code-coordinator 0.5.268__tar.gz → 0.5.269__tar.gz

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.268
+Version: 0.5.269
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.268
+Version: 0.5.269
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.268",
+  "tag": "0.5.269",
   "distance": 0,
-  "node": "gf1fb3361f55813adaa28edcc31c2b9a1b6a20836",
+  "node": "gfb3b3633ce05c303a5c7243c93486fab73020f5e",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-28"

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/coord/commands/drive_queue.py

@@ -2587,6 +2587,68 @@ def clear_roll_pending() -> None:
         pass
 
 
+def _roll_pending_may_fire(*, occupied: int, now: float, queue_rows) -> tuple[bool, str]:
+    """Is it worth attempting to fire a pending roll THIS tick? (#2870 part 2)
+
+    #2587's original rule was ``occupied == 0`` — this tick's own
+    reconciliation (`_reconcile_running`'s ``occupies`` verdict) found
+    literally nothing left running. That rule never learned #2854: `coord
+    release propagate`'s own quiescence check
+    (:func:`coord.release_propagate.assess_quiescence`) treats a `running`
+    drive-queue row with no LIVE assignment right now, past its settle
+    window, as genuinely idle — the row just hasn't reached a terminal state
+    yet (nothing has reconciled it to ``done``). This tick's own ``occupied``
+    count has no such reading: a between-legs row launched on a different
+    host reads ``unknown`` here (#1870 — this tick's local tmux check proves
+    nothing about a row launched elsewhere) and stays charged, forever,
+    against an ``occupied == 0`` bar it can never clear. The 2026-08-28
+    incident this closes: `coord release propagate`, run directly, reported
+    ``quiescent — nothing in flight`` (between-legs, past the settle window)
+    for the SAME row this tick's own ``occupied`` reading was still counting
+    — so the tick never even ATTEMPTED the roll `coord release propagate`
+    would have accepted.
+
+    ``occupied == 0`` stays the cheap fast path — no extra board read. Only
+    when it is nonzero does this re-derive the SAME between-legs/settle-
+    window reading `coord release propagate` itself makes, from a fresh
+    board fetch. This is an ADVISORY re-check, not the authoritative one:
+    firing merely hands off to `coord-release-window.service`, which invokes
+    `coord release propagate` for real (never `--force`) and simply defers
+    again — costing nothing — if this read turns out to have been too
+    optimistic. So there is no harm in checking, and every reason to: the
+    alternative is a marker that can sit past its own between-legs row
+    forever with `coord drive-queue status` reporting `alert: (none)` the
+    whole time, because from the queue's own point of view nothing is wrong
+    — it is waiting on a roll, exactly as designed.
+
+    *queue_rows* are the SAME raw `drive_queue` rows this tick already read
+    (`coord.state.list_drive_queue()`) — reused rather than re-fetched, and
+    passed straight through as `assess_quiescence`'s ``queue_entries``: that
+    function reads the raw ``state``/``repo_name``/``issue_number`` columns,
+    not `QueueEntry` or `BoardView`'s reduced shapes.
+
+    A board this cannot read degrades to "no, don't fire" (never raises) —
+    the tick's own fail-closed abort already covers a board it cannot read
+    for reconciliation; a re-check that itself cannot read the board must
+    not provoke a fire it cannot justify.
+    """
+    if occupied == 0:
+        return True, ""
+    from coord import release_propagate as rp  # noqa: PLC0415
+
+    try:
+        payload = _fetch_board_payload()
+    except Exception:  # noqa: BLE001 — see docstring: fail closed, never raise
+        return False, ""
+    quiescence = rp.assess_quiescence(
+        queue_entries=queue_rows,
+        assignments=payload.get("assignments") or [],
+        issues=payload.get("issues") or [],
+        now=now,
+    )
+    return quiescence.quiescent, quiescence.reason
+
+
 def _fire_pending_roll(*, dry_run: bool = False) -> tuple[bool, str]:
     """Best-effort ``systemctl --user start --no-block
     coord-release-window.service`` (#2587 design point 3).
@@ -2954,16 +3016,22 @@ def _escalate_persistent_self_cordon(
     _write_self_cordon_state(state)
 
 
-def _fetch_board_view() -> BoardView:
-    """Board + live drive sessions, typed.
+def _fetch_board_payload() -> dict:
+    """The raw ``/board`` payload (+ standalone top-ups), untyped.
 
