code-coordinator 0.5.196__tar.gz → 0.5.200__tar.gz

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.196
+Version: 0.5.200
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.196
+Version: 0.5.200
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/code_coordinator.egg-info/SOURCES.txt

@@ -608,6 +608,7 @@ tests/test_refine_chat.py
 tests/test_release_cordon_2101.py
 tests/test_release_cordon_daemon_leads_2176.py
 tests/test_release_cordon_deadlock_2240.py
+tests/test_release_cordon_stuck_2490.py
 tests/test_release_propagate.py
 tests/test_release_unified_1242.py
 tests/test_release_verify.py

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/code_coordinator.egg-info/scm_file_list.json

@@ -670,6 +670,7 @@
     "tests/test_release_cordon_2101.py",
     "tests/test_release_cordon_daemon_leads_2176.py",
     "tests/test_release_cordon_deadlock_2240.py",
+    "tests/test_release_cordon_stuck_2490.py",
     "tests/test_release_propagate.py",
     "tests/test_release_unified_1242.py",
     "tests/test_release_verify.py",

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.196",
+  "tag": "0.5.200",
   "distance": 0,
-  "node": "g049ba86f1fa5713231873ab0a75ea2fa2c2fe27f",
+  "node": "gc8878ff7b1ebea74a3711aba656f4ccbb265122e",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/coord/commands/release.py

@@ -1354,6 +1354,7 @@ def _apply_cordons(  # noqa: PLR0912 — one linear apply-the-plan pass
     outcome.cooling_seconds = plan.cooling_seconds
     outcome.collateral_spared = list(plan.collateral_spared)
     outcome.blocked_behind = plan.blocked_behind
+    outcome.stuck_in_cooldown = list(plan.stuck_in_cooldown)
     if plan.released is not None:
         outcome.released = plan.released.to_dict()
         # stderr as well as stdout: on the timer host this line IS the
@@ -2148,8 +2149,18 @@ def release_cordon(
             )
         )
         return
+    # #2490: hosts the newest propagate run flagged as behind, idle, and
+    # left uncordoned only because the #2240 cooldown is suppressing new
+    # cordons. These are exactly the machines an operator would otherwise
+    # have to notice by hand (`coord status` showing `online • idle` on a
+    # host that's actually stuck on an old version) — surface them even when
+    # `active` is empty, since a stuck host is by definition NOT cordoned.
+    stuck_hosts, stuck_target = _stuck_hosts_from_journal()
     if not active:
-        click.echo("no machines are cordoned — the fleet is free to take work")
+        if stuck_hosts:
+            _echo_stuck_hosts(stuck_hosts, stuck_target)
+        else:
+            click.echo("no machines are cordoned — the fleet is free to take work")
         return
     for name, record in sorted(active.items()):
         remaining = max(0.0, record.expires_at - now) / 60.0
@@ -2180,6 +2191,8 @@ def release_cordon(
             f"`coord release propagate` releases it by itself after "
             f"{rc.DEFAULT_MAX_DEFERRALS}."
         )
+    if stuck_hosts:
+        _echo_stuck_hosts(stuck_hosts, stuck_target)
     click.echo(
         f"\nclear one with `coord release cordon --clear <machine>` "
         f"(default lifetime {rc.DEFAULT_TTL_SECONDS / 60:.0f}m — a cordon "
@@ -2197,6 +2210,59 @@ def _read_propagation_records() -> list[dict]:
         return []
 
