code-coordinator 0.5.268__tar.gz → 0.5.270__tar.gz

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.268
+Version: 0.5.270
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.268
+Version: 0.5.270
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/code_coordinator.egg-info/SOURCES.txt

@@ -714,6 +714,7 @@ tests/test_split.py
 tests/test_split_work.py
 tests/test_sql_dialect.py
 tests/test_stage_projection.py
+tests/test_stale_busy_reviewer_697.py
 tests/test_stalled_pipeline.py
 tests/test_state.py
 tests/test_state_review_findings_daemon.py

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/code_coordinator.egg-info/scm_file_list.json

@@ -786,6 +786,7 @@
     "tests/test_split_work.py",
     "tests/test_sql_dialect.py",
     "tests/test_stage_projection.py",
+    "tests/test_stale_busy_reviewer_697.py",
     "tests/test_stalled_pipeline.py",
     "tests/test_state.py",
     "tests/test_state_review_findings_daemon.py",

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.268",
+  "tag": "0.5.270",
   "distance": 0,
-  "node": "gf1fb3361f55813adaa28edcc31c2b9a1b6a20836",
+  "node": "g03d05893c4dd0a33802455a4bac412f730e4f018",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-28"

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/coord/commands/drive_queue.py

@@ -2587,6 +2587,68 @@ def clear_roll_pending() -> None:
         pass
 
 
+def _roll_pending_may_fire(*, occupied: int, now: float, queue_rows) -> tuple[bool, str]:
+    """Is it worth attempting to fire a pending roll THIS tick? (#2870 part 2)
+
+    #2587's original rule was ``occupied == 0`` — this tick's own
+    reconciliation (`_reconcile_running`'s ``occupies`` verdict) found
+    literally nothing left running. That rule never learned #2854: `coord
+    release propagate`'s own quiescence check
+    (:func:`coord.release_propagate.assess_quiescence`) treats a `running`
+    drive-queue row with no LIVE assignment right now, past its settle
+    window, as genuinely idle — the row just hasn't reached a terminal state
+    yet (nothing has reconciled it to ``done``). This tick's own ``occupied``
+    count has no such reading: a between-legs row launched on a different
+    host reads ``unknown`` here (#1870 — this tick's local tmux check proves
+    nothing about a row launched elsewhere) and stays charged, forever,
+    against an ``occupied == 0`` bar it can never clear. The 2026-08-28
+    incident this closes: `coord release propagate`, run directly, reported
+    ``quiescent — nothing in flight`` (between-legs, past the settle window)
+    for the SAME row this tick's own ``occupied`` reading was still counting
+    — so the tick never even ATTEMPTED the roll `coord release propagate`
+    would have accepted.
+
+    ``occupied == 0`` stays the cheap fast path — no extra board read. Only
+    when it is nonzero does this re-derive the SAME between-legs/settle-
+    window reading `coord release propagate` itself makes, from a fresh
+    board fetch. This is an ADVISORY re-check, not the authoritative one:
+    firing merely hands off to `coord-release-window.service`, which invokes
+    `coord release propagate` for real (never `--force`) and simply defers
+    again — costing nothing — if this read turns out to have been too
+    optimistic. So there is no harm in checking, and every reason to: the
+    alternative is a marker that can sit past its own between-legs row
+    forever with `coord drive-queue status` reporting `alert: (none)` the
+    whole time, because from the queue's own point of view nothing is wrong
+    — it is waiting on a roll, exactly as designed.
+
+    *queue_rows* are the SAME raw `drive_queue` rows this tick already read
+    (`coord.state.list_drive_queue()`) — reused rather than re-fetched, and
+    passed straight through as `assess_quiescence`'s ``queue_entries``: that
+    function reads the raw ``state``/``repo_name``/``issue_number`` columns,
+    not `QueueEntry` or `BoardView`'s reduced shapes.
+
+    A board this cannot read degrades to "no, don't fire" (never raises) —
+    the tick's own fail-closed abort already covers a board it cannot read
+    for reconciliation; a re-check that itself cannot read the board must
+    not provoke a fire it cannot justify.
+    """
+    if occupied == 0:
+        return True, ""
+    from coord import release_propagate as rp  # noqa: PLC0415
+
+    try:
+        payload = _fetch_board_payload()
+    except Exception:  # noqa: BLE001 — see docstring: fail closed, never raise
+        return False, ""
+    quiescence = rp.assess_quiescence(
+        queue_entries=queue_rows,
+        assignments=payload.get("assignments") or [],
+        issues=payload.get("issues") or [],
+        now=now,
+    )
+    return quiescence.quiescent, quiescence.reason
+
+
 def _fire_pending_roll(*, dry_run: bool = False) -> tuple[bool, str]:
     """Best-effort ``systemctl --user start --no-block
     coord-release-window.service`` (#2587 design point 3).
@@ -2954,16 +3016,22 @@ def _escalate_persistent_self_cordon(
     _write_self_cordon_state(state)
 
