code-coordinator 0.5.260__tar.gz → 0.5.262__tar.gz

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.260
+Version: 0.5.262
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.260
+Version: 0.5.262
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/code_coordinator.egg-info/SOURCES.txt

@@ -91,6 +91,7 @@ coord/hooks.py
 coord/housekeeping.py
 coord/interactive.py
 coord/issue_store.py
+coord/issues_sync_status.py
 coord/liveness_auditor.py
 coord/machine_pause.py
 coord/merge_queue.py
@@ -232,6 +233,7 @@ coord/health/checks/fleet_unit_drift.py
 coord/health/checks/graph.py
 coord/health/checks/graphify_cli.py
 coord/health/checks/index_lock.py
+coord/health/checks/issues_sync_staleness.py
 coord/health/checks/plan_usage.py
 coord/health/checks/release_cordon.py
 coord/health/checks/repo_state.py
@@ -571,6 +573,7 @@ tests/test_health_coord_web_ci_pin.py
 tests/test_health_deploy_lane_facts.py
 tests/test_health_fix.py
 tests/test_health_incident_regression.py
+tests/test_health_issues_sync_staleness.py
 tests/test_health_pypi.py
 tests/test_health_registry.py
 tests/test_health_release_cordon_probe.py
@@ -590,6 +593,7 @@ tests/test_interactive_test_verdict_backstop.py
 tests/test_interactive_token_attribution.py
 tests/test_interactive_worktree.py
 tests/test_issue_store_seam.py
+tests/test_issues_sync_status.py
 tests/test_liveness_auditor.py
 tests/test_liveness_notify.py
 tests/test_lock_contention_ratchet.py

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/code_coordinator.egg-info/scm_file_list.json

@@ -153,6 +153,7 @@
     "coord/health/checks/graph.py",
     "coord/health/checks/graphify_cli.py",
     "coord/health/checks/index_lock.py",
+    "coord/health/checks/issues_sync_staleness.py",
     "coord/health/checks/plan_usage.py",
     "coord/health/checks/release_cordon.py",
     "coord/health/checks/repo_state.py",
@@ -175,6 +176,7 @@
     "coord/housekeeping.py",
     "coord/interactive.py",
     "coord/issue_store.py",
+    "coord/issues_sync_status.py",
     "coord/liveness_auditor.py",
     "coord/machine_pause.py",
     "coord/merge_queue.py",
@@ -643,6 +645,7 @@
     "tests/test_health_deploy_lane_facts.py",
     "tests/test_health_fix.py",
     "tests/test_health_incident_regression.py",
+    "tests/test_health_issues_sync_staleness.py",
     "tests/test_health_pypi.py",
     "tests/test_health_registry.py",
     "tests/test_health_release_cordon_probe.py",
@@ -662,6 +665,7 @@
     "tests/test_interactive_token_attribution.py",
     "tests/test_interactive_worktree.py",
     "tests/test_issue_store_seam.py",
+    "tests/test_issues_sync_status.py",
     "tests/test_liveness_auditor.py",
     "tests/test_liveness_notify.py",
     "tests/test_lock_contention_ratchet.py",

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.260",
+  "tag": "0.5.262",
   "distance": 0,
-  "node": "g573c17e8ef6c8019f91d8f409127e24e5e3224fd",
+  "node": "g0ef4d9fe88b17a02b984541dc5f936ddefb6ec56",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-28"

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/coord/commands/lifecycle.py

@@ -565,7 +565,17 @@ def serve(config_path: Path, bind_host: str, bind_port: int, token: str | None)
         from coord.dao import SqliteStore
         from coord.db import DB_PATH
         from coord.serve_app import build_app as build_serve_app
-        from coord.serve_app import resolve_serve_token
+        from coord.serve_app import configure_daemon_logging, resolve_serve_token
+
+    # #2862: turn the daemon's own logging on BEFORE anything else runs.
+    # Without this the root logger has no handler and sits at WARNING, and
+    # `uvicorn.run(log_level="info")` below does not change that (it only
+    # configures the `uvicorn*` loggers) — so every `log.info(...)` in
+    # `serve_app._tick_loop`, including the customer-portal bridge's per-pass
+    # summary, was discarded before it was formatted. That is what made "Step
+    # 3d is quiet" unfalsifiable from the journal in #2824 and again in #2862.
+    # Level via $COORD_LOG_LEVEL (default INFO).
+    configure_daemon_logging()
 
