code-coordinator 0.5.310__tar.gz → 0.5.312__tar.gz

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.310
+Version: 0.5.312
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.310
+Version: 0.5.312
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

code_coordinator-0.5.312/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.312",
+  "distance": 0,
+  "node": "g809179d4ae62704f319b523abbe2d69427d5a406",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-31"
+}

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/commands/lifecycle.py

@@ -24,7 +24,13 @@ def _print_housekeeping_result(resp: dict) -> None:
     archived_a = resp.get("archived_assignments", 0)
     archived_n = resp.get("archived_notifications", 0)
     days = resp.get("retention_days")
-    if not archived_a and not archived_n:
+    # #2974: the confirm-worktree sweep runs on its own age window,
+    # independent of `retention_days` above, and must be reported even when
+    # there was nothing terminal to archive — that used to be the ONLY thing
+    # this sweep did, so a run that only reclaimed leaked worktrees must not
+    # print "nothing to archive" and hide it.
+    removed_wt = resp.get("removed_confirm_worktrees", 0)
+    if not archived_a and not archived_n and not removed_wt:
         click.echo(
             f"housekeeping: nothing to archive (no terminal rows older than {days}d)."
         )
@@ -35,6 +41,12 @@ def _print_housekeeping_result(resp: dict) -> None:
         f"housekeeping: {verb} {archived_a} assignment(s) + "
         f"{archived_n} notification(s) (terminal, older than {days}d).{suffix}"
     )
+    if removed_wt:
+        wt_verb = "would remove" if dry else "removed"
+        click.echo(
+            f"housekeeping: {wt_verb} {removed_wt} stale confirm-worktree(s) "
+            "(#2974)."
+        )
 
 
 @click.command(

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/confirm_test.py

@@ -104,6 +104,7 @@ existed.
 from __future__ import annotations
 
 import os
+import shutil
 import subprocess
 import threading
 import time
@@ -484,6 +485,106 @@ def confirm_lock_path(repo_name: str, branch: str) -> Path:
     return COORD_DIR / "confirm-worktrees" / f"{safe}.lock"
 
