code-coordinator 0.5.256__tar.gz → 0.5.257__tar.gz

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.256
+Version: 0.5.257
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.256
+Version: 0.5.257
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.256",
+  "tag": "0.5.257",
   "distance": 0,
-  "node": "g1d53f40b4c8b97ed2f04d59ad1fad5e0d631d098",
+  "node": "g0f6b2aa2009290d8d6e254f4de39fff2490b3253",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-27"

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/coord/commands/drive_queue.py

@@ -3450,21 +3450,45 @@ def _fetch_live_prereq_terminal(
     BOUNDED THE SAME WAY ITS SIBLINGS ARE. Only deps named by an entry
     currently ``waiting`` or ``blocked`` with a non-empty ``after=``, and
     only those the board does NOT already resolve on its own
-    (``facts.landed``, ``facts.open``, ``facts.active_work``, or a hit in
-    this tick's own pre-reconcile ``states`` — i.e. genuinely still queued)
-    make it into a live call. A queue with no unresolved ``after=`` edge
-    costs nothing here, same as ``_fetch_live_blocked_gate`` costs nothing
-    with no ``blocked`` rows. ``states`` is approximated from *entries*'
-    pre-tick ``state`` field (cheap, no I/O) rather than threaded from
-    ``plan_tick``'s own in-progress reconcile — a false negative here (a dep
-    this approximation still calls a live-check target, when the tick's own
-    authoritative ``states`` would already have resolved it another way)
-    costs one harmless extra ``gh`` read, never a wrong verdict:
-    ``_resolve_prereqs`` only ever consults this mapping in its OWN final
-    branch, after its own ``states``/``facts`` checks have already returned.
-    A false positive (a dep this skips that the tick's real walk would have
-    reached the final branch for) simply leaves that one dep to the
-    pre-#2602 fallback for this tick — caught on the next one.
+    (``facts.landed``, ``facts.open``, ``facts.active_work``, or a
+    ``STATE_DONE`` hit in this tick's own pre-reconcile ``states`` — i.e.
+    already known landed) make it into a live call. A queue with no
+    unresolved ``after=`` edge costs nothing here, same as
+    ``_fetch_live_blocked_gate`` costs nothing with no ``blocked`` rows.
+    ``states`` is approximated from *entries*' pre-tick ``state`` field
+    (cheap, no I/O) rather than threaded from ``plan_tick``'s own
+    in-progress reconcile — a false negative here (a dep this approximation
+    still calls a live-check target, when the tick's own authoritative
+    ``states`` would already have resolved it another way) costs one
+    harmless extra ``gh`` read, never a wrong verdict: ``_resolve_prereqs``
+    only ever consults this mapping in its OWN final branch, after its own
+    ``states``/``facts`` checks have already returned. A false positive (a
+    dep this skips that the tick's real walk would have reached the final
+    branch for) simply leaves that one dep to the pre-#2602 fallback for
+    this tick — caught on the next one.
+
+    #2850 WIDENS THE BOUND, in two ways, both closing the same class of gap
+    the incident exposed (a pre-req stuck under a stale/bogus queue row, not
+    merely absent from the queue):
+
+    * a dep whose queue row IS present now still gets a live call as long as
+      that row isn't already ``STATE_DONE`` — before #2850 any dep present
+      in ``states`` at all (``running``, ``waiting``, ``blocked``, ...) was
+      excluded outright, on the (pre-#2850) assumption that "still queued"
+      meant the local row was trustworthy. A `running` row that outlived the
+      drive it named (the #2850 incident: a drive that exited 0 having
+      merged, requeued into a `running` row nothing else re-checks) broke
+      that assumption; ``coord.drive_queue._resolve_prereqs``'s matching
+      #2850 change is what actually consults this for those deps.
+    * every ``running`` entry's OWN key is also added as a target when it
+      has no live tmux session (``board.live_sessions``) and the board does
+      not yet show it landed — i.e. exactly the entries
+      ``coord.drive_queue._reconcile_running`` is about to run its
+      death/retry diagnosis on THIS tick. That function consults this same
+      mapping, keyed by its OWN ``entry.key``, right before it would
+      otherwise spend a requeue attempt — the "re-check before requeuing
+      anything" half of #2850, independent of whatever (if anything) the
+      drive's own exit reason said.
     """
     states = {e.key: e.state for e in entries}
     targets: set[str] = set()
@@ -3472,12 +3496,24 @@ def _fetch_live_prereq_terminal(
         if e.state not in (STATE_WAITING, STATE_BLOCKED) or not e.after:
             continue
         for dep in e.after:
-            if dep in targets or states.get(dep) is not None:
+            if dep in targets or states.get(dep) == STATE_DONE:
                 continue
             facts = board.facts(dep)
             if facts.landed or facts.open or facts.active_work:
                 continue
             targets.add(dep)
+    # #2850: a RUNNING entry about to be reconciled by `_reconcile_running`'s
+    # death/retry logic THIS tick (no live session, and the board's own
+    # cached facts don't show it landed) gets the identical live re-check —
+    # bounded to exactly the entries that would otherwise risk a requeue.
+    for e in entries:
+        if e.state != STATE_RUNNING or e.key in targets:
+            continue
+        if e.key in board.live_sessions:
+            continue
+        if board.facts(e.key).landed:
+            continue
+        targets.add(e.key)
     if not targets:
         return {}
 