 
+def _stuck_hosts_from_journal() -> tuple[list[str], str | None]:
+    """Hosts the NEWEST propagate run flagged as stuck-in-cooldown (#2490).
+
+    ``CordonPlan.stuck_in_cooldown`` (mirrored onto ``CordonOutcome`` and
+    journalled under a run's ``cordons`` key) names behind, idle hosts a run
+    left uncordoned only because the #2240 deadlock-release cooldown is
+    still active — the gap the issue is about: nothing gave such a host a
+    signal or a path back to rolling for up to the cooldown's full length.
+
+    Only the single newest record counts, deliberately: this is a
+    point-in-time reading ("as of the last tick"), and a host named in an
+    older record may since have gone busy, rolled, or had its cooldown
+    lift — reporting it from a stale record would be a false alarm, which is
+    exactly the kind of noise this fleet already has too much of. No
+    journal (a thin client, or a host that has never run propagate)
+    degrades to nothing rather than raising — mirrors every other reader of
+    this journal in this module.
+    """
+    try:
+        records = _read_propagation_records()
+    except Exception:  # noqa: BLE001 — never load-bearing
+        return [], None
+    if not records:
+        return [], None
+    newest = records[-1]
+    if not isinstance(newest, dict):
+        return [], None
+    cordons = newest.get("cordons")
+    if not isinstance(cordons, dict):
+        return [], None
+    stuck = cordons.get("stuck_in_cooldown") or []
+    if not isinstance(stuck, list):
+        return [], None
+    target = newest.get("target_version")
+    return [str(h) for h in stuck], (str(target) if target else None)
+
+
+def _echo_stuck_hosts(stuck_hosts: list[str], stuck_target: str | None) -> None:
+    """The #2490 notice both branches of ``release_cordon`` share.
+
+    One line per host, each naming its own override command — the format
+    the issue itself asks for: "precision: 18m behind v0.5.192, idle, cordon
+    suppressed by cooldown (#2240) — consider `coord agent update --machine
+    precision`."
+    """
+    version = f"v{stuck_target}" if stuck_target else "the release"
+    click.echo(f"\n! STUCK (#2490): behind {version}, idle, cordon suppressed "
+               "by the #2240 deadlock-release cooldown — no automatic path "
+               "back to rolling until it lifts on its own:")
+    for host in sorted(stuck_hosts):
+        click.echo(f"  ! {host}: consider `coord agent update --machine {host}`")
+
+
 @release_group.command(
     "rollback",
     help=(

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/coord/commands/status.py

@@ -55,6 +55,30 @@ def _cordon_stall_suffix(cordons: dict) -> str:
     return f" ({described})" if described else ""
 
 
+def _stuck_in_cooldown_hosts() -> dict[str, str | None]:
+    """Machine name -> target version, for hosts stuck-in-cooldown (#2490).
+
+    Thin wrapper around :func:`coord.commands.release._stuck_hosts_from_journal`
+    — same journal, same "newest record only" reading, reused rather than
+    reimplemented. A host in this dict is behind the target version, was
+    idle as of the last `coord release propagate` tick, and is NOT cordoned
+    (the #2240 cooldown is suppressing it) — which is exactly why it shows
+    up everywhere else in this command as a flatly ordinary `online • idle`.
+    That silence is the whole finding of #2490: a human noticed only because
+    they happened to be watching `coord status` themselves.
+
+    Degrades to ``{}`` on any error (no journal, an unreadable one, a thin
+    client) — never load-bearing, same contract as `_cordon_stall_suffix`.
+    """
+    from coord.commands.release import _stuck_hosts_from_journal  # noqa: PLC0415
+
+    try:
+        hosts, target = _stuck_hosts_from_journal()
+    except Exception:  # noqa: BLE001 — a status render must never fail on this
+        return {}
+    return {h: target for h in hosts}
+
+
 def _live_advisory_entries(
     entries: list[dict],
     cfg: "Config",
@@ -187,6 +211,9 @@ def status(config_path: Path, machine_filter: str | None, no_reconcile: bool, ti
     # same, which is why the 70-minute stall was invisible.
     cordon_stall = _cordon_stall_suffix(cordons)
     quiet_windows = effective_quiet_hours(cfg.machines)
+    # #2490: hosts the last propagate run flagged as behind + idle + stuck
+    # behind an active #2240 cooldown — see `_stuck_in_cooldown_hosts`.
+    stuck_in_cooldown = _stuck_in_cooldown_hosts()
 
     statuses = check_all(machines, timeout=timeout)
     agent_completed: dict[str, dict] = {}
@@ -314,6 +341,22 @@ def status(config_path: Path, machine_filter: str | None, no_reconcile: bool, ti
             for repo_name, reason in degraded.items():
                 click.echo(f"    ⚠ degraded: {repo_name} — {reason}")
 