-    Raises whatever the fetch raised — the caller turns that into a fail-closed
-    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
-    tick: it returns ``[]`` when tmux is unavailable, and the board's
-    ``active_work`` signal still holds the capacity line in that case.
+    Split out of :func:`_fetch_board_view` (#2870) so a caller that needs the
+    RAW ``assignments``/``issues`` rows — not `BoardView`'s already-reduced
+    per-issue facts — has one place to get them. :func:`coord.
+    release_propagate.assess_quiescence` is exactly such a caller (#2870's
+    between-legs settle-window re-check for the roll-pending fire condition,
+    see :func:`_roll_pending_may_fire`): it reads raw assignment rows
+    (``machine_name``/``dispatched_at``/``finished_at``) `BoardView` never
+    carries at all.
+
+    Raises whatever the fetch raised — same fail-closed contract as before
+    this split.
     """
     from coord.board_service import resolve as resolve_board_service  # noqa: PLC0415
-    from coord.drive import list_drive_sessions  # noqa: PLC0415
     from coord.drive_state import BoardFetcher  # noqa: PLC0415
 
     payload = BoardFetcher().fetch()
@@ -2986,6 +3054,20 @@ def _fetch_board_view() -> BoardView:
             top_up["merge_queue"] = _local_merge_queue_rows()
         if top_up:
             payload = {**payload, **top_up}
+    return payload
+
+
+def _fetch_board_view() -> BoardView:
+    """Board + live drive sessions, typed.
+
+    Raises whatever the fetch raised — the caller turns that into a fail-closed
+    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
+    tick: it returns ``[]`` when tmux is unavailable, and the board's
+    ``active_work`` signal still holds the capacity line in that case.
+    """
+    from coord.drive import list_drive_sessions  # noqa: PLC0415
+
+    payload = _fetch_board_payload()
     return build_board_view(payload, list_drive_sessions())
 
 
@@ -4382,7 +4464,12 @@ def drive_queue_tick(
                 f"could not read the board — aborting without launching anything: {exc}"
             ) from None
 
-        entries = entries_from_rows(list_drive_queue())
+        # #2870: the raw rows are kept alongside the typed `entries` — see
+        # `_roll_pending_may_fire`'s `queue_rows` parameter, which needs the
+        # untyped `state`/`repo_name`/`issue_number` shape
+        # `coord.release_propagate.assess_quiescence` reads, not `QueueEntry`.
+        raw_queue_rows = list_drive_queue()
+        entries = entries_from_rows(raw_queue_rows)
 
         # #2587: is a fleet roll queued for the next inter-drive gap? Read
         # BEFORE `effective_capacity` is resolved — a live, unexpired marker
@@ -4563,7 +4650,24 @@ def drive_queue_tick(
         # `--dry-run`'s "mutate nothing" contract for every other write in
         # this function.
         if roll_pending is not None:
-            if plan.occupied == 0:
+            # #2870: `plan.occupied == 0` alone is the pre-#2854 reading —
+            # a between-legs row with no live assignment right now, past
+            # its settle window, can sit `occupied` here (e.g. #1870's
+            # `unknown` verdict for a row launched on another host)
+            # forever, even though `coord release propagate` itself would
+            # already call the fleet quiescent for that exact row. See
+            # `_roll_pending_may_fire`'s own docstring for the full
+            # mechanism and the incident this closes.
+            fire_ready, fire_note = _roll_pending_may_fire(
+                occupied=plan.occupied, now=now, queue_rows=raw_queue_rows
+            )
+            if fire_ready:
+                if plan.occupied and fire_note:
+                    click.echo(
+                        f"(queue still shows {plan.occupied} occupying a slot, "
+                        f"but #2854's settle-window reading calls it quiescent — "
+                        f"{fire_note} — attempting the roll anyway)"
+                    )
                 fired, detail = _fire_pending_roll()
                 if fired:
                     # #2587 review: this must NOT clear the marker. `fired`

