code-coordinator 0.5.520__tar.gz → 0.5.522__tar.gz

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.520
+Version: 0.5.522
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.520
+Version: 0.5.522
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

code_coordinator-0.5.522/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.522",
+  "distance": 0,
+  "node": "g3d51cf0a782a606306c6175a5b2271d2d93ea2d4",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-27"
+}

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/coord/commands/drive_queue.py

@@ -35,7 +35,7 @@ import socket
 import subprocess
 import time
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Mapping, Sequence
+from typing import TYPE_CHECKING, Any, Iterable, Mapping, Sequence
 
 import click
 
@@ -88,6 +88,7 @@ from coord.drive_queue import (
     fired_holds,
     flag_shadows_config_warning,
     is_dispatch_failure_reason,
+    is_fix_round_ceiling_blocked,
     is_merge_gate_block_reason,
     is_permanent_block_reason,
     is_pre_dispatch_block_reason,
@@ -1386,10 +1387,10 @@ _BLOCKED_AFTER_NOTE = (
 # ships doesn't have to go read the issue to learn their remove+add might be
 # about to race an automatic resume.
 _BLOCKED_GATE_NOTE = (
-    "note: a re-evaluable blocked cause (i.e. not a #1844/#2019 permanent "
-    "refusal) IS re-checked against the merge gate automatically (#2230) — "
-    "see `resumes=` above if this row has already self-resumed and "
-    "re-blocked"
+    "note: a re-evaluable blocked cause (i.e. not a #1844/#2019/#2972 "
+    "permanent refusal) IS re-checked against the merge gate automatically "
+    "(#2230) — see `resumes=` above if this row has already self-resumed "
+    "and re-blocked"
 )
 
 # #2589: `_BLOCKED_GATE_NOTE` above is flatly wrong for a row whose cause is
@@ -5576,6 +5577,34 @@ def _record_checks_stale_escalation(entry: "QueuedMerge", *, reason: str) -> Non
         click.echo(f"  (could not record the checks_stale escalation: {exc})")
 
 
+def _fix_round_ceiling_blocked_keys(
+    queue_entries: Iterable[QueueEntry],
+) -> set[tuple[str, int]]:
+    """#3454: ``(repo, issue)`` keys whose drive-queue row has already given
+    up on the #2972 fix-round ceiling — a block means stop: nothing this
+    module auto-dispatches should fire again for one of these until an
+    operator runs ``coord drive-queue remove`` + ``add``.
+
+    Delegates the actual predicate to :func:`coord.drive_queue.
+    is_fix_round_ceiling_blocked` — the #3454 review's "one question, one
+    answer" fix: ``coord.notify``'s stalled-pipeline sweep (a second,
+    independent ``dispatch_conflict_fix`` caller) asks this SAME function
+    per-row rather than re-deriving the ``state == blocked AND
+    is_fix_round_ceiling_reason`` check here a second time.
+
+    Pure, over an already-fetched entry list, so
+    ``_run_auto_revalidate_checks_stale``'s use of it (skip a
+    stale-rebase conflict-fix candidate whose OWN entry gave up this way) is
+    testable without mocking the live board/ci_store/conflict_fix stack that
+    function otherwise needs.
+    """
+    return {
+        (e.repo, e.issue)
+        for e in queue_entries
+        if is_fix_round_ceiling_blocked(e.state, e.last_reason)
+    }
+
+
 def _run_auto_revalidate_checks_stale(config_path: Path | None) -> None:
     """#2535: unattended remedy for merge-queue entries blocked SOLELY on
     stale CI checks against an already-approved review — closing the gap
@@ -5720,6 +5749,7 @@ def _run_auto_revalidate_checks_stale(config_path: Path | None) -> None:
         from coord.state import (  # noqa: PLC0415
             dismiss_drive_escalation,
             list_drive_escalations,
+            list_drive_queue,
             load_board as _load_board,
         )
 
