code-coordinator 0.5.491__tar.gz → 0.5.493__tar.gz

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.491
+Version: 0.5.493
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.491
+Version: 0.5.493
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.491",
+  "tag": "0.5.493",
   "distance": 0,
-  "node": "g0bf722668fffd8f60d76696692afdbf7f1b292ff",
+  "node": "g21581c4b4d4c5107d3a7da2aefbfdfbd93aeee1e",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-09-18"

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/coord/commands/test_gate.py

@@ -565,6 +565,45 @@ def test(assignment_id: str, config_path: Path, verdict: str | None, reason: str
         elif verdict == "running":
             click.echo("  (transient — record --passed/--fail/--skipped when the run concludes)")
 
+        # #3386 (item 3 of #3378): tell the human RIGHT HERE how close (or
+        # past) this repo is to the consecutive baseline-red merge-block
+        # limit — `record_test_verdict` above just incremented it if this
+        # was a `baseline_red`-confirmed skip
+        # (`coord.confirm_test.test_confirmation_for_skip_reason`). Silence
+        # here is exactly how #3378's bypass ran unnoticed for 33 days: the
+        # command that records the bypass is the one place a human is
+        # already looking.
+        if test_confirmation == "baseline_red":
+            from coord.state import (
+                BASELINE_RED_STREAK_LIMIT,
+                baseline_red_merge_blocked,
+                baseline_red_streak,
+            )
+
+            # #3386 review: `baseline_red_merge_blocked` is the ONE predicate
+            # both the real merge refusal (`coord.merge_queue.
+            # evaluate_smoke_verdict`) and any repo-level alert surface must
+            # call — never a second, independently-derived comparison
+            # against `BASELINE_RED_STREAK_LIMIT` (#2096). This echo used to
+            # re-derive `streak >= BASELINE_RED_STREAK_LIMIT` itself; now it
+            # asks the same function the merge gate asks, so the two can
+            # never silently disagree.
+            streak = baseline_red_streak(assignment.repo_name)
+            if baseline_red_merge_blocked(assignment.repo_name):
+                click.echo(
+                    f"  WARNING: {assignment.repo_name} has now recorded {streak} "
+                    f"consecutive baseline-red (#2170) classifications — "
+                    f"`coord merge` will refuse EVERY branch on this repo until "
+                    f"the merge base itself is fixed (#3386)."
+                )
+            else:
+                click.echo(
+                    f"  note: {assignment.repo_name}'s consecutive baseline-red "
+                    f"streak is now {streak}/{BASELINE_RED_STREAK_LIMIT} — "
+                    f"merges for this repo stop at {BASELINE_RED_STREAK_LIMIT} "
+                    f"in a row with no genuine pass in between (#3386)."
+                )
+
         # #271 part 1: restore the local checkout to `default_branch` after a
         # pass/skip verdict (legacy safety — #561 means a Build no longer moves
         # the base, so this is a no-op on fresh checkouts), and #561: remove the

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/coord/db.py

@@ -666,6 +666,129 @@ def rollback_after_driver_error(conn: Any | None, exc: BaseException) -> None:
         pass
 