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/coord/commands/release.py

@@ -654,11 +654,24 @@ def _lane_versions_by_host(report) -> dict[str, list[str | None]]:
 
 
 def _ensure_roll_pending_marker(
-    target_version: str, *, reason: str, dry_run: bool = False
+    target_version: str, *, reason: str, min_releases_behind: int | None = None,
+    dry_run: bool = False,
 ) -> None:
     """#2587: make sure a roll-pending marker exists for *target_version*,
     without resetting an already-live one's clock.
 
+    #2870: *min_releases_behind* is the effective `propagation.
+    min_releases_behind`/`--min-behind` threshold THIS run resolved and
+    already gated on before reaching this call (see the #2583 gate just
+    above this function's one call site) — stamped onto the marker
+    (`RollPending.min_releases_behind`) so whatever eventually discharges it
+    (`coord.commands.release._run_propagate`, threaded a matching
+    `--min-behind`) is gated at the SAME threshold this arm used, not
+    whatever threshold ITS OWN invocation happens to resolve. Like
+    `target_version`/`reason`, this is updated on every re-arm (a re-arm is
+    a fresh decision about what SHOULD roll and at what threshold) — only
+    `set_at`/`deferrals` stay frozen (see below).
+
     #2869: ``dry_run=True`` is the ONE seam every call site must go through —
     it never touches disk, only echoing what it *would* have written, in the
     same "would ..." register as ``_fire_pending_roll``'s and
@@ -712,7 +725,10 @@ def _ensure_roll_pending_marker(
             )
             return
         write_roll_pending(
-            _dataclasses.replace(existing, target_version=target_version, reason=reason)
+            _dataclasses.replace(
+                existing, target_version=target_version, reason=reason,
+                min_releases_behind=min_releases_behind,
+            )
         )
         return
     if dry_run:
@@ -723,7 +739,10 @@ def _ensure_roll_pending_marker(
         )
         return
     write_roll_pending(
-        RollPending(target_version=target_version, set_at=_time.time(), reason=reason)
+        RollPending(
+            target_version=target_version, set_at=_time.time(), reason=reason,
+            min_releases_behind=min_releases_behind,
+        )
     )
 
 
@@ -1123,7 +1142,14 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         # too, so a plain periodic `coord-release-propagate.timer` run also
         # arms the drive-queue tick's own inter-drive-gap trigger instead of
         # requiring an operator to separately reach for `nightly-window`.
-        _ensure_roll_pending_marker(record.target_version, reason="propagate", dry_run=dry_run)
+        # #2870: stamp THIS run's own already-passed `effective_min_behind`
+        # (resolved above, 3a) onto the marker, so whatever discharges it is
+        # gated at the threshold that armed it, not a threshold re-resolved
+        # from scratch later.
+        _ensure_roll_pending_marker(
+            record.target_version, reason="propagate",
+            min_releases_behind=effective_min_behind, dry_run=dry_run,
+        )
         _finish(rp.STATUS_DEFERRED, 0)
 
     still_busy = busy_hosts - set(current)
@@ -2846,7 +2872,7 @@ def _latest_propagate_record_since(state_dir: Path, since: float) -> dict | None
 
 def _run_propagate(
     *, daemon_host: str, target_version: str, config_path: Path, state_dir: Path,
-    runner=None, now_fn=None,
+    min_behind: int | None = None, runner=None, now_fn=None,
 ) -> tuple[str, int, str, float | None]:
     """``coord release propagate --daemon-host ... --target ... --json``.
 
