code-coordinator 0.5.211__tar.gz → 0.5.214__tar.gz

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.211
+Version: 0.5.214
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.211
+Version: 0.5.214
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.211",
+  "tag": "0.5.214",
   "distance": 0,
-  "node": "g69492bc482e0d53d98048d02518e14923db70112",
+  "node": "g2e87641a37faa3849364d808e9047a3c9632f0c2",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/coord/commands/drive_queue.py

@@ -2350,6 +2350,162 @@ def _run_merge_only_candidates(plan: TickPlan, config_path: Path | None) -> None
         click.echo(f"merge-only: {reason}")
 
 
+def _run_auto_revalidate_checks_stale(config_path: Path | None) -> None:
+    """#2535: best-effort auto-fire of the CI-staleness rerun for merge-queue
+    entries blocked SOLELY on stale CI checks against an already-approved
+    review — closing the gap where nothing periodic ever calls a live
+    ``coord merge`` or ``coord merge --revalidate`` on such an entry's
+    behalf, so it just sits until an operator notices ``--dry-run``'s
+    ``checks_stale`` line and reruns by hand (the trigger: #2530's Gate-A
+    PR #2534 sat blocked 2026-08-21 on nothing but 210 unrelated merges
+    having landed since its CI last ran).
+
+    Deliberately narrow — this is NOT ``merge.auto_drain`` reopened (that
+    flag stays ``False`` by design; see ``docs/DRIVE_QUEUE.md`` and the
+    2026-06-07 incident it guards against). This step never merges anything
+    and never touches an entry blocked on review, a real CI failure, or a
+    conflict — it only triggers a ``gh run rerun`` for the exact shape
+    :func:`coord.merge_queue.ci_revalidation_candidates` already scopes
+    ``--revalidate``'s CI arm to (#1851/#1925): ``PENDING``, review
+    approved, smoke fresh, CI checks green but predating the current base.
+
+    BOUNDED, shared with the live path. Draws from the SAME
+    ``ci_stale_reruns``/``MAX_CI_STALE_RERUNS`` budget
+    :func:`coord.merge_queue.process`'s own #2197 auto-rerun already spends
+    from — a live ``coord merge`` attempt and this tick share one ceiling,
+    never two independent ones that could double the effective retry count.
+    An entry that has already exhausted the budget (on a prior live attempt
+    or a prior tick) is left for a human exactly as #2197 already leaves it;
+    this function never fires a further rerun past the cap, though it does
+    keep recording the escalation (below) for as long as the entry stays
+    stuck, so a human watching the audit trail sees it, not just the first
+    tick that hit the ceiling.
+
+    Cost-visible (#1632's posture): every triggered rerun is a real CI run
+    on GitHub's own runners, recorded via :func:`coord.audit.record_audit`
+    (operational tier) so an operator can see the auto-fired count — same
+    spirit as the notifier being advisory rather than silent, never a
+    silent background spend.
+
+    Deliberately NOT behind a new config flag — this reuses exactly the
+    bound and the counter #2197 already established for "an automatic CI
+    rerun triggered by staleness"; the only thing new here is a periodic
+    caller for the case nothing was already about to call ``process()``
+    live. If that judgment turns out to be wrong in practice, the fix is a
+    ``merge.auto_revalidate_stale_ci`` off-switch, not removing the
+    dedicated budget this already shares.
+
+    Best-effort like every other optional step in this tick (conflict
+    reconciliation in ``_auto_drain_tick``, the merge-only fast path above):
+    a failure here must never abort the rest of the tick. Skipped entirely
+    on a thin client — this daemon-host tick is the only place it ever
+    runs, same guard :func:`_fetch_live_ci_gate`/
+    :func:`_run_merge_only_candidates` use.
+    """
+    from coord.board_service import resolve as resolve_board_service  # noqa: PLC0415
+
+    if resolve_board_service() is not None:
+        return
+
+    try:
+        from coord import github_ops as _gh_ops  # noqa: PLC0415
+        from coord import merge_queue as _mq  # noqa: PLC0415
+        from coord.audit import record_audit  # noqa: PLC0415
+        from coord.ci_store import build_ci_store  # noqa: PLC0415