 
-def _fetch_board_view() -> BoardView:
-    """Board + live drive sessions, typed.
+def _fetch_board_payload() -> dict:
+    """The raw ``/board`` payload (+ standalone top-ups), untyped.
 
-    Raises whatever the fetch raised — the caller turns that into a fail-closed
-    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
-    tick: it returns ``[]`` when tmux is unavailable, and the board's
-    ``active_work`` signal still holds the capacity line in that case.
+    Split out of :func:`_fetch_board_view` (#2870) so a caller that needs the
+    RAW ``assignments``/``issues`` rows — not `BoardView`'s already-reduced
+    per-issue facts — has one place to get them. :func:`coord.
+    release_propagate.assess_quiescence` is exactly such a caller (#2870's
+    between-legs settle-window re-check for the roll-pending fire condition,
+    see :func:`_roll_pending_may_fire`): it reads raw assignment rows
+    (``machine_name``/``dispatched_at``/``finished_at``) `BoardView` never
+    carries at all.
+
+    Raises whatever the fetch raised — same fail-closed contract as before
+    this split.
     """
     from coord.board_service import resolve as resolve_board_service  # noqa: PLC0415
-    from coord.drive import list_drive_sessions  # noqa: PLC0415
     from coord.drive_state import BoardFetcher  # noqa: PLC0415
 
     payload = BoardFetcher().fetch()
@@ -2986,6 +3054,20 @@ def _fetch_board_view() -> BoardView:
             top_up["merge_queue"] = _local_merge_queue_rows()
         if top_up:
             payload = {**payload, **top_up}
+    return payload
+
+
+def _fetch_board_view() -> BoardView:
+    """Board + live drive sessions, typed.
+
+    Raises whatever the fetch raised — the caller turns that into a fail-closed
+    abort.  ``list_drive_sessions()`` is deliberately NOT allowed to fail the
+    tick: it returns ``[]`` when tmux is unavailable, and the board's
+    ``active_work`` signal still holds the capacity line in that case.
+    """
+    from coord.drive import list_drive_sessions  # noqa: PLC0415
+
+    payload = _fetch_board_payload()
     return build_board_view(payload, list_drive_sessions())
 
 
@@ -4382,7 +4464,12 @@ def drive_queue_tick(
                 f"could not read the board — aborting without launching anything: {exc}"
             ) from None
 
-        entries = entries_from_rows(list_drive_queue())
+        # #2870: the raw rows are kept alongside the typed `entries` — see
+        # `_roll_pending_may_fire`'s `queue_rows` parameter, which needs the
+        # untyped `state`/`repo_name`/`issue_number` shape
+        # `coord.release_propagate.assess_quiescence` reads, not `QueueEntry`.
+        raw_queue_rows = list_drive_queue()
+        entries = entries_from_rows(raw_queue_rows)
 
