP 503: No server is currently available")],
+        mergeable=False,
+    )
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+    entry = queued(2159)
+    assert entry["state"] != "parked", entry  # no longer wedged on a dead read
+    from coord.merge_queue import is_ci_unreadable_reason
+    assert not is_ci_unreadable_reason(entry["last_reason"] or ""), entry
+    assert "parked" not in cli_no_gates("status").output
+
+
 def test_a_live_ready_wins_even_over_a_stale_cached_plan_reading(
     cli_no_gates, seed, launches, coord_db, live_ci_backend, board_merge_plan,
 ):

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/tests/test_merge_queue.py

@@ -5515,6 +5515,69 @@ class TestPlan:
         assert not mq.is_ci_unreadable_reason(plan[0].reason)
         assert "CI failed" in (plan[0].reason or "")
 
+    def test_ready_when_conflicted_and_checks_unreadable(self, coord_db) -> None:
+        """#2380: a DIRTY/CONFLICTING PR's `gh pr checks` fetch can itself
+        fail (GitHub can't build a merge ref to run anything against), which
+        reads identically to a transient GitHub-unreachable blip —
+        CI_UNREADABLE_PREFIX. Confirmed via `check_pr_mergeable` reading
+        CONFLICTING, this must NOT block on "retry the read" (which can
+        never succeed for a conflicting PR) — mirror the #1877 checks-absent
+        fall-through immediately above so `coord merge` reaches the real
+        merge attempt and routes to the #241 conflict-fix path."""
+        from types import SimpleNamespace
+
+        class FakeCi:
+            is_available = True
+            def list_checks_for_pr(self, repo, number):
+                return [SimpleNamespace(
+                    name="coord: could not read CI status for acme/api#99 "
+                         "(HTTP 503: No server is currently available)",
+                    status="completed", conclusion="unknown",
+                )]
+
+        items = [_q("w1", size=50, pr=99)]
+        save_queue(items)
+        board = self._board(completed=[
+            self._work("w1", test_state="passed"),
+            self._review("w1", verdict="approve"),
+        ])
+        cfg = self._config()
+        gh = FakeGh(mergeable_results={99: False})
+        plan = mq.plan(board, cfg, ci_store=FakeCi(), gh_ops=gh)
+        assert plan[0].status == mq.PLAN_READY
+        assert plan[0].reason is None
+        assert ("acme/api", 99) in gh.mergeable_calls
+
+    def test_blocked_ci_unreadable_stays_blocked_when_not_confirmed_conflicted(
+        self, coord_db
+    ) -> None:
+        """#2380 companion (acceptance criterion): an UNKNOWN mergeability
+        read (still computing, or no probe at all) must keep today's
+        CI_UNREADABLE_PREFIX park — this is additive, not a general
+        loosening of the CI-unreadable path."""
+        from types import SimpleNamespace
+
+        class FakeCi:
+            is_available = True
+            def list_checks_for_pr(self, repo, number):
+                return [SimpleNamespace(
+                    name="coord: could not read CI status for acme/api#99 "
+                         "(HTTP 503: No server is currently available)",
+                    status="completed", conclusion="unknown",
+                )]
+
+        cfg = self._config()
+        board = self._board(completed=[
+            self._work("w1", test_state="passed"),
+            self._review("w1", verdict="approve"),
+        ])
+
+        for gh_ops in (FakeGh(mergeable_results={99: True}), FakeGh(mergeable_results={99: None}), None):
+            save_queue([_q("w1", size=50, pr=99)])
+            plan = mq.plan(board, cfg, ci_store=FakeCi(), gh_ops=gh_ops)
+            assert plan[0].status == mq.PLAN_BLOCKED
+            assert mq.is_ci_unreadable_reason(plan[0].reason)
+
     def test_blocked_ci_absent_when_repo_declares_ci(self, coord_db) -> None:
         """#1904: an empty check list for a repo that declares CI must show
         BLOCKED with a `checks_absent`-style reason — not READY, the
@@ -6516,6 +6579,83 @@ class TestProcessConflictedEmptyChecks:
         assert items[0].state == PENDING
 