+        from coord.commands._common import _load_config  # noqa: PLC0415
+        from coord.state import load_board as _load_board  # noqa: PLC0415
+
+        cfg = _load_config(config_path)
+        board = _load_board()
+        ci_store = build_ci_store(
+            cfg.ci_store.type, host=cfg.ci_store.host, token_env=cfg.ci_store.token_env,
+        )
+        if ci_store is None or not ci_store.is_available:
+            return
+        items = _mq.load_queue()
+        candidates = _mq.ci_revalidation_candidates(items, board, cfg, ci_store, _gh_ops)
+    except Exception:  # noqa: BLE001 — best-effort, see docstring
+        return
+
+    if not candidates:
+        return
+
+    touched: list = []
+    for entry in candidates:
+        label = f"{entry.repo_name} #{entry.issue_number} ({entry.branch})"
+        if entry.ci_stale_reruns >= _mq.MAX_CI_STALE_RERUNS:
+            # Budget already spent (on a previous tick, or a previous live
+            # `coord merge` attempt) — #2197's own terminal wording is
+            # already on the entry from whichever call last evaluated it.
+            # Nothing new to trigger; still worth one audit row per tick so
+            # an operator watching the trail sees this has been sitting
+            # exhausted, not silently forgotten.
+            record_audit(
+                tier="operational", category="merge",
+                event_type="merge_checks_stale_auto_revalidate_exhausted",
+                actor="drive-queue-tick",
+                summary=(
+                    f"auto-revalidate: {label} still checks_stale after "
+                    f"{entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS} "
+                    "auto-reruns — needs a human (`coord merge --revalidate` "
+                    "or `coord merge --only`)"
+                ),
+                repo=entry.repo_name, issue=entry.issue_number,
+                assignment_id=entry.assignment_id,
+                details={
+                    "pr_number": entry.pr_number,
+                    "ci_stale_reruns": entry.ci_stale_reruns,
+                },
+            )
+            continue
+        try:
+            reran = ci_store.rerun_for_pr(entry.repo_github, entry.pr_number)
+        except Exception as exc:  # noqa: BLE001 — one entry's failure must not sink the rest
+            click.echo(
+                f"auto-revalidate: could not re-run CI for {label}: {exc}", err=True
+            )
+            continue
+        entry.ci_stale_reruns += 1
+        entry.error = (
+            f"{_mq.CI_PENDING_PREFIX} re-run triggered for CI checks that "
+            "predate the current base (#2535 auto-revalidate "
+            f"{entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS} "
+            f"{'triggered' if reran else 'failed to trigger'})"
+        )
+        touched.append(entry)
+        click.echo(
+            f"auto-revalidate: {'triggered' if reran else 'FAILED to trigger'} "
+            f"a CI re-run for {label} (checks_stale, review already approved) "
+            f"— {entry.ci_stale_reruns}/{_mq.MAX_CI_STALE_RERUNS}"
+        )
+        record_audit(
+            tier="operational", category="merge",
+            event_type="merge_checks_stale_auto_revalidate",
+            actor="drive-queue-tick",
+            summary=(
+                f"auto-revalidate: {'triggered' if reran else 'FAILED to trigger'} "
+                f"a CI re-run for {label} — {entry.ci_stale_reruns}/"
+                f"{_mq.MAX_CI_STALE_RERUNS}"
+            ),
+            repo=entry.repo_name, issue=entry.issue_number,
+            assignment_id=entry.assignment_id,
+            details={"pr_number": entry.pr_number, "reran": reran},
+        )
+
+    if not touched:
+        return
+
+    try:
+        from coord import merge_queue as _mq  # noqa: PLC0415
+
+        fresh = _mq.load_queue()
+        by_id = {e.assignment_id: e for e in touched}
+        merged = [by_id.get(item.assignment_id, item) for item in fresh]
+        _mq.save_queue(merged)
+    except Exception:  # noqa: BLE001 — best-effort persistence; next tick recomputes
+        pass
+
+
 def _run_resume_probe(entry: QueueEntry) -> ProbeResult:
     """Run one entry's ``--resume-when`` probe with a hard timeout.
 