     # #2824: `allow_thin_client=False` — `coord serve` IS the daemon every
     # thin client's `_load_config()` proxies to; it must always load the

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/coord/drive_queue.py

@@ -91,6 +91,7 @@ from typing import Any, Iterable, Mapping, Sequence
 
 from coord.drive_state import TERMINAL_STATUSES, WORK_LIKE
 from coord.gate_a import is_gate_a_refusal_reason
+from coord.issues_sync_status import STALENESS_WARN_SECONDS as ISSUE_CACHE_STALE_CEILING_S
 from coord.merge_queue import (
     PLAN_READY,
     ci_rollup_all_clear,
@@ -961,6 +962,12 @@ class IssueFacts:
 
     known: bool = False
     issue_state: str = ""  # "open" / "closed" / "" when the board has no row
+    # #2858: how long ago the `issues` cache row behind `issue_state` was
+    # last refreshed by `coord.serve_app._sync_issues_tick` — `None` when
+    # the board carried no `synced_at` for this issue at all (no issues row,
+    # or a payload built before #2858). Populated by `build_board_view`;
+    # see `issue_cache_stale` for the ONE thing this changes.
+    issue_synced_at: float | None = None
     merged: bool = False  # a work-like assignment with status == 'merged'
     active_work: bool = False  # a NON-terminal work-like assignment
     # #1891: this issue's CURRENT merge-queue entry is refused for nothing
@@ -1042,6 +1049,32 @@ class IssueFacts:
         return self.merged or self.closed
 
 
+def _issue_cache_stale(facts: IssueFacts, now: float | None) -> bool:
+    """True when *facts*' ``issue_synced_at`` is old enough (#2858) that a
+    NEGATIVE ``landed`` reading — the board's ``issues`` cache still says
+    "open" — should not be trusted as current, because the cache that fact
+    came from may simply not have caught up with a merge/close yet (a
+    starved :func:`coord.serve_app._sync_issues_tick`).
+
+    ``now=None`` — the same "no clock, no age" convention every other
+    staleness check in this module uses (see :func:`_park_reading_age`) —
+    and a ``facts.issue_synced_at`` of ``None`` (no ``issues`` row at all, or
+    a board payload built before #2858) both read as "not stale": the safe
+    default is trusting the cache exactly as every caller did before this
+    field existed, so every pre-#2858 board fixture / pure-logic call site is
+    unaffected.
+
+    Deliberately has NO bearing on a POSITIVE ``landed`` reading — once
+    ``landed`` is ``True`` it is always trustworthy (see its own docstring:
+    nothing ever un-lands an issue). This is only ever consulted where a
+    negative reading is about to be treated as definitive enough to spend a
+    retry/exhausted attempt on — see ``_reconcile_running``'s one call site.
+    """
+    if now is None or facts.issue_synced_at is None:
+        return False
+    return (now - facts.issue_synced_at) >= ISSUE_CACHE_STALE_CEILING_S
+
+
 @dataclass(frozen=True)
 class BoardView:
     """The whole board reduced to per-issue facts plus live drive sessions."""
@@ -1107,6 +1140,13 @@ def build_board_view(
             continue
         entry = slot(entry_key(repo, int(number)))
         entry["issue_state"] = str(row.get("state") or "").lower()
+        # #2858: carried alongside `issue_state` so a stale cache read can be
+        # told apart from a fresh one — see `_issue_cache_stale`. `BoardIssue.
+        # synced_at` is already on the wire (coord/board_schema.py); this is
+        # the first consumer that reads it off a `/board` `issues` row.
+        synced_at = row.get("synced_at")
+        if isinstance(synced_at, (int, float)):
+            entry["issue_synced_at"] = float(synced_at)
 
     # #1891: `merge_ci_pending` — mirrors `drive_state._merge_entry`'s OWN
     # reason resolution exactly (live `merge_plan` reason, falling back to
@@ -3230,6 +3270,46 @@ def _reconcile_running(
             None,
         )
 