         # #2587: is a fleet roll queued for the next inter-drive gap? Read
         # BEFORE `effective_capacity` is resolved — a live, unexpired marker
@@ -4563,7 +4650,24 @@ def drive_queue_tick(
         # `--dry-run`'s "mutate nothing" contract for every other write in
         # this function.
         if roll_pending is not None:
-            if plan.occupied == 0:
+            # #2870: `plan.occupied == 0` alone is the pre-#2854 reading —
+            # a between-legs row with no live assignment right now, past
+            # its settle window, can sit `occupied` here (e.g. #1870's
+            # `unknown` verdict for a row launched on another host)
+            # forever, even though `coord release propagate` itself would
+            # already call the fleet quiescent for that exact row. See
+            # `_roll_pending_may_fire`'s own docstring for the full
+            # mechanism and the incident this closes.
+            fire_ready, fire_note = _roll_pending_may_fire(
+                occupied=plan.occupied, now=now, queue_rows=raw_queue_rows
+            )
+            if fire_ready:
+                if plan.occupied and fire_note:
+                    click.echo(
+                        f"(queue still shows {plan.occupied} occupying a slot, "
+                        f"but #2854's settle-window reading calls it quiescent — "
+                        f"{fire_note} — attempting the roll anyway)"
+                    )
                 fired, detail = _fire_pending_roll()
                 if fired:
                     # #2587 review: this must NOT clear the marker. `fired`

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/coord/commands/release.py

@@ -654,11 +654,24 @@ def _lane_versions_by_host(report) -> dict[str, list[str | None]]:
 
 
 def _ensure_roll_pending_marker(
-    target_version: str, *, reason: str, dry_run: bool = False
+    target_version: str, *, reason: str, min_releases_behind: int | None = None,
+    dry_run: bool = False,
 ) -> None:
     """#2587: make sure a roll-pending marker exists for *target_version*,
     without resetting an already-live one's clock.
 
+    #2870: *min_releases_behind* is the effective `propagation.
+    min_releases_behind`/`--min-behind` threshold THIS run resolved and
+    already gated on before reaching this call (see the #2583 gate just
+    above this function's one call site) — stamped onto the marker
+    (`RollPending.min_releases_behind`) so whatever eventually discharges it
+    (`coord.commands.release._run_propagate`, threaded a matching
+    `--min-behind`) is gated at the SAME threshold this arm used, not
+    whatever threshold ITS OWN invocation happens to resolve. Like
+    `target_version`/`reason`, this is updated on every re-arm (a re-arm is
+    a fresh decision about what SHOULD roll and at what threshold) — only
+    `set_at`/`deferrals` stay frozen (see below).
+
     #2869: ``dry_run=True`` is the ONE seam every call site must go through —
     it never touches disk, only echoing what it *would* have written, in the
     same "would ..." register as ``_fire_pending_roll``'s and
@@ -712,7 +725,10 @@ def _ensure_roll_pending_marker(
             )
             return
         write_roll_pending(
-            _dataclasses.replace(existing, target_version=target_version, reason=reason)
+            _dataclasses.replace(
+                existing, target_version=target_version, reason=reason,
+                min_releases_behind=min_releases_behind,
+            )
         )
         return
     if dry_run:
@@ -723,7 +739,10 @@ def _ensure_roll_pending_marker(
         )
         return
     write_roll_pending(
-        RollPending(target_version=target_version, set_at=_time.time(), reason=reason)
+        RollPending(
+            target_version=target_version, set_at=_time.time(), reason=reason,
+            min_releases_behind=min_releases_behind,
+        )
     )
 
 
@@ -1123,7 +1142,14 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         # too, so a plain periodic `coord-release-propagate.timer` run also
         # arms the drive-queue tick's own inter-drive-gap trigger instead of
         # requiring an operator to separately reach for `nightly-window`.
-        _ensure_roll_pending_marker(record.target_version, reason="propagate", dry_run=dry_run)
+        # #2870: stamp THIS run's own already-passed `effective_min_behind`
+        # (resolved above, 3a) onto the marker, so whatever discharges it is
+        # gated at the threshold that armed it, not a threshold re-resolved
+        # from scratch later.
+        _ensure_roll_pending_marker(
+            record.target_version, reason="propagate",
+            min_releases_behind=effective_min_behind, dry_run=dry_run,
+        )
         _finish(rp.STATUS_DEFERRED, 0)
 
