code-coordinator 0.5.267__tar.gz → 0.5.269__tar.gz

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.267
+Version: 0.5.269
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.267
+Version: 0.5.269
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.267",
+  "tag": "0.5.269",
   "distance": 0,
-  "node": "g1fa630fb3cebe560405cb33c1b2ce1e3fed742a4",
+  "node": "gfb3b3633ce05c303a5c7243c93486fab73020f5e",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-28"

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/coord/commands/drive_queue.py

@@ -2587,6 +2587,68 @@ def clear_roll_pending() -> None:
         pass
 
 
+def _roll_pending_may_fire(*, occupied: int, now: float, queue_rows) -> tuple[bool, str]:
+    """Is it worth attempting to fire a pending roll THIS tick? (#2870 part 2)
+
+    #2587's original rule was ``occupied == 0`` — this tick's own
+    reconciliation (`_reconcile_running`'s ``occupies`` verdict) found
+    literally nothing left running. That rule never learned #2854: `coord
+    release propagate`'s own quiescence check
+    (:func:`coord.release_propagate.assess_quiescence`) treats a `running`
+    drive-queue row with no LIVE assignment right now, past its settle
+    window, as genuinely idle — the row just hasn't reached a terminal state
+    yet (nothing has reconciled it to ``done``). This tick's own ``occupied``
+    count has no such reading: a between-legs row launched on a different
+    host reads ``unknown`` here (#1870 — this tick's local tmux check proves
+    nothing about a row launched elsewhere) and stays charged, forever,
+    against an ``occupied == 0`` bar it can never clear. The 2026-08-28
+    incident this closes: `coord release propagate`, run directly, reported
+    ``quiescent — nothing in flight`` (between-legs, past the settle window)
+    for the SAME row this tick's own ``occupied`` reading was still counting
+    — so the tick never even ATTEMPTED the roll `coord release propagate`
+    would have accepted.
+
+    ``occupied == 0`` stays the cheap fast path — no extra board read. Only
+    when it is nonzero does this re-derive the SAME between-legs/settle-
+    window reading `coord release propagate` itself makes, from a fresh
+    board fetch. This is an ADVISORY re-check, not the authoritative one:
+    firing merely hands off to `coord-release-window.service`, which invokes
+    `coord release propagate` for real (never `--force`) and simply defers
+    again — costing nothing — if this read turns out to have been too
+    optimistic. So there is no harm in checking, and every reason to: the
+    alternative is a marker that can sit past its own between-legs row
+    forever with `coord drive-queue status` reporting `alert: (none)` the
+    whole time, because from the queue's own point of view nothing is wrong
+    — it is waiting on a roll, exactly as designed.
+
+    *queue_rows* are the SAME raw `drive_queue` rows this tick already read
+    (`coord.state.list_drive_queue()`) — reused rather than re-fetched, and
+    passed straight through as `assess_quiescence`'s ``queue_entries``: that
+    function reads the raw ``state``/``repo_name``/``issue_number`` columns,
+    not `QueueEntry` or `BoardView`'s reduced shapes.
+
+    A board this cannot read degrades to "no, don't fire" (never raises) —
+    the tick's own fail-closed abort already covers a board it cannot read
+    for reconciliation; a re-check that itself cannot read the board must
+    not provoke a fire it cannot justify.
+    """
+    if occupied == 0:
+        return True, ""
+    from coord import release_propagate as rp  # noqa: PLC0415
+
+    try:
+        payload = _fetch_board_payload()
+    except Exception:  # noqa: BLE001 — see docstring: fail closed, never raise
+        return False, ""
+    quiescence = rp.assess_quiescence(
+        queue_entries=queue_rows,
+        assignments=payload.get("assignments") or [],
+        issues=payload.get("issues") or [],
+        now=now,
+    )
+    return quiescence.quiescent, quiescence.reason
+
+
 def _fire_pending_roll(*, dry_run: bool = False) -> tuple[bool, str]:
     """Best-effort ``systemctl --user start --no-block
     coord-release-window.service`` (#2587 design point 3).
@@ -2954,16 +3016,22 @@ def _escalate_persistent_self_cordon(
     _write_self_cordon_state(state)
 
 
-def _fetch_board_view() -> BoardView:
-    """Board + live drive sessions, typed.
+def _fetch_board_payload() -> dict:
+    """The raw ``/board`` payload (+ standalone top-ups), untyped.
 