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/coord/drive.py

@@ -116,7 +116,11 @@ from coord.failure_class import (
     environmental_backoff_secs,
     plan_usage_limit_resume,
 )
-from coord.models import DELIVERABLE_ANALYSIS_LABEL, POLICY_REFUSAL_MARKER
+from coord.models import (
+    DELIVERABLE_ANALYSIS_LABEL,
+    MERGE_LANDED_MARKER,
+    POLICY_REFUSAL_MARKER,
+)
 from coord.self_health import self_freshness
 from coord.usage_limits import PlanLimits, evaluate_usage_gate, get_plan_limits
 # Lost in the #1584-onto-#1590 rebase: _decide_review() calls this, but the
@@ -1869,7 +1873,10 @@ def decide(
     if state.work_status == "merged" or state.merge_status == "MERGED":
         target = state.repo_default_branch or "main"
         if state.work_branch and verifier.verify_merged(state):
-            return _succeed(f"✓ MERGED — {state.work_branch} has landed on {target}")
+            return _succeed(
+                f"✓ MERGED — {state.work_branch} has landed on {target}\n"
+                f"   {MERGE_LANDED_MARKER}"
+            )
         base = opts.repo_path or f"~/src/{state.repo}"
         return _die(
             f"board says merged but {state.work_branch} has NOT landed on {target}\n"

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/coord/drive_queue.py

@@ -100,7 +100,7 @@ from coord.merge_queue import (
     is_ci_unreadable_reason,
     is_stale_smoke_reason,
 )
-from coord.models import is_policy_refusal_reason
+from coord.models import is_merge_landed_reason, is_policy_refusal_reason
 