+    # #2858: the board's `issues` cache row behind `facts.landed`'s negative
+    # half (`facts.closed`) can itself be stale — `coord.serve_app.
+    # _sync_issues_tick` runs on a slow (300s default) cadence and can be
+    # starved for tens of minutes by a shared `gh` rate-limit backoff
+    # (:mod:`coord.github_throttle`) that faster pollers keep re-arming. Every
+    # POSITIVE witness this function has (`facts.landed`, `own_reason`,
+    # `live_prereq_terminal`) was already checked above and would have
+    # returned `done` — reaching here means none of them confirmed a landing,
+    # which is NOT the same as a fresh, trustworthy "still open". Spending a
+    # retry/exhausted attempt on a false negative reproduces #2850's own
+    # shape (a landed issue's queue entry gets churned instead of settling)
+    # through a different door — the stale cache, not the requeue logic
+    # #2850 fixed. Park instead: no attempt spent, re-checked every tick
+    # exactly like the `merge_ci_pending` park just above, and it resolves
+    # itself the moment the cache catches up (or a later tick's live re-check
+    # succeeds).
+    if _issue_cache_stale(facts, now):
+        # `_issue_cache_stale` only returns True when both are set — see its
+        # docstring — so this subtraction is safe without another None guard.
+        age = now - facts.issue_synced_at
+        reason = (
+            f"issue cache is stale ({age / 60:.0f}m old) — cannot confirm "
+            f"this issue is still open, so not spending an attempt on it "
+            f"(#2858); parking until the next tick sees a fresher read"
+        )
+        return (
+            Reconcile(
+                entry.key,
+                "parked",
+                reason,
+                occupies=False,
+                updates={
+                    "state": STATE_PARKED,
+                    "last_reason": reason,
+                    "session_name": None,
+                },
+            ),
+            None,
+        )
+
     # #2273: was there ever a board-visible assignment for THIS launch? A
     # `True` here does not change whether an attempt is spent (see
     # DISPATCH_FAILURE_MIN_BACKOFF_SECONDS's comment for why exempting this

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/coord/github_ops.py

@@ -232,6 +232,58 @@ def _classify_rate_limit(stderr: str) -> tuple[bool, bool]:
     return False, False
 
 
+# #2858 proposal 4: a plain "rate limit" 403 with no "secondary" wording gets
+# classified `primary_rate_limit` by `_classify_rate_limit` above purely from
+# `gh`'s stderr text — but GitHub's abuse-detection (secondary) limiter fires
+# on request RATE/concurrency, not the primary quota, and its own error text
+# does not reliably say "secondary" (see :mod:`coord.github_throttle`'s
+# docstring: "does not show up in `gh api rate_limit` at all"). The
+# 2026-08-27 incident this closes: every hit was recorded `primary_rate_
+# limit` while `gh api rate_limit` read `core 4986/5000` the whole time —
+# sending an operator to check a quota that was never the problem.
+_PRIMARY_HEALTHY_REMAINING_FLOOR = 50
+_RATE_LIMIT_CHECK_TIMEOUT_S = 5.0
+
+
+def _primary_quota_healthy() -> bool | None:
+    """Best-effort ``True``/``False``/``None`` (unknown) reading of whether
+    the primary REST quota is currently healthy.
+
+    Shells out directly rather than through :func:`_gh` — deliberately: this
+    runs FROM INSIDE `_gh`'s own rate-limit failure handling, so routing it
+    back through `_gh` would recurse into the same seam that just failed
+    (and would itself be subject to the very backoff this call exists to
+    disambiguate). `gh api rate_limit` is GitHub's own documented exemption
+    from counting against the quota it reports, so one extra call here does
+    not make the situation this is diagnosing any worse.
+
+    Returns ``None`` — "don't know, don't reclassify" — on ANY failure
+    (missing binary, timeout, non-zero exit, unparseable JSON): silently
+    mislabeling a hit as ``secondary_rate_limit`` on a guess would be worse
+    than leaving the pre-#2858 ``primary_rate_limit`` default alone, since
+    only a *positive* health reading is stronger evidence than "gh's own
+    stderr didn't say 'secondary'".
+    """
+    try:
+        result = subprocess.run(
+            ["gh", "api", "rate_limit"],
+            capture_output=True, text=True, timeout=_RATE_LIMIT_CHECK_TIMEOUT_S,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if result.returncode != 0:
+        return None
+    try:
+        payload = json.loads(result.stdout)
+    except (json.JSONDecodeError, ValueError):
+        return None
+    core = ((payload or {}).get("resources") or {}).get("core") or {}
+    remaining = core.get("remaining")
+    if not isinstance(remaining, (int, float)):
+        return None
+    return remaining >= _PRIMARY_HEALTHY_REMAINING_FLOOR
+
+
 def _extract_rate_limit_detail(stderr: str) -> GhResponseMeta:
     """Best-effort status/request-id extraction from `gh`'s plain stderr
     text (no `-i`, no headers) -- covers every `_gh` call site, not just the
@@ -294,7 +346,7 @@ def _parse_gh_include(raw: str) -> tuple[GhResponseMeta, str]:
     return GhResponseMeta(status, request_id, retry_after), body
 