-    Raises whatever the fetch raised — the caller turns that into a fail-closed
-    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
-    tick: it returns ``[]`` when tmux is unavailable, and the board's
-    ``active_work`` signal still holds the capacity line in that case.
+    Split out of :func:`_fetch_board_view` (#2870) so a caller that needs the
+    RAW ``assignments``/``issues`` rows — not `BoardView`'s already-reduced
+    per-issue facts — has one place to get them. :func:`coord.
+    release_propagate.assess_quiescence` is exactly such a caller (#2870's
+    between-legs settle-window re-check for the roll-pending fire condition,
+    see :func:`_roll_pending_may_fire`): it reads raw assignment rows
+    (``machine_name``/``dispatched_at``/``finished_at``) `BoardView` never
+    carries at all.
+
+    Raises whatever the fetch raised — same fail-closed contract as before
+    this split.
     """
     from coord.board_service import resolve as resolve_board_service  # noqa: PLC0415
-    from coord.drive import list_drive_sessions  # noqa: PLC0415
     from coord.drive_state import BoardFetcher  # noqa: PLC0415
 
     payload = BoardFetcher().fetch()
@@ -2986,6 +3054,20 @@ def _fetch_board_view() -> BoardView:
             top_up["merge_queue"] = _local_merge_queue_rows()
         if top_up:
             payload = {**payload, **top_up}
+    return payload
+
+
+def _fetch_board_view() -> BoardView:
+    """Board + live drive sessions, typed.
+
+    Raises whatever the fetch raised — the caller turns that into a fail-closed
+    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
+    tick: it returns ``[]`` when tmux is unavailable, and the board's
+    ``active_work`` signal still holds the capacity line in that case.
+    """
+    from coord.drive import list_drive_sessions  # noqa: PLC0415
+
+    payload = _fetch_board_payload()
     return build_board_view(payload, list_drive_sessions())
 
 
@@ -4382,7 +4464,12 @@ def drive_queue_tick(
                 f"could not read the board — aborting without launching anything: {exc}"
             ) from None
 
-        entries = entries_from_rows(list_drive_queue())
+        # #2870: the raw rows are kept alongside the typed `entries` — see
+        # `_roll_pending_may_fire`'s `queue_rows` parameter, which needs the
+        # untyped `state`/`repo_name`/`issue_number` shape
+        # `coord.release_propagate.assess_quiescence` reads, not `QueueEntry`.
+        raw_queue_rows = list_drive_queue()
+        entries = entries_from_rows(raw_queue_rows)
 
         # #2587: is a fleet roll queued for the next inter-drive gap? Read
         # BEFORE `effective_capacity` is resolved — a live, unexpired marker
@@ -4563,7 +4650,24 @@ def drive_queue_tick(
         # `--dry-run`'s "mutate nothing" contract for every other write in
         # this function.
         if roll_pending is not None:
-            if plan.occupied == 0:
+            # #2870: `plan.occupied == 0` alone is the pre-#2854 reading —
+            # a between-legs row with no live assignment right now, past
+            # its settle window, can sit `occupied` here (e.g. #1870's
+            # `unknown` verdict for a row launched on another host)
+            # forever, even though `coord release propagate` itself would
+            # already call the fleet quiescent for that exact row. See
+            # `_roll_pending_may_fire`'s own docstring for the full
+            # mechanism and the incident this closes.
+            fire_ready, fire_note = _roll_pending_may_fire(
+                occupied=plan.occupied, now=now, queue_rows=raw_queue_rows
+            )
+            if fire_ready:
+                if plan.occupied and fire_note:
+                    click.echo(
+                        f"(queue still shows {plan.occupied} occupying a slot, "
+                        f"but #2854's settle-window reading calls it quiescent — "
+                        f"{fire_note} — attempting the roll anyway)"
+                    )
                 fired, detail = _fire_pending_roll()
                 if fired:
                     # #2587 review: this must NOT clear the marker. `fired`

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/coord/commands/release.py

@@ -654,11 +654,24 @@ def _lane_versions_by_host(report) -> dict[str, list[str | None]]:
 
 
 def _ensure_roll_pending_marker(
-    target_version: str, *, reason: str, dry_run: bool = False
+    target_version: str, *, reason: str, min_releases_behind: int | None = None,
+    dry_run: bool = False,
 ) -> None:
     """#2587: make sure a roll-pending marker exists for *target_version*,
     without resetting an already-live one's clock.
 
