code-coordinator 0.5.172__tar.gz → 0.5.175__tar.gz

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.172
+Version: 0.5.175
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.172
+Version: 0.5.175
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/code_coordinator.egg-info/SOURCES.txt

@@ -810,6 +810,7 @@ tests/acceptance/ms-65/detail_substate_2285.rs
 tests/acceptance/ms-65/manifest.yml
 tests/acceptance/ms-65/pipeline_tabs_2284.rs
 tests/acceptance/ms-65/tabs_discoverability_2287.rs
+tests/acceptance/ms-65/tabs_persistence_2286.rs
 tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
 tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
 tests/acceptance/ms-65/mocks/board-preview-tab.screen

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/code_coordinator.egg-info/scm_file_list.json

@@ -456,6 +456,7 @@
     "tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
     "tests/acceptance/ms-65/pipeline_tabs_2284.rs",
     "tests/acceptance/ms-65/tabs_discoverability_2287.rs",
+    "tests/acceptance/ms-65/tabs_persistence_2286.rs",
     "tests/acceptance/ms-example/mocks/home-active.html",
     "tests/conftest.py",
     "tests/fixtures/board-pipeline-basic.json",

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.172",
+  "tag": "0.5.175",
   "distance": 0,
-  "node": "gbab69913bc39627dc11bb77bed4e0e8c37519e6e",
+  "node": "g517152e1c6b8bcb5f78fa7edd29915934fa18cc9",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-19"

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/ci_github.py

@@ -146,6 +146,49 @@ class GitHubCi:
         return True
 
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Checks the merge gate evaluates — narrowed to what GitHub's own
+        branch protection actually REQUIRES, when that's determinable
+        (#2388/#2446).
+
+        A repo can report far more `gh pr checks` entries than GitHub's
+        required-status-check list (this repo: 9 reported, 5 required), and
+        every merge-gate predicate downstream of this method
+        (`failed_checks`, `in_flight_checks`, `checks_are_stale`) otherwise
+        waits on advisory jobs GitHub itself doesn't — a hung/flaky ADVISORY
+        check (e.g. `Acceptance (web)`, or an unconditional Playwright/
+        Chromium install with no timeout) then blocks `coord merge`
+        indefinitely even though the PR is already `MERGEABLE`. Never
+        filters (returns everything :meth:`list_all_checks_for_pr` does)
+        when the required list can't be determined — #1525's bias: unknown
+        reads as "wait on everything reported", not as a free pass to stop
+        waiting on something that might matter.
+
+        #2446: this is deliberately the ONLY narrowed view — see
+        :meth:`list_all_checks_for_pr` for the full, unfiltered set that
+        feeds `coord merge --plan`'s CI summary, so a regressed advisory
+        check stays visible to an operator even though it can no longer gate
+        a merge attempt.
+        """
+        checks = self._all_checks(repo, number)
+        required = self._required_contexts(repo)
+        if required:
+            return [c for c in checks if c.name in required]
+        return checks
+
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Every check `gh pr checks` reports, required or advisory (#2446).
+
+        Purely a visibility view — `coord merge --plan`/the TUI's CI badges
+        read this so a regressed ADVISORY check (one GitHub's branch
+        protection doesn't require, and :meth:`list_checks_for_pr` therefore
+        no longer waits on) is still something an operator can see, per
+        #2446's suggested fix: "still visible ... but should never gate a
+        merge attempt." Shares :meth:`list_checks_for_pr`'s cached fetch —
+        one `gh pr checks` subprocess call backs both views, never two.
+        """
+        return self._all_checks(repo, number)
+
+    def _all_checks(self, repo: str, number: int) -> list[CheckRun]:
         key = (repo, number)
         now = time.time()
         cached = self._cache.get(key)
@@ -367,7 +410,13 @@ class GitHubCi:
             return [_unreadable_check(repo, number, str(e))]
         if not isinstance(raw, list):
             return [_unreadable_check(repo, number, "gh pr checks returned non-list JSON")]
-        checks = [
+        # #2446: `_all_checks` (this method's only caller) is the single
+        # unfiltered fetch shared by both `list_checks_for_pr` (narrowed to
+        # required contexts) and `list_all_checks_for_pr` (everything) — the
+        # required-contexts narrowing used to happen here, which meant an
+        # advisory check's regression was invisible everywhere, not just to
+        # the merge gate. See both methods' docstrings.
+        return [
             CheckRun(
                 name=str(entry.get("name", "")),
                 status=_status_from_bucket(str(entry.get("bucket", ""))),
@@ -380,22 +429,6 @@ class GitHubCi:
             for entry in raw
             if isinstance(entry, dict)
         ]
-        # #2388: narrow to what branch protection actually REQUIRES, when
-        # that's determinable — a repo can report far more `gh pr checks`
-        # entries than GitHub's own required list (this repo: 9 reported, 5
-        # required), and every merge-gate predicate downstream of this
-        # method (`failed_checks`, `in_flight_checks`, `checks_are_stale`)
-        # otherwise waits on advisory jobs GitHub itself doesn't. A hung
-        # advisory job (e.g. an unconditional Playwright/Chromium install
-        # with no timeout) would then block `coord merge` indefinitely even
-        # though the PR is already `MERGEABLE`. `_required_contexts` returns
-        # `None` (never filters) when it can't determine the required list
-        # — #1525's bias: unknown reads as "wait on everything reported",
-        # not as a free pass to stop waiting on something that might matter.
-        required = self._required_contexts(repo)
-        if required:
-            checks = [c for c in checks if c.name in required]
-        return checks
 