 
-def _gh(*args: str) -> str:
+def _gh(*args: str, force_through_backoff: bool = False) -> str:
     """Run ``gh`` with *args* and return its stdout, or raise :class:`GhError`.
 
     #1483: this is the single seam every ``_gh``-backed helper in this module
@@ -319,11 +371,28 @@ def _gh(*args: str) -> str:
     call entirely and raises immediately, reusing the ORIGINAL hit's detail.
     That skip is the actual damping: fewer requests reach a limiter that
     only decays when request volume drops.
+
+    #2858: ``force_through_backoff=True`` is the starvation-floor escape
+    hatch for a caller on a SLOW, fixed cadence (``coord.serve_app.
+    _sync_issues_tick``'s 300s tick) that a shared latch re-armed by faster
+    pollers can otherwise starve indefinitely — every sample this caller
+    takes lands mid-window, so it never once falls through to the short
+    sleep-then-call path below, and it is exactly this class of caller a
+    2026-08-27 incident showed CAN keep failing for 39+ minutes straight
+    even though GitHub's real limiter had already cleared (a direct `gh`
+    call succeeded in under a second the whole time). Setting it skips ONLY
+    the pre-emptive "still deep inside the window, don't even try" branch
+    immediately below — the short jittered pre-call sleep just after it
+    still runs unchanged, and a genuinely-still-active real limit still
+    raises (and still re-records) normally once the actual network call is
+    made. This never removes damping for the callers the latch exists to
+    protect (this flag is not theirs to set); it only stops a rare,
+    low-frequency caller from being permanently outbid by them.
     """
     backoff_sleep_s, active_backoff = github_throttle.consult()
     if active_backoff is not None:
         remaining = active_backoff.until - time.time()
-        if remaining > github_throttle.MAX_PRECALL_SLEEP_S:
+        if remaining > github_throttle.MAX_PRECALL_SLEEP_S and not force_through_backoff:
             # Still well inside a known backoff window -- don't add another
             # request to a limiter that only recovers when the rate drops.
             # This is not a fresh observation, so it is not re-recorded.
@@ -379,6 +448,14 @@ def _gh(*args: str) -> str:
         record_gh_call(args, outcome=_classify_gh_exit(stderr), duration_s=duration, detail=stderr)
         is_rate_limit, is_secondary = _classify_rate_limit(stderr)
         if is_rate_limit:
+            if not is_secondary:
+                # #2858: `gh`'s own text didn't say "secondary" -- confirm
+                # against the live primary quota before believing it rather
+                # than assuming the text is always right. `None` (couldn't
+                # tell) leaves `is_secondary` exactly as `_classify_rate_
+                # limit` set it -- see `_primary_quota_healthy`'s docstring.
+                if _primary_quota_healthy():
+                    is_secondary = True
             text_meta = _extract_rate_limit_detail(stderr)
             # `-i` callers (get_branch_sha/get_default_branch_head) get
             # headers on stdout even on a non-2xx response -- prefer that
@@ -435,18 +512,36 @@ def _json_loads_or(raw: str | None, default: Any = None) -> Any:
         return default
 
 
-def _gh_json(*args: str, default: Any = None) -> Any:
+def _gh_json(*args: str, default: Any = None, force_through_backoff: bool = False) -> Any:
     """Run ``gh`` with *args* and JSON-decode its stdout, failing open.
 