+    #2870: *min_releases_behind* is the effective `propagation.
+    min_releases_behind`/`--min-behind` threshold THIS run resolved and
+    already gated on before reaching this call (see the #2583 gate just
+    above this function's one call site) — stamped onto the marker
+    (`RollPending.min_releases_behind`) so whatever eventually discharges it
+    (`coord.commands.release._run_propagate`, threaded a matching
+    `--min-behind`) is gated at the SAME threshold this arm used, not
+    whatever threshold ITS OWN invocation happens to resolve. Like
+    `target_version`/`reason`, this is updated on every re-arm (a re-arm is
+    a fresh decision about what SHOULD roll and at what threshold) — only
+    `set_at`/`deferrals` stay frozen (see below).
+
     #2869: ``dry_run=True`` is the ONE seam every call site must go through —
     it never touches disk, only echoing what it *would* have written, in the
     same "would ..." register as ``_fire_pending_roll``'s and
@@ -712,7 +725,10 @@ def _ensure_roll_pending_marker(
             )
             return
         write_roll_pending(
-            _dataclasses.replace(existing, target_version=target_version, reason=reason)
+            _dataclasses.replace(
+                existing, target_version=target_version, reason=reason,
+                min_releases_behind=min_releases_behind,
+            )
         )
         return
     if dry_run:
@@ -723,7 +739,10 @@ def _ensure_roll_pending_marker(
         )
         return
     write_roll_pending(
-        RollPending(target_version=target_version, set_at=_time.time(), reason=reason)
+        RollPending(
+            target_version=target_version, set_at=_time.time(), reason=reason,
+            min_releases_behind=min_releases_behind,
+        )
     )
 
 
@@ -1123,7 +1142,14 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         # too, so a plain periodic `coord-release-propagate.timer` run also
         # arms the drive-queue tick's own inter-drive-gap trigger instead of
         # requiring an operator to separately reach for `nightly-window`.
-        _ensure_roll_pending_marker(record.target_version, reason="propagate", dry_run=dry_run)
+        # #2870: stamp THIS run's own already-passed `effective_min_behind`
+        # (resolved above, 3a) onto the marker, so whatever discharges it is
+        # gated at the threshold that armed it, not a threshold re-resolved
+        # from scratch later.
+        _ensure_roll_pending_marker(
+            record.target_version, reason="propagate",
+            min_releases_behind=effective_min_behind, dry_run=dry_run,
+        )
         _finish(rp.STATUS_DEFERRED, 0)
 
     still_busy = busy_hosts - set(current)
@@ -2846,7 +2872,7 @@ def _latest_propagate_record_since(state_dir: Path, since: float) -> dict | None
 
 def _run_propagate(
     *, daemon_host: str, target_version: str, config_path: Path, state_dir: Path,
-    runner=None, now_fn=None,
+    min_behind: int | None = None, runner=None, now_fn=None,
 ) -> tuple[str, int, str, float | None]:
     """``coord release propagate --daemon-host ... --target ... --json``.
 
@@ -2858,6 +2884,20 @@ def _run_propagate(
     run decided was needed is the version that actually rolls, even if a new
     release lands on PyPI mid-drain.
 