     def _required_contexts(self, repo: str) -> frozenset[str] | None:
         now = time.time()

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/ci_store.py

@@ -125,6 +125,28 @@ class CiStore(Protocol):
 
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]: ...
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Every check reported for *repo*/*number*, required or advisory
+        (#2446) — the unfiltered counterpart to :meth:`list_checks_for_pr`,
+        which narrows to what branch protection actually requires so the
+        merge gate never blocks on a merely-advisory check (see that
+        method's docstring on :class:`coord.ci_github.GitHubCi`).
+
+        Purely a visibility view: `coord merge --plan`'s CI summary reads
+        this so a regressed advisory check is still visible to an operator
+        even though it can no longer gate a merge attempt — matching what
+        GitHub's own merge button already allows.
+
+        Optional/duck-typed like :meth:`rerun_failed_for_pr` — call sites
+        use ``getattr(ci_store, "list_all_checks_for_pr", None)`` and fall
+        back to :meth:`list_checks_for_pr` for a stand-in (a test stub, or
+        :class:`coord.gate_snapshot.GateSnapshot` when its own snapshot
+        wasn't refreshed with the unfiltered view) that predates this
+        capability — read as "no separate advisory view available", not an
+        error.
+        """
+        ...
+
     @property
     def is_available(self) -> bool: ...
 
@@ -232,6 +254,11 @@ class NoOpCi:
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
         return []
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """No-op: CI gating is disabled entirely, so there is nothing to
+        show either the gate or an operator (#2446)."""
+        return []
+
     @property
     def is_available(self) -> bool:
         return False

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/commands/merge.py

@@ -944,6 +944,60 @@ def _reconcile_via_daemon(svc, params: dict) -> None:
         sys.exit(int(code))
 