+        # #2490: this host is behind the release, was idle last tick, and
+        # nothing is cordoning it because a #2240 deadlock-release cooldown
+        # is suppressing all new cordons fleet-wide. Without this line the
+        # machine above reads as a plain `online • idle` — indistinguishable
+        # from a machine with nothing to do, which is exactly how the
+        # 2026-08-20 incident went unnoticed for the length of the cooldown.
+        if m.name in stuck_in_cooldown:
+            stuck_target = stuck_in_cooldown[m.name]
+            stuck_version = f"v{stuck_target}" if stuck_target else "the release"
+            click.echo(
+                f"    ⚠ STUCK: behind {stuck_version} and idle, but cordoning "
+                "is suppressed by an active #2240 deadlock-release cooldown "
+                "(#2490) — no automatic path back to rolling until it lifts; "
+                f"consider `coord agent update --machine {m.name}`"
+            )
+
         if status_result and status_result.ok and status_result.data:
             for entry in status_result.data.get("active", []):
                 progress = entry.get("progress")

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/coord/pipeline.py

@@ -228,6 +228,17 @@ def compute_pipeline(
         None,
     )
 
+    # #2498: a review that came back "request-changes" must never read as
+    # mergeable, no matter what else is true about the assignment (including
+    # a stray `mq_entry` — see the `mq_entry is not None` branch below, and
+    # the unconditional "enqueue" gate this used to feed). Computed once here
+    # so both the stage-progression chain and the stage-status/gate-list
+    # logic further down share the same verdict check.
+    review_rejected = (
+        review_assignment is not None
+        and review_assignment.review_verdict == "request-changes"
+    )
+
     # ── Determine current_stage ──────────────────────────────────────────────
     current_stage: str
     if assignment.status == "running":
@@ -251,7 +262,39 @@ def compute_pipeline(
         current_stage = "merged"
     elif assignment.status in ("done", "pending"):
         # Evaluate from most advanced to least advanced.
-        if mq_entry is not None:
+        # #2498: an `mq_entry` (queued/merging/merged) no longer trumps
+        # everything else when the linked review came back request-changes —
+        # fall through to the normal review/smoke evaluation below instead,
+        # so a rejected review keeps showing as blocked even if it was
+        # (incorrectly) enqueued before this fix, or by any other path that
+        # doesn't re-check the verdict.
+        #
+        # #2498 (review 1): a *genuine* smoke/test failure or an
+        # in-progress smoke assignment must still be checked, and still win,
+        # BEFORE `review_assignment` — those are real, distinct signals
+        # (an infra failure, or a smoke run that hasn't finished yet) and
+        # existing coverage (test_failed_smoke_assignment_does_not_fall_
+        # through_to_review) depends on a failed smoke assignment surfacing
+        # even when a review also completed.
+        #
+        # But `assignment.smoke_test == "pass"` (and the sibling
+        # "smoke_assignment done → treat as passed" branch) is a different
+        # kind of signal: per `coord/state.py:_record_test_verdict_local`
+        # (#1384), recording `test_state="passed"` always mirrors to
+        # `smoke_test="pass"` on this same work assignment — the default
+        # behaviour on every ordinary Test-gate pass, not an edge case — and
+        # `auto_loop.py`'s `test_precedes_review` gate requires exactly that
+        # mirrored "passed" state before it will ever dispatch a review. So
+        # by the time `review_assignment` exists at all, `smoke_test` is
+        # already "pass" essentially every time — meaning checking it before
+        # `review_assignment` resolved `current_stage` to "smoke_passed" and
+        # never reached the review branch at all, leaving `review_rejected`
+        # unenforced on the realistic "Test passed, then Review rejected"
+        # path. A dispatched review is definitionally more advanced than a
+        # merely-passed Test gate (Test precedes Review), so the "pass"
+        # branches move below the review check while the failure/running
+        # branches stay above it.
+        if mq_entry is not None and not review_rejected:
             from coord.merge_queue import MERGED, MERGING
 