 
+#: #2974: default age (hours) a directory under ``confirm-worktrees/`` may sit
+#: unremoved before :func:`sweep_stale_confirm_worktrees` reclaims it outright.
+#: Every entry under that root is throwaway by construction (#561) and
+#: `confirm_branch`'s own `finally` now removes its worktree on every exit —
+#: so anything still here this long survived something worse than an ordinary
+#: failure (a hard kill of the whole process, `coord-agent`/`coord-serve`
+#: restarting mid-run before #2974's `finally` fix ever ran, a full disk
+#: mid-cleanup). Generous relative to :data:`CONFIRM_DEFAULT_TIMEOUT_SECONDS`
+#: (20 min) so this never races a confirmation that is still legitimately
+#: in flight.
+#:
+#: Footgun to remember if either ceiling ever moves: the margin here is
+#: relative, not enforced. `sweep_stale_confirm_worktrees` doesn't know
+#: whether a given `confirm-worktrees/<repo>-<branch>` entry has a
+#: `confirm_branch` call still running against it — it reclaims purely on
+#: directory mtime. If `CONFIRM_DEFAULT_TIMEOUT_SECONDS` (or a future
+#: per-repo override of it) is ever raised to within a few hours of this
+#: constant, a still-in-flight confirmation's worktree (and its `.lock`
+#: file) could be `rmtree`'d out from under it by this sweep. Keep this
+#: comfortably above whatever the longest configured confirmation timeout
+#: is, not just the current default.
+STALE_WORKTREE_MAX_AGE_HOURS = 6.0
+
+
+def sweep_stale_confirm_worktrees(
+    *,
+    max_age_hours: float = STALE_WORKTREE_MAX_AGE_HOURS,
+    dry_run: bool = False,
+    now: float | None = None,
+) -> dict:
+    """Reclaim ``confirm-worktrees/`` entries older than *max_age_hours* (#2974).
+
+    Belt-and-suspenders over the `finally`-based cleanup in
+    :func:`confirm_branch`: that fix stops the leak going forward, but does
+    nothing about the hundreds of directories (189G measured on one host,
+    #2974) a build that never reaches this fix — or any future bug in the
+    cleanup path itself — can still leave behind. This sweep is the backstop
+    that ages them out regardless of cause.
+
+    Deliberately filesystem-only: it reclaims disk with a plain
+    ``shutil.rmtree`` keyed on directory mtime, and does **not** attempt a
+    ``git worktree prune`` in the originating repo's checkout (that would
+    need to map each ``<repo>-<branch>`` directory name back to a configured
+    repo, which is ambiguous when a repo or branch name itself contains a
+    ``-``). The admin metadata that leaves behind in the base checkout's
+    ``.git/worktrees/`` is a few KB per entry — negligible next to the build
+    trees this reclaims — and self-heals the next time :func:`confirm_branch`
+    or :func:`coord.revalidate.revalidate` runs `git worktree prune` for that
+    repo anyway.
+
+    Called from :func:`coord.housekeeping.sweep`'s existing low-cadence
+    daemon tick and ``coord housekeeping``, so it needs no new wiring or
+    schedule of its own. Returns
+    ``{"removed": [names], "dry_run": bool, "max_age_hours": float}`` —
+    ``removed`` lists what was (or, for ``dry_run``, would be) deleted.
+    Silently a no-op if the directory does not exist yet.
+    """
+    from coord.state import COORD_DIR  # noqa: PLC0415
+
+    root = COORD_DIR / "confirm-worktrees"
+    result: dict = {
+        "removed": [],
+        "dry_run": dry_run,
+        "max_age_hours": max_age_hours,
+    }
+    if not root.exists():
+        return result
+
+    cutoff = (now if now is not None else time.time()) - max_age_hours * 3600.0
+    try:
+        entries = sorted(root.iterdir())
+    except OSError:
+        return result
+
+    for entry in entries:
+        # Lock files (`confirm_lock_path`) are tiny and self-explanatory by
+        # name; only the worktree directories themselves are the disk cost
+        # this sweep exists to reclaim. A stray lock with no matching
+        # worktree directory is harmless — the next `confirm_branch` call for
+        # that (repo, branch) simply re-creates and re-locks it.
+        if entry.name.endswith(".lock") or not entry.is_dir():
+            continue
+        try:
+            mtime = entry.stat().st_mtime
+        except OSError:
+            continue
+        if mtime >= cutoff:
+            continue
+        result["removed"].append(entry.name)
+        if dry_run:
+            continue
+        shutil.rmtree(entry, ignore_errors=True)
+        lock_path = root / f"{entry.name}.lock"
+        try:
+            lock_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+    return result
+
+
 def branch_touched_files(repo_dir: Path, branch: str, base_branch: str) -> list[str]:
     """Paths the branch changes vs its merge-base with *base_branch*.
 
@@ -915,9 +1016,9 @@ def confirm_branch(
                 test_command,
             )
 
-        # Green, and observed rather than reported. Clean up: nothing to
-        # inspect.
-        _remove_worktree(repo_dir, wt_path)
+        # Green, and observed rather than reported. Nothing to inspect —
+        # cleanup happens in `finally` below, same as every other exit from
+        # this block.
         return ConfirmationResult(
             kind=KIND_OK,
             reason=(
@@ -928,6 +1029,31 @@ def confirm_branch(
             returncode=0,
         )
     finally:
+        # #2974: EVERY exit from the block above — including KIND_TIMEOUT
+        # (a hung/slow suite), KIND_SIGNAL (a coord-agent/coord-serve restart
+        # landing mid-run, #2527), and a genuine refutation (KIND_BUILD/
+        # KIND_SUITE) — must remove this worktree, not just the green path.
+        #
+        # `coord.revalidate`'s sibling helper deliberately KEEPS a failed
+        # worktree "for inspection" (see its `_remove_worktree` docstring and
+        # `format_failure`'s "worktree kept for inspection" line) because
+        # `coord merge --revalidate` is opt-in, operator-initiated, and rare —
+        # a human is watching and can go look at the tree it names.
+        # `confirm_branch` is the opposite shape: it runs unattended, on every
+        # PASS claim, inside the automatic reap path, keyed by (repo, branch)
+        # — and a branch is rarely revisited, so nothing was ever going to
+        # remove a "kept for inspection" tree here. That is exactly how this
+        # leaked to 189G / 346 dirs on one host in nine days (#2974): the
+        # biggest trees came from the slowest repos, i.e. precisely the
+        # KIND_TIMEOUT/KIND_SIGNAL runs that used to fall through this
+        # `finally` without cleanup.
+        #
+        # Nothing of diagnostic value is lost: the captured output tail
+        # (`ConfirmationResult.output`) is already persisted to
+        # `test_output/<assignment_id>.txt` by `write_confirmation_output`
+        # regardless of outcome — the worktree itself was never the thing an
+        # operator actually inspected.
+        _remove_worktree(repo_dir, wt_path)
         lock.release()
 