@@ -2730,6 +2886,15 @@ def drive_queue_tick(
         if not reconcile_only:
             _run_merge_only_candidates(plan, config_path)
 
+        # #2535: independent of the drive-queue plan above (this scans the
+        # MERGE queue directly, not drive-queue rows) — a bounded, best-effort
+        # CI re-run for any entry blocked solely on stale-but-green checks
+        # with an already-approved review. Same `not reconcile_only` posture
+        # as the merge-only fast path just above: a `gh run rerun` is a real
+        # external action that mode promises not to take.
+        if not reconcile_only:
+            _run_auto_revalidate_checks_stale(config_path)
+
         # #2235 Phase 0: record every entry this tick moved INTO or OUT OF
         # `blocked`/`parked`, with the reason the queue stated and — for a
         # release — what the release itself reveals about the true cause.

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/coord/notify.py

@@ -11,6 +11,7 @@ from typing import TYPE_CHECKING
 import httpx
 
 if TYPE_CHECKING:
+    from coord.merge_queue import QueuedMerge
     from coord.models import Assignment, Board
     from coord.progress import SmokeVerdict
 
@@ -991,6 +992,14 @@ class StalledDispatchAction:
       (#602).
     - ``"skipped_human_required"``  — the conflict-fix retry cap was already
       hit; surfacing to a human, not auto-retrying.
+    - ``"skipped_sealed_conflict"`` (#2537) — ``merge_conflict_unresolved``
+      on a :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row whose conflict
+      was confirmed (:func:`_conflict_confined_to_sealed_paths`) to be
+      confined to the repo's sealed acceptance-oracle paths — a
+      conflict-fix worker is guaranteed to self-restrict and push nothing
+      there, so the dispatch was skipped rather than spending a worker
+      session on a known no-op; needs a sealed-path-aware rebase dispatcher
+      (a follow-up issue, not yet implemented).
     - ``"disabled"``                — ``pipeline.auto_dispatch_stalled`` is
       off; detection/narration still happened, dispatch did not.
     """
@@ -1044,6 +1053,50 @@ def _stalled_row_has_live_session(board: "Board", work: "Assignment") -> bool:
     return False
 
 
+def _conflict_confined_to_sealed_paths(
+    entry: "QueuedMerge", config: Config,
+) -> list[str] | None:
+    """#2537: best-effort check for whether *entry*'s merge conflict can
+    ONLY be within the repo's sealed acceptance-oracle paths
+    (:meth:`coord.config.AcceptanceConfig.sealed_paths`).
+
+    Returns the entry branch's changed-file list when every file it touches
+    (the three-dot compare of *entry.target_branch*...*entry.branch*, via
+    :func:`coord.github_ops.get_compare_files` — the SAME GitHub-API-only,
+    no-local-checkout seam #1720's dispatch-time overlap fence already uses)
+    falls under a sealed path. GitHub's conflicting-file set is necessarily
+    a SUBSET of this branch's own changed files — a file can only conflict
+    if *this* branch touches it too — so confining the WHOLE branch diff to
+    sealed paths is sufficient to guarantee the conflict is, without needing
+    a local checkout or a `git merge-tree` call.
+
+    Returns ``None`` — "can't confirm confinement, don't skip the ordinary
+    dispatch" — when: the repo has no acceptance driver configured (nothing
+    is sealed); the compare API call fails or reports no files; or anything
+    is touched outside every sealed path. This is a pure availability
+    signal, never a hard "not confined" claim — a caller that gets ``None``
+    falls back to :func:`coord.conflict_fix.dispatch_conflict_fix` exactly
+    as before, which is always safe: a genuinely sealed-confined conflict
+    just makes that dispatch a no-op (the conflict-fix worker self-restricts
+    per CLAUDE.md's own sealed-path rule), so the only cost of a missed
+    detection here is one wasted worker session, never an incorrect action.
+    """
+    sealed = config.acceptance.sealed_paths(entry.repo_name)
+    if not sealed:
+        return None
+    from coord import github_ops  # noqa: PLC0415
+    from coord.review import _path_is_sealed  # noqa: PLC0415
+
+    files = github_ops.get_compare_files(
+        entry.repo_github, entry.target_branch, entry.branch,
+    )
+    if not files:
+        return None
+    if all(any(_path_is_sealed(f, s) for s in sealed) for f in files):
+        return files
+    return None
+
+
 def dispatch_stalled_pipeline_action(
     detection: StalledDetection,
     work: "Assignment",
@@ -1058,11 +1111,12 @@ def dispatch_stalled_pipeline_action(
     Gated by ``config.pipeline.auto_dispatch_stalled`` (default ``False`` —
     detection/narration via :func:`post_stalled_pipeline` is unconditional;
     this is the opt-in action half) — EXCEPT for a ``review_request_changes_
-    no_fix`` stall on a :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row
-    (``test-author``/``mock-author``), which dispatches regardless of the
-    flag: no loop owns that row (#2302), so the flag would only leave it
-    stalled forever with no alternative dispatcher to race. ``work`` rows
-    under the same reason keep the opt-in gate — ``coord drive`` owns those.
+    no_fix`` OR (#2537) ``merge_conflict_unresolved`` stall on a
+    :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row (``test-author``/
+    ``mock-author``), which dispatches regardless of the flag: no loop owns
+    that row (#2302), so the flag would only leave it stalled forever with
+    no alternative dispatcher to race. ``work`` rows under the same reasons
+    keep the opt-in gate — ``coord drive`` owns those.
     Mutates *board* in place exactly like
     the auto-loop / review-dispatch helpers it delegates to — the caller is
     responsible for persisting it.
@@ -1091,7 +1145,15 @@ def dispatch_stalled_pipeline_action(
       the same bulk gate-checked enqueue the daemon passive tick already
       runs on every interval.
     - ``merge_conflict_unresolved`` → :func:`coord.conflict_fix.dispatch_conflict_fix`,
-      the #1474 ``_dispatch_conflict_fixes`` path.
+      the #1474 ``_dispatch_conflict_fixes`` path — UNLESS (#2537) *work* is a
+      :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row AND the conflict can
+      be confirmed (via :func:`_conflict_confined_to_sealed_paths`, a
+      compare-API-only check) to be confined to the repo's sealed
+      acceptance-oracle paths — a conflict-fix worker is REQUIRED by
+      CLAUDE.md's own sealed-path rule to self-restrict from editing those,
+      so it is guaranteed to push nothing; that case returns
+      ``"skipped_sealed_conflict"`` instead of spending a worker session on
+      a known no-op.
     - ``review_failed_no_verdict`` (#1584) → :func:`coord.review.dispatch_review`
       again, the SAME call as ``done_no_review`` — the failed review left no
       verdict behind, so recovery is identical to "no review was ever
@@ -1116,10 +1178,20 @@ def dispatch_stalled_pipeline_action(
     # no drive run over it at all (see #2289). So this one reason+type
     # combination bypasses the flag — every other reason, and `work` rows
     # under this same reason, keep the opt-in gate unchanged.
+    #
+    # #2537: a `merge_conflict_unresolved` stall on the SAME row types is the
+    # identical shape — `coord drive` has no conflict-fix arm for
+    # test-author/mock-author rows either (it `_die()`s on them before ever
+    # reaching a merge), and the passive tick only re-enqueues, never
+    # dispatches a conflict-fix. Without this, the row bounces
+    # PENDING → CONFLICT → parked forever with nobody attempting a fix
+    # (observed live: coord-portal#132). So this reason joins the bypass for
+    # these row types too — every other reason, and `work` rows under either
+    # reason, keep the opt-in gate unchanged.
     from coord.models import SEALED_PATH_AUTHOR_TYPES  # noqa: PLC0415
 
