code-coordinator 0.5.256__tar.gz → 0.5.258__tar.gz

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.256
+Version: 0.5.258
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.256
+Version: 0.5.258
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/code_coordinator.egg-info/SOURCES.txt

@@ -667,6 +667,7 @@ tests/test_release_cordon_deadlock_2240.py
 tests/test_release_cordon_stuck_2490.py
 tests/test_release_propagate.py
 tests/test_release_propagate_threshold.py
+tests/test_release_roll_between_legs_2854.py
 tests/test_release_roll_window_handoff.py
 tests/test_release_unified_1242.py
 tests/test_release_verify.py

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/code_coordinator.egg-info/scm_file_list.json

@@ -739,6 +739,7 @@
     "tests/test_release_cordon_stuck_2490.py",
     "tests/test_release_propagate.py",
     "tests/test_release_propagate_threshold.py",
+    "tests/test_release_roll_between_legs_2854.py",
     "tests/test_release_roll_window_handoff.py",
     "tests/test_release_unified_1242.py",
     "tests/test_release_verify.py",

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.256",
+  "tag": "0.5.258",
   "distance": 0,
-  "node": "g1d53f40b4c8b97ed2f04d59ad1fad5e0d631d098",
+  "node": "gef4810f9d5759ef0c6af207cb768d16498aae9f4",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-27"

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/coord/commands/drive_queue.py

@@ -3450,21 +3450,45 @@ def _fetch_live_prereq_terminal(
     BOUNDED THE SAME WAY ITS SIBLINGS ARE. Only deps named by an entry
     currently ``waiting`` or ``blocked`` with a non-empty ``after=``, and
     only those the board does NOT already resolve on its own
-    (``facts.landed``, ``facts.open``, ``facts.active_work``, or a hit in
-    this tick's own pre-reconcile ``states`` — i.e. genuinely still queued)
-    make it into a live call. A queue with no unresolved ``after=`` edge
-    costs nothing here, same as ``_fetch_live_blocked_gate`` costs nothing
-    with no ``blocked`` rows. ``states`` is approximated from *entries*'
-    pre-tick ``state`` field (cheap, no I/O) rather than threaded from
-    ``plan_tick``'s own in-progress reconcile — a false negative here (a dep
-    this approximation still calls a live-check target, when the tick's own
-    authoritative ``states`` would already have resolved it another way)
-    costs one harmless extra ``gh`` read, never a wrong verdict:
-    ``_resolve_prereqs`` only ever consults this mapping in its OWN final
-    branch, after its own ``states``/``facts`` checks have already returned.
-    A false positive (a dep this skips that the tick's real walk would have
-    reached the final branch for) simply leaves that one dep to the
-    pre-#2602 fallback for this tick — caught on the next one.
+    (``facts.landed``, ``facts.open``, ``facts.active_work``, or a
+    ``STATE_DONE`` hit in this tick's own pre-reconcile ``states`` — i.e.
+    already known landed) make it into a live call. A queue with no
+    unresolved ``after=`` edge costs nothing here, same as
+    ``_fetch_live_blocked_gate`` costs nothing with no ``blocked`` rows.
+    ``states`` is approximated from *entries*' pre-tick ``state`` field
+    (cheap, no I/O) rather than threaded from ``plan_tick``'s own
+    in-progress reconcile — a false negative here (a dep this approximation
+    still calls a live-check target, when the tick's own authoritative
+    ``states`` would already have resolved it another way) costs one
+    harmless extra ``gh`` read, never a wrong verdict: ``_resolve_prereqs``
+    only ever consults this mapping in its OWN final branch, after its own
+    ``states``/``facts`` checks have already returned. A false positive (a
+    dep this skips that the tick's real walk would have reached the final
+    branch for) simply leaves that one dep to the pre-#2602 fallback for
+    this tick — caught on the next one.
+
+    #2850 WIDENS THE BOUND, in two ways, both closing the same class of gap
+    the incident exposed (a pre-req stuck under a stale/bogus queue row, not
+    merely absent from the queue):
+
+    * a dep whose queue row IS present now still gets a live call as long as
+      that row isn't already ``STATE_DONE`` — before #2850 any dep present
+      in ``states`` at all (``running``, ``waiting``, ``blocked``, ...) was
+      excluded outright, on the (pre-#2850) assumption that "still queued"
+      meant the local row was trustworthy. A `running` row that outlived the
+      drive it named (the #2850 incident: a drive that exited 0 having
+      merged, requeued into a `running` row nothing else re-checks) broke
+      that assumption; ``coord.drive_queue._resolve_prereqs``'s matching
+      #2850 change is what actually consults this for those deps.
+    * every ``running`` entry's OWN key is also added as a target when it
+      has no live tmux session (``board.live_sessions``) and the board does
+      not yet show it landed — i.e. exactly the entries
+      ``coord.drive_queue._reconcile_running`` is about to run its
+      death/retry diagnosis on THIS tick. That function consults this same
+      mapping, keyed by its OWN ``entry.key``, right before it would
+      otherwise spend a requeue attempt — the "re-check before requeuing
+      anything" half of #2850, independent of whatever (if anything) the
+      drive's own exit reason said.
     """
     states = {e.key: e.state for e in entries}
     targets: set[str] = set()
@@ -3472,12 +3496,24 @@ def _fetch_live_prereq_terminal(
         if e.state not in (STATE_WAITING, STATE_BLOCKED) or not e.after:
             continue
         for dep in e.after:
-            if dep in targets or states.get(dep) is not None:
+            if dep in targets or states.get(dep) == STATE_DONE:
                 continue
             facts = board.facts(dep)
             if facts.landed or facts.open or facts.active_work:
                 continue
             targets.add(dep)
+    # #2850: a RUNNING entry about to be reconciled by `_reconcile_running`'s
+    # death/retry logic THIS tick (no live session, and the board's own
+    # cached facts don't show it landed) gets the identical live re-check —
+    # bounded to exactly the entries that would otherwise risk a requeue.
+    for e in entries:
+        if e.state != STATE_RUNNING or e.key in targets:
+            continue
+        if e.key in board.live_sessions:
+            continue
+        if board.facts(e.key).landed:
+            continue
+        targets.add(e.key)
     if not targets:
         return {}
 