 # ── queue states ─────────────────────────────────────────────────────────────
 #
@@ -1818,17 +1818,26 @@ def _resolve_prereqs(
     _fetch_live_prereq_terminal``, the same positive-liveness test
     ``coord.overlap_predict``'s ``terminal_checker`` uses for the sibling
     ``[branch]`` half of #2602) confirms the issue is closed or its PR
-    merged — consulted ONLY in the final branch below, right before it would
-    otherwise declare *dep* unsatisfiable. This is the recovery half: the
-    cached ``board.facts(dep)`` this function checks first is a periodic
-    ``/board`` build, not a live read, and a pre-req that has JUST left the
-    queue (merged, issue closed) can outrun that cache — reading as "not
-    queued, not merged, not open" (:data:`_UNKNOWN_PREREQ_MARKER`) even
+    merged. This is the recovery half: the cached ``board.facts(dep)`` this
+    function checks first is a periodic ``/board`` build, not a live read,
+    and a pre-req that has JUST left the queue (merged, issue closed) can
+    outrun that cache — reading as "not queued, not merged, not open" even
     though the dep is, in fact, already done. Before this existed that
     verdict was unconditionally unsatisfiable and permanent
     (coord-portal#145/#149/#150, 2026-08-22): a dep absent here (no live
     check ran, or it ran and came back inconclusive) falls through to
     exactly that pre-#2602 behaviour — never a false "satisfied".
+
+    #2850 widens WHERE this is consulted: originally only the final branch
+    below (*dep* absent from the queue entirely) checked it. But a dep can
+    just as easily be PRESENT in the queue under a stale or outright bogus
+    row — the #2850 incident: a drive that exited 0 having merged got
+    requeued into a `running` row that never dies again on its own — and
+    that shape used to return "waiting"/"will never satisfy" straight out
+    of the ``dep_state is not None`` branch, never reaching this check at
+    all. So it is now ALSO consulted there, for every ``dep_state`` other
+    than ``STATE_DONE``: a pre-req that demonstrably landed must satisfy
+    the dependent whatever its own queue row happens to claim.
     """
     if entry.key in cycle_keys:
         return _Verdict(False, True, cycle_keys[entry.key])
@@ -1863,6 +1872,20 @@ def _resolve_prereqs(
                 # flips to `done`, instead of the tick after the cache
                 # independently rediscovers the same fact.
                 continue
+            if (live_prereq_terminal or {}).get(dep):
+                # #2850: *dep*'s OWN queue row says it is still in play
+                # (``running``, ``waiting``, ``blocked``, ...) — but a live
+                # re-check taken THIS tick confirms it is, in fact, already
+                # closed or merged. Before this, only a dep ABSENT from the
+                # queue entirely ever reached the #2602 recovery check below;
+                # a dep still SITTING in the queue under a stale/bogus row
+                # (the #2850 incident: a drive that exited 0 having merged,
+                # requeued into a bogus `running` row) short-circuited to
+                # "waiting"/"will never satisfy" here and shadowed the very
+                # recovery check meant to catch exactly this. A dependent
+                # must never be blocked by a pre-req that demonstrably
+                # landed, whatever its queue row claims.
+                continue
             if dep_state in (STATE_BLOCKED, STATE_FAILED):
                 return _Verdict(
                     False,
@@ -2757,6 +2780,7 @@ def _reconcile_running(
     exit_reasons: Mapping[str, str] | None = None,
     exit_refused: Mapping[str, bool] | None = None,
     exit_dead_end: Mapping[str, bool] | None = None,
+    live_prereq_terminal: Mapping[str, bool] | None = None,
 ) -> tuple[Reconcile, Blocked | None]:
     """Resolve one ``running`` entry against the board.
 
@@ -2848,6 +2872,35 @@ def _reconcile_running(
     the default budget. Still finite, still ``exhausted`` → ``blocked`` with
     the same diagnosis-and-recovery instructions once ITS wider ceiling is
     also hit.
+
+    #2850 adds TWO more "already landed" signals, both checked with the SAME
+    priority as ``facts.landed`` above — right after it, before
+    ``facts.active_work`` — because both are confirmations of terminal
+    completion at least as strong as a cached board read, and a drive that
+    has genuinely landed must never be requeued regardless of what
+    ``active_work``/cross-host/grace-window evidence says next:
+
+    * ``own_reason`` matching :func:`coord.models.is_merge_landed_reason` —
+      the drive's OWN exit narrated a confirmed merge (``coord.drive.
+      decide``'s "terminal: merged" branch, gated on a LIVE
+      ``verifier.verify_merged`` call, not merely the board's cached
+      ``merge_status``). Before this, ``exit_code=0`` plus a "✓ MERGED —
+      … has landed" summary still fell all the way through to the generic
+      "no session, no active work, nothing landed" retry logic below — the
+      drive's own strongest evidence, sitting unread in ``own_reason``,
+      never consulted — and got requeued and relaunched into dead air.
+    * *live_prereq_terminal* (#2602's mechanism, reused): when the shell's
+      bounded live re-check (:func:`coord.commands.drive_queue.
+      _fetch_live_prereq_terminal`, widened by #2850 to also probe a
+      ``running`` entry's OWN key, not just other entries' ``after=``
+      pre-reqs) confirms THIS key is closed or merged, that outranks
+      ``own_reason`` even existing — it catches every OTHER shape of "this
+      entry's issue is actually done, but this run's own exit reason
+      either says nothing about it or predates it" (a crash, a reap, a
+      dead-end exit for an issue that merged out of band between the crash
+      and this tick). Re-checking before ANY requeue — not only the
+      literal MERGED-exit-text case — is what makes the class safe rather
+      than patching just the one reported instance.
     """
     facts = board.facts(entry.key)
 