@@ -2858,6 +2884,20 @@ def _run_propagate(
     run decided was needed is the version that actually rolls, even if a new
     release lands on PyPI mid-drain.
 
+    #2870: *min_behind*, when given, is passed through as `--min-behind` —
+    the threshold the roll-pending marker being discharged here was ARMED
+    at (`RollPending.min_releases_behind`), NOT this process's own
+    `propagation.min_releases_behind`. Before this, this call never passed
+    `--min-behind` at all, so `coord release propagate` always re-resolved
+    ITS OWN threshold from `coordinator.yml` — a marker armed below the
+    fleet default (e.g. `coord release nightly-window --min-behind 1`
+    against a fleet configured `min_releases_behind: 5`) could never reach
+    the threshold ITS discharge required and held forever, `alert: (none)`
+    the whole time. ``None`` (an old marker with no recorded threshold, or
+    one whose arming run never evaluated the gate) omits the flag, matching
+    the pre-#2870 behaviour — this process resolves its own default exactly
+    as it always did.
+
     Returns ``(status, exit_code, combined_output, propagate_started_at)``.
     ``status`` is read from the propagation journal entry that run itself
     wrote (:func:`_latest_propagate_record_since`) — the same ground truth
@@ -2883,6 +2923,8 @@ def _run_propagate(
         "--daemon-host", daemon_host, "--target", target_version,
         "--json", "--config", str(config_path),
     ]
+    if min_behind is not None:
+        argv.extend(["--min-behind", str(min_behind)])
     try:
         proc = run(argv, capture_output=True, text=True, timeout=1800)
     except Exception as exc:  # noqa: BLE001
@@ -3224,9 +3266,24 @@ def release_nightly_window(
         # attempt, safe to make redundantly since `coord release propagate`
         # never carries `--force` here (trap 1) and simply defers again if
         # the fleet is still busy.
+        # #2870: gate the discharge at the threshold the marker was ARMED
+        # at (`existing.min_releases_behind`), not whatever `coord release
+        # propagate` would re-resolve on its own — that mismatch is exactly
+        # how a marker armed via `--min-behind 1` froze the queue against a
+        # fleet configured `min_releases_behind: 5`, forever holding at "3
+        # behind, threshold 5" no matter how many times this fired. A
+        # marker with no recorded threshold (written before this field
+        # existed, or whose arming run never evaluated the gate at all)
+        # falls back to THIS run's own `effective_min_behind` — the same
+        # value it would have used before #2870.
         prop_status, prop_exit, prop_output, prop_started_at = _run_propagate(
             daemon_host=daemon_name, target_version=existing.target_version,
             config_path=config_path, state_dir=state_dir,
+            min_behind=(
+                existing.min_releases_behind
+                if existing.min_releases_behind is not None
+                else effective_min_behind
+            ),
         )
         record.propagate_status = prop_status
         record.propagate_exit_code = prop_exit
@@ -3303,6 +3360,13 @@ def release_nightly_window(
     # re-arm — the queue froze because the bound that was supposed to save it
     # could never be reached. Only a genuinely fresh marker (no existing one
     # at all) gets a new clock.
+    # #2870: every write below stamps `effective_min_behind` — THIS run's
+    # own already-resolved threshold (section 2b above) — onto the marker,
+    # so `_run_propagate`'s belt-and-braces call above (and any future
+    # discharge) is gated at the SAME threshold that armed it, not whatever
+    # `coord release propagate` would re-resolve on its own later. Updated
+    # on every re-arm, same as `target_version`/`reason` just below — only
+    # `set_at`/`deferrals` are the frozen "clock" #2607 protects.
     if existing is not None:
         click.echo(
             f"replacing stale roll-pending marker ({existing.describe()}) "
@@ -3313,6 +3377,7 @@ def release_nightly_window(
         write_roll_pending(
             _dataclasses.replace(
                 existing, target_version=record.target_version, reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     else:
@@ -3321,6 +3386,7 @@ def release_nightly_window(
                 target_version=record.target_version,
                 set_at=time.time(),
                 reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     click.echo(