 
+def undo_pending_write(conn: Any | None, exc: BaseException, *, undo: Callable[[], Any]) -> None:
+    """Run *undo* — a compensating statement touching only THIS write's own
+    row — after *exc*, the #3382 sibling of
+    :func:`rollback_after_driver_error` for a writer whose own
+    ``conn.commit()`` call, not just the statement before it, can raise.
+
+    :func:`rollback_after_driver_error` deliberately no-ops for a plain
+    SQLite error (see its docstring): that is correct when the failure is a
+    STATEMENT that never got to write anything — SQLite's ``SQLITE_BUSY``,
+    hit while acquiring the lock a write needs, leaves nothing applied, so
+    simply re-running the whole write closure from scratch (what
+    :func:`retry_on_locked` does) is exactly as good as a rollback.
+
+    That reasoning does not hold when it is ``conn.commit()`` itself that
+    raises. WAL-checkpoint contention can make ``COMMIT`` hit
+    ``SQLITE_BUSY`` *after* the statement(s) before it already applied
+    inside the still-open transaction — the write is neither committed nor
+    undone, so it sits there, genuinely pending, on ``coord.db``'s shared
+    process-wide connection, ready for a completely unrelated handler's next
+    unrelated ``commit()`` to durably persist it later. #3382: this is
+    exactly how a ``review_claims`` row survived two callers who each saw
+    their own ``/review-claim`` POST fail with a 503 — neither call's own
+    retry-free write had anything guarding its ``commit()``, so the pending
+    insert outlived both failed calls and was swept up by a later,
+    completely unrelated write on the same shared connection.
+
+    A bare retry of the closure does not fix this the way it fixes a failed
+    statement, either: an ``INSERT OR IGNORE`` re-run against its own
+    still-pending prior insert reads back as a conflict (``rowcount == 0``),
+    so the retry silently misreports "someone else already holds this
+    claim" about a claim only this process's own earlier, abandoned attempt
+    took.
+
+    **Why a compensating statement, and not a transaction-level undo of any
+    kind (#3382 review rounds 1 and 2).** Two earlier shapes of this
+    function were both rejected, for the same underlying reason:
+
+    * ``conn.rollback()`` (round 1). On ``coord.db``'s shared, process-wide
+      SQLite singleton (see this module's own docstring), that discards
+      *every* other thread's not-yet-committed statement too — this process
+      dispatches other ``_*_local`` writers through ``run_in_threadpool`` on
+      real OS worker threads (the daemon's periodic tick, the ``/board``
+      build, ``/assignment/*`` handlers), and Python's ``sqlite3`` joins ANY
+      thread's statement issued on this one connection between commits into
+      the SAME open transaction. An unrelated writer that already got
+      ``sql.execute``/``sql.insert_ignore``'s success back (nothing in this
+      tree commits internally — see ``coord/sql.py``) then silently loses it
+      when its own later ``conn.commit()`` no-ops or raises ``cannot commit
+      - no transaction is active`` — this issue's own second logged symptom.
+
+    * ``SAVEPOINT`` + ``ROLLBACK TO SAVEPOINT`` (round 2), whether the
+      savepoint name is a shared literal or made unique per call. Unique
+      names fix only the narrower half of the problem (two concurrent calls
+      resolving each other's marker, since SQLite binds a name to the most
+      recently established savepoint of that name). They do **not** fix the
+      half that matters: ``ROLLBACK TO SAVEPOINT`` reverts the database to
+      its state *just after that savepoint was established*, so it undoes
+      every statement issued since — including another thread's, which this
+      writer has no business undoing — and destroys that thread's own
+      savepoints along the way. Verified against a real ``sqlite3``
+      connection (Python 3.12, SQLite 3.45): with two distinctly-named
+      savepoints opened back to back and one row inserted after each,
+      ``ROLLBACK TO`` the OUTER (uniquely-named) savepoint removes BOTH
+      rows. A transaction-scoped undo simply cannot express "mine only" on a
+      connection several threads write through.
+
+    So the undo is row-scoped instead: *undo* issues one statement that
+    names this write's own row and nothing else (delete the row this call
+    inserted, identified by its own ``claimed_at`` stamp; re-insert the row
+    this call deleted, with the ``claimed_at`` it read back first). It is
+    exact regardless of how other threads' statements interleave with this
+    one — before the failure or after it — because it never refers to their
+    rows.
+
+    It also degrades better than a transaction-level undo when an unrelated
+    thread's ``commit()`` lands *between* this write's statement and this
+    recovery: a savepoint would already have been destroyed by that commit
+    (``COMMIT`` releases all savepoints), leaving ``ROLLBACK TO`` to fail
+    and this write's row durably committed and leaked — precisely the
+    incident. The compensating statement instead stays pending and is
+    flushed by whichever ``commit()`` reaches it next (this closure's own
+    retry, or another writer's), so the net effect on this row is still
+    nothing.
+
+    Call this from the ``except sql.driver_errors():`` block of a write
+    closure that both executes a statement *and* calls ``conn.commit()``
+    itself, and **only when that closure's own statement actually applied**
+    (``cursor.rowcount``) — a statement that failed applied nothing, so
+    there is nothing to compensate, the same "a failed STATEMENT applies
+    nothing" reasoning :func:`rollback_after_driver_error` already
+    documents. Today's callers are the ``review_claims``/``smoke_claims``
+    claim and release writes in ``coord/state.py`` (#3113/#3333), the two
+    sites where "did this claim land" is an exclusive-ownership decision the
+    rest of the system relies on, unlike most of this module's writers where
+    a duplicate-on-retry UPDATE/DELETE is harmless.
+
+    Unlike :func:`rollback_after_driver_error`, this does not inspect *exc*
+    for a SQLSTATE: the plain-SQLite case above is exactly what it exists to
+    cover. On Postgres it is a harmless no-op in practice — a failed
+    ``COMMIT`` there aborts the whole transaction (so *undo* raises
+    ``InFailedSqlTransaction``, suppressed below) and
+    :func:`retry_on_locked`'s own :func:`rollback_after_driver_error` call
+    has already undone this write for real; ``get_connection()`` also hands
+    each THREAD its own connection there (see this module's docstring), so
+    no other thread's statement was ever at risk.
+
+    Same suppression rule as :func:`rollback_after_driver_error`: a ``None``
+    *conn* is a no-op, and a failure of *undo* itself is swallowed so it
+    never masks *exc*, the exception actually worth seeing. If the
+    compensating statement cannot run either (sustained contention
+    outlasting even this), this write's own row is left pending for the next
+    writer's eventual commit/rollback to resolve — the same residual,
+    already-accepted risk :func:`rollback_after_driver_error`'s own
+    suppressed-failure path carries today, not a new one.
+    """
+    if conn is None:
+        return
+    try:
+        undo()
+    except Exception:  # noqa: BLE001 — never mask the caught driver error
+        pass
+
+
 # #2538: a handful of consecutive short retries — long enough to ride out a
 # concurrent writer (the daemon's own passive tick, another `coord merge`/
 # `coord notify` invocation) that only holds the DB for a moment, short