@@ -2874,6 +2927,62 @@ def _reconcile_running(
             None,
         )
 
+    # Resolved here — before `facts.active_work` and everything after it —
+    # so the #2850 merged-exit check just below can use it; every later
+    # branch that reads `own_reason` (gate_a/policy park, refused/dead_end,
+    # the retry/exhausted wording) is unaffected by hoisting this, since
+    # none of them run before this point.
+    own_reason = (exit_reasons or {}).get(entry.key)
+    if own_reason and is_merge_landed_reason(own_reason):
+        # #2850: the drive's own exit already confirmed — via a LIVE
+        # `verify_merged` check, not the board's cached `merge_status` —
+        # that this landed. Mark it done here, before anything below gets a
+        # chance to read the absent session / absent active-work as a death
+        # and requeue a launch that has nothing left to do.
+        reason = f"{own_reason} — confirmed merged (#2850), not a death"
+        return (
+            Reconcile(
+                entry.key,
+                "done",
+                reason,
+                occupies=False,
+                updates={
+                    "state": STATE_DONE,
+                    "last_reason": reason,
+                    "session_name": None,
+                },
+            ),
+            None,
+        )
+
+    if (live_prereq_terminal or {}).get(entry.key):
+        # #2850 defence in depth: whatever THIS run's own exit reason says
+        # (or doesn't — a crash leaves none at all), a live re-check taken
+        # THIS tick confirms the issue is already closed or its PR merged.
+        # That is stronger evidence than an absent tmux session and absent
+        # board `active_work` could ever be on their own — mark done rather
+        # than let the death-diagnosis logic below spend an attempt
+        # relaunching a drive with nothing left to do.
+        reason = (
+            "drive finished — a live re-check this tick confirms the issue "
+            "is already closed or its PR merged (#2850), independent of "
+            "this run's own exit reason and the cached board"
+        )
+        return (
+            Reconcile(
+                entry.key,
+                "done",
+                reason,
+                occupies=False,
+                updates={
+                    "state": STATE_DONE,
+                    "last_reason": reason,
+                    "session_name": None,
+                },
+            ),
+            None,
+        )
+
     if facts.active_work:
         return (
             Reconcile(
@@ -2916,7 +3025,10 @@ def _reconcile_running(
     # purely for stability — the two codes are mutually exclusive by
     # construction (`_drive_exit_summary` records exactly one), so the order
     # is never actually load-bearing.
-    own_reason = (exit_reasons or {}).get(entry.key)
+    #
+    # `own_reason` itself was already resolved above (#2850, before the
+    # `facts.active_work` check) so the merged-exit short-circuit could use
+    # it — reused here unchanged.
 
     # #2063 rides the SAME evidence as `refused` below but reaches the
     # OPPOSITE conclusion, so it is checked first. A Gate-A "no recorded
@@ -4121,6 +4233,7 @@ def plan_tick(
             exit_reasons=exit_reasons,
             exit_refused=exit_refused,
             exit_dead_end=exit_dead_end,
+            live_prereq_terminal=live_prereq_terminal,
         )
         reconciles.append(reconcile)
         if reconcile.occupies:

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/coord/models.py

@@ -550,6 +550,31 @@ def is_policy_refusal_reason(text: str | None) -> bool:
     return bool(text) and POLICY_REFUSAL_MARKER in text
 