 
@@ -942,6 +1068,7 @@ __all__ = [
     "NOTIFY_BASE_CLIENT_TIMEOUT_SECONDS",
     "PERMISSION_DENIED_EXIT",
     "REFUTING_KINDS",
+    "STALE_WORKTREE_MAX_AGE_HOURS",
     "ConfirmationResult",
     "begin_confirmation_pass",
     "branch_touched_files",
@@ -952,6 +1079,7 @@ __all__ = [
     "confirmation_timeout",
     "notify_client_timeout_seconds",
     "spend_confirmation_budget",
+    "sweep_stale_confirm_worktrees",
     "unmet_confirmation_capabilities",
     "write_confirmation_output",
 ]

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/drive_queue.py

@@ -2302,12 +2302,20 @@ class UnreachableWait:
     evidence a genuine transient wouldn't have, and `last_reason` is
     whatever the last sweep to touch this row recorded — useful context,
     never re-interpreted here.
+
+    `dependents` (#2978) is the count of OTHER queue entries whose `after=`
+    names this one — computed against the full entry set the caller passed
+    to :func:`detect_unreachable_waits`, not just the flagged subset, so it
+    is accurate even though those dependents themselves never appear in the
+    result (see the predicate's own docstring for why). `0` for an entry
+    nothing is chained behind.
     """
 
     key: str
     state: str
     deferrals: int
     last_reason: str
+    dependents: int = 0
 
 
 def detect_unreachable_waits(
@@ -2317,35 +2325,73 @@ def detect_unreachable_waits(
 ) -> list[UnreachableWait]:
     """Entries sitting in the #2944 guaranteed-false wait.
 
-    ``state in (blocked, parked) AND attempts == 0 AND deferrals >
-    min_deferrals`` — see the module comment above this function for why
-    that combination can never resolve itself. Pure and cheap (a predicate
-    over already-loaded rows, no clock, no I/O), so the same function backs
-    both `coord drive-queue status`'s `alert:` line
-    (`coord.commands.drive_queue._queue_alert`) and the `coord doctor` WARN
-    (`coord.health.checks.wedged_drive_queue`) — one definition of "wedged",
-    not two that could drift apart.
-
-    An entry with ``attempts > 0`` is excluded unconditionally, however long
-    it has sat: it WAS dispatched at least once, so it has (or had) a real
-    branch/PR/merge-queue row for a sweep to have a genuine opinion about —
-    that is a legitimate wait, not an unreachable one.
+    Two independent shapes, either of which qualifies a `blocked`/`parked`
+    entry — both provably have no branch/PR/merge-queue row for any sweep to
+    ever form an opinion about, which is the actual invariant this predicate
+    is checking, not "attempts == 0" as a proxy for it (#2978 found the proxy
+    wrong for the second shape):
+
+    * ``attempts == 0`` and ``deferrals > min_deferrals`` — never dispatched
+      at all. The original #2944 shape.
+    * ``attempts > 0``, ``state == blocked``, and the entry's own
+      `last_reason` carries #2273's "no assignment was ever created for this
+      run" marker (:func:`_is_dispatch_failure_reason`) — every dispatch
+      attempt died before `coord assign` produced a board-visible row, and
+      the entry has now exhausted its retry budget (the only way to reach
+      `blocked` with that reason: see `_reconcile_running`'s `exhausted`
+      branch). Exhaustion is its own grace period — there is no next attempt
+      left to wait out — so `min_deferrals` is not applied here.
+
+    A `blocked`/`parked` entry whose `last_reason` is instead one of
+    `_resolve_prereqs`'s unsatisfiable-`after=` verdict shapes
+    (:func:`_is_unsatisfiable_prereq_reason`) is excluded UNCONDITIONALLY,
+    regardless of attempts/deferrals — #2978: that shape is
+    :func:`_reconcile_blocked_after`'s to resolve (#2362, widened #2756),
+    not an operator's, and flagging it here directly contradicts that
+    function's own documented behaviour. This is what keeps a chain's
+    dependents (each blocked with "pre-req X is queued but blocked — it will
+    never satisfy") out of the result entirely, leaving only the root that
+    actually needs a human.
+
+    Pure and cheap (a predicate over already-loaded rows, no clock, no I/O),
+    so the same function backs both `coord drive-queue status`'s `alert:`
+    line (`coord.commands.drive_queue._queue_alert`) and the `coord doctor`
+    WARN (`coord.health.checks.wedged_drive_queue`) — one definition of
+    "wedged", not two that could drift apart.
     """
-    return [
-        UnreachableWait(
-            key=e.key, state=e.state, deferrals=e.deferrals, last_reason=e.last_reason
+    entries = list(entries)
+    dependents_of: dict[str, int] = {}
+    for e in entries:
+        for dep in e.after:
+            dependents_of[dep] = dependents_of.get(dep, 0) + 1
+
+    waits: list[UnreachableWait] = []
+    for e in entries:
+        if e.state not in (STATE_BLOCKED, STATE_PARKED):
+            continue
+        if _is_unsatisfiable_prereq_reason(e.last_reason):
+            continue
+        if e.attempts == 0:
+            if e.deferrals <= min_deferrals:
+                continue
+        elif not (e.state == STATE_BLOCKED and _is_dispatch_failure_reason(e.last_reason)):
+            continue
+        waits.append(
+            UnreachableWait(
+                key=e.key,
+                state=e.state,
+                deferrals=e.deferrals,
+                last_reason=e.last_reason,
+                dependents=dependents_of.get(e.key, 0),
+            )
         )
-        for e in entries
-        if e.state in (STATE_BLOCKED, STATE_PARKED)
-        and e.attempts == 0
-        and e.deferrals > min_deferrals
-    ]
+    return waits
 