     sealed_author_stall = (
-        detection.reason == "review_request_changes_no_fix"
+        detection.reason in ("review_request_changes_no_fix", "merge_conflict_unresolved")
         and work.type in SEALED_PATH_AUTHOR_TYPES
     )
     if not config.pipeline.auto_dispatch_stalled and not sealed_author_stall:
@@ -1423,6 +1495,35 @@ def dispatch_stalled_pipeline_action(
                 kind="skipped_human_required",
                 detail="conflict-fix already active or its retry cap was already hit",
             )
+        # #2537: dispatch_conflict_fix is guaranteed to no-op on a conflict
+        # confined to the repo's sealed acceptance-oracle paths — the
+        # conflict-fix worker is REQUIRED by CLAUDE.md's own sealed-path
+        # rule to self-restrict from editing them (the additive carve-out
+        # applies only to test-author/mock-author dispatches, never
+        # conflict-fix), so it pushes nothing and the entry just re-stalls
+        # next tick. Confirmed live on coord-portal#132/#135: a manually
+        # forced dispatch_conflict_fix restored its worktree clean and
+        # pushed nothing. Skip the known-wasted dispatch when we can
+        # confirm confinement in advance; resolving it for real needs a
+        # sealed-path-aware re-dispatch (tracked as a follow-up issue, not
+        # yet implemented) — dispatch_conflict_fix stays the fallback for
+        # every other case (can't confirm confinement, or genuinely not
+        # confined).
+        if work.type in SEALED_PATH_AUTHOR_TYPES:
+            sealed_files = _conflict_confined_to_sealed_paths(entry, config)
+            if sealed_files is not None:
+                return StalledDispatchAction(
+                    kind="skipped_sealed_conflict",
+                    detail=(
+                        "conflict is confined to sealed acceptance paths ("
+                        + ", ".join(sealed_files)
+                        + ") — a conflict-fix worker is required to "
+                        "self-restrict from editing them (CLAUDE.md's "
+                        "sealed-path rule) and would push nothing; needs a "
+                        "sealed-path-aware rebase dispatcher (follow-up "
+                        "issue), not dispatch_conflict_fix"
+                    ),
+                )
         fix = dispatch_conflict_fix(entry, board, config, prefer_machine=work.machine_name)
         if fix is None:
             return StalledDispatchAction(