 
+def _ci_field(summary, name: str, default=0):
+    """Read *name* off a CI rollup, tolerating both shapes ``p.ci_summary``/
+    ``p.ci_summary_all`` can arrive in (#2446).
+
+    ``coord.merge_queue.plan()`` (the local, in-process path) hands back
+    real :class:`~coord.ci_store.CiCheckSummary` instances. ``coord merge
+    --plan`` against a daemon instead reconstructs ``PlannedMerge`` from the
+    ``/board`` JSON payload (``_show_plan_from_daemon`` below) — the server
+    side flattens each rollup with ``dataclasses.asdict`` and nothing
+    re-hydrates it, so on that path both fields arrive as plain ``dict``s
+    instead. ``summary`` is ``None`` on either path when there's nothing to
+    report (no PR yet, no ``ci_store``, …).
+    """
+    if summary is None:
+        return default
+    if isinstance(summary, dict):
+        return summary.get(name, default)
+    return getattr(summary, name, default)
+
+
+def _advisory_ci_note(p) -> str:
+    """#2446: describe any check failing/still-running in the unfiltered
+    (required + advisory) CI rollup that the required-only rollup
+    (``p.ci_summary`` — the same view the merge gate itself evaluates)
+    doesn't already account for.
+
+    A regression here is on a check GitHub's own branch protection doesn't
+    require — `coord merge`'s gate correctly no longer blocks on it (see
+    ``coord.ci_github.GitHubCi.list_checks_for_pr``'s docstring), but an
+    operator staring at a READY row while a real job is red/hung nearby
+    still deserves to see it. Returns ``""`` when there's nothing extra to
+    report (no ``ci_summary_all``, or it agrees with ``ci_summary``).
+    """
+    if p.ci_summary_all is None:
+        return ""
+    req_failed = _ci_field(p.ci_summary, "failed")
+    req_running = _ci_field(p.ci_summary, "running")
+    req_failed_names = set(_ci_field(p.ci_summary, "failed_names", []) or [])
+    extra_failed = _ci_field(p.ci_summary_all, "failed") - req_failed
+    extra_running = _ci_field(p.ci_summary_all, "running") - req_running
+    if extra_failed <= 0 and extra_running <= 0:
+        return ""
+    all_failed_names = _ci_field(p.ci_summary_all, "failed_names", []) or []
+    advisory_failed_names = [n for n in all_failed_names if n not in req_failed_names]
+    bits = []
+    if advisory_failed_names:
+        bits.append("failing: " + ", ".join(advisory_failed_names))
+    elif extra_failed > 0:
+        bits.append(f"{extra_failed} failing")
+    if extra_running > 0:
+        bits.append(f"{extra_running} running")
+    return "   [advisory CI, not blocking — " + "; ".join(bits) + "]"
+
+
 def _print_merge_plan_entries(planned: list) -> None:
     """Print a list of PlannedMerge entries grouped by repo → target_branch."""
     if not planned:
@@ -963,7 +1017,7 @@ def _print_merge_plan_entries(planned: list) -> None:
             _status_str = f"{_p.status}   {_p.reason}"
         click.echo(
             f"  {_p.rank}. #{_p.issue_number}  {_size_str}   "
-            f"{_status_str}     {_p.issue_title}"
+            f"{_status_str}     {_p.issue_title}{_advisory_ci_note(_p)}"
         )
 
 

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/drive.py

@@ -114,6 +114,7 @@ from coord.failure_class import (
     plan_usage_limit_resume,
 )
 from coord.models import DELIVERABLE_ANALYSIS_LABEL, POLICY_REFUSAL_MARKER
+from coord.self_health import self_freshness
 from coord.usage_limits import PlanLimits, evaluate_usage_gate, get_plan_limits
 # Lost in the #1584-onto-#1590 rebase: _decide_review() calls this, but the
 # import lived in a hunk #1590 rewrote, so the merge came out textually clean
@@ -181,6 +182,20 @@ EXIT_DISPATCH_REFUSED = 5
 # vimcode#635 for the two live incidents (140 minutes and ~25 minutes of a
 # held queue slot, respectively, producing nothing).
 EXIT_DEAD_END = 6
+# #2443: a deliberate SELF-HEAL exit, not a failure — the drive loop noticed
+# it was stuck repeating the identical WAIT reason (see `_SELF_HEAL_WAIT_
+# STREAK`) while its OWN on-disk `coord` install had moved since this
+# session started. Python never reloads an already-imported module, so a
+# fix landing mid-run is otherwise invisible to a live session for as long
+# as `--deadline` allows — the claude-coordinator#2286 incident this closes
+# polled one unfetchable path every ~60s for 2+ hours after the fix was
+# already on disk. Distinct from EXIT_DISPATCH_REFUSED/EXIT_DEAD_END on
+# purpose: this condition is NOT permanent — relaunching is exactly the fix
+# — so it must fall through `coord.drive_queue._reconcile_running`'s
+# ordinary `retry` branch rather than either of those two `blocked`
+# branches, which is why nothing in drive_queue.py needs to special-case
+# this code at all.
+EXIT_SELF_STALE = 7
 
 
 class DriveError(Exception):
@@ -218,6 +233,31 @@ _CAPTURED_OUTPUT_LIMIT = 4000
 # never *tightened* for the environmental case.
 _ENVIRONMENTAL_WORK_RETRY_BUDGET = 5
 