 
+# #2850: the machine-readable tag `coord.drive.decide` embeds in its
+# `_succeed()` message when the "terminal: merged" branch's own LIVE check
+# (`MergeVerifier.verify_merged`) confirms the issue has genuinely landed —
+# not merely that the board's cached `merge_status` claims so.
+#
+# Text-marker matching (not a dedicated exit code) mirrors
+# `POLICY_REFUSAL_MARKER` immediately above: `EXIT_OK` is shared by every
+# clean drive exit — this one, a `deliverable:analysis` 0-commit stop, and a
+# `--no-merge` "review approved, stopping here" — so the exit code alone
+# cannot distinguish "confirmed merged" from "stopped short of merging on
+# purpose". `coord/drive_queue.py`'s `_reconcile_running` recognises this
+# straight out of the drive's own `drive_exited` audit summary (`own_reason`)
+# and marks the queue entry `done` instead of requeuing a launch that has
+# nothing left to do — closing the #2850 failure mode: a drive that exits 0
+# having MERGED got requeued and relaunched into dead air, with the bogus
+# `running` row shadowing #2602's own live re-check for every dependent
+# chained `--after` it.
+MERGE_LANDED_MARKER = "[drive-merged #2850]"
+
+
+def is_merge_landed_reason(text: str | None) -> bool:
+    """Whether *text* is a #2850 confirmed-merge drive-exit reason."""
+    return bool(text) and MERGE_LANDED_MARKER in text
+
+
 @dataclass
 class Assignment:
     machine_name: str

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/tests/test_cli_drive_queue.py

@@ -1338,6 +1338,56 @@ def test_a_blocked_entry_resumes_and_launches_once_a_live_recheck_confirms_its_p
     assert len(launches) == 1, launches
 
 
+def test_a_dependent_is_released_when_its_prereq_is_wrongly_stuck_running(
+    cli, seed, launches, monkeypatch,
+):
+    """#2850 end-to-end: the reported vimcode#536/#673 incident shape. The
+    pre-req (1650) sits in the queue under a BOGUS `running` row — exactly
+    what a drive that exited 0 having merged and then got requeued anyway
+    looks like — while the cached board's `issues` row for it still reads
+    "open" (the sync that would flip it hasn't caught up yet). Before this
+    fix, `_resolve_prereqs` read `states[dep] == "running"` and returned
+    "waiting on ... (queued, running)" unconditionally — the `running` row
+    shadowed the SAME live re-check that already resolves a pre-req merely
+    ABSENT from the queue (`test_a_blocked_entry_resumes_...` above) — so
+    the dependent (1654) sat blocked for as long as the bogus row
+    persisted. A live `github_ops.work_is_terminal` re-check taken THIS
+    tick must release the dependent regardless of what the pre-req's own
+    queue row claims."""
+    seed(issues={1650: "open", 1654: "open"})
+    cli("add", REPO, "1650")
+    cli("add", REPO, "1654", "--after", "1650")
+
+    # Simulate the bogus post-merge `running` row directly — a drive that
+    # exited 0 having merged and was requeued, exactly the #2850 symptom
+    # fixes 1/2 (in `coord.drive_queue`) now prevent from ever happening;
+    # this test pins the DEPENDENT side even if some other cause ever
+    # leaves a pre-req wrongly `running` again.
+    state._update_drive_queue_entry_local(REPO, 1650, state="running", attempts=1)
+
+    import coord.github_ops as github_ops
+
+    monkeypatch.setattr(
+        github_ops,
+        "work_is_terminal",
+        lambda repo_github, issue_number, branch, **_kw: (
+            repo_github == "john/claude-coordinator" and issue_number == 1650
+        ),
+    )
+
+    result = cli("tick")
+    assert result.exit_code == 0, result.output
+    dependent = queued(1654)
+    assert dependent["state"] == "running"  # launched, not blocked/deferred
+    assert len(launches) == 1, launches
+
+    # #2850 fix 1/2: the pre-req's own bogus `running` row is ALSO
+    # corrected in the SAME tick — reconciled to `done`, not left standing
+    # to requeue yet another dead-air relaunch.
+    prereq = queued(1650)
+    assert prereq["state"] == "done"
+
+
 def test_list_with_no_after_is_unaffected_by_the_2183_diagnosis(cli):
     """A `blocked` entry that never declared any `after=` at all keeps
     rendering exactly as it always has — no board dependency, no remedy
@@ -1990,6 +2040,53 @@ def test_a_permanent_dispatch_refusal_blocks_on_the_first_tick_no_attempt_spent(
     assert state._get_drive_escalation_local(REPO, 1762) is not None
 