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/docs/ORACLE_LOOP.md

@@ -393,8 +393,16 @@ Phase 0 steps 1–2 and Phase 1 step 6 above are also reachable by right-clickin
   not a live session). The CLI's own claim-detection refuses a duplicate dispatch while one is
   already in flight. This *is* Phase 0 step 1.
 - **"View Gate A mock (PR)"** 👁 → opens that worker's PR in the browser so a human can read
-  `contract.md` + the rendered mock(s). Disabled until a PR exists. **Merging that PR does not
-  satisfy Gate A** (#2063) — it is only how you *see* what you are signing off on.
+  `contract.md` and review/merge the branch. Disabled until a PR exists. **This does not show the
+  rendered mock(s)** (#2501) — GitHub's "Files changed" view renders `.html` as a source diff,
+  never a live page; use "View Gate A mock (local)" below for that. **Merging that PR does not
+  satisfy Gate A** (#2063) — it is only how you review/merge what you are signing off on.
+- **"View Gate A mock (local)"** 👁 → the actual mock viewer (#2501). Fast-forward-pulls the local
+  checkout's default branch (never forcing, never touching a dirty or diverged tree — aborts with
+  a toast instead, same as everywhere else this repo touches git destructively) and then opens
+  `tests/acceptance/ms-NN/mocks/` from disk in the OS's default browser, where `.html` actually
+  renders. Disabled until that mocks directory exists locally. Opens `mocks/index.html` once #2512
+  ships it; falls back to opening the mocks directory itself until then.
 - **"Approve Gate A"** ✓ → `coord gate-a --approved <repo> <tracking_issue>` — records the verdict
   that actually satisfies Gate A. Sits directly beside the 👁 on purpose: reviewing and recording
   are one gesture.

{code_coordinator-0.5.211 → code_coordinator-0.5.214}/tests/test_cli_drive_queue.py

@@ -2166,6 +2166,149 @@ def test_a_parked_merge_only_race_falls_back_to_an_ordinary_relaunch(
     assert len(merge_only_runs.merge) == 1, merge_only_runs.merge
 