+# #2443: how many CONSECUTIVE polls of the IDENTICAL `Action.label` to
+# tolerate before `Driver._loop` checks whether its own on-disk `coord`
+# install has moved since this session started. Below this, a same-label
+# repeat is indistinguishable from an ordinary slow-but-progressing wait (a
+# 10-20 minute test, a slow CI check) and checking would just be wasted
+# subprocess calls; at/above it, the check itself is a single local `git
+# rev-parse HEAD` (no network — see `coord.self_health.self_freshness
+# (fetch=False)`), cheap enough to run on every remaining poll of the
+# streak. At the default `--poll` of 60s this is ~10 minutes — fast enough
+# to matter against a multi-hour `--deadline`, slow enough that a routine
+# wait is never mistaken for the stuck case this exists to catch.
+_SELF_HEAL_WAIT_STREAK = 10
+
+
+def _current_self_head() -> str | None:
+    """Real default for `Driver.self_head_probe` (#2443): THIS process's own
+    on-disk `coord` install's current HEAD, or ``None`` when it can't be
+    determined (not a git checkout, unreadable HEAD — see
+    :func:`coord.self_health.self_freshness`). ``fetch=False``: this only
+    needs to notice code that has ALREADY landed locally (e.g. a prior `git
+    pull`), never reaches the network, and therefore never blocks the poll
+    loop on a slow/unreachable origin.
+    """
+    return self_freshness(fetch=False).head_sha
+
 
 def _bounded_tail(text: str, limit: int = _CAPTURED_OUTPUT_LIMIT) -> str:
     """*text*, or its last *limit* characters if longer — the tail, because
@@ -3685,8 +3725,19 @@ class Driver:
     # real `claude -p "/usage"` subprocess — mirrors *verifier*/*oracle_gate*
     # above. Defaults to the real (cached, ~60s) probe.
     usage_prober: Callable[[], PlanLimits] = get_plan_limits
+    # #2443: injected so tests can script a fake on-disk HEAD sequence
+    # without a real git checkout — same shape as *usage_prober* above.
+    # Defaults to the real, local-only (`fetch=False`) probe.
+    self_head_probe: Callable[[], str | None] = _current_self_head
 
     _run_log: Path | None = field(default=None, init=False, repr=False)
+    # #2443: this session's own on-disk `coord` HEAD, captured once by
+    # `_loop()` right as the poll loop begins — the baseline every later
+    # `_self_heal_drift_message` check compares against. `None` when it
+    # could not be determined (not a git checkout, unreadable HEAD), which
+    # keeps the self-heal check permanently a no-op for this run rather than
+    # ever comparing against a placeholder.
+    _start_head_sha: str | None = field(default=None, init=False, repr=False)
     # #1499: the terminating Action's own message, captured by `_loop()` right
     # before it returns — `run()` folds this into the `drive_exited` audit
     # summary/details so a non-exceptional terminal exit (e.g. `decide()`
@@ -3818,6 +3869,36 @@ class Driver:
         finally:
             lock.release()
 
+    # ── self-heal (#2443) ──────────────────────────────────────────────
+    def _self_heal_drift_message(self, label: str, streak: int) -> str | None:
+        """Has THIS process's own on-disk ``coord`` install moved since this
+        drive session started? ``None`` when it hasn't — or when freshness
+        can't be determined at all, which must never be misread as drift —
+        the overwhelmingly common case, so the caller just keeps waiting
+        exactly as before.
+
+        Only ever consulted once *label* (a WAIT ``Action``'s own reason)
+        has repeated *streak* times in a row (``_loop``'s
+        ``_SELF_HEAL_WAIT_STREAK`` gate) — this is specifically the #2286
+        shape: ``_decide_acceptance_author``'s "could not verify commits
+        (git fetch failed), retrying" arm returned the IDENTICAL label every
+        ~60s for 2+ hours after the fix that would have resolved it had
+        already landed on disk, because Python never reloads an
+        already-imported module. A stale in-memory `coord/drive.py` has no
+        way to notice that on its own — this is the bounded check that lets
+        it notice anyway.
+        """
+        current = self.self_head_probe()
+        if not current or not self._start_head_sha or current == self._start_head_sha:
+            return None
+        return (
+            "code changed underneath this session — on-disk coord moved "
+            f"from {self._start_head_sha[:8]} to {current[:8]} while stuck "
+            f"repeating the same wait {streak}x: {label!r}. Exiting "
+            "(EXIT_SELF_STALE) so coord drive-queue relaunches with "
+            f"current code instead of continuing to wait on stale logic (#2443)."
+        )
+
     def _post_escalation_comment(self, state: IssueState, message: str) -> None:
         """#1526: durably surface an escalation's reason onto the issue
         itself, not just this run's tmux pane and the ``coord escalate``
@@ -4061,6 +4142,15 @@ class Driver:
         # nudge) while guaranteeing a stalled stage is never more than one
         # `stall_secs` window away from a fresh check.
         last_nudge: float | None = None
+        # #2443: this session's own on-disk `coord` HEAD, captured once,
+        # right as the poll loop begins — see `_self_heal_drift_message`.
+        self._start_head_sha = self.self_head_probe()
+        # A distinct object (never equal to any real `Action.label`, empty
+        # string included) so the very first WAIT of the run always starts
+        # its streak at 1 rather than accidentally matching an unset
+        # sentinel.
+        last_wait_label: object = object()
+        same_wait_streak = 0
 