{code_coordinator-0.5.491 → code_coordinator-0.5.493}/coord/merge_queue.py

@@ -52,7 +52,13 @@ from coord.models import (
     trust_issue_closed_for,
 )
 from coord.pr_body_lint import downgrade_closing_keywords, find_closing_references
-from coord.state import COORD_DIR, dismiss_drive_escalation, record_uat_verdict
+from coord.state import (
+    COORD_DIR,
+    baseline_red_merge_blocked,
+    baseline_red_streak,
+    dismiss_drive_escalation,
+    record_uat_verdict,
+)
 from coord.uat_checks import UatCheckResult, evaluate_uat_checks
 
 _log = logging.getLogger(__name__)
@@ -1713,10 +1719,22 @@ def passes_merge_gates(a, config, board, gh_ops: "GhOps | None" = None) -> bool:
 # non-``None`` to run) straight to SMOKE_OK — a verdict this code never
 # actually confirmed still covers the current head. See
 # `UNKNOWN_BRANCH_HEAD_REASON`.
+#
+# #3386 adds a fourth: SMOKE_BASELINE_RED_BLOCKED — a `"skipped"` verdict
+# confirmed `baseline_red` (#3378 item 2) exists and is otherwise fresh, but
+# this repo has racked up `BASELINE_RED_STREAK_LIMIT` (or more) of them in a
+# row with no genuine `passed` verdict in between. #1732's "skipped never
+# goes stale" exemption is deliberately narrower than it looks: it covers a
+# STRUCTURAL skip (nothing to smoke-test) unconditionally, but a
+# `baseline_red` skip is a claim that the CURRENT merge base — not the
+# branch — is why the suite fails, and #3378 found that claim, satisfied
+# every time, merges a repo whose `main` has been red for 33 days without
+# anyone noticing. See `coord.state.baseline_red_merge_blocked`.
 SMOKE_OK = "ok"
 SMOKE_MISSING = "missing"
 SMOKE_STALE = "stale"
 SMOKE_UNKNOWN = "unknown"
+SMOKE_BASELINE_RED_BLOCKED = "baseline_red_blocked"
 