 
+class TestProcessConflictedUnreadableChecks:
+    """#2380: a DIRTY/CONFLICTING PR whose `gh pr checks` FETCH itself fails
+    (GitHub can't build a merge ref, so `gh pr checks` has nothing to read)
+    reads identically to a transient GitHub-unreachable blip —
+    CI_UNREADABLE_PREFIX. Before this fix that parked forever behind
+    `checks_unreadable`'s "retry the read" logic: no amount of retrying
+    reads GitHub cannot ever answer differently, so the park never resolved
+    (the live incident behind this issue, claude-coordinator#2375 / PR
+    #2379, parked 6x with zero forward progress). `process()` must consult
+    `check_pr_mergeable` — same probe, same fail-closed contract as #1877's
+    sibling checks-absent fix — and, for a CONFIRMED conflict only, route
+    STRAIGHT to the `conflict` event / #241 conflict-fix dispatch instead of
+    parking behind a read that can never succeed."""
+
+    @staticmethod
+    def _ci_unreadable():
+        from types import SimpleNamespace
+
+        class _Ci:
+            is_available = True
+            def list_checks_for_pr(self, repo, number):
+                return [SimpleNamespace(
+                    name="coord: could not read CI status for acme/api#99 "
+                         "(HTTP 503: No server is currently available)",
+                    status="completed", conclusion="unknown",
+                )]
+        return _Ci()
+
+    def test_confirmed_conflict_routes_directly_to_conflict_event(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = FakeGh(mergeable_results={99: False})
+        events = process(items, gh, ci_store=self._ci_unreadable())
+
+        assert gh.mergeable_calls == [("acme/api", 99)]
+        # Unlike #1877's empty-checks case, this routes DIRECTLY to a
+        # conflict event/state — there is no real `gh pr merge` attempt to
+        # fall through to, because the CI gate never reaches the merge
+        # section for a non-empty (if unreadable) check list.
+        assert gh.merge_calls == [], "no live merge attempt needed for this route"
+        kinds = [e.kind for e in events]
+        assert "conflict" in kinds
+        assert "checks_unreadable" not in kinds
+        assert items[0].state == CONFLICT
+        # Routes through the SAME classifier #241 already uses — this fix
+        # only changes reachability, not the classify-and-dispatch machinery.
+        assert mq.classify_conflict(items[0].error) == "rebaseable"
+
+    def test_unknown_mergeability_keeps_parking_as_checks_unreadable(self) -> None:
+        """Acceptance criterion: a genuinely UNKNOWN mergeability read
+        (still computing, no probe available, or the probe errored) must
+        keep today's park-and-wait behavior unchanged — this is additive,
+        not a general loosening of the CI-unreadable path."""
+        for verdict in (True, None):
+            items = [_q("w1", pr=99)]
+            gh = FakeGh(mergeable_results={99: verdict})
+            events = process(items, gh, ci_store=self._ci_unreadable())
+
+            assert gh.merge_calls == [], verdict
+            kinds = [e.kind for e in events]
+            assert "checks_unreadable" in kinds, verdict
+            assert "conflict" not in kinds, verdict
+            assert items[0].state == PENDING, verdict
+            assert mq.is_ci_unreadable_reason(items[0].error), verdict
+
+    def test_dry_run_previews_conflict_route_without_merging(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = FakeGh(mergeable_results={99: False})
+        events = process(items, gh, ci_store=self._ci_unreadable(), dry_run=True)
+
+        assert gh.merge_calls == []
+        kinds = [e.kind for e in events]
+        assert "conflict" in kinds
+        assert "checks_failed" not in kinds
+        assert "merged" not in kinds
+        assert items[0].state == PENDING
+
+
 class TestCiInfraReason:
     """#1892: `_ci_infra_reason` — the classification helper, isolated from
     `process()`'s I/O. `getattr(ci, "list_jobs_for_run", None)` is the

{code_coordinator-0.5.141 → code_coordinator-0.5.143}/tests/test_reconcile.py

@@ -262,6 +262,64 @@ class TestReassignThreadsProvider:
         payload = mock_post.call_args.kwargs["json"]
         assert "provider" not in payload
 
+    @patch("coord.reconcile.httpx.post")
+    def test_a_model_dropped_from_the_ladder_is_not_inherited_forever(
+        self, mock_post: MagicMock,
+    ) -> None:
+        """#2383: `failed.model` names a model an operator has since
+        removed from `models.escalation` — the auto-reassign call site
+        never passes `model=` explicitly (reconcile.py's `newly_failed`
+        loop), so without a clamp this would be inherited on EVERY future
+        retry of the same lineage, forever, regardless of what the current
+        ladder says."""
+        resp = MagicMock()
+        resp.json.return_value = {"id": "newid"}
+        mock_post.return_value = resp
+        cfg = Config(
+            repos=[Repo(name="api", github="acme/api")],
+            machines=[
+                Machine(name="laptop", host="l", repos=["api"], repo_paths={"api": "/tmp"}),
+                Machine(name="server", host="s", repos=["api"], repo_paths={"api": "/tmp"}),
+            ],
+        )
+        assert "fable" not in cfg.models.escalation  # sanity: not on the ladder
+        board = Board()
+        failed = _failed(model="fable")
+
+        result = _reassign(failed, board, cfg)
+
+        assert result is not None
+        payload = mock_post.call_args.kwargs["json"]
+        assert payload["model"] != "claude-fable-5"
+        assert payload["model"] == cfg.models.resolve(cfg.models.escalation[-1])
+
+    @patch("coord.reconcile.httpx.post")
+    def test_an_explicit_model_override_is_never_clamped(
+        self, mock_post: MagicMock,
+    ) -> None:
+        """The clamp is scoped to the INHERITED (`model=None`) path only —
+        a caller that explicitly asks for a specific model (e.g. #1291's
+        semantic-conflict escalation) must get exactly that model, even one
+        off the ordinary ladder."""
+        resp = MagicMock()
+        resp.json.return_value = {"id": "newid"}
+        mock_post.return_value = resp
+        cfg = Config(
+            repos=[Repo(name="api", github="acme/api")],
+            machines=[
+                Machine(name="laptop", host="l", repos=["api"], repo_paths={"api": "/tmp"}),
+                Machine(name="server", host="s", repos=["api"], repo_paths={"api": "/tmp"}),
+            ],
+        )
+        board = Board()
+        failed = _failed(model="sonnet")
+
+        result = _reassign(failed, board, cfg, model="opus")
+
+        assert result is not None
+        payload = mock_post.call_args.kwargs["json"]
+        assert payload["model"] == cfg.models.resolve("opus")
+
 
 # ── #1711: the provider-availability gate, applied to retry routing ────────