+    #2870: *min_behind*, when given, is passed through as `--min-behind` —
+    the threshold the roll-pending marker being discharged here was ARMED
+    at (`RollPending.min_releases_behind`), NOT this process's own
+    `propagation.min_releases_behind`. Before this, this call never passed
+    `--min-behind` at all, so `coord release propagate` always re-resolved
+    ITS OWN threshold from `coordinator.yml` — a marker armed below the
+    fleet default (e.g. `coord release nightly-window --min-behind 1`
+    against a fleet configured `min_releases_behind: 5`) could never reach
+    the threshold ITS discharge required and held forever, `alert: (none)`
+    the whole time. ``None`` (an old marker with no recorded threshold, or
+    one whose arming run never evaluated the gate) omits the flag, matching
+    the pre-#2870 behaviour — this process resolves its own default exactly
+    as it always did.
+
     Returns ``(status, exit_code, combined_output, propagate_started_at)``.
     ``status`` is read from the propagation journal entry that run itself
     wrote (:func:`_latest_propagate_record_since`) — the same ground truth
@@ -2883,6 +2923,8 @@ def _run_propagate(
         "--daemon-host", daemon_host, "--target", target_version,
         "--json", "--config", str(config_path),
     ]
+    if min_behind is not None:
+        argv.extend(["--min-behind", str(min_behind)])
     try:
         proc = run(argv, capture_output=True, text=True, timeout=1800)
     except Exception as exc:  # noqa: BLE001
@@ -3224,9 +3266,24 @@ def release_nightly_window(
         # attempt, safe to make redundantly since `coord release propagate`
         # never carries `--force` here (trap 1) and simply defers again if
         # the fleet is still busy.
+        # #2870: gate the discharge at the threshold the marker was ARMED
+        # at (`existing.min_releases_behind`), not whatever `coord release
+        # propagate` would re-resolve on its own — that mismatch is exactly
+        # how a marker armed via `--min-behind 1` froze the queue against a
+        # fleet configured `min_releases_behind: 5`, forever holding at "3
+        # behind, threshold 5" no matter how many times this fired. A
+        # marker with no recorded threshold (written before this field
+        # existed, or whose arming run never evaluated the gate at all)
+        # falls back to THIS run's own `effective_min_behind` — the same
+        # value it would have used before #2870.
         prop_status, prop_exit, prop_output, prop_started_at = _run_propagate(
             daemon_host=daemon_name, target_version=existing.target_version,
             config_path=config_path, state_dir=state_dir,
+            min_behind=(
+                existing.min_releases_behind
+                if existing.min_releases_behind is not None
+                else effective_min_behind
+            ),
         )
         record.propagate_status = prop_status
         record.propagate_exit_code = prop_exit
@@ -3303,6 +3360,13 @@ def release_nightly_window(
     # re-arm — the queue froze because the bound that was supposed to save it
     # could never be reached. Only a genuinely fresh marker (no existing one
     # at all) gets a new clock.
+    # #2870: every write below stamps `effective_min_behind` — THIS run's
+    # own already-resolved threshold (section 2b above) — onto the marker,
+    # so `_run_propagate`'s belt-and-braces call above (and any future
+    # discharge) is gated at the SAME threshold that armed it, not whatever
+    # `coord release propagate` would re-resolve on its own later. Updated
+    # on every re-arm, same as `target_version`/`reason` just below — only
+    # `set_at`/`deferrals` are the frozen "clock" #2607 protects.
     if existing is not None:
         click.echo(
             f"replacing stale roll-pending marker ({existing.describe()}) "
@@ -3313,6 +3377,7 @@ def release_nightly_window(
         write_roll_pending(
             _dataclasses.replace(
                 existing, target_version=record.target_version, reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     else:
@@ -3321,6 +3386,7 @@ def release_nightly_window(
                 target_version=record.target_version,
                 set_at=time.time(),
                 reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     click.echo(

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/coord/drive.py

@@ -587,6 +587,14 @@ class Action:
     # the work row's own last attempt reported, or `_decide_merge` would
     # diagnose one PR using the other PR's gates.
     merge_scope: str = "work"
+    # #2871: an explicit ``(event_type, summary, details)`` for `Driver._loop`
+    # to write via `_record_drive_audit`, independent of whatever this Action
+    # otherwise does (WAIT/RUN/EXIT). `decide()` stays a pure function of its
+    # inputs — it hands back *what happened*, never writes the audit log
+    # itself — while still letting a poll that neither dispatches nor exits
+    # (e.g. bypassing a stale pre-dispatch refusal) leave a durable trail
+    # instead of only a run-log line nobody queries later.
+    audit_event: tuple[str, str, dict[str, Any]] | None = None
 
     @property
     def is_exit(self) -> bool:
@@ -605,6 +613,44 @@ def _die(message: str, exit_code: int = EXIT_TERMINAL_FAILURE) -> Action:
     return Action(kind=EXIT, message=message, exit_code=exit_code)
 