 
 def _short_sha(sha: str | None) -> str:
@@ -1773,6 +1791,9 @@ class SmokeVerdictStatus:
     # sentence. `None` for every other kind, and for a SMOKE_UNKNOWN whose
     # `gh_ops` stand-in didn't support `raise_on_transient` at all.
     probe_error: "GhTransientError | None" = None
+    # #3386: the repo's consecutive baseline-red streak that produced a
+    # SMOKE_BASELINE_RED_BLOCKED verdict — `None` for every other kind.
+    baseline_red_streak: int | None = None
 
     @property
     def short_reason(self) -> str | None:
@@ -1784,6 +1805,11 @@ class SmokeVerdictStatus:
             return None
         if self.kind == SMOKE_UNKNOWN:
             return unknown_branch_head_reason(self.probe_error)
+        if self.kind == SMOKE_BASELINE_RED_BLOCKED:
+            return (
+                f"{self.baseline_red_streak} consecutive baseline-red "
+                "classifications — merge base needs fixing (#3386)"
+            )
         if self.kind == SMOKE_STALE:
             if self.anchor == "run":
                 return (
@@ -1810,6 +1836,20 @@ class SmokeVerdictStatus:
             # `unknown_branch_head_reason` appends real status/request-id/
             # retry-after when `probe_error` carries any.
             return unknown_branch_head_reason(self.probe_error)
+        if self.kind == SMOKE_BASELINE_RED_BLOCKED:
+            # #3386: a bypass that still merges is not a bypass. This repo
+            # has recorded `baseline_red_streak` consecutive `baseline-red`
+            # (#2170) classifications with no genuine `passed` verdict in
+            # between — the merge base itself needs fixing before this or
+            # any other branch on this repo merges. Waiving requires
+            # `--skip-smoke`, same as any other smoke refusal; there is no
+            # per-branch fix, only a repo-level one.
+            return (
+                f"merge refused: {self.baseline_red_streak} consecutive "
+                "baseline-red (#2170) classifications on this repo with no "
+                "genuine passed verdict in between — the merge base itself "
+                "needs fixing, not another branch (#3386)"
+            )
         if self.kind == SMOKE_STALE:
             aid = self.assignment_id or "<assignment>"
             if self.anchor == "run":
@@ -3269,88 +3309,145 @@ def evaluate_smoke_verdict(
         # moves — a rename upstream, or new commits on the branch, can't
         # turn "there is nothing here a smoke test could exercise" into
         # false. Only `passed` verdicts go through the #1479 base/branch
-        # staleness check below; `skipped` is accepted unconditionally.
-        if test_state == "skipped":
+        # staleness check below; a STRUCTURAL `skipped` is accepted
+        # unconditionally, same as always.
+        #
+        # #3386: a `baseline_red`-confirmed skip (#3378 item 2) is NOT that
+        # structural claim — it asserts the merge BASE, not the branch, is
+        # why the suite fails, and that assertion is falsifiable two ways:
+        #   * item 3 — this repo has racked up too many of these in a row
+        #     with no genuine `passed` in between
+        #     (`coord.state.baseline_red_streak`), so even a fresh
+        #     one must not merge until the base itself is fixed. A bypass
+        #     that still merges every time is not a bypass, it is an outage
+        #     with a footnote — confirmed live on #3383 against a `main`
+        #     that had been red 33 days.
+        #   * item 4 — the branch has since moved on (a fix round pushed new
+        #     commits), so the classification no longer describes what is
+        #     actually on the branch (#3376's live gate defect: a skip cited
+        #     from a since-superseded assignment). Falls through to the same
+        #     branch-content check `passed` gets below.
+        # Deliberately does NOT run the base-move check just below even for
+        # a `baseline_red` skip: that check exists to catch a `passed`
+        # MEASUREMENT going stale, whereas "the base is red" is exactly what
+        # this classification already asserts — item 3's streak bound is
+        # what covers a chronically-moving red base instead.
+        test_confirmation = getattr(a, "test_confirmation", None)
+        # "baseline_red" mirrors `coord.confirm_test.TEST_CONFIRMATION_
+        # BASELINE_RED` — kept as a literal (not an import) to avoid a
+        # module-level import of `coord.confirm_test`, which imports
+        # `coord.revalidate`, which imports THIS module. Pinned against
+        # drift by `tests/test_merge_queue.py::TestStaleSmokeVerdictReporting::
+        # test_literal_matches_the_canonical_confirm_test_constant`.
+        is_baseline_red_skip = (
+            test_state == "skipped" and test_confirmation == "baseline_red"
+        )
+        if test_state == "skipped" and not is_baseline_red_skip:
             return SmokeVerdictStatus(
                 ok=True, kind=SMOKE_OK, assignment_id=getattr(a, "assignment_id", None)
             )
-
-        # Merge base moved: the tested combination (this branch + that base)
-        # no longer exists, even if the branch's own diff is unchanged.
-        test_base_sha = getattr(a, "test_base_sha", None)
-        if (
-            test_base_sha is not None
-            and current_base_sha is None
-            and not base_sha_attempted
-            and gh_ops is not None
-            and repo_github
-            and target_branch
-        ):
-            current_base_sha, base_sha_probe_failed, base_sha_probe_error = _gh_get_branch_sha(
-                gh_ops, repo_github, target_branch
-            )
-            base_sha_attempted = True
-
-        # #2704: the live probe just above positively confirmed it could not
-        # read GitHub, while a recorded verdict names a specific base SHA to
-        # compare against. Before #2704 a failed (or merely un-attempted)
-        # lookup was indistinguishable from a clean `None`, so this fell
-        # straight through to the "base moved" check below, which is a
-        # silent no-op on `current_base_sha is None` and lets execution
-        # reach SMOKE_OK further down: a verdict this call never actually
-        # confirmed still covers the current base. Fail closed instead — we
-        # do not KNOW whether the base moved, so we cannot vouch for it.
-        if test_base_sha is not None and base_sha_probe_failed:
-            if unknown is None:
-                unknown = SmokeVerdictStatus(
+        if is_baseline_red_skip:
+            # #3386 review: the streak store is keyed by the coordinator's
+            # internal short `repo_name` (what `record_baseline_red_
+            # classification`/`_record_test_verdict_local` write) — NOT by
+            # `repo_github` (an "owner/repo" GitHub slug). A prior version
+            # of this fell back to `repo_github` when `a.repo_name` was
+            # falsy; that fallback would have looked up the wrong key and
+            # silently read streak=0 (never block) had it ever actually
+            # fired. A board-recorded work assignment's `repo_name` should
+            # always be populated, so there is no real fallback value to
+            # have here — dropped rather than kept as dead code with wrong
+            # semantics.
+            repo_for_streak = getattr(a, "repo_name", None)
+            if repo_for_streak and baseline_red_merge_blocked(repo_for_streak):
+                return SmokeVerdictStatus(
                     ok=False,
-                    kind=SMOKE_UNKNOWN,
+                    kind=SMOKE_BASELINE_RED_BLOCKED,
                     assignment_id=getattr(a, "assignment_id", None),
-                    anchor="base",
-                    recorded_sha=test_base_sha,
-                    probe_error=base_sha_probe_error,
+                    baseline_red_streak=baseline_red_streak(repo_for_streak),
                 )
-            continue
 