     Composes :func:`_gh` (still raises on a non-zero ``gh`` exit / missing
     binary / timeout) with :func:`_json_loads_or` (fails open to *default* on
     empty/malformed stdout from an otherwise-successful invocation). See
     :func:`_json_loads_or` for why this exists.
-    """
-    return _json_loads_or(_gh(*args), default)
+
+    *force_through_backoff* passes straight through to :func:`_gh` — see its
+    docstring (#2858). Deliberately omitted from the call entirely (rather
+    than forwarded as an explicit ``False``) when unset: a bare ``_gh(*args)``
+    keeps every OTHER ``_gh_json``-based call site's exact pre-#2858 call
+    signature, which matters because several tests mock ``_gh`` directly and
+    assert on its exact call args — forwarding an always-present keyword
+    would have changed every one of those, not just the callers that
+    actually use this.
+    """
+    if force_through_backoff:
+        raw = _gh(*args, force_through_backoff=True)
+    else:
+        raw = _gh(*args)
+    return _json_loads_or(raw, default)
 
 
-def get_open_issues(repo: str) -> list[dict]:
+def get_open_issues(repo: str, *, force_through_backoff: bool = False) -> list[dict]:
+    """*force_through_backoff* (#2858): set by ``coord.serve_app.
+    _sync_issues_tick`` once ``coord.issues_sync_status.is_starved(repo)``
+    says this repo has gone too long without a successful sync — see
+    :func:`coord.github_ops._gh`'s docstring for what it actually changes.
+    """
     # #658: raised from 100 → 500 so repos with many open issues don't silently
     # skip old issue numbers during coord sync.  GitHub paginates the REST list
     # endpoint at 100 items internally, so this costs ~5 API calls for a large
@@ -456,6 +551,7 @@ def get_open_issues(repo: str) -> list[dict]:
         "--json", "number,title,labels,milestone,body,assignees",
         "--limit", "500",
         default=[],
+        force_through_backoff=force_through_backoff,
     )
 
 