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/coord/drive_queue.py

@@ -1561,6 +1561,26 @@ class RollPending:
     #: fleet still busy — bumped by the shell each tick it does NOT fire the
     #: roll. Never bumped by `plan_tick` itself (pure; no counting state).
     deferrals: int = 0
+    #: #2870: the ``propagation.min_releases_behind``/``--min-behind``
+    #: threshold this marker was ARMED at — `coord release nightly-window`/
+    #: `coord.commands.release._ensure_roll_pending_marker` stamp the
+    #: effective threshold THEIR OWN run resolved (override, else
+    #: `coordinator.yml`, else 1) at the moment they write this marker.
+    #: Before #2870, discharge (`_run_propagate`'s `coord release propagate`
+    #: subprocess) always re-resolved its OWN threshold from scratch — the
+    #: fleet default, never whatever `--min-behind` armed this marker at —
+    #: so a marker armed below the fleet default (e.g. a
+    #: `coord-release-window.service` ExecStart carrying `--min-behind 1`
+    #: against a fleet configured `min_releases_behind: 5`) could never
+    #: reach the threshold its own discharge path required and froze the
+    #: queue forever. Carried through to `_run_propagate` as `--min-behind`
+    #: so discharge is gated at the SAME threshold arm used. `None` for a
+    #: marker written before this field existed (`from_dict`'s tolerant
+    #: parse) or one whose arming run never evaluated the gate at all
+    #: (`effective_min_behind <= 1`) — the discharge call then falls back to
+    #: ITS OWN effective threshold, matching the pre-#2870 behaviour rather
+    #: than guessing.
+    min_releases_behind: int | None = None
 
     def expired(self, now: float) -> bool:
         """Has this marker outlived ITS OWN bound — TTL or deferral ceiling?
@@ -1589,6 +1609,7 @@ class RollPending:
             "ttl_seconds": self.ttl_seconds,
             "max_deferrals": self.max_deferrals,
             "deferrals": self.deferrals,
+            "min_releases_behind": self.min_releases_behind,
         }
 
     @classmethod
@@ -1615,6 +1636,7 @@ class RollPending:
                 data.get("max_deferrals"), ROLL_PENDING_DEFAULT_MAX_DEFERRALS
             ),
             deferrals=_as_int_default(data.get("deferrals"), 0),
+            min_releases_behind=_as_optional_int(data.get("min_releases_behind")),
         )
 
 
@@ -1632,6 +1654,21 @@ def _as_int_default(value: Any, default: int) -> int:
         return default
 
 
+def _as_optional_int(value: Any) -> int | None:
+    """Tolerant parse for a field that is legitimately absent (``None``),
+    unlike :func:`_as_int_default`'s fields which always have a real
+    fallback — see `RollPending.min_releases_behind`'s own docstring for why
+    "not recorded" must stay `None` rather than silently becoming some
+    default int a caller could mistake for a real threshold.
+    """
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
 @dataclass(frozen=True)
 class TickPlan:
     """Everything one tick decided, and nothing it has done yet."""

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/tests/test_cli_release_propagate.py

@@ -459,6 +459,37 @@ def test_a_busy_daemon_host_defers_the_whole_run(
     assert pending.reason == "propagate"
 