         while True:
             now = self.clock()
@@ -4155,6 +4245,36 @@ class Driver:
             for warning in action.warnings:
                 self.warn(warning)
 
+            # #2443: self-heal — see `_self_heal_drift_message`. Tracked off
+            # the Action's own `label`, NOT `fingerprint` above: a WAIT can
+            # (and, in the #2286 shape, does) repeat the identical reason
+            # poll after poll while the board fingerprint itself is static
+            # for the same underlying reason, so this is really the same
+            # signal — but keying directly on what the loop is ABOUT TO DO
+            # keeps this correct even for a WAIT arm whose label happens to
+            # be static text unrelated to fingerprint (e.g. "TEST: in
+            # progress on a capability-matched machine") without needing to
+            # reason about the two staying in lockstep. A non-WAIT action
+            # (RUN or EXIT) always resets the streak: dispatching something
+            # is progress by definition.
+            if action.kind == WAIT:
+                if action.label == last_wait_label:
+                    same_wait_streak += 1
+                else:
+                    last_wait_label = action.label
+                    same_wait_streak = 1
+                if same_wait_streak >= _SELF_HEAL_WAIT_STREAK:
+                    drift = self._self_heal_drift_message(
+                        action.label, same_wait_streak
+                    )
+                    if drift:
+                        self._last_exit_message = drift
+                        self.warn(drift)
+                        return EXIT_SELF_STALE
+            else:
+                last_wait_label = object()
+                same_wait_streak = 0
+
             if action.is_exit:
                 # #1499: capture the exit reason for the audit boundary before
                 # anything below can fail — the escalation write is explicitly

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/gate_snapshot.py

@@ -136,6 +136,16 @@ class GateSnapshot:
     """
 
     checks: dict[tuple[str, int], list[CheckRun]] = field(default_factory=dict)
+    # #2446: the unfiltered counterpart to `checks` above — `checks` is
+    # already narrowed to branch-protection-required contexts (see
+    # `coord.ci_github.GitHubCi.list_checks_for_pr`'s docstring), so a
+    # regressed ADVISORY check (one GitHub's own merge button doesn't wait
+    # on either) would otherwise be invisible to `coord merge --plan`'s CI
+    # summary, not just to the merge gate. Populated from
+    # `list_all_checks_for_pr` when the inner `CiStore` offers it; falls
+    # back to the same (already-narrowed) data as `checks` for a backend
+    # that doesn't, same fail-open shape as `workflows_declared` below.
+    all_checks: dict[tuple[str, int], list[CheckRun]] = field(default_factory=dict)
     commit_messages: dict[tuple[str, int], list[str]] = field(default_factory=dict)
     epic_issues: dict[tuple[str, int], bool] = field(default_factory=dict)
     # #1640: (repo, branch) -> HEAD SHA, and (repo, base, head) -> patch-id,
@@ -180,6 +190,19 @@ class GateSnapshot:
                 return [_stale_check(age)]
         return self.checks.get((repo, number), [])
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Unfiltered counterpart to :meth:`list_checks_for_pr` (#2446) —
+        same staleness handling, but keyed off ``all_checks`` so an
+        advisory check's regression stays visible to `coord merge --plan`
+        even though `list_checks_for_pr` (the gate's own view) no longer
+        waits on it.
+        """
+        if self.ci_available:
+            age = None if self.refreshed_at is None else time.time() - self.refreshed_at
+            if age is None or age > STALE_AFTER_SECONDS:
+                return [_stale_check(age)]
+        return self.all_checks.get((repo, number), [])
+
     def expects_checks(self, repo: str, number: int) -> bool:
         # #1904: unlike `list_checks_for_pr`'s "unknown reads as failing"
         # (#1525) posture, a repo this snapshot hasn't cached an answer for
@@ -286,6 +309,7 @@ class GateSnapshotRefresher:
         entries = [e for e in pending if e.pr_number]
 