 
+def test_a_confirmed_merge_exit_marks_done_and_never_relaunches(
+    cli, seed, launches,
+):
+    """#2850, end-to-end: the reported vimcode#536 incident. A drive that
+    exits 0 having genuinely MERGED (its own `drive_exited` audit summary
+    carries `coord.models.MERGE_LANDED_MARKER`, exactly what
+    `coord.drive.decide`'s "terminal: merged" branch now writes) must mark
+    the queue entry `done` on the very first tick that observes it — NOT
+    fall through to the generic death diagnosis and requeue a second launch
+    for work that is already finished. Before this fix the tick's own log
+    read `exit_code=0: ✓ MERGED … has landed` and STILL requeued it
+    "(attempt 1/2)" and relaunched — a bogus `running` row that then
+    shadowed every `--after` dependent chained onto it.
+    """
+    from coord.audit import record_audit
+    from coord.models import MERGE_LANDED_MARKER
+
+    seed(issues={1762: "open"})
+    cli("add", REPO, "1762")
+    cli("tick")
+    assert len(launches) == 1, launches
+
+    merged_reason = (
+        "drive exited for claude-coordinator#1762 (exit_code=0): ✓ MERGED "
+        f"— issue-1762-example has landed on develop\n   {MERGE_LANDED_MARKER}"
+    )
+    launched_at = queued(1762)["launched_at"]
+    _backdate(1762, DRIVE_STARTUP_GRACE_SECONDS + 60)
+    record_audit(
+        tier="business", category="drive", event_type="drive_exited",
+        actor="drive", summary=merged_reason, repo=REPO, issue=1762,
+        ts=launched_at + 5,
+        details={"exit_code": 0, "reason": merged_reason},
+    )
+
+    result = cli("tick")
+    assert result.exit_code == 0, result.output
+    assert "done" in result.output.lower()
+    # NOT the retry path: no second launch was ever spawned for this issue.
+    assert len(launches) == 1, launches
+
+    entry = queued(1762)
+    assert entry["state"] == "done"
+    assert entry["attempts"] == 0  # never spent — this was never a death
+    assert MERGE_LANDED_MARKER in (entry["last_reason"] or "")
+
+
 # ── #1891: `parked` — a missing CI verdict must not consume merge budget ────
 #
 # Black-box per this repo's CLAUDE.md: drives the queue through a simulated

{code_coordinator-0.5.256 → code_coordinator-0.5.257}/tests/test_drive_queue.py

@@ -49,6 +49,7 @@ from coord.drive_queue import (
     render_plan,
     validate_enqueue,
 )
+from coord.models import MERGE_LANDED_MARKER
 
 REPO = "claude-coordinator"
 
@@ -2738,6 +2739,178 @@ def test_a_policy_refusal_still_reconciles_to_done_if_it_lands_by_hand():
     assert reconcile.updates["state"] == STATE_DONE
 