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/coord/commands/release.py

@@ -908,11 +908,16 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
     # have happened at all). Feed the same seam so it defers like a live
     # assignment instead of getting reaped.
     extra_busy.extend(_confirmation_running_busy())
+    # #2854: `now` opts this run into the between-legs settle window — a
+    # drive-queue row that is `running` but has genuinely had no live
+    # assignment on its last-known host for at least the settle window rolls
+    # that host without waiting for the row to reach a terminal state.
     quiescence = rp.assess_quiescence(
         queue_entries=board.get("drive_queue") or [],
         assignments=board.get("assignments") or [],
         issues=board.get("issues") or [],
         extra_busy=extra_busy,
+        now=time.time(),
     )
     record.quiescence = quiescence.to_dict()
     if quiescence.stale:
@@ -927,6 +932,19 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
             "tick --reconcile-only` to clear them for good)",
             err=True,
         )
+    if quiescence.settled:
+        # #2854: a `running` row whose host rolled BETWEEN LEGS — the row
+        # itself is still in flight, only the settled host is being treated
+        # as idle. Printed unconditionally, same reasoning as `stale` above:
+        # a host rolled mid-drive must leave a readable trace of why that was
+        # judged safe.
+        click.echo(
+            "note: rolling host(s) for drive-queue row(s) that are between "
+            f"legs and past the settle window: {', '.join(quiescence.settled)} "
+            "(#2854 — the row itself is still running; only the currently "
+            "idle host is being treated as quiescent)",
+            err=True,
+        )
 
     hosts = [m.name for m in (getattr(config, "machines", ()) or ())]
     busy_hosts = quiescence.busy_hosts()
@@ -2705,14 +2723,21 @@ def _drain(
                 rp.Busy(kind="board unreadable", subject="/board", detail=board_error)
             )
         extra_busy.extend(extra_busy_fetch())
+        # #2854: same settle-window opt-in as the top-level `propagate` call
+        # site — one clock read per poll, reused for both the settle window
+        # and `elapsed` below, so a between-legs gap that crosses the settle
+        # threshold mid-drain clears within THIS wait rather than only on
+        # the next `coord release propagate` tick.
+        poll_now = now_fn()
         quiescence = rp.assess_quiescence(
             queue_entries=board.get("drive_queue") or [],
             assignments=board.get("assignments") or [],
             issues=board.get("issues") or [],
             extra_busy=extra_busy,
+            now=poll_now,
         )
         busy = bool(quiescence.fleet_wide_busy) or daemon_host in quiescence.busy_hosts()
-        elapsed = now_fn() - start
+        elapsed = poll_now - start
         if not busy:
             return rw.DrainOutcome(drained=True, elapsed_seconds=elapsed, detail="drained")
         detail = quiescence.busy_reason_for_host(daemon_host) or quiescence.reason