         checks: dict[tuple[str, int], list[CheckRun]] = {}
+        all_checks: dict[tuple[str, int], list[CheckRun]] = {}
         messages: dict[tuple[str, int], list[str]] = {}
         epics: dict[tuple[str, int], bool] = {}
         branch_shas: dict[tuple[str, str], str | None] = {}
@@ -342,6 +366,21 @@ class GateSnapshotRefresher:
                     checks[key] = inner.list_checks_for_pr(*key)
                 except Exception:  # noqa: BLE001 — fail-open for this entry
                     checks[key] = []
+                # #2446: the unfiltered view backing `coord merge --plan`'s
+                # CI summary — see `GateSnapshot.all_checks`'s field
+                # comment. `list_all_checks_for_pr` is optional/duck-typed
+                # (a `CiStore` stand-in that predates #2446 doesn't offer
+                # it); falling back to the already-fetched `checks[key]`
+                # degrades to "advisory checks aren't shown separately",
+                # never to an extra `gh` call or a missing key.
+                list_all = getattr(inner, "list_all_checks_for_pr", None)
+                if list_all is not None:
+                    try:
+                        all_checks[key] = list_all(*key)
+                    except Exception:  # noqa: BLE001 — fail-open for this entry
+                        all_checks[key] = checks[key]
+                else:
+                    all_checks[key] = checks[key]
                 # #1904: repo-wide, so dedupe across every pending entry in
                 # the same repo — one `gh api .../actions/workflows` call
                 # per repo per tick, not one per PR. A failure here reads
@@ -372,6 +411,7 @@ class GateSnapshotRefresher:
 
         snap = GateSnapshot(
             checks=checks,
+            all_checks=all_checks,
             commit_messages=messages,
             epic_issues=epics,
             branch_shas=branch_shas,

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/coord/merge_queue.py

@@ -3984,6 +3984,20 @@ class PlannedMerge:
     # when no PR is open yet, or `ci_store` has no checks for this PR.
     pr_number: int | None = None
     ci_summary: "CiCheckSummary | None" = None
+    # #2446: the unfiltered (required + advisory) counterpart to
+    # `ci_summary` above, which is narrowed to what GitHub's branch
+    # protection actually requires — the same scope the merge gate itself
+    # evaluates (see `_entry_gate_status`/`coord.ci_github.GitHubCi.
+    # list_checks_for_pr`'s docstrings). A merely-advisory check regressing
+    # (a flaky/hung job the branch's own protection rules don't wait on
+    # either) must never gate a merge attempt, but it's still worth an
+    # operator seeing — this is what `coord merge --plan` renders that from.
+    # `None` under the same conditions as `ci_summary` (no PR yet, or no
+    # `ci_store`); a `CiStore` that predates `list_all_checks_for_pr` yields
+    # the same value as `ci_summary` rather than `None`, so a plan built
+    # against an older store still shows *something* instead of silently
+    # losing the badge.
+    ci_summary_all: "CiCheckSummary | None" = None
     # #2397: mirrors `config.merge.auto_drain` (default False) at plan-build
     # time — read-only exposure, no gate-logic change. The TUI's per-issue
     # Merge stage box needs this to tell "nothing retries until a human runs
@@ -4101,6 +4115,7 @@ def plan(
             reason: str | None = None
 