 
 def unreachable_wait_alert(waits: Sequence[UnreachableWait]) -> QueueAlert:
     """The queue-level record #2944's predicate raises, in :func:`_hold_alert`'s
-    shape — a message naming the entry (or entries), the deferral count that
-    is the evidence, and the ONE remedy that actually clears it.
+    shape — a message naming the entry (or entries), the evidence that
+    qualified it, and the ONE remedy that actually clears it.
 
     ``add`` alone does not clear ``blocked`` (the queue list already
     documents this as a footgun elsewhere) — only ``remove`` then ``add``
@@ -2357,29 +2403,52 @@ def unreachable_wait_alert(waits: Sequence[UnreachableWait]) -> QueueAlert:
     ``gate_readings``/``details`` lines are printed) so the remedy is visible
     wherever this alert's ``reason`` is, not just to a caller that also reads
     the structured field.
+
+    #2978: each name also carries its `dependents` count when non-zero — the
+    entries chained behind a flagged root never appear in `waits` (see
+    `detect_unreachable_waits`), so without this an operator has no way to
+    know a fix to the one row named here will also resolve N others they
+    never see mentioned. Explicitly says those dependents need no remedy of
+    their own, since #2944's original wording ("for each entry named above")
+    read, on a real incident, as an instruction to `remove`+`add` entries
+    that were never named — but easy to mis-generalize to "the dependents
+    too" by an operator who does not already know #2756 self-heals them.
     """
-    names = ", ".join(
-        f"{w.key} ({w.state}, {w.deferrals} deferrals)" for w in waits[:5]
-    )
+    def _name(w: UnreachableWait) -> str:
+        base = f"{w.key} ({w.state}, {w.deferrals} deferrals)"
+        if w.dependents:
+            plural = "ies" if w.dependents != 1 else "y"
+            base += (
+                f" — {w.dependents} dependent entr{plural} chained behind it "
+                "will self-heal automatically once this clears (#2756), no "
+                "remedy needed on them"
+            )
+        return base
+
+    names = ", ".join(_name(w) for w in waits[:5])
     more = ", ..." if len(waits) > 5 else ""
     plural = len(waits) != 1
     return QueueAlert(
         reason=(
             f"{len(waits)} queue entr{'ies' if plural else 'y'} stuck in a "
-            "guaranteed-false wait — never dispatched (attempts=0) yet "
-            f"blocked/parked past {UNREACHABLE_WAIT_MIN_DEFERRALS} deferrals; "
+            "guaranteed-false wait — blocked/parked with no branch/PR/"
+            "merge-queue row any sweep could ever act on (never dispatched, "
+            "or every dispatch attempt died before creating an assignment); "
             f"no sweep can ever clear this on its own: {names}{more}. Fix: "
             "coord drive-queue remove <repo> <issue> && "
-            "coord drive-queue add <repo> <issue> for each entry named above."
+            "coord drive-queue add <repo> <issue> for each ROOT entry named "
+            "above — never on a dependent chained behind one."
         ),
         details=tuple(
             f"{w.key}: {w.state}, {w.deferrals} deferrals, "
-            f"last_reason={w.last_reason!r}"
+            f"dependents={w.dependents}, last_reason={w.last_reason!r}"
             for w in waits
         ),
         command=(
             "coord drive-queue remove <repo> <issue> && "
-            "coord drive-queue add <repo> <issue> — for each entry named above"
+            "coord drive-queue add <repo> <issue> — for each ROOT entry "
+            "named above; any dependents chained behind it self-heal on "
+            "their own (#2756)"
         ),
     )
 