-        # #1738/#1778/#1847: the base moved, but a moved SHA doesn't
-        # necessarily mean a content change that could affect a test result.
-        # `_base_move_spared` tries, in order: is the base move itself
-        # provably inert content (docs/scripts/issue-template only, #1738);
-        # failing that, is *this branch*'s entire diff (as actually tested,
-        # test_base_sha..test_head_sha) provably inert (#1778); failing that,
-        # do the two diffs simply touch disjoint files (#1847) — a
-        # substantive base move and a substantive branch that have nothing to
-        # do with each other. Any one being true means the tested combination
-        # is still covered — fall through to the branch-content check below
-        # instead of staling here. If the branch has since gained real
-        # content, that check still catches it independently via the
-        # patch-id compare (#1847 doesn't short-circuit it).
         base_move_spare_reason: str | None = None
-        if (
-            test_base_sha is not None
-            and current_base_sha is not None
-            and test_base_sha != current_base_sha
-        ):
-            spared, base_move_spare_reason = _base_move_spared(
-                gh_ops,
-                repo_github,
-                test_base_sha,
-                current_base_sha,
-                getattr(a, "test_head_sha", None),
-            )
-            if not spared:
-                # stale: re-verify against the new base
-                if stale is None:
-                    stale = SmokeVerdictStatus(
+        test_base_sha = getattr(a, "test_base_sha", None)
+        if test_state == "passed":
+            # Merge base moved: the tested combination (this branch + that
+            # base) no longer exists, even if the branch's own diff is
+            # unchanged. #3386: skipped entirely for a `baseline_red` skip —
+            # see the comment above.
+            if (
+                test_base_sha is not None
+                and current_base_sha is None
+                and not base_sha_attempted
+                and gh_ops is not None
+                and repo_github
+                and target_branch
+            ):
+                current_base_sha, base_sha_probe_failed, base_sha_probe_error = (
+                    _gh_get_branch_sha(gh_ops, repo_github, target_branch)
+                )
+                base_sha_attempted = True
+
+            # #2704: the live probe just above positively confirmed it could
+            # not read GitHub, while a recorded verdict names a specific
+            # base SHA to compare against. Before #2704 a failed (or merely
+            # un-attempted) lookup was indistinguishable from a clean
+            # `None`, so this fell straight through to the "base moved"
+            # check below, which is a silent no-op on `current_base_sha is
+            # None` and lets execution reach SMOKE_OK further down: a
+            # verdict this call never actually confirmed still covers the
+            # current base. Fail closed instead — we do not KNOW whether
+            # the base moved, so we cannot vouch for it.
+            if test_base_sha is not None and base_sha_probe_failed:
+                if unknown is None:
+                    unknown = SmokeVerdictStatus(
                         ok=False,
-                        kind=SMOKE_STALE,
+                        kind=SMOKE_UNKNOWN,
                         assignment_id=getattr(a, "assignment_id", None),
                         anchor="base",
                         recorded_sha=test_base_sha,
-                        current_sha=current_base_sha,
+                        probe_error=base_sha_probe_error,
                     )
                 continue
 