             if mq_entry.state == MERGED:
@@ -260,8 +303,6 @@ def compute_pipeline(
                 current_stage = "merging"
             else:
                 current_stage = "merge_ready"
-        elif assignment.smoke_test == "pass":
-            current_stage = "smoke_passed"
         elif assignment.smoke_test == "fail":
             current_stage = "smoke_failed"
         elif smoke_assignment is not None and smoke_assignment.status in ("running", "pending"):
@@ -270,9 +311,6 @@ def compute_pipeline(
             # Smoke assignment itself failed (infra failure) — not the same as
             # the smoke *test* failing, but still unblocks the work assignment.
             current_stage = "smoke_failed"
-        elif smoke_assignment is not None and smoke_assignment.status in ("done",):
-            # Smoke assignment completed but smoke_test not yet set — treat as passed.
-            current_stage = "smoke_passed"
         elif review_assignment is not None:
             if review_assignment.status in ("running", "pending", "finalizing"):
                 # #1566: "finalizing" is a review row whose agent finished but
@@ -288,6 +326,11 @@ def compute_pipeline(
                 current_stage = "review_failed"
             else:
                 current_stage = "review_done"
+        elif assignment.smoke_test == "pass":
+            current_stage = "smoke_passed"
+        elif smoke_assignment is not None and smoke_assignment.status in ("done",):
+            # Smoke assignment completed but smoke_test not yet set — treat as passed.
+            current_stage = "smoke_passed"
         else:
             current_stage = "done"
     else:
@@ -327,6 +370,12 @@ def compute_pipeline(
             # This is the current stage.
             if current_stage == "merged":
                 status = "completed"  # final state, show as completed
+            elif current_stage == "review_done" and review_rejected:
+                # #2498: the review step finished, but a request-changes
+                # verdict means it did NOT clear the assignment for the next
+                # gate — show "active"/blocked, not a green "completed" that
+                # reads as "review passed."
+                status = "active"
             elif current_stage in ("smoke_passed", "review_done"):
                 status = "completed"  # sub-stage "done", ready for next gate
             elif current_stage == "failed":
@@ -367,7 +416,13 @@ def compute_pipeline(
     elif current_stage == "review_failed":
         available_gates.append(PipelineGate("dispatch_review", "Dispatch Review", _EP))
     elif current_stage == "review_done":
-        available_gates.append(PipelineGate("enqueue", "Queue for Merge", _EP))
+        # #2498: only offer "Queue for Merge" when the review is approved or
+        # hasn't produced a verdict yet — a request-changes verdict must not
+        # be one click from the merge queue. `dispatch_fix` just below is
+        # already correctly gated the mirror-image way (only offered ON
+        # request-changes); this makes `enqueue` its proper complement.
+        if not review_rejected:
+            available_gates.append(PipelineGate("enqueue", "Queue for Merge", _EP))
         if review_assignment is not None and review_assignment.review_posted_at is None:
             available_gates.append(PipelineGate("post_findings", "Post Findings", _EP))
         # Offer the phone a way to record a review verdict manually when the

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/coord/release_cordon.py

@@ -658,6 +658,17 @@ class CordonPlan:
     #: exactly when `collateral_spared` is non-empty. The single fact that
     #: would have turned a 40-minute puzzle into one line of output.
     blocked_behind: str | None = None
+    #: #2490: hosts that are BEHIND *target_version*, have no busy signal of
+    #: their own this run (idle), and are not being cordoned only because an
+    #: unexpired deadlock-release cooldown is suppressing all new cordons —
+    #: set exactly when ``cooling_seconds > 0``. This is the gap the issue
+    #: names: a host in this state has no automatic path back to rolling for
+    #: up to the cooldown's full length, and nothing surfaced that it was
+    #: sitting there idle, behind, and unflagged. Reported separately from
+    #: ``collateral_spared`` (blocked behind a busy daemon host — a different
+    #: reason a behind host stays uncordoned) so each surface can name the
+    #: actual cause instead of collapsing both into "not cordoned".
+    stuck_in_cooldown: tuple[str, ...] = ()
 
     @property
     def empty(self) -> bool:
@@ -668,6 +679,7 @@ class CordonPlan:
             or self.expired
             or self.released
             or self.collateral_spared
+            or self.stuck_in_cooldown
         )
 
     def to_dict(self) -> dict:
@@ -681,6 +693,7 @@ class CordonPlan:
             "cooling_seconds": self.cooling_seconds,
             "collateral_spared": list(self.collateral_spared),
             "blocked_behind": self.blocked_behind,
+            "stuck_in_cooldown": list(self.stuck_in_cooldown),
         }
 