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/health/checks/wedged_drive_queue.py

@@ -19,6 +19,15 @@ so this check and that line can never say different things) — this probe
 just re-derives it, live, from ``drive_queue`` state every time ``coord
 doctor`` runs, independent of whatever the last tick happened to report.
 
+#2978: the predicate also flags an ``attempts > 0`` entry that exhausted its
+retry budget without ever getting a #2273 dispatch-layer death past `coord
+assign` (same "no branch/PR ever existed" invariant, just reached a
+different way) — and excludes an entry blocked solely on an unsatisfiable
+``after=`` pre-req, since that one is ``_reconcile_blocked_after``'s to
+self-heal (#2362/#2756), not an operator's. See
+``coord.drive_queue.detect_unreachable_waits`` for the exact predicate; this
+probe does not duplicate it, only renders its result.
+
 This is deliberately independent of #2935 (which fixes the specific sweep
 that produced the #2900/#2907 incident) and #2230 (the sweep's origin): both
 are about *why* a row gets wedged this way; this check is about the row
@@ -51,16 +60,19 @@ from coord.health.registry import COST_NETWORK, check
     cost=COST_NETWORK,
     description=(
         "Drive-queue rows in `coord.drive_queue`'s #2944 guaranteed-false "
-        "wait: `blocked`/`parked`, `attempts == 0` (never dispatched — no "
-        "branch, no PR, no merge-queue row ever existed or ever can), "
-        "sitting past a few ticks of grace. Reads via `coord.state."
-        "list_drive_queue`, which — per its own docstring — routes to the "
-        "daemon over HTTP when `board_service` is set (the common case on a "
-        "thin-client fleet machine, see `release_cordon.py`) and only reads "
-        "the local DB directly otherwise; `cost=network` so `--no-network`/"
-        "timer runs and the automatic per-agent health poll skip it exactly "
-        "like the other network-costed checks, same precedent as "
-        "`release_cordon`."
+        "wait: `blocked`/`parked` with no branch/PR/merge-queue row any "
+        "sweep could ever act on — either `attempts == 0` (never dispatched) "
+        "past a few ticks of grace, or `attempts > 0` with an exhausted "
+        "#2273 dispatch-layer death (#2978). Excludes an entry blocked "
+        "solely on an unsatisfiable `after=` pre-req — that one is "
+        "`_reconcile_blocked_after`'s to self-heal (#2756), not an "
+        "operator's. Reads via `coord.state.list_drive_queue`, which — per "
+        "its own docstring — routes to the daemon over HTTP when "
+        "`board_service` is set (the common case on a thin-client fleet "
+        "machine, see `release_cordon.py`) and only reads the local DB "
+        "directly otherwise; `cost=network` so `--no-network`/timer runs "
+        "and the automatic per-agent health poll skip it exactly like the "
+        "other network-costed checks, same precedent as `release_cordon`."
     ),
 )
 def probe_wedged_drive_queue(ctx: HealthContext) -> CheckResult:
@@ -92,7 +104,10 @@ def probe_wedged_drive_queue(ctx: HealthContext) -> CheckResult:
         )
 