+            # #1738/#1778/#1847: the base moved, but a moved SHA doesn't
+            # necessarily mean a content change that could affect a test
+            # result. `_base_move_spared` tries, in order: is the base move
+            # itself provably inert content (docs/scripts/issue-template
+            # only, #1738); failing that, is *this branch*'s entire diff (as
+            # actually tested, test_base_sha..test_head_sha) provably inert
+            # (#1778); failing that, do the two diffs simply touch disjoint
+            # files (#1847) — a substantive base move and a substantive
+            # branch that have nothing to do with each other. Any one being
+            # true means the tested combination is still covered — fall
+            # through to the branch-content check below instead of staling
+            # here. If the branch has since gained real content, that check
+            # still catches it independently via the patch-id compare
+            # (#1847 doesn't short-circuit it).
+            if (
+                test_base_sha is not None
+                and current_base_sha is not None
+                and test_base_sha != current_base_sha
+            ):
+                spared, base_move_spare_reason = _base_move_spared(
+                    gh_ops,
+                    repo_github,
+                    test_base_sha,
+                    current_base_sha,
+                    getattr(a, "test_head_sha", None),
+                )
+                if not spared:
+                    # stale: re-verify against the new base
+                    if stale is None:
+                        stale = SmokeVerdictStatus(
+                            ok=False,
+                            kind=SMOKE_STALE,
+                            assignment_id=getattr(a, "assignment_id", None),
+                            anchor="base",
+                            recorded_sha=test_base_sha,
+                            current_sha=current_base_sha,
+                        )
+                    continue
+
         # Branch content changed since the test ran. Same SHA-then-patch-id
         # fallback as has_approved_review: a content-identical rebase (SHA
         # moved, patch-id didn't) does not invalidate the verdict.