     still_busy = busy_hosts - set(current)
@@ -2846,7 +2872,7 @@ def _latest_propagate_record_since(state_dir: Path, since: float) -> dict | None
 
 def _run_propagate(
     *, daemon_host: str, target_version: str, config_path: Path, state_dir: Path,
-    runner=None, now_fn=None,
+    min_behind: int | None = None, runner=None, now_fn=None,
 ) -> tuple[str, int, str, float | None]:
     """``coord release propagate --daemon-host ... --target ... --json``.
 
@@ -2858,6 +2884,20 @@ def _run_propagate(
     run decided was needed is the version that actually rolls, even if a new
     release lands on PyPI mid-drain.
 
+    #2870: *min_behind*, when given, is passed through as `--min-behind` —
+    the threshold the roll-pending marker being discharged here was ARMED
+    at (`RollPending.min_releases_behind`), NOT this process's own
+    `propagation.min_releases_behind`. Before this, this call never passed
+    `--min-behind` at all, so `coord release propagate` always re-resolved
+    ITS OWN threshold from `coordinator.yml` — a marker armed below the
+    fleet default (e.g. `coord release nightly-window --min-behind 1`
+    against a fleet configured `min_releases_behind: 5`) could never reach
+    the threshold ITS discharge required and held forever, `alert: (none)`
+    the whole time. ``None`` (an old marker with no recorded threshold, or
+    one whose arming run never evaluated the gate) omits the flag, matching
+    the pre-#2870 behaviour — this process resolves its own default exactly
+    as it always did.
+
     Returns ``(status, exit_code, combined_output, propagate_started_at)``.
     ``status`` is read from the propagation journal entry that run itself
     wrote (:func:`_latest_propagate_record_since`) — the same ground truth
@@ -2883,6 +2923,8 @@ def _run_propagate(
         "--daemon-host", daemon_host, "--target", target_version,
         "--json", "--config", str(config_path),
     ]
+    if min_behind is not None:
+        argv.extend(["--min-behind", str(min_behind)])
     try:
         proc = run(argv, capture_output=True, text=True, timeout=1800)
     except Exception as exc:  # noqa: BLE001
@@ -3224,9 +3266,24 @@ def release_nightly_window(
         # attempt, safe to make redundantly since `coord release propagate`
         # never carries `--force` here (trap 1) and simply defers again if
         # the fleet is still busy.
+        # #2870: gate the discharge at the threshold the marker was ARMED
+        # at (`existing.min_releases_behind`), not whatever `coord release
+        # propagate` would re-resolve on its own — that mismatch is exactly
+        # how a marker armed via `--min-behind 1` froze the queue against a
+        # fleet configured `min_releases_behind: 5`, forever holding at "3
+        # behind, threshold 5" no matter how many times this fired. A
+        # marker with no recorded threshold (written before this field
+        # existed, or whose arming run never evaluated the gate at all)
+        # falls back to THIS run's own `effective_min_behind` — the same
+        # value it would have used before #2870.
         prop_status, prop_exit, prop_output, prop_started_at = _run_propagate(
             daemon_host=daemon_name, target_version=existing.target_version,
             config_path=config_path, state_dir=state_dir,
+            min_behind=(
+                existing.min_releases_behind
+                if existing.min_releases_behind is not None
+                else effective_min_behind
+            ),
         )
         record.propagate_status = prop_status
         record.propagate_exit_code = prop_exit
@@ -3303,6 +3360,13 @@ def release_nightly_window(
     # re-arm — the queue froze because the bound that was supposed to save it
     # could never be reached. Only a genuinely fresh marker (no existing one
     # at all) gets a new clock.
+    # #2870: every write below stamps `effective_min_behind` — THIS run's
+    # own already-resolved threshold (section 2b above) — onto the marker,
+    # so `_run_propagate`'s belt-and-braces call above (and any future
+    # discharge) is gated at the SAME threshold that armed it, not whatever
+    # `coord release propagate` would re-resolve on its own later. Updated
+    # on every re-arm, same as `target_version`/`reason` just below — only
+    # `set_at`/`deferrals` are the frozen "clock" #2607 protects.
     if existing is not None:
         click.echo(
             f"replacing stale roll-pending marker ({existing.describe()}) "
@@ -3313,6 +3377,7 @@ def release_nightly_window(
         write_roll_pending(
             _dataclasses.replace(
                 existing, target_version=record.target_version, reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     else:
@@ -3321,6 +3386,7 @@ def release_nightly_window(
                 target_version=record.target_version,
                 set_at=time.time(),
                 reason="nightly-window",
+                min_releases_behind=effective_min_behind,
             )
         )
     click.echo(