 
+# ═══════════════════════════════════════════════════════════════════════════
+# #2850: a drive that exits 0 having MERGED must reconcile straight to
+# `done`, never `retry` — before this fix, `own_reason` carried the drive's
+# own "✓ MERGED — … has landed" text but `_reconcile_running` never read it
+# for anything but the gate_a/policy/refused/dead_end special cases, so a
+# confirmed-landed drive fell all the way through to the generic "no
+# session, no active work, nothing landed" death diagnosis and got
+# requeued — the reported vimcode#536 incident. Two independent recoveries,
+# reproduced separately: `own_reason` naming a confirmed merge (#2850 fix 1),
+# and a live re-check confirming landed independent of `own_reason` (#2850
+# fix 2) — and, on the DEPENDENT side, a pre-req's queue row no longer
+# shadowing that same live re-check just because it is present and not yet
+# `done` (#2850 fix 3).
+# ═══════════════════════════════════════════════════════════════════════════
+
+MERGED_OWN_REASON = (
+    "drive exited for claude-coordinator#1650 (exit_code=0): ✓ MERGED — "
+    f"issue-1650-example has landed on develop\n   {MERGE_LANDED_MARKER}"
+)
+
+
+def test_an_own_reason_confirming_merge_reconciles_to_done_not_retry():
+    """#2850 fix 1, the literal reported shape: exit_code=0, `own_reason`
+    narrates a confirmed merge — must mark `done` on the FIRST tick that
+    observes it, not spend a retry attempt requeuing a launch with nothing
+    left to do."""
+    entries = [entry(1650, position=3, state=STATE_RUNNING, attempts=0)]
+    plan = plan_tick(
+        entries, board(), capacity=1,
+        exit_reasons={entry_key(REPO, 1650): MERGED_OWN_REASON},
+    )
+    reconcile = plan.reconciles[0]
+    assert reconcile.outcome == "done"
+    assert reconcile.updates["state"] == STATE_DONE
+    assert "attempts" not in reconcile.updates  # never spent
+    assert plan.blocked == ()
+    assert plan.launch is None
+
+
+def test_a_merge_landed_own_reason_wins_even_deep_into_the_attempt_budget():
+    entries = [
+        entry(1650, state=STATE_RUNNING, attempts=DEFAULT_MAX_ATTEMPTS - 1)
+    ]
+    plan = plan_tick(
+        entries, board(), capacity=1,
+        exit_reasons={entry_key(REPO, 1650): MERGED_OWN_REASON},
+    )
+    assert plan.reconciles[0].outcome == "done"  # not "exhausted"
+    assert plan.blocked == ()
+
+
+def test_an_own_reason_that_merely_mentions_merge_without_the_marker_still_retries():
+    """The marker, not the human-readable "MERGED" text, is what decides
+    this — a reason that talks ABOUT a merge (e.g. a merge-gate failure
+    diagnosis) without #2850's `MERGE_LANDED_MARKER` must not be
+    misread as a confirmed landing."""
+    entries = [
+        entry(
+            1650,
+            state=STATE_RUNNING,
+            attempts=0,
+            launched_at=NOW - DRIVE_STARTUP_GRACE_SECONDS - 1,
+        )
+    ]
+    own_reason = (
+        "drive exited for claude-coordinator#1650 (exit_code=1): merge "
+        "attempted 3 times without landing."
+    )
+    plan = plan_tick(
+        entries, board(), capacity=1, now=NOW,
+        exit_reasons={entry_key(REPO, 1650): own_reason},
+    )
+    assert plan.reconciles[0].outcome == "retry"
+
+
+def test_a_live_recheck_marks_a_dead_running_entry_done_with_no_own_reason_at_all():
+    """#2850 fix 2: `live_prereq_terminal` is now ALSO consulted for a
+    `running` entry's OWN key, independent of whatever (if anything) its
+    `own_reason` says — a crash that left no exit reason at all, or an exit
+    reason unrelated to landing, must still be caught if a live re-check
+    this tick confirms the issue already closed or merged."""
+    entries = [
+        entry(
+            1650,
+            state=STATE_RUNNING,
+            attempts=0,
+            launched_at=NOW - DRIVE_STARTUP_GRACE_SECONDS - 1,
+        )
+    ]
+    plan = plan_tick(
+        entries, board(), capacity=1, now=NOW,