 
+def test_a_busy_daemon_deferral_stamps_this_runs_own_threshold_onto_the_marker(
+    valid_config_path, state_dir, no_network, monkeypatch
+):
+    """#2870: the marker `_ensure_roll_pending_marker` arms here must carry
+    THIS run's own already-passed `--min-behind`/`propagation.
+    min_releases_behind` threshold (`RollPending.min_releases_behind`) — so
+    whatever eventually discharges it (`coord release nightly-window`'s
+    belt-and-braces `coord release propagate` call, or the drive-queue
+    tick's spawned `coord-release-window.service`) is gated at the SAME
+    threshold that armed it, not a threshold re-resolved from scratch."""
+    monkeypatch.setattr(
+        release_cmd, "_fetch_board",
+        lambda: ({"assignments": [{"machine_name": "server", "issue_number": 9,
+                                   "status": "RUNNING"}]}, None),
+    )
+    monkeypatch.setattr(
+        release_cmd, "_releases_behind_count", lambda *a, **k: (7, None),
+    )
+    _stub_verify(monkeypatch, versions={"laptop": ["0.4.110"], "server": ["0.4.110"]},
+                 daemon="server")
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(valid_config_path),
+         "--target", "0.4.111", "--min-behind", "5"],
+    )
+    assert result.exit_code == 0, result.output
+    pending = dq_cmd.read_roll_pending()
+    assert pending is not None
+    assert pending.min_releases_behind == 5
+
+
 def test_a_busy_daemon_dry_run_defers_without_writing_the_marker(
     valid_config_path, state_dir, no_network, monkeypatch
 ):

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/tests/test_cli_release_window.py

@@ -426,6 +426,59 @@ def test_a_marker_pending_for_the_same_target_is_fired_and_cleared_on_success(
     assert not escalations
 
 
+def test_a_marker_pending_for_the_same_target_discharges_at_its_own_arm_threshold(
+    valid_config_path, state_dir, no_network, escalations, monkeypatch
+):
+    """#2870: the belt-and-braces `coord release propagate` call this
+    command makes for an existing marker must be gated at the threshold the
+    marker was ARMED at (`RollPending.min_releases_behind`), never at
+    whatever `propagation.min_releases_behind` (or this run's OWN
+    `--min-behind`) happens to resolve to. Before #2870 this kwarg was never
+    passed at all, so a marker armed via `--min-behind 1` against a fleet
+    configured `min_releases_behind: 5` could never discharge — every
+    belt-and-braces attempt (and every tick-fired `coord-release-window.
+    service` re-entry) re-resolved the fleet default and held forever."""
+    _stub_verify(monkeypatch, daemon_version="0.5.30")
+    prop_calls = _stub_propagate(monkeypatch, status=rp.STATUS_VERIFIED, exit_code=0)
+    # Armed at threshold 7 (e.g. by a prior `--min-behind 7` run) — a value
+    # deliberately unreachable by THIS run's own resolution (no `--min-behind`
+    # / no `propagation:` block here, so it defaults to 1), proving the
+    # marker's own threshold is what's threaded through, not this run's.
+    dq_cmd.write_roll_pending(_pending(target_version="0.5.31", min_releases_behind=7))
+
+    result = CliRunner().invoke(
+        main,
+        ["release", "nightly-window", "--config", str(valid_config_path),
+         "--target", "0.5.31", "--daemon-host", "server"],
+    )
+    assert result.exit_code == 0, result.output
+    assert len(prop_calls) == 1
+    assert prop_calls[0]["min_behind"] == 7  # the marker's own arm threshold, not 1
+
+
+def test_a_marker_with_no_recorded_threshold_falls_back_to_this_runs_own(
+    valid_config_path, state_dir, no_network, escalations, monkeypatch
+):
+    """A marker written before #2870 (or whose arming run never evaluated
+    the #2583 gate at all) carries no `min_releases_behind` — the discharge
+    call falls back to THIS run's own effective threshold, exactly the
+    pre-#2870 behaviour, rather than guessing or omitting the flag."""
+    _stub_verify(monkeypatch, daemon_version="0.5.30")
+    prop_calls = _stub_propagate(monkeypatch, status=rp.STATUS_VERIFIED, exit_code=0)
+    dq_cmd.write_roll_pending(_pending(target_version="0.5.31", min_releases_behind=None))
+
+    result = CliRunner().invoke(
+        main,
+        ["release", "nightly-window", "--config", str(valid_config_path),
+         "--target", "0.5.31", "--daemon-host", "server"],
+    )
+    assert result.exit_code == 0, result.output
+    assert len(prop_calls) == 1
+    # No `--min-behind` and no `propagation:` block on THIS run -> defaults
+    # to 1, exactly as `_resolve_min_behind` always has.
+    assert prop_calls[0]["min_behind"] == 1
+
+
 def test_a_marker_pending_for_the_same_target_up_to_date_race_clears_it_too(
     valid_config_path, state_dir, no_network, monkeypatch
 ):