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/coord/drive_queue.py

@@ -1561,6 +1561,26 @@ class RollPending:
     #: fleet still busy — bumped by the shell each tick it does NOT fire the
     #: roll. Never bumped by `plan_tick` itself (pure; no counting state).
     deferrals: int = 0
+    #: #2870: the ``propagation.min_releases_behind``/``--min-behind``
+    #: threshold this marker was ARMED at — `coord release nightly-window`/
+    #: `coord.commands.release._ensure_roll_pending_marker` stamp the
+    #: effective threshold THEIR OWN run resolved (override, else
+    #: `coordinator.yml`, else 1) at the moment they write this marker.
+    #: Before #2870, discharge (`_run_propagate`'s `coord release propagate`
+    #: subprocess) always re-resolved its OWN threshold from scratch — the
+    #: fleet default, never whatever `--min-behind` armed this marker at —
+    #: so a marker armed below the fleet default (e.g. a
+    #: `coord-release-window.service` ExecStart carrying `--min-behind 1`
+    #: against a fleet configured `min_releases_behind: 5`) could never
+    #: reach the threshold its own discharge path required and froze the
+    #: queue forever. Carried through to `_run_propagate` as `--min-behind`
+    #: so discharge is gated at the SAME threshold arm used. `None` for a
+    #: marker written before this field existed (`from_dict`'s tolerant
+    #: parse) or one whose arming run never evaluated the gate at all
+    #: (`effective_min_behind <= 1`) — the discharge call then falls back to
+    #: ITS OWN effective threshold, matching the pre-#2870 behaviour rather
+    #: than guessing.
+    min_releases_behind: int | None = None
 
     def expired(self, now: float) -> bool:
         """Has this marker outlived ITS OWN bound — TTL or deferral ceiling?
@@ -1589,6 +1609,7 @@ class RollPending:
             "ttl_seconds": self.ttl_seconds,
             "max_deferrals": self.max_deferrals,
             "deferrals": self.deferrals,
+            "min_releases_behind": self.min_releases_behind,
         }
 
     @classmethod
@@ -1615,6 +1636,7 @@ class RollPending:
                 data.get("max_deferrals"), ROLL_PENDING_DEFAULT_MAX_DEFERRALS
             ),
             deferrals=_as_int_default(data.get("deferrals"), 0),
+            min_releases_behind=_as_optional_int(data.get("min_releases_behind")),
         )
 
 
@@ -1632,6 +1654,21 @@ def _as_int_default(value: Any, default: int) -> int:
         return default
 
 
+def _as_optional_int(value: Any) -> int | None:
+    """Tolerant parse for a field that is legitimately absent (``None``),
+    unlike :func:`_as_int_default`'s fields which always have a real
+    fallback — see `RollPending.min_releases_behind`'s own docstring for why
+    "not recorded" must stay `None` rather than silently becoming some
+    default int a caller could mistake for a real threshold.
+    """
+    if value is None:
+        return None
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
 @dataclass(frozen=True)
 class TickPlan:
     """Everything one tick decided, and nothing it has done yet."""