     def render(self) -> list[str]:
@@ -718,6 +731,13 @@ class CordonPlan:
                 "release (#2240) is still letting the fleet work; nothing was "
                 "cordoned this run"
             )
+        for host in self.stuck_in_cooldown:
+            lines.append(
+                f"  ! STUCK: {host} is behind and idle, but cordoning is "
+                "suppressed by the deadlock-release cooldown above (#2490) — "
+                f"it has no automatic path back to rolling until the cooldown "
+                f"lifts. Consider `coord agent update --machine {host}`."
+            )
         for esc in self.escalations:
             lines.append(f"  ! {esc.message}")
         return lines
@@ -880,6 +900,21 @@ def plan_cordons(
     pressure = pressure or DeferralPressure()
     cooling = pressure.cooling_for(now, release_cooldown)
     if cooling > 0:
+        # #2490: a behind host with no busy signal of its own has nothing
+        # left holding it back except this cooldown — it is idle, it is
+        # behind, and it will sit exactly like that until the cooldown
+        # lifts (up to `release_cooldown` seconds) with no cordon and,
+        # before this, no signal anywhere that it needs attention.
+        # `collateral` hosts are excluded: those are uncordoned for an
+        # unrelated reason (blocked behind a busy daemon host) that already
+        # has its own name (`collateral_spared`/`blocked_behind`).
+        stuck = tuple(
+            sorted(
+                host
+                for host in (drift.behind - collateral)
+                if not (busy_reasons or {}).get(host)
+            )
+        )
         return CordonPlan(
             uncordon=to_uncordon,
             expired=expired,
@@ -887,6 +922,7 @@ def plan_cordons(
             unknown=tuple(sorted(drift.undecided & set(live))),
             collateral_spared=tuple(sorted(collateral)),
             blocked_behind=blocked_behind,
+            stuck_in_cooldown=stuck,
         )
     if max_deferrals > 0 and pressure.consecutive >= max_deferrals:
         return CordonPlan(
@@ -984,6 +1020,12 @@ class CordonOutcome:
     #: #2176: the daemon host `collateral_spared` was spared on account of.
     #: Mirrors `CordonPlan.blocked_behind`.
     blocked_behind: str | None = None
+    #: #2490: mirrors `CordonPlan.stuck_in_cooldown` — behind, idle hosts this
+    #: run left uncordoned only because the #2240 deadlock cooldown is still
+    #: active. Journalled (not just printed) so a read-only surface like
+    #: `coord status` can flag them without recomputing `plan_cordons` itself
+    #: — see `coord.commands.status._stuck_in_cooldown_hosts`.
+    stuck_in_cooldown: list[str] = field(default_factory=list)
 
     def to_dict(self) -> dict:
         return {
@@ -999,4 +1041,5 @@ class CordonOutcome:
             "max_deferrals": self.max_deferrals,
             "collateral_spared": list(self.collateral_spared),
             "blocked_behind": self.blocked_behind,
+            "stuck_in_cooldown": list(self.stuck_in_cooldown),
         }

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/coord/release_propagate.py

@@ -1294,6 +1294,14 @@ def render_record(record: PropagationRecord | Mapping[str, Any]) -> list[str]:
             "    cordons held off (post-release cooldown, #2240): "
             f"{float(cordons['cooling_seconds']) / 60.0:.0f}m left"
         )
+    # #2490: name the hosts that were behind and idle but left uncordoned
+    # purely because of the cooldown above — the gap that let `precision`
+    # sit stuck for 30 minutes with no automatic path back to rolling.
+    if cordons.get("stuck_in_cooldown"):
+        lines.append(
+            "    ! STUCK (idle, behind, cooldown-suppressed, #2490): "
+            + ", ".join(cordons["stuck_in_cooldown"])
+        )
     for esc in cordons.get("escalated") or []:
         lines.append(f"    ! {esc.get('message') or esc}")
     for err in cordons.get("errors") or []:

{code_coordinator-0.5.196 → code_coordinator-0.5.200}/tests/test_pipeline.py

@@ -1787,3 +1787,99 @@ class TestDispatchFixGateForRequestChanges:
         pv = compute_pipeline(work, board, [], _config())
         gate_actions = {g.action for g in pv.available_gates}
         assert "dispatch_fix" not in gate_actions
+
+
+class TestMergeQueueIgnoresRejectedReview:
+    """#2498: coord-web showed a request-changes review as mergeable once
+    merge-queued — the top badge read "mergeable," the Review row in the
+    gate-status list read green/"completed," and "Merge" was enabled,
+    directly under a Review section whose own verdict said "Changes
+    requested." Root cause was `current_stage`'s `mq_entry is not None`
+    check firing unconditionally, before ever consulting
+    `review_assignment.review_verdict` — and a second bug feeding it: the
+    "enqueue" gate at review_done was offered unconditionally instead of
+    being gated on the verdict the way `dispatch_fix` already was."""
+
+    def test_mq_entry_with_rejected_review_is_not_merge_ready(self) -> None:
+        """An mq_entry existing (e.g. from before this fix, or any other path
+        that skipped the verdict check) must not make a request-changes
+        assignment read as merge_ready/merging/merged."""
+        work = _work(aid="work-1", status="done")
+        rev = _review(of_aid="work-1", status="done")
+        rev.review_verdict = "request-changes"
+        mq = [_mq_entry(state=PENDING)]
+        board = Board(completed=[work, rev])
+        pv = compute_pipeline(work, board, mq, _config())
+
+        assert pv.current_stage not in ("merge_ready", "merging", "merged")
+        assert pv.current_stage == "review_done"
+
+        gate_actions = {g.action for g in pv.available_gates}
+        assert "merge" not in gate_actions
+        assert "enqueue" not in gate_actions
+        assert "dispatch_fix" in gate_actions
+
+        review = next(s for s in pv.stages if s.name == "review")
+        assert review.status != "completed"
+
+    def test_review_done_rejected_does_not_offer_enqueue(self) -> None:
+        """Even with no mq_entry at all, "Queue for Merge" must not be
+        offered on a request-changes verdict (the bug's proximate cause: a
+        human — or an automated caller — one click from queueing rejected
+        code)."""
+        work = _work(aid="work-1", status="done")
+        rev = _review(of_aid="work-1", status="done")
+        rev.review_verdict = "request-changes"
+        board = Board(completed=[work, rev])
+        pv = compute_pipeline(work, board, [], _config())
+
+        assert pv.current_stage == "review_done"
+        gate_actions = {g.action for g in pv.available_gates}
+        assert "enqueue" not in gate_actions
+        assert "dispatch_fix" in gate_actions
+
+    def test_smoke_test_pass_then_rejected_review_is_not_smoke_passed(self) -> None:
+        """#2498 review 1: the realistic path. Per `_record_test_verdict_local`
+        (#1384), a passed Test gate always mirrors `smoke_test="pass"` onto
+        the parent work assignment BEFORE review ever dispatches (Test
+        precedes Review) — so `smoke_test == "pass"` is the normal state by
+        the time a review completes, not an edge case. The old elif-chain
+        checked `assignment.smoke_test == "pass"` before `review_assignment
+        is not None`, so it resolved to "smoke_passed" and never reached the
+        review_rejected guard at all: the review stage rendered "waiting"
+        (hiding that a review even ran) and the untouched `smoke_passed`
+        branch offered "enqueue" unconditionally — one click from queueing
+        rejected code. No `mq_entry` needed to trigger it."""
+        work = _work(aid="work-1", status="done", smoke_test="pass")
+        rev = _review(of_aid="work-1", status="done")
+        rev.review_verdict = "request-changes"
+        board = Board(completed=[work, rev])
+        pv = compute_pipeline(work, board, [], _config())
+
+        assert pv.current_stage not in ("smoke_passed", "merge_ready", "merging", "merged")
+        assert pv.current_stage == "review_done"
+
+        gate_actions = {g.action for g in pv.available_gates}
+        assert "enqueue" not in gate_actions
+        assert "dispatch_fix" in gate_actions
+
+        review = next(s for s in pv.stages if s.name == "review")
+        assert review.status != "waiting"
+        assert review.status != "completed"
+
+    def test_review_done_approved_still_offers_enqueue_with_mq_entry_absent(self) -> None:
+        """Sanity check the fix doesn't over-correct: an approved (or
+        no-verdict-yet) review_done still offers enqueue, unaffected."""
+        work = _work(aid="work-1", status="done")
+        rev = _review(of_aid="work-1", status="done")
+        rev.review_verdict = "approve"
+        board = Board(completed=[work, rev])
+        pv = compute_pipeline(work, board, [], _config())
+
+        assert pv.current_stage == "review_done"
+        gate_actions = {g.action for g in pv.available_gates}
+        assert "enqueue" in gate_actions
+        assert "dispatch_fix" not in gate_actions
+
+        review = next(s for s in pv.stages if s.name == "review")
+        assert review.status == "completed"