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/coord/drive.py

@@ -116,7 +116,11 @@ from coord.failure_class import (
     environmental_backoff_secs,
     plan_usage_limit_resume,
 )
-from coord.models import DELIVERABLE_ANALYSIS_LABEL, POLICY_REFUSAL_MARKER
+from coord.models import (
+    DELIVERABLE_ANALYSIS_LABEL,
+    MERGE_LANDED_MARKER,
+    POLICY_REFUSAL_MARKER,
+)
 from coord.self_health import self_freshness
 from coord.usage_limits import PlanLimits, evaluate_usage_gate, get_plan_limits
 # Lost in the #1584-onto-#1590 rebase: _decide_review() calls this, but the
@@ -1869,7 +1873,10 @@ def decide(
     if state.work_status == "merged" or state.merge_status == "MERGED":
         target = state.repo_default_branch or "main"
         if state.work_branch and verifier.verify_merged(state):
-            return _succeed(f"✓ MERGED — {state.work_branch} has landed on {target}")
+            return _succeed(
+                f"✓ MERGED — {state.work_branch} has landed on {target}\n"
+                f"   {MERGE_LANDED_MARKER}"
+            )
         base = opts.repo_path or f"~/src/{state.repo}"
         return _die(
             f"board says merged but {state.work_branch} has NOT landed on {target}\n"

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/coord/drive_queue.py

@@ -100,7 +100,7 @@ from coord.merge_queue import (
     is_ci_unreadable_reason,
     is_stale_smoke_reason,
 )
-from coord.models import is_policy_refusal_reason
+from coord.models import is_merge_landed_reason, is_policy_refusal_reason
 
 # ── queue states ─────────────────────────────────────────────────────────────
 #
@@ -1818,17 +1818,26 @@ def _resolve_prereqs(
     _fetch_live_prereq_terminal``, the same positive-liveness test
     ``coord.overlap_predict``'s ``terminal_checker`` uses for the sibling
     ``[branch]`` half of #2602) confirms the issue is closed or its PR
-    merged — consulted ONLY in the final branch below, right before it would
-    otherwise declare *dep* unsatisfiable. This is the recovery half: the
-    cached ``board.facts(dep)`` this function checks first is a periodic
-    ``/board`` build, not a live read, and a pre-req that has JUST left the
-    queue (merged, issue closed) can outrun that cache — reading as "not
-    queued, not merged, not open" (:data:`_UNKNOWN_PREREQ_MARKER`) even
+    merged. This is the recovery half: the cached ``board.facts(dep)`` this
+    function checks first is a periodic ``/board`` build, not a live read,
+    and a pre-req that has JUST left the queue (merged, issue closed) can
+    outrun that cache — reading as "not queued, not merged, not open" even
     though the dep is, in fact, already done. Before this existed that
     verdict was unconditionally unsatisfiable and permanent
     (coord-portal#145/#149/#150, 2026-08-22): a dep absent here (no live
     check ran, or it ran and came back inconclusive) falls through to
     exactly that pre-#2602 behaviour — never a false "satisfied".
+
+    #2850 widens WHERE this is consulted: originally only the final branch
+    below (*dep* absent from the queue entirely) checked it. But a dep can
+    just as easily be PRESENT in the queue under a stale or outright bogus
+    row — the #2850 incident: a drive that exited 0 having merged got
+    requeued into a `running` row that never dies again on its own — and
+    that shape used to return "waiting"/"will never satisfy" straight out
+    of the ``dep_state is not None`` branch, never reaching this check at
+    all. So it is now ALSO consulted there, for every ``dep_state`` other
+    than ``STATE_DONE``: a pre-req that demonstrably landed must satisfy
+    the dependent whatever its own queue row happens to claim.
     """
     if entry.key in cycle_keys:
         return _Verdict(False, True, cycle_keys[entry.key])
@@ -1863,6 +1872,20 @@ def _resolve_prereqs(
                 # flips to `done`, instead of the tick after the cache
                 # independently rediscovers the same fact.
                 continue
+            if (live_prereq_terminal or {}).get(dep):
+                # #2850: *dep*'s OWN queue row says it is still in play
+                # (``running``, ``waiting``, ``blocked``, ...) — but a live
+                # re-check taken THIS tick confirms it is, in fact, already
+                # closed or merged. Before this, only a dep ABSENT from the
+                # queue entirely ever reached the #2602 recovery check below;
+                # a dep still SITTING in the queue under a stale/bogus row
+                # (the #2850 incident: a drive that exited 0 having merged,
+                # requeued into a bogus `running` row) short-circuited to
+                # "waiting"/"will never satisfy" here and shadowed the very
+                # recovery check meant to catch exactly this. A dependent
+                # must never be blocked by a pre-req that demonstrably
+                # landed, whatever its queue row claims.
+                continue
             if dep_state in (STATE_BLOCKED, STATE_FAILED):
                 return _Verdict(
                     False,
@@ -2757,6 +2780,7 @@ def _reconcile_running(
     exit_reasons: Mapping[str, str] | None = None,
     exit_refused: Mapping[str, bool] | None = None,
     exit_dead_end: Mapping[str, bool] | None = None,
+    live_prereq_terminal: Mapping[str, bool] | None = None,
 ) -> tuple[Reconcile, Blocked | None]:
     """Resolve one ``running`` entry against the board.
 