{code_coordinator-0.5.268 → code_coordinator-0.5.269}/tests/test_release_propagate_threshold.py

@@ -487,3 +487,59 @@ def test_window_at_threshold_sets_the_marker_exactly_as_before(
     assert record["status"] == rw.STATUS_ROLL_PENDING
     assert record["releases_behind"] == 10
     assert record["min_releases_behind"] == 10
+    # #2870: the marker itself carries the threshold it was armed at.
+    assert pending.min_releases_behind == 10
+
+
+def test_2870_a_marker_armed_below_the_fleet_default_still_discharges_at_its_own_threshold(
+    tmp_path, state_dir, no_network, monkeypatch
+):
+    """#2870's own regression test: `nightly-window --min-behind 1` against a
+    fleet configured `min_releases_behind: 5` must not produce a marker that
+    can never clear. Before the fix, the marker carried no threshold at all,
+    so every discharge attempt (this command's own belt-and-braces `coord
+    release propagate` call, and every re-entry the drive-queue tick fires
+    via `coord-release-window.service`) re-resolved the fleet default (5)
+    and held forever at "N behind, threshold 5" — exactly the 2026-08-28
+    incident (`v0.5.259`/`v0.5.260`, held ~40 minutes with two machines
+    idle, `alert: (none)` throughout)."""
+    config_path = tmp_path / "coordinator.yml"
+    config_path.write_text(VALID_CONFIG + "\npropagation:\n  min_releases_behind: 5\n")
+
+    # ── night 1: armed at --min-behind 1, well below the fleet default.
+    _stub_behind(monkeypatch, behind=1)
+    _stub_window_verify(monkeypatch, daemon_version="0.4.100")
+    arm = CliRunner().invoke(
+        main,
+        ["release", "nightly-window", "--config", str(config_path),
+         "--target", "0.4.111", "--daemon-host", "server", "--min-behind", "1"],
+    )
+    assert arm.exit_code == 0, arm.output
+    armed = dq_cmd.read_roll_pending()
+    assert armed is not None
+    assert armed.min_releases_behind == 1  # NOT the fleet default of 5
+
+    # ── night 2 (or the tick's own `coord-release-window.service` re-entry —
+    #    that unit's ExecStart carries the SAME operator-added `--min-behind
+    #    1` every time it runs, exactly like `coord-release-window.service`
+    #    in the issue's own evidence section): same marker, same target.
+    #    Before #2870, the belt-and-braces `coord release propagate` call
+    #    never passed `--min-behind` AT ALL regardless of what this run's own
+    #    gate resolved, so the real subprocess fell back to the fleet default
+    #    (5) and held. After the fix it is gated at the marker's own arm
+    #    threshold (1).
+    prop_calls = _stub_propagate(monkeypatch, status=rp.STATUS_VERIFIED, exit_code=0)
+    fire = CliRunner().invoke(
+        main,
+        ["release", "nightly-window", "--config", str(config_path),
+         "--target", "0.4.111", "--daemon-host", "server", "--min-behind", "1"],
+    )
+    assert fire.exit_code == 0, fire.output
+    assert len(prop_calls) == 1
+    assert prop_calls[0]["min_behind"] == 1, (
+        "the discharge call re-resolved the fleet default instead of the "
+        "marker's own arm threshold — this is the exact #2870 freeze"
+    )
+    # And the marker actually clears — it does not survive the next
+    # propagate the way it did in the incident.
+    assert dq_cmd.read_roll_pending() is None