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/coord/review.py

@@ -1090,6 +1090,104 @@ class ReviewerChoice:
     rationale: str
 
 
+# #697: how far past a row's OWN needs-attention threshold a `pending`/
+# `running` row must sit before reviewer selection stops counting its machine
+# as busy.  One hour of margin on top of a threshold that is itself measured
+# in tens of minutes: comfortably longer than any reap path needs
+# (`coord.reconcile._reconcile_no_agent_record` on the daemon's 30s tick,
+# `coord.diagnose.sweep_dead_running_rows` on `coord-notify.timer`'s 5min
+# cadence), so a row still counted busy here is one every reaper has already
+# had many chances at.
+STALE_BUSY_BUFFER_SECONDS = 3600.0
+
+# The same horizon for rows whose type has NO wall-clock threshold at all —
+# `PipelineConfig.attention_threshold_for` returns `inf` for the attended
+# chat/troubleshoot/audit family (#1133).  Those are exactly the rows #697
+# observed at 51h and 70h, so "never expires" is not an option here; a flat,
+# deliberately generous day is.  A human really attending a chat session for
+# a full day is far rarer than a tmux session that died without being reaped.
+STALE_BUSY_INTERACTIVE_SECONDS = 24 * 3600.0
+
+
+def _is_stale_busy_row(a: Assignment, config: Config, now: float) -> bool:
+    """True when *a* is too old to still be believed as occupying its machine (#697).
+
+    Reviewer selection's ``busy`` set used to count **every** ``pending``/
+    ``running`` board row, which is how a zombie row broke dispatch in #697:
+    rows whose worker had been dead for hours-to-days kept inflating the set,
+    so real machines looked occupied and selection was pushed onto whatever
+    candidate happened to look "free" — on #669 that was an *offline* machine,
+    and the review could not be dispatched at all.
+
+    This is deliberately **not** a liveness probe, and deliberately **not** a
+    reap.  The reapers (``coord.reconcile._reconcile_no_agent_record``,
+    ``coord.interactive.reap_stale_interactive_sessions``,
+    ``coord.diagnose.sweep_dead_running_rows``) own the "is it actually dead?"
+    question, they answer it with a positive disproof or a real tmux/agent
+    probe, and they are the only things allowed to write a terminal status.
+    Guessing from age alone would be #1870's mistake if it gated a *write*.
+
+    Here it gates only a *ranking*, where being wrong is cheap and
+    self-correcting in both directions:
+
+    * Wrong about a genuinely-live row → its machine is ranked as idle and may
+      receive the review.  That is the SAME outcome fallback 1
+      ("different machine, currently busy — review will queue") already
+      produces on a one-other-machine fleet, and a genuinely-saturated agent
+      answers with a rejection that ``_ranked_reviewer_candidates`` already
+      falls through on (#904).
+    * Wrong about a dead row (age not yet reached) → status quo ante: the
+      machine stays "busy" and merely ranks lower.
+
+    A row with no ``dispatched_at`` is never stale — there is nothing to
+    compute an age from, and this path never guesses, mirroring
+    ``sweep_dead_running_rows``.
+    """
+    dispatched_at = getattr(a, "dispatched_at", None)
+    if not dispatched_at:
+        return False
+    try:
+        dispatched = float(dispatched_at)
+    except (TypeError, ValueError):
+        return False
+
+    threshold = config.pipeline.attention_threshold_for(
+        a.type or "work",
+        provider_name=a.provider_name,
+        review_of_assignment_id=a.review_of_assignment_id,
+    )
+    if threshold == float("inf"):
+        horizon = STALE_BUSY_INTERACTIVE_SECONDS
+    else:
+        horizon = threshold + STALE_BUSY_BUFFER_SECONDS
+    return (now - dispatched) > horizon
+
+
+def busy_machine_names(
+    board: Board,
+    config: Config,
+    *,
+    now: float | None = None,
+) -> set[str]:
+    """Machines with at least one *believable* in-flight row (#697).
+
+    The shared ``busy`` set for :func:`pick_reviewer_machine` and
+    :func:`_ranked_reviewer_candidates` — a ``pending``/``running`` row whose
+    age is past :func:`_is_stale_busy_row`'s horizon is presumed dead and no
+    longer holds its machine down.  See that function for why an age-only
+    heuristic is the right instrument *for a ranking* and the wrong one for a
+    reap.
+    """
+    if now is None:
+        now = time.time()
+    return {
+        a.machine_name
+        for a in board.active
+        if a.status in ("pending", "running")
+        and not _is_stale_busy_row(a, config, now)
+    }
+
+
 def pick_reviewer_machine(
     worker_machine_name: str,
     repo_name: str,
@@ -1111,6 +1209,11 @@ def pick_reviewer_machine(
     cordon blocked the review, the unreviewable entry stayed `running`, the
     running entry deferred the roll, and the deferred roll left the cordon
     up. Explicit pauses and quiet hours still apply.
+
+    #697: the ``busy`` set is :func:`busy_machine_names`, which drops
+    ``pending``/``running`` rows too old to still be believed — a zombie row
+    used to make a real machine look occupied indefinitely and push selection
+    onto an offline "free" candidate.
     """
     from coord.machine_pause import follow_on_paused_set
     paused = follow_on_paused_set(config.machines)
@@ -1121,7 +1224,7 @@ def pick_reviewer_machine(
     if not candidates:
         return None
 