@@ -5743,6 +5773,33 @@ def _run_auto_revalidate_checks_stale(config_path: Path | None) -> None:
             return
         items = _mq.load_queue()
         candidates = _mq.ci_revalidation_candidates(items, board, cfg, ci_store, _gh_ops)
+        # #3454: an entry whose drive-queue row already gave up on the #2972
+        # fix-round ceiling is PARKED — a block means stop, not "the driver
+        # stopped but the pipeline is still live" (quadraui#1077: a
+        # stale-rebase conflict-fix from THIS mechanism fired 6h07m after the
+        # ceiling block, one of the paid legs the block's own "giving up"
+        # wording told the operator would not happen). Filtered out of
+        # `candidates` itself, not just the dispatch loop below, so the
+        # escalation-cleanup pass right above also treats a newly-parked
+        # entry as no-longer-live and dismisses any open `checks_stale`
+        # escalation for it — the ceiling block's own reason is the one
+        # surface an operator needs, not a second "needs a human" this
+        # mechanism would otherwise keep alive for a row that already has
+        # one. `is_fix_round_ceiling_blocked` (not the broader
+        # `is_permanent_block_reason`) so a #1844/#2019 permanent block —
+        # neither of which this mechanism has ever been asked to change —
+        # keeps its pre-#3454 behaviour exactly. `coord.notify`'s stalled-
+        # pipeline sweep — the THIRD, independent `dispatch_conflict_fix`
+        # caller the #3454 review found unfiltered — now calls this exact
+        # same predicate per-row rather than a separately-derived check.
+        ceiling_blocked_keys = _fix_round_ceiling_blocked_keys(
+            entries_from_rows(list_drive_queue())
+        )
+        candidates = [
+            c
+            for c in candidates
+            if (c.repo_name, c.issue_number) not in ceiling_blocked_keys
+        ]
     except Exception:  # noqa: BLE001 — best-effort, see docstring
         return
 

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/coord/dr_verify.py

@@ -714,13 +714,26 @@ def live_board_assignment_count(live_db_path: Path) -> int:
     count, which is always larger once a board has any history (#762's
     retention cap). There is no need to *boot* a second daemon to answer this:
     the live daemon (if one is even running) is not what is being tested here
-    — only "what would `/board` report for this file" is needed, and that is
-    exactly :meth:`coord.dao.SqliteStore.board_projection`, the same function
-    `coord/serve_app.py`'s `/board` route calls. Calling it directly, read-only,
-    against the live file is the "one question, one answer" version of asking
-    a second daemon to boot just to answer a question the daemon already
-    knows how to answer without booting.
+    — only "what would `/board` report for this file" is needed.
+
+    That answer is **not** simply :meth:`coord.dao.SqliteStore.board_projection`
+    — #762's retention window is only the first of two filters the route
+    applies. ``coord/serve_app.py``'s `/board` route also runs the projection
+    through :func:`coord.board_wire.bound_board_payload`, which caps terminal
+    assignments to :data:`coord.board_wire.MAX_TERMINAL_ASSIGNMENTS` (#1791) on
+    top of the retention window — a *second*, tighter cut a board with any
+    real history will always hit before the 14-day window ever does (#3451).
+    Skipping that second cut here made this function's own docstring claim —
+    "the same function `/board` route calls" — false: it counted a raw,
+    unbounded-by-cardinality projection while the restored side (a real
+    daemon's `/board`) counted the capped one, so parity failed on every real
+    fleet board regardless of whether the restore was actually fine.
+    :func:`coord.board_wire.bound_board_payload` mutates ``payload`` in place,
+    so applying it here before counting is the "one question, one answer"
+    version of asking a second daemon to boot just to answer a question the
+    daemon already knows how to answer without booting.
     """
+    from coord.board_wire import bound_board_payload  # noqa: PLC0415
     from coord.dao import SqliteStore  # noqa: PLC0415
 
     try:
@@ -730,6 +743,7 @@ def live_board_assignment_count(live_db_path: Path) -> int:
             f"parity check failed: could not read the live board's /board "
             f"count from {live_db_path}: {exc}"
         ) from None
+    bound_board_payload(payload)
     rows = payload.get("assignments")
     if not isinstance(rows, list):
         raise DRVerifyError(