 
+def _format_age(seconds: float) -> str:
+    """Coarse human age ('38m', '15h', '1.2d') for a pre-dispatch audit note.
+
+    Deliberately not the CLI's full relative-time renderer — this is one
+    field inside an audit `summary`/`details`, not a UI surface, so a small
+    self-contained formatter is enough (#2871).
+    """
+    seconds = max(0.0, seconds)
+    if seconds < 3600:
+        return f"{int(seconds // 60)}m"
+    if seconds < 86400:
+        return f"{seconds / 3600:.0f}h"
+    return f"{seconds / 86400:.1f}d"
+
+
+def _refused_policy_is_stale(state: IssueState) -> bool:
+    """True when a terminal ``refused_policy`` work row no longer describes
+    the issue as it stands now (#2871).
+
+    A worker refuses pre-dispatch work exactly once, correctly, for the ask
+    it was shown — the refusal says nothing about a DIFFERENT ask on the same
+    issue number. If the issue was retargeted (title rewritten) after that
+    row finished, the branch it would have produced (workers name branches
+    ``issue-{N}-{slugify(title)}`` at dispatch time, see
+    ``coord.agent``'s ``branch_name`` construction) no longer matches what a
+    fresh dispatch would name — that mismatch is the signal a retarget
+    happened. Conservative on every uncertainty (no branch recorded, no
+    title resolved): returns ``False`` — i.e. still treated as blocking —
+    rather than risk waving a genuinely-unresolved refusal through.
+    """
+    if not state.work_branch or not state.issue_title:
+        return False
+    from coord.agent import _slugify  # noqa: PLC0415
+
+    expected_branch = f"issue-{state.issue}-{_slugify(state.issue_title)}"
+    return state.work_branch != expected_branch
+
+
 # ── oracle-loop JIT slice authoring (#1453) ─────────────────────────────────
 
 
@@ -2036,8 +2082,58 @@ def decide(
         # deliverable was a doc edit, which CLAUDE.md itself tells a worker
         # to refuse and stop rather than attempt). Unlike an ADVISORY 0-commit
         # exit, retrying changes nothing — the rule this worker cited is not
-        # going anywhere — so this is a `_die()` exactly like every other
-        # terminal branch here, but the message embeds
+        # going anywhere — UNLESS the issue itself has since changed.
+        #
+        # #2871: a refusal is a verdict on the ASK the worker was shown, not
+        # a standing veto on the issue NUMBER forever. `coord/claim.py`'s
+        # `find_work_claim` never even sees this row (it's terminal, so it
+        # lives in `board.completed`) — the reason a stale refusal blocks
+        # every later drive is entirely HERE: `work_aid`/`work_status` above
+        # are the latest work-like row for this issue regardless of how old
+        # or how differently-scoped it is, so a fresh `coord drive` launch
+        # reads the fossil row as "this run's" state before ever reaching
+        # `_dispatch_work_stage`. If the issue was retargeted (title
+        # rewritten) after this row finished, `_refused_policy_is_stale`
+        # detects it — the old refusal no longer describes what a fresh
+        # dispatch would even be asked to do — and this bypasses the veto
+        # instead of dying again on the SAME prose a fresh worker never
+        # produced this run (CC#916).
+        age_seconds = (
+            time.time() - state.work_finished_at
+            if state.work_finished_at is not None
+            else None
+        )
+        age = _format_age(age_seconds) if age_seconds is not None else "unknown age"
+        if _refused_policy_is_stale(state):
+            bypass_summary = (
+                f"pre-dispatch: bypassing stale refused_policy assignment "
+                f"{state.work_aid} ({age} old) on issue {state.repo}#{state.issue} "
+                f"— retargeted since (branch {state.work_branch!r} no longer "
+                "matches the issue's current title); dispatching fresh work (#2871)"
+            )
+            dispatch = _dispatch_work_stage(
+                state, opts, counters, machine, oracle, gate_checker, verifier
+            )
+            return replace(
+                dispatch,
+                audit_event=(
+                    "refused_policy_stale",
+                    bypass_summary,
+                    {
+                        "stale_assignment_id": state.work_aid,
+                        "stale_branch": state.work_branch,
+                        "age_seconds": age_seconds,
+                    },
+                ),
+            )
+        # Still genuinely blocking: `_die()` exactly like every other
+        # terminal branch here, but the message now says explicitly that
+        # THIS run refused pre-dispatch on an OLD row (naming it and its
+        # age) rather than reading as a fresh worker refusing again — and
+        # names the remedy that actually clears it (#2871: retargeting is
+        # what makes the branch above fire on the next drive; `coord
+        # drive-queue remove`+`add` alone does nothing, since the queue row
+        # was never what was blocking). The message still embeds
         # `POLICY_REFUSAL_MARKER`: `coord/drive_queue.py`'s
         # `_reconcile_running` recognises that marker in this run's own
         # `drive_exited` audit summary and parks the queue entry
@@ -2046,12 +2142,16 @@ def decide(
         # principle #1844 already applies pre-dispatch, applied here
         # post-dispatch.
         return _die(
-            f"work {state.work_aid} refused on a standing repo-rule "
-            "prohibition rather than doing the dispatched work — the worker "
-            "did the CORRECT thing (#2234). Needs the coordinator: do the "
-            "work directly (or re-scope the issue so its deliverable isn't "
-            f"coordinator-only), then `coord drive-queue remove {state.repo} "
-            f"{state.issue}` once handled.\n"
+            f"pre-dispatch refusal on assignment {state.work_aid} "
+            f"(refused_policy, {age} old) — work refused on a standing "
+            "repo-rule prohibition rather than doing the dispatched work; "
+            "the worker did the CORRECT thing (#2234). Needs the "
+            "coordinator: do the work directly, OR retarget the issue "
+            "(rewrite its title so the deliverable matches what should "
+            "actually be dispatched) — the next `coord drive` detects the "
+            "retarget and dispatches fresh work automatically (#2871), so "
+            f"`coord drive-queue remove {state.repo} {state.issue}` + `add` "
+            "then genuinely clears this once the issue is retargeted.\n"
             f"   inspect: coord log {state.work_aid} --machine "
             f"{state.work_machine or machine}\n"
             f"   {POLICY_REFUSAL_MARKER}"
@@ -4680,6 +4780,15 @@ class Driver:
             for warning in action.warnings:
                 self.warn(warning)
 