             ci_summary = None
+            ci_summary_all = None
             if entry.state == PENDING:
                 base_status, reason = _entry_gate_status(
                     entry, board, config, ci_store, gh_ops
@@ -4126,11 +4141,43 @@ def plan(
                 # only ever populates checks for entries that are PENDING at
                 # refresh time, so a MERGING/MERGED row never had real
                 # snapshot data to render in the first place.
+                #
+                # #2446: `ci_summary` MUST stay derived from the same
+                # (already required-narrowed) `list_checks_for_pr` view
+                # `_entry_gate_status` just consulted above — do not widen it
+                # to the unfiltered check list. `coord.drive_queue
+                # ._ci_rollup_all_clear` reads this exact field as positive
+                # evidence that a frozen "CI running:" raw-row string has
+                # gone stale, and that evidence is only valid when it is
+                # counting the SAME checks the live gate decision is based
+                # on (see that function's docstring); widening it here would
+                # make a still-pending ADVISORY check block the #2158
+                # park-recovery self-heal even though the gate itself (and
+                # GitHub's own merge button) is already clear. Advisory
+                # visibility is a genuinely separate concern — see
+                # `ci_summary_all` below.
                 if ci_store is not None and ci_store.is_available and entry.pr_number:
                     checks = ci_store.list_checks_for_pr(entry.repo_github, entry.pr_number)
                     if checks:
                         ci_summary = summarize_counts(checks)
 
+                    # #2446: the unfiltered (required + advisory) rollup —
+                    # pure visibility, never consulted by any gate decision
+                    # or self-heal evidence. Lets `coord merge --plan`/the
+                    # TUI still show a regressed advisory check (e.g.
+                    # `Acceptance (web)`) even though it can no longer block
+                    # `_entry_gate_status` above or the #2158 recovery read
+                    # above. Falls back to `ci_summary` for a `CiStore`
+                    # stand-in that predates `list_all_checks_for_pr`.
+                    list_all = getattr(ci_store, "list_all_checks_for_pr", None)
+                    all_checks = (
+                        list_all(entry.repo_github, entry.pr_number)
+                        if list_all is not None
+                        else checks
+                    )
+                    if all_checks:
+                        ci_summary_all = summarize_counts(all_checks)
+
             result.append(PlannedMerge(
                 assignment_id=entry.assignment_id,
                 repo_name=entry.repo_name,
@@ -4145,6 +4192,7 @@ def plan(
                 reason=reason,
                 pr_number=entry.pr_number,
                 ci_summary=ci_summary,
+                ci_summary_all=ci_summary_all,
                 enqueued_at=entry.enqueued_at,
                 last_attempt=entry.last_attempt,
                 milestone=milestones.get((entry.repo_name, entry.issue_number)),

{code_coordinator-0.5.172 → code_coordinator-0.5.175}/docs/OPERATING_GOTCHAS.md

@@ -44,6 +44,23 @@ doc's guess) and reports STALE with a commit count when it hasn't been pulled
 since a `coord/**` fix merged — the checkable gate for this row, the same way
 `coord diagnose --graph` is the checkable gate for graphify freshness.
 
+**#2443: a LIVE `coord drive` session now self-heals mid-run too.** #2436
+above only helps *before* a new launch — it says nothing about a session
+that was already running, with the OLD code loaded into memory, when the fix
+landed. Python never reloads an already-imported module, so a stale live
+session has no way to notice a fix on its own. `coord/drive.py`'s poll loop
+now watches its own `WAIT` actions: once the identical wait reason repeats
+`_SELF_HEAL_WAIT_STREAK` (10) polls in a row, it compares its own on-disk
+`coord` HEAD (captured once, at session start) against the current one
+(`coord.self_health.self_freshness(fetch=False)` — a local `git rev-parse
+HEAD`, no network). If the checkout moved underneath it, the session exits
+`EXIT_SELF_STALE` — a clean, non-permanent exit `coord drive-queue`'s
+ordinary retry/relaunch path picks straight back up under the current code —
+instead of continuing to poll dead logic for the rest of `--deadline`. This
+is the actual fix for the incident #2436 diagnosed after the fact: a live
+session on dellserver polled one unfetchable path every ~60s for 2+ hours
+after the #2319/#2320 fix that would have resolved it was already on disk.
+
 Not academic. #1394 (worker strands uncommitted work, then cleanup destroys it)
 sat merged-but-undeployed, and the very next dispatch — #1402 — hit the
 identical bug: **$3.44 and 10 minutes lost to something already fixed on