@@ -2848,6 +2872,35 @@ def _reconcile_running(
     the default budget. Still finite, still ``exhausted`` → ``blocked`` with
     the same diagnosis-and-recovery instructions once ITS wider ceiling is
     also hit.
+
+    #2850 adds TWO more "already landed" signals, both checked with the SAME
+    priority as ``facts.landed`` above — right after it, before
+    ``facts.active_work`` — because both are confirmations of terminal
+    completion at least as strong as a cached board read, and a drive that
+    has genuinely landed must never be requeued regardless of what
+    ``active_work``/cross-host/grace-window evidence says next:
+
+    * ``own_reason`` matching :func:`coord.models.is_merge_landed_reason` —
+      the drive's OWN exit narrated a confirmed merge (``coord.drive.
+      decide``'s "terminal: merged" branch, gated on a LIVE
+      ``verifier.verify_merged`` call, not merely the board's cached
+      ``merge_status``). Before this, ``exit_code=0`` plus a "✓ MERGED —
+      … has landed" summary still fell all the way through to the generic
+      "no session, no active work, nothing landed" retry logic below — the
+      drive's own strongest evidence, sitting unread in ``own_reason``,
+      never consulted — and got requeued and relaunched into dead air.
+    * *live_prereq_terminal* (#2602's mechanism, reused): when the shell's
+      bounded live re-check (:func:`coord.commands.drive_queue.
+      _fetch_live_prereq_terminal`, widened by #2850 to also probe a
+      ``running`` entry's OWN key, not just other entries' ``after=``
+      pre-reqs) confirms THIS key is closed or merged, that outranks
+      ``own_reason`` even existing — it catches every OTHER shape of "this
+      entry's issue is actually done, but this run's own exit reason
+      either says nothing about it or predates it" (a crash, a reap, a
+      dead-end exit for an issue that merged out of band between the crash
+      and this tick). Re-checking before ANY requeue — not only the
+      literal MERGED-exit-text case — is what makes the class safe rather
+      than patching just the one reported instance.
     """
     facts = board.facts(entry.key)
 
@@ -2874,6 +2927,62 @@ def _reconcile_running(
             None,
         )
 