+        live_prereq_terminal={entry_key(REPO, 1650): True},
+    )
+    reconcile = plan.reconciles[0]
+    assert reconcile.outcome == "done"
+    assert reconcile.updates["state"] == STATE_DONE
+    assert plan.blocked == ()
+
+
+def test_a_dependent_is_released_when_its_queued_but_not_done_prereq_has_live_landed():
+    """#2850 fix 3: `_resolve_prereqs`'s `dep_state is not None` branch used
+    to return "waiting on {dep} (queued, {dep_state})" unconditionally for
+    any state short of `done` — never consulting `live_prereq_terminal`,
+    unlike its own final branch for a dep absent from the queue altogether
+    (#2602). A pre-req sitting in the queue under ANY other state must
+    release its dependent the moment a live re-check confirms it actually
+    landed. Position 0 goes to the DEPENDENT (not the pre-req) so a passing
+    assertion on ``plan.launch`` is unambiguous — `plan_tick` launches at
+    most one entry per tick, position order first, so a `STATE_WAITING`
+    pre-req sitting at an earlier position would otherwise win the single
+    launch slot on its own unrelated eligibility and mask the very thing
+    under test."""
+    entries = [
+        entry(1654, position=0, after=(entry_key(REPO, 1650),)),
+        entry(1650, position=1, state=STATE_WAITING),
+    ]
+    plan = plan_tick(
+        entries, board(), capacity=2,
+        live_prereq_terminal={entry_key(REPO, 1650): True},
+    )
+    assert plan.launch is not None
+    assert plan.launch.issue == 1654
+
+
+def test_a_dependent_is_released_when_its_prereq_is_wrongly_stuck_running():
+    """The exact reported incident, reproduced end to end: a pre-req sits in
+    a bogus `running` row (a drive that exited 0 having merged, requeued —
+    the shape #2850 fixes 1/2 now prevent, but this pins the DEPENDENT side
+    even if some other cause ever leaves a pre-req wrongly `running` again).
+    A live re-check confirming the pre-req landed must release the
+    dependent on THIS tick, whatever the pre-req's own row still claims —
+    and the pre-req's own bogus `running` row is corrected in the SAME
+    tick, not requeued into yet another relaunch."""
+    entries = [
+        entry(1650, position=0, state=STATE_RUNNING),
+        entry(1654, position=1, after=(entry_key(REPO, 1650),)),
+    ]
+    plan = plan_tick(
+        entries, board(), capacity=2,
+        live_prereq_terminal={entry_key(REPO, 1650): True},
+    )
+    assert plan.launch is not None
+    assert plan.launch.issue == 1654
+    prereq_reconcile = next(
+        r for r in plan.reconciles if r.key == entry_key(REPO, 1650)
+    )
+    assert prereq_reconcile.outcome == "done"
+
+
+def test_a_dependent_is_released_when_its_prereq_is_blocked_but_live_landed():
+    """Fix 3 pinned in ISOLATION from fix 2: a `blocked` pre-req never goes
+    through `_reconcile_running`'s step-1 walk at all (that loop only
+    touches `STATE_RUNNING` rows), so `states[dep]` stays `STATE_BLOCKED`
+    for the whole tick — the ONLY thing that can release the dependent here
+    is `_resolve_prereqs` itself consulting `live_prereq_terminal`. Before
+    #2850 this branch (`dep_state in (STATE_BLOCKED, STATE_FAILED)`)
+    returned "it will never satisfy" unconditionally, matching #2055's own
+    rationale for re-checking a `blocked` pre-req's OWN row — a human can
+    merge a blocked issue's work out of band just as easily as a running
+    one's."""
+    entries = [
+        entry(1654, position=0, after=(entry_key(REPO, 1650),)),
+        entry(1650, position=1, state=STATE_BLOCKED, attempts=2),
+    ]
+    plan = plan_tick(
+        entries, board(), capacity=1,
+        live_prereq_terminal={entry_key(REPO, 1650): True},
+    )
+    assert plan.launch is not None
+    assert plan.launch.issue == 1654
+
+
 # ── #2055: `blocked`/`failed` re-checked against the board too ─────────────
 #
 # #1891's landed re-check above was `parked`-only. `blocked`/`failed` got no