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/coord/drive_queue.py

@@ -160,9 +160,10 @@ def dispatch_type_for_labels(issue_labels: Iterable[str] | None) -> str:
 #
 # #2230 qualifies "terminal" for `blocked` specifically: it still means "no
 # `coord drive` launches from this row again on its own" and "stays in the
-# table for history" for a PERMANENT cause (#1844/#2019) or one the sweep has
-# no evidence about. It no longer means "nothing ever writes to this row
-# again" — a `blocked` entry whose cause was a re-evaluable gate reading may
+# table for history" for a PERMANENT cause (#1844/#2019/#2972 — see
+# `_PERMANENT_BLOCK_MARKERS`) or one the sweep has no evidence about. It no
+# longer means "nothing ever writes to this row again" — a `blocked` entry
+# whose cause was a re-evaluable gate reading may
 # be moved straight back to `waiting` by `plan_tick`'s own reconcile pass,
 # with no operator action, the moment that reading clears. See
 # `is_permanent_block_reason` and `_reconcile_blocked` below for exactly
@@ -282,7 +283,74 @@ PARK_STALE_SECONDS = 45 * 60.0
 # clear (see `_reconcile_blocked` and the `live_blocked_gate` parameter of
 # `plan_tick`). No evidence either way leaves the entry exactly as untouched
 # as it was before this feature existed.
-_PERMANENT_BLOCK_MARKERS: tuple[str, ...] = ("(#1844)", "(#2019)")
+#
+# #3454: `(#2972)` joined this tuple after quadraui#1077 (2026-09-27) showed
+# the gap a THIRD marker was needed for — a #2972 fix-round-ceiling give-up
+# is not like #309's ordinary `exhausted`: relaunching cannot produce more
+# budget no matter how the merge gate reads, so treating it as merely
+# "unlucky, re-check later" let #2230's own sweep silently resume it back to
+# `waiting` (attempts reset to 0!) the moment the gate cleared — handing the
+# exact fresh budget the ceiling exists to deny, from inside the mechanism
+# built to respect it. Marking it permanent here closes that specific hole:
+# `_reconcile_blocked` returns `None` for it unconditionally, same as
+# #1844/#2019, and only an operator's `coord drive-queue remove` + `add`
+# (a fresh row) ever gives this entry another attempt. This
+# does NOT stop the row from being noticed if the issue lands anyway
+# out-of-band — `plan_tick`'s own step-1b `facts.landed` check (#2055/#3368)
+# runs unconditionally for every `blocked` entry regardless of this marker,
+# exactly as it always has; what stops is only the AUTOMATIC relaunch/
+# merge-only paths #2230 gates. See :func:`is_fix_round_ceiling_reason` for
+# the narrower predicate `coord.commands.drive_queue` uses to also stop its
+# OWN independent auto-dispatch (the stale-rebase conflict-fix revalidation)
+# from re-firing against a row that has already given up this way.
+_PERMANENT_BLOCK_MARKERS: tuple[str, ...] = ("(#1844)", "(#2019)", "(#2972)")
+
+
+def is_fix_round_ceiling_reason(reason: str | None) -> bool:
+    """#3454: does *reason* name the #2972 fix-round-ceiling give-up — the
+    ``_reconcile_running`` "giving up rather than relaunching with a fresh
+    budget" branch, below?
+
+    Marker-based, same convention as :func:`is_permanent_block_reason` (whose
+    ``_PERMANENT_BLOCK_MARKERS`` this reuses the same ``(#2972)`` text for):
+    the branch that writes this reason stamps the marker unconditionally, so
+    a substring check is exact, not a heuristic guess. A dedicated predicate
+    rather than reusing ``is_permanent_block_reason`` directly because a
+    caller outside this module (``coord.commands.drive_queue``'s stale-rebase
+    auto-revalidation, #3454) wants to ask SPECIFICALLY "did this entry give
+    up on the fix-round ceiling", not the broader "is this blocked for any
+    permanent reason" — conflating the two would silently widen that other
+    caller's behaviour to #1844/#2019 rows too, which nothing in #3454 asked
+    for and nothing has verified is safe.
+    """
+    if not reason:
+        return False
+    return "(#2972)" in reason
+
+
+def is_fix_round_ceiling_blocked(state: str | None, last_reason: str | None) -> bool:
+    """#3454 review: the ONE predicate every auto-dispatcher must consult
+    before firing against a (repo, issue) — "has this row's drive-queue
+    entry already given up on the #2972 fix-round ceiling".
+
+    The review that opened this function found TWO independent
+    ``dispatch_conflict_fix`` callers deciding this question with different
+    logic: ``coord.commands.drive_queue``'s stale-rebase auto-revalidation
+    checked it, ``coord.notify``'s stalled-pipeline sweep (a third,
+    pre-existing caller of the same worker) did not — so a
+    ``(#2972)``-blocked entry could still receive a brand-new conflict-fix
+    leg via the second path, entirely unaffected by the first fix. Both now
+    call this one function instead of each re-deriving "blocked AND
+    :func:`is_fix_round_ceiling_reason`" — the "one question, one answer"
+    rule this module already applies elsewhere (#2096/#2085).
+
+    ``state`` must be the LIVE state (:data:`STATE_BLOCKED`, not merely "the
+    reason string looks like a ceiling give-up") — a row that has since been
+    removed/re-added by an operator (the documented remedy) has a fresh
+    ``last_reason`` from a NEW life, but a stale caller that only checked the
+    reason string could still misfire against the archived one.
+    """
+    return state == STATE_BLOCKED and is_fix_round_ceiling_reason(last_reason)
 