 
+# ── #2535: auto-fire a CI re-run for a merge-queue entry blocked SOLELY on
+# stale-but-green checks with an already-approved review — no drive-queue row
+# needed at all, since this scans the merge queue directly. Fixtures below are
+# deliberately self-contained (not `live_ci_backend`, which fixes the base
+# timestamp to always read FRESH — the opposite of what a staleness scenario
+# needs, and whose fake CI stand-in has no `rerun_for_pr` to assert calls on).
+
+
+def _seed_pending_merge_row(
+    coord_db, issue: int, *, pr_number: int, ci_stale_reruns: int = 0
+) -> None:
+    """A bare `merge_queue` row — no drive-queue counterpart — PENDING, with
+    a PR number (required for `ci_revalidation_candidates` to consider it at
+    all) and an optional pre-spent `ci_stale_reruns` budget."""
+    coord_db.execute(
+        "INSERT INTO merge_queue "
+        "(assignment_id, repo_name, repo_github, branch, target_branch, "
+        " issue_number, issue_title, state, pr_number, enqueued_at, "
+        " ci_stale_reruns) "
+        "VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)",
+        (
+            f"w{issue}", REPO, "john/claude-coordinator", f"work-{issue}", "main",
+            issue, f"issue {issue}", pr_number, time.time(), ci_stale_reruns,
+        ),
+    )
+    coord_db.commit()
+
+
+class _FakeStaleCi:
+    """Stands in for the live backend, like `live_ci_backend`'s `_FakeLiveCi`
+    — but with a `rerun_for_pr` that records its calls (#2182's fake has
+    none, since nothing before #2535 ever needed the tick to trigger one)."""
+
+    is_available = True
+
+    def __init__(self, rerun_calls: list) -> None:
+        self._rerun_calls = rerun_calls
+
+    def list_checks_for_pr(self, repo: str, number: int) -> list:
+        from coord.ci_store import CheckRun
+
+        return [CheckRun(
+            name="build", status="completed", conclusion="success",
+            url="", run_id="1", started_at=100.0, completed_at=160.0,
+        )]
+
+    def expects_checks(self, repo: str, number: int) -> bool:
+        return True
+
+    def rerun_for_pr(self, repo: str, number: int) -> bool:
+        self._rerun_calls.append((repo, number))
+        return True
+
+
+@pytest.fixture
+def stale_ci_backend(monkeypatch):
+    """Fakes the #1851 staleness shape directly: a green check that
+    `started_at` well BEFORE the base's own commit timestamp — the base
+    moved out from under an already-green PR. Returns the list of
+    `(repo, pr_number)` pairs `rerun_for_pr` was called with.
+    """
+    import coord.ci_store as ci_store_module
+    import coord.github_ops as github_ops
+
+    rerun_calls: list[tuple[str, int]] = []
+    monkeypatch.setattr(
+        ci_store_module, "build_ci_store", lambda t, **_kw: _FakeStaleCi(rerun_calls)
+    )
+    # The check above started at 100.0; the base's own commit landed at
+    # 1000.0 — well AFTER, so `_ci_checks_are_stale` reads True.
+    monkeypatch.setattr(
+        github_ops, "get_branch_commit_timestamp", lambda repo, branch: 1000.0
+    )
+    monkeypatch.setattr(github_ops, "get_pr_commit_messages", lambda repo, n: [])
+    monkeypatch.setattr(github_ops, "check_pr_mergeable", lambda repo, n: None)
+    return rerun_calls
+
+
+def test_auto_revalidate_fires_a_ci_rerun_for_an_entry_blocked_solely_on_stale_checks(
+    cli_no_gates, coord_db, stale_ci_backend,
+):
+    """The #2530/#2534 shape, unattended: a PENDING entry with a PR, review
+    already satisfied (`cli_no_gates` disables the review requirement —
+    the same minimal "sole blocker is CI" shape
+    `TestCiRevalidationCandidates` uses in tests/test_merge_queue.py), and
+    CI checks that are green but predate the current base. The tick fires
+    the re-run itself — no drive-queue row, no operator running
+    `coord merge --revalidate` by hand.
+    """
+    _seed_pending_merge_row(coord_db, 2534, pr_number=42)
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+
+    assert stale_ci_backend == [("john/claude-coordinator", 42)]
+    row = coord_db.execute(
+        "SELECT ci_stale_reruns, error FROM merge_queue WHERE issue_number = ?",
+        (2534,),
+    ).fetchone()
+    assert row["ci_stale_reruns"] == 1
+    assert row["error"].startswith("CI running:")
+    assert "#2535" in row["error"]
+
+    from coord.audit import query_audit_log
+
+    entries = query_audit_log(event_type="merge_checks_stale_auto_revalidate")["entries"]
+    assert len(entries) == 1
+    assert entries[0]["issue"] == 2534
+    assert entries[0]["repo"] == REPO
+
+
+def test_auto_revalidate_never_exceeds_the_shared_budget(
+    cli_no_gates, coord_db, stale_ci_backend,
+):
+    """Budget already spent (whether by a prior tick or a prior live
+    `coord merge` attempt makes no difference — it's the same counter): no
+    NEW rerun fires, but the exhaustion is still recorded so a human
+    watching the audit trail sees it."""
+    from coord.merge_queue import MAX_CI_STALE_RERUNS
+
+    _seed_pending_merge_row(
+        coord_db, 2534, pr_number=42, ci_stale_reruns=MAX_CI_STALE_RERUNS
+    )
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+
+    assert stale_ci_backend == []  # no new rerun triggered
+    row = coord_db.execute(
+        "SELECT ci_stale_reruns FROM merge_queue WHERE issue_number = ?",
+        (2534,),
+    ).fetchone()
+    assert row["ci_stale_reruns"] == MAX_CI_STALE_RERUNS  # unchanged
+
+    from coord.audit import query_audit_log
+
+    entries = query_audit_log(
+        event_type="merge_checks_stale_auto_revalidate_exhausted"
+    )["entries"]
+    assert len(entries) == 1
+    assert entries[0]["issue"] == 2534
+
+
 def test_a_repeatedly_dead_drive_still_reaches_blocked_and_escalates(
     cli, seed, launches, coord_db
 ):