+            # #2871: `decide()` stays a pure function of its inputs — it
+            # cannot write the audit log itself — so an Action that carries
+            # its own audit note (e.g. bypassing a stale pre-dispatch
+            # refusal) gets recorded here, the one place this loop already
+            # writes durable `drive_*` audit rows.
+            if action.audit_event is not None:
+                event_type, summary, details = action.audit_event
+                self._record_drive_audit(event_type, summary, details=details)
+
             # #2443: self-heal — see `_self_heal_drift_message`. Tracked off
             # the Action's own `label`, NOT `fingerprint` above: a WAIT can
             # (and, in the #2286 shape, does) repeat the identical reason

{code_coordinator-0.5.267 → code_coordinator-0.5.269}/coord/drive_queue.py

@@ -1561,6 +1561,26 @@ class RollPending:
     #: fleet still busy — bumped by the shell each tick it does NOT fire the
     #: roll. Never bumped by `plan_tick` itself (pure; no counting state).
     deferrals: int = 0
+    #: #2870: the ``propagation.min_releases_behind``/``--min-behind``
+    #: threshold this marker was ARMED at — `coord release nightly-window`/
+    #: `coord.commands.release._ensure_roll_pending_marker` stamp the
+    #: effective threshold THEIR OWN run resolved (override, else
+    #: `coordinator.yml`, else 1) at the moment they write this marker.
+    #: Before #2870, discharge (`_run_propagate`'s `coord release propagate`
+    #: subprocess) always re-resolved its OWN threshold from scratch — the
+    #: fleet default, never whatever `--min-behind` armed this marker at —
+    #: so a marker armed below the fleet default (e.g. a
+    #: `coord-release-window.service` ExecStart carrying `--min-behind 1`
+    #: against a fleet configured `min_releases_behind: 5`) could never
+    #: reach the threshold its own discharge path required and froze the
+    #: queue forever. Carried through to `_run_propagate` as `--min-behind`
+    #: so discharge is gated at the SAME threshold arm used. `None` for a
+    #: marker written before this field existed (`from_dict`'s tolerant
+    #: parse) or one whose arming run never evaluated the gate at all
+    #: (`effective_min_behind <= 1`) — the discharge call then falls back to
+    #: ITS OWN effective threshold, matching the pre-#2870 behaviour rather
+    #: than guessing.
+    min_releases_behind: int | None = None
 