     sample = ", ".join(
-        f"{w.key} ({w.state}, {w.deferrals} deferrals)" for w in waits[:5]
+        f"{w.key} ({w.state}, {w.deferrals} deferrals"
+        + (f", {w.dependents} dependents self-heal (#2756)" if w.dependents else "")
+        + ")"
+        for w in waits[:5]
     )
     return CheckResult(
         check_id="wedged_drive_queue",
@@ -104,11 +119,17 @@ def probe_wedged_drive_queue(ctx: HealthContext) -> CheckResult:
         ),
         detail=(
             f"e.g. {sample}" + (", ..." if len(waits) > 5 else "")
-            + " — never dispatched (attempts=0), cannot clear on its own; "
-            "fix: coord drive-queue remove <repo> <issue> && "
-            "coord drive-queue add <repo> <issue>"
+            + " — no branch/PR/merge-queue row any sweep could ever act on "
+            "(never dispatched, or every dispatch attempt died before "
+            "creating an assignment); cannot clear on its own. fix (root "
+            "only — any dependents self-heal, #2756): coord drive-queue "
+            "remove <repo> <issue> && coord drive-queue add <repo> <issue>"
+        ),
+        threshold=(
+            "warn when any entry is blocked/parked with no branch/PR a sweep "
+            "could ever act on: attempts=0 past a few ticks of grace, or "
+            "attempts>0 with an exhausted #2273 dispatch-layer death"
         ),
-        threshold="warn when any entry is blocked/parked, attempts=0, past a few ticks of grace",
         values={
             "count": len(waits),
             "entries": [
@@ -116,6 +137,7 @@ def probe_wedged_drive_queue(ctx: HealthContext) -> CheckResult:
                     "key": w.key,
                     "state": w.state,
                     "deferrals": w.deferrals,
+                    "dependents": w.dependents,
                     "last_reason": w.last_reason,
                 }
                 for w in waits

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/housekeeping.py

@@ -33,6 +33,14 @@ declog. ``coord.merge_queue.merged_issue_keys()`` unions the live table with
 the archive so the "already merged, don't re-enqueue" dedup in
 ``enqueue_approved_work``/``staging_items`` keeps working after a row ages
 out.
+
+#2974: this is also the one existing low-cadence, filesystem-safe hook the
+daemon already calls on a timer (and that ``coord housekeeping`` calls on
+demand) — so it is where :func:`coord.confirm_test.sweep_stale_confirm_worktrees`
+is wired in too, reclaiming ``~/.coord/confirm-worktrees/`` entries that
+outlived ``confirm_branch``'s own per-run cleanup. That is disk hygiene, not
+DB archiving, but reusing this sweep's cadence beats inventing a second timer
+for a second maintenance job.
 """
 
 from __future__ import annotations
@@ -140,12 +148,13 @@ def _move_rows(
 
 def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     """Archive stale terminal assignments + their notifications + merged
-    merge_queue entries.
+    merge_queue entries, and reclaim leaked confirm-worktree directories.
 
     Returns ``{"archived_assignments": N, "archived_notifications": M,
-    "archived_merge_queue": K, "dry_run": bool, "retention_days": D}``.
-    ``archived_*`` are the counts that were (or, for ``dry_run``, would be)
-    moved.  A no-op returns zeros.
+    "archived_merge_queue": K, "removed_confirm_worktrees": W, "dry_run": bool,
+    "retention_days": D}``. ``archived_*``/``removed_confirm_worktrees`` are
+    the counts that were (or, for ``dry_run``, would be) moved/deleted.  A
+    no-op returns zeros.
 
     Conservative by construction: nothing active, recent (within the archive
     window), queued-for-merge, latest-of-an-open-issue, or review-linked to any
@@ -153,17 +162,29 @@ def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     are in the terminal ``MERGED`` state (#1107 Part 3) — non-terminal /
     conflicted entries are left for ``prune_stale_queue_entries`` or manual
     ``coord merge --drop``.
+
+    #2974: ``removed_confirm_worktrees`` is independent of the DB-archiving
+    ``cutoff``/``retention_days`` above (it has its own, much shorter,
+    :data:`coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS` window) and runs
+    even when DB archiving itself is disabled (``COORD_ARCHIVE_RETENTION_DAYS``
+    ``<= 0``) — a disk leak on the daemon host is not something an operator
+    who merely turned off DB archiving meant to also keep.
     """
+    from coord.confirm_test import sweep_stale_confirm_worktrees  # noqa: PLC0415
+
+    swept_worktrees = sweep_stale_confirm_worktrees(dry_run=dry_run, now=now)
+
     cutoff = _archive_cutoff(now)
     result = {
         "archived_assignments": 0,
         "archived_notifications": 0,
         "archived_merge_queue": 0,
+        "removed_confirm_worktrees": len(swept_worktrees["removed"]),
         "dry_run": dry_run,
         "retention_days": _archive_retention_days(),
     }
     if cutoff is None:
-        return result  # archiving disabled
+        return result  # DB archiving disabled; the worktree sweep above still ran
 