+    # Resolved here — before `facts.active_work` and everything after it —
+    # so the #2850 merged-exit check just below can use it; every later
+    # branch that reads `own_reason` (gate_a/policy park, refused/dead_end,
+    # the retry/exhausted wording) is unaffected by hoisting this, since
+    # none of them run before this point.
+    own_reason = (exit_reasons or {}).get(entry.key)
+    if own_reason and is_merge_landed_reason(own_reason):
+        # #2850: the drive's own exit already confirmed — via a LIVE
+        # `verify_merged` check, not the board's cached `merge_status` —
+        # that this landed. Mark it done here, before anything below gets a
+        # chance to read the absent session / absent active-work as a death
+        # and requeue a launch that has nothing left to do.
+        reason = f"{own_reason} — confirmed merged (#2850), not a death"
+        return (
+            Reconcile(
+                entry.key,
+                "done",
+                reason,
+                occupies=False,
+                updates={
+                    "state": STATE_DONE,
+                    "last_reason": reason,
+                    "session_name": None,
+                },
+            ),
+            None,
+        )
+
+    if (live_prereq_terminal or {}).get(entry.key):
+        # #2850 defence in depth: whatever THIS run's own exit reason says
+        # (or doesn't — a crash leaves none at all), a live re-check taken
+        # THIS tick confirms the issue is already closed or its PR merged.
+        # That is stronger evidence than an absent tmux session and absent
+        # board `active_work` could ever be on their own — mark done rather
+        # than let the death-diagnosis logic below spend an attempt
+        # relaunching a drive with nothing left to do.
+        reason = (
+            "drive finished — a live re-check this tick confirms the issue "
+            "is already closed or its PR merged (#2850), independent of "
+            "this run's own exit reason and the cached board"
+        )
+        return (
+            Reconcile(
+                entry.key,
+                "done",
+                reason,
+                occupies=False,
+                updates={
+                    "state": STATE_DONE,
+                    "last_reason": reason,
+                    "session_name": None,
+                },
+            ),
+            None,
+        )
+
     if facts.active_work:
         return (
             Reconcile(
@@ -2916,7 +3025,10 @@ def _reconcile_running(
     # purely for stability — the two codes are mutually exclusive by
     # construction (`_drive_exit_summary` records exactly one), so the order
     # is never actually load-bearing.
-    own_reason = (exit_reasons or {}).get(entry.key)
+    #
+    # `own_reason` itself was already resolved above (#2850, before the
+    # `facts.active_work` check) so the merged-exit short-circuit could use
+    # it — reused here unchanged.
 
     # #2063 rides the SAME evidence as `refused` below but reaches the
     # OPPOSITE conclusion, so it is checked first. A Gate-A "no recorded
@@ -4121,6 +4233,7 @@ def plan_tick(
             exit_reasons=exit_reasons,
             exit_refused=exit_refused,
             exit_dead_end=exit_dead_end,
+            live_prereq_terminal=live_prereq_terminal,
         )
         reconciles.append(reconcile)
         if reconcile.occupies:

{code_coordinator-0.5.256 → code_coordinator-0.5.258}/coord/models.py

@@ -550,6 +550,31 @@ def is_policy_refusal_reason(text: str | None) -> bool:
     return bool(text) and POLICY_REFUSAL_MARKER in text
 
 
+# #2850: the machine-readable tag `coord.drive.decide` embeds in its
+# `_succeed()` message when the "terminal: merged" branch's own LIVE check
+# (`MergeVerifier.verify_merged`) confirms the issue has genuinely landed —
+# not merely that the board's cached `merge_status` claims so.
+#
+# Text-marker matching (not a dedicated exit code) mirrors
+# `POLICY_REFUSAL_MARKER` immediately above: `EXIT_OK` is shared by every
+# clean drive exit — this one, a `deliverable:analysis` 0-commit stop, and a
+# `--no-merge` "review approved, stopping here" — so the exit code alone
+# cannot distinguish "confirmed merged" from "stopped short of merging on
+# purpose". `coord/drive_queue.py`'s `_reconcile_running` recognises this
+# straight out of the drive's own `drive_exited` audit summary (`own_reason`)
+# and marks the queue entry `done` instead of requeuing a launch that has
+# nothing left to do — closing the #2850 failure mode: a drive that exits 0
+# having MERGED got requeued and relaunched into dead air, with the bogus
+# `running` row shadowing #2602's own live re-check for every dependent
+# chained `--after` it.
+MERGE_LANDED_MARKER = "[drive-merged #2850]"
+
+
+def is_merge_landed_reason(text: str | None) -> bool:
+    """Whether *text* is a #2850 confirmed-merge drive-exit reason."""
+    return bool(text) and MERGE_LANDED_MARKER in text
+
+
 @dataclass
 class Assignment:
     machine_name: str