code_coordinator-0.5.262/coord/health/checks/issues_sync_staleness.py

@@ -0,0 +1,132 @@
+"""Fleet-scope: per-repo issues-cache staleness (#2858).
+
+``coord.serve_app._sync_issues_tick`` refreshes the local ``issues`` cache
+every repo needs — and before this check existed, a repo that stopped
+refreshing (the 2026-08-27 incident: a shared ``gh`` backoff latch,
+:mod:`coord.github_throttle`, re-armed by faster pollers every ~80s outbid
+this tick's 300s cadence for 39 minutes straight) looked IDENTICAL to a
+fresh cache everywhere an operator would look — ``coord status``, ``coord
+health``, the board itself. That silence is what let the staleness cascade:
+``coord.drive_queue.IssueFacts.landed`` reads this same cache with no notion
+of its own age, so a merged-and-closed issue kept reporting ``open`` and the
+drive queue blocked every dependent on it.
+
+This check makes that age visible. It reads
+``ctx.fleet.daemon_host["issues_sync_status"]`` — a per-repo
+``{last_success_at, last_attempt_at, last_error}`` snapshot
+:mod:`coord.health.fleet_snapshot`'s ``FleetHealthRefresher`` stamps from
+:mod:`coord.issues_sync_status` on its own tick, the same "daemon-host-local
+fact" shape :mod:`coord.health.checks.fleet_board` already established for
+``/board``'s own latency+size. Like that check, this only reports something
+real on the daemon host — everywhere else ``ctx.fleet`` is ``None`` and the
+result is ``unknown``.
+"""
+
+from __future__ import annotations
+
+from coord.health.models import CheckResult, HealthContext, Severity
+from coord.health.registry import check
+from coord.issues_sync_status import STALENESS_CRIT_SECONDS, STALENESS_WARN_SECONDS
+
+
+def _configured_repo_names(ctx: HealthContext) -> list[str]:
+    repos = getattr(ctx.config, "repos", None) or ()
+    return [r.name for r in repos if getattr(r, "name", None)]
+
+
+@check(
+    id="issues_sync_staleness",
+    scope="fleet",
+    title="issues sync",
+    order=21,
+    description=(
+        "How long since each repo's issues cache last synced successfully "
+        "(#2858) — a stale cache silently freezes IssueFacts.landed."
+    ),
+)
+def probe_issues_sync_staleness(ctx: HealthContext) -> list[CheckResult] | CheckResult:
+    if ctx.fleet is None:
+        return CheckResult(
+            check_id="issues_sync_staleness",
+            scope="fleet",
+            severity=Severity.UNKNOWN,
+            headroom="no fleet snapshot (fleet checks only run on the daemon)",
+        )
+
+    status = (ctx.fleet.daemon_host or {}).get("issues_sync_status")
+    if status is None:
+        return CheckResult(
+            check_id="issues_sync_staleness",
+            scope="fleet",
+            severity=Severity.UNKNOWN,
+            headroom="no issues-sync data yet",
+        )
+
+    repo_names = _configured_repo_names(ctx)
+    if not repo_names:
+        # No config to enumerate against (e.g. a bare context) — fall back
+        # to whatever repos the status snapshot itself knows about, so this
+        # check still says something rather than reporting nothing at all.
+        repo_names = sorted(status.keys())
+
+    results: list[CheckResult] = []
+    for repo_name in repo_names:
+        row = status.get(repo_name)
+        if row is None:
+            results.append(
+                CheckResult(
+                    check_id="issues_sync_staleness",
+                    scope="fleet",
+                    subject=repo_name,
+                    severity=Severity.UNKNOWN,
+                    headroom="never synced",
+                )
+            )
+            continue
+
+        last_success_at = row.get("last_success_at")
+        last_error = row.get("last_error")
+
+        if last_success_at is None:
+            results.append(
+                CheckResult(
+                    check_id="issues_sync_staleness",
+                    scope="fleet",
+                    subject=repo_name,
+                    severity=Severity.UNKNOWN,
+                    headroom="never synced successfully",
+                    detail=last_error or "",
+                    values=dict(row),
+                )
+            )
+            continue
+
+        age_s = max(0.0, ctx.now - last_success_at)
+        if age_s >= STALENESS_CRIT_SECONDS:
+            severity = Severity.CRIT
+        elif age_s >= STALENESS_WARN_SECONDS:
+            severity = Severity.WARN
+        else:
+            severity = Severity.OK
+
+        age_min = age_s / 60.0
+        headroom = f"synced {age_min:.0f}m ago"
+        if severity is not Severity.OK and last_error:
+            headroom += f" (last error: {last_error[:120]})"
+
+        results.append(
+            CheckResult(
+                check_id="issues_sync_staleness",
+                scope="fleet",
+                subject=repo_name,
+                severity=severity,
+                headroom=headroom,
+                threshold=(
+                    f"warn at {STALENESS_WARN_SECONDS / 60:.0f}m, "
+                    f"crit at {STALENESS_CRIT_SECONDS / 60:.0f}m"
+                ),
+                values=dict(row, age_s=age_s),
+            )
+        )
+
+    return results

{code_coordinator-0.5.260 → code_coordinator-0.5.262}/coord/health/fleet_snapshot.py

@@ -328,6 +328,24 @@ class FleetHealthRefresher:
         daemon_host["phantom_running"] = self._phantom_running_rows(machines)
         daemon_host["board_latency_ms"] = self._board_latency_ms
         daemon_host["board_payload_bytes"] = self._board_payload_bytes
+        # #2858: per-repo issues-sync staleness — a small local JSON read
+        # (coord.issues_sync_status), same "daemon-host-local fact" shape as
+        # the two lines above. `coord.health.checks.issues_sync_staleness`
+        # is the consumer; best-effort so a corrupt/missing state file
+        # degrades to "no data" rather than breaking this whole tick.
+        try:
+            from coord import issues_sync_status  # noqa: PLC0415
+
+            daemon_host["issues_sync_status"] = {
+                repo_name: {
+                    "last_success_at": row.last_success_at,
+                    "last_attempt_at": row.last_attempt_at,
+                    "last_error": row.last_error,
+                }
+                for repo_name, row in issues_sync_status.all_status().items()
+            }
+        except Exception:  # noqa: BLE001 — see docstring
+            daemon_host["issues_sync_status"] = {}
 
         # ── 3. run the fleet-scope registry over the assembled snapshot ────
         by_name = {row["machine"]: {