     conn = get_connection()
     index = [

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/coord/serve_app.py

@@ -739,7 +739,9 @@ def _audit_housekeeping_sweep(swept: dict) -> None:
             f"housekeeping: archived {swept.get('archived_assignments', 0)} "
             f"assignment(s), {swept.get('archived_notifications', 0)} "
             f"notification(s), {swept.get('archived_merge_queue', 0)} "
-            "merge_queue entry(ies)"
+            "merge_queue entry(ies), removed "
+            f"{swept.get('removed_confirm_worktrees', 0)} stale "
+            "confirm-worktree(s) (#2974)"
         ),
         details=swept,
     )
@@ -9477,13 +9479,16 @@ def build_app(store: CoordStore, config: Config, *, token: str | None = None) ->
                             swept.get("archived_assignments")
                             or swept.get("archived_notifications")
                             or swept.get("archived_merge_queue")
+                            or swept.get("removed_confirm_worktrees")
                         ):
                             log.info(
                                 "housekeeping: archived %d assignment(s), "
-                                "%d notification(s), %d merge_queue entry(ies)",
+                                "%d notification(s), %d merge_queue entry(ies), "
+                                "removed %d stale confirm-worktree(s)",
                                 swept["archived_assignments"],
                                 swept["archived_notifications"],
                                 swept.get("archived_merge_queue", 0),
+                                swept.get("removed_confirm_worktrees", 0),
                             )
                             _audit_housekeeping_sweep(swept)
                     except Exception:  # noqa: BLE001

{code_coordinator-0.5.310 → code_coordinator-0.5.312}/tests/test_board_cap_762.py

@@ -20,6 +20,33 @@ RECENT = NOW - 2 * 86400      # 2 days ago  → inside the 14d board window
 OLD = NOW - 40 * 86400        # 40 days ago → outside both windows
 
 
+@pytest.fixture(autouse=True)
+def _isolated_confirm_worktrees_dir(monkeypatch, tmp_path):
+    """#2974: ``housekeeping.sweep()`` now also calls
+    ``coord.confirm_test.sweep_stale_confirm_worktrees`` on every invocation
+    (even ``dry_run=False`` calls made directly, as most tests below do), and
+    that helper resolves its sweep root from the real, lazily-resolved
+    ``coord.state.COORD_DIR`` (``~/.coord`` on POSIX absent a ``$COORD_DIR``
+    override).  Before this fixture, every test in this file that calls the
+    real (non-dry-run) ``housekeeping.sweep()`` — or drives it through the
+    real ``/housekeeping`` endpoint — would ``shutil.rmtree`` anything under
+    the OPERATOR's real ``~/.coord/confirm-worktrees/`` older than
+    ``coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS`` as an untracked side
+    effect of running `pytest`.  Pin ``coord.state.COORD_DIR`` to a private
+    ``tmp_path`` for every test in this module — mirrors
+    ``tests/test_confirm_test.py``'s own ``isolated_coord_dir`` fixture,
+    which the real ``sweep_stale_confirm_worktrees`` call site already
+    trusts (it re-imports ``coord.state.COORD_DIR`` fresh on every call, so
+    a plain ``monkeypatch.setattr`` here is picked up with no further
+    wiring). A file-local autouse fixture (rather than a global one in
+    ``tests/conftest.py``) is deliberate: ``tests/test_platform_paths.py``
+    has real tests that assert ``coord.state.COORD_DIR`` reflects the
+    *actual* default resolution with nothing overriding it, which a global
+    override would break.
+    """
+    monkeypatch.setattr("coord.state.COORD_DIR", tmp_path / "coord-state")
+
+
 def _ins_assignment(
     conn: sqlite3.Connection,
     aid: str,