-    busy = {a.machine_name for a in board.active if a.status in ("pending", "running")}
+    busy = busy_machine_names(board, config)
 
     different = [
         m for m in candidates
@@ -1191,6 +1294,9 @@ def _ranked_reviewer_candidates(
     literal "no eligible reviewer machine configured for repo
     'claude-coordinator'" that a cordoned fleet answered every review
     dispatch with for 70 minutes.
+
+    #697: shares :func:`busy_machine_names` with ``pick_reviewer_machine``, so
+    tier 1 vs tier 2 here is decided on *believable* in-flight rows only.
     """
     from coord.machine_pause import follow_on_paused_set  # noqa: PLC0415
 
@@ -1202,7 +1308,7 @@ def _ranked_reviewer_candidates(
     if not candidates:
         return []
 
-    busy = {a.machine_name for a in board.active if a.status in ("pending", "running")}
+    busy = busy_machine_names(board, config)
 
     result: list[tuple[Machine, bool]] = []
     for m in candidates:

{code_coordinator-0.5.268 → code_coordinator-0.5.270}/tests/test_cli_release_propagate.py

@@ -459,6 +459,37 @@ def test_a_busy_daemon_host_defers_the_whole_run(
     assert pending.reason == "propagate"
 
 
+def test_a_busy_daemon_deferral_stamps_this_runs_own_threshold_onto_the_marker(
+    valid_config_path, state_dir, no_network, monkeypatch
+):
+    """#2870: the marker `_ensure_roll_pending_marker` arms here must carry
+    THIS run's own already-passed `--min-behind`/`propagation.
+    min_releases_behind` threshold (`RollPending.min_releases_behind`) — so
+    whatever eventually discharges it (`coord release nightly-window`'s
+    belt-and-braces `coord release propagate` call, or the drive-queue
+    tick's spawned `coord-release-window.service`) is gated at the SAME
+    threshold that armed it, not a threshold re-resolved from scratch."""
+    monkeypatch.setattr(
+        release_cmd, "_fetch_board",
+        lambda: ({"assignments": [{"machine_name": "server", "issue_number": 9,
+                                   "status": "RUNNING"}]}, None),
+    )
+    monkeypatch.setattr(
+        release_cmd, "_releases_behind_count", lambda *a, **k: (7, None),
+    )
+    _stub_verify(monkeypatch, versions={"laptop": ["0.4.110"], "server": ["0.4.110"]},
+                 daemon="server")
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(valid_config_path),
+         "--target", "0.4.111", "--min-behind", "5"],
+    )
+    assert result.exit_code == 0, result.output
+    pending = dq_cmd.read_roll_pending()
+    assert pending is not None
+    assert pending.min_releases_behind == 5
+
+
 def test_a_busy_daemon_dry_run_defers_without_writing_the_marker(
     valid_config_path, state_dir, no_network, monkeypatch
 ):