     def expired(self, now: float) -> bool:
         """Has this marker outlived ITS OWN bound — TTL or deferral ceiling?
@@ -1589,6 +1609,7 @@ class RollPending:
             "ttl_seconds": self.ttl_seconds,
             "max_deferrals": self.max_deferrals,
             "deferrals": self.deferrals,
+            "min_releases_behind": self.min_releases_behind,
         }
 
     @classmethod
@@ -1615,6 +1636,7 @@ class RollPending:
                 data.get("max_deferrals"), ROLL_PENDING_DEFAULT_MAX_DEFERRALS
             ),
             deferrals=_as_int_default(data.get("deferrals"), 0),
+            min_releases_behind=_as_optional_int(data.get("min_releases_behind")),
         )
 
 
@@ -1632,6 +1654,21 @@ def _as_int_default(value: Any, default: int) -> int:
         return default
 
 
+def _as_optional_int(value: Any) -> int | None:
+    """Tolerant parse for a field that is legitimately absent (``None``),
+    unlike :func:`_as_int_default`'s fields which always have a real
+    fallback — see `RollPending.min_releases_behind`'s own docstring for why
+    "not recorded" must stay `None` rather than silently becoming some
+    default int a caller could mistake for a real threshold.
+    """
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
 @dataclass(frozen=True)
 class TickPlan:
     """Everything one tick decided, and nothing it has done yet."""
@@ -3107,18 +3144,32 @@ def _reconcile_running(
     # _decide` marks a `refused_policy` work row with `POLICY_REFUSAL_
     # MARKER` (coord.models) rather than `EXIT_DISPATCH_REFUSED`, so this is
     # checked purely off `own_reason` text, independent of `exit_refused`.
-    # Unlike #2063 this NEVER self-clears — a policy refusal names a
-    # STANDING rule, not a pending verdict — so it deliberately does not get
-    # the "queue resumes it automatically" wording Gate-A's park does; see
-    # `plan_tick`'s pre-pass below, which recognises this same marker and
-    # leaves the entry parked rather than falling through to the CI-park
-    # auto-resume. An operator clears it exactly like a `blocked` entry:
-    # handle it, then `coord drive-queue remove`.
+    # Unlike #2063 this does not self-clear on its own timer — a policy
+    # refusal names a STANDING rule, not a pending verdict — so it
+    # deliberately does not get the "queue resumes it automatically" wording
+    # Gate-A's park does; see `plan_tick`'s pre-pass below, which recognises
+    # this same marker and leaves the entry parked rather than falling
+    # through to the CI-park auto-resume.
+    #
+    # #2871: the precondition IS an operator action, but it is a RETARGET
+    # (rewrite the issue so its deliverable isn't the coordinator-only thing
+    # that got refused), not queue surgery. Before #2871, `coord.drive.
+    # decide()` re-read the SAME stale `refused_policy` row on every relaunch
+    # regardless of what the issue said by then, so `remove`+`add` looked
+    # like the fix but did nothing — a fresh queue row, same blocking
+    # assignment. `decide()` now compares that row's branch against the
+    # issue's CURRENT title-derived slug (`_refused_policy_is_stale`) and
+    # bypasses a stale refusal instead of dying on it again, so `remove`+
+    # `add` (or any later relaunch) genuinely works — but only once the
+    # retarget has actually happened.
     if own_reason and is_policy_refusal_reason(own_reason):
         reason = (
             f"{own_reason} — parking without spending an attempt (#2234); "
-            "needs the coordinator, not a relaunch — `coord drive-queue "
-            "remove` once handled"
+            "needs the coordinator, not a relaunch — retarget the issue "
+            "(rewrite its title so the deliverable isn't coordinator-only), "
+            "then `coord drive-queue remove`+`add` (or just relaunch "
+            "`coord drive`) — it now detects the retarget and dispatches "
+            "fresh work automatically (#2871)"
         )
         return (
             Reconcile(