 
 def is_permanent_block_reason(text: str | None) -> bool:
@@ -5112,13 +5180,25 @@ def _reconcile_running(
     # ran.
     budget = total_fix_round_budget(entry, fix_round_config_default)
     if remaining_fix_rounds(entry, facts, fix_round_config_default) <= 0:
+        # #3454: this block now DOES mean "stop" — see
+        # `_PERMANENT_BLOCK_MARKERS`'s `(#2972)` entry and
+        # `is_fix_round_ceiling_reason` above for the mechanics. Say so
+        # explicitly rather than leaving an operator to infer it: quadraui#1077
+        # showed a bare "giving up" read as "nothing more will happen or be
+        # spent" while the fleet kept dispatching paid legs against the same
+        # branch for hours.
         reason = (
             f"fix-round ceiling reached across relaunches (#2972): "
             f"{facts.work_leg_count} work leg(s) already run against a "
             f"budget of {budget} (1 work dispatch + "
             f"{effective_max_fix_rounds(entry, fix_round_config_default)} fix "
             f"round(s)) — giving up rather than relaunching with a fresh "
-            f"budget{dispatch_note}"
+            f"budget{dispatch_note}. Stopped (#3454): no further relaunch, "
+            f"gate-clear resume, or auto-dispatched stale-rebase conflict-fix "
+            f"(from any of this fleet's independent dispatchers) will fire "
+            f"for this entry — `coord drive-queue remove {entry.repo} "
+            f"{entry.issue}` + `add` (a fresh row) is the only way to give "
+            f"it another attempt."
         )
         return (
             Reconcile(entry.key, "exhausted", reason, occupies=False),

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/coord/notify.py

@@ -1069,6 +1069,14 @@ class StalledDispatchAction:
       (#602).
     - ``"skipped_human_required"``  — the conflict-fix retry cap was already
       hit; surfacing to a human, not auto-retrying.
+    - ``"skipped_fix_round_ceiling_blocked"`` (#3454) — ``merge_conflict_
+      unresolved`` or ``merge_gate_checks_stale`` on a (repo, issue) whose
+      drive-queue row already gave up on the #2972 fix-round ceiling (see
+      :func:`coord.drive_queue.is_fix_round_ceiling_blocked`) — a block
+      means stop, so this sweep leaves it parked exactly like ``coord.
+      commands.drive_queue``'s stale-rebase auto-revalidation already does,
+      rather than handing it a third independent path to a fresh
+      conflict-fix leg (quadraui#1077).
     - ``"skipped_sealed_conflict"`` (#2537, narrowed by #2555) —
       ``merge_conflict_unresolved`` on a
       :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row whose conflict was
@@ -1138,6 +1146,35 @@ def _stalled_row_has_live_session(board: "Board", work: "Assignment") -> bool:
     return False
 
 
+def _fix_round_ceiling_blocked_for_work(work: "Assignment") -> bool:
+    """#3454 review: true when *work*'s (repo, issue) has a drive-queue row
+    that has already given up on the #2972 fix-round ceiling.
+
+    This module's ``merge_conflict_unresolved`` and ``merge_gate_checks_
+    stale`` arms are a THIRD, independent caller of :func:`coord.
+    conflict_fix.dispatch_conflict_fix` — the review found them unfiltered
+    while ``coord.commands.drive_queue``'s stale-rebase auto-revalidation
+    (the second caller) already skipped a ceiling-blocked candidate,
+    letting quadraui#1077's "giving up" block get a brand-new conflict-fix
+    leg anyway via THIS path 6h07m later. Both callers now ask the exact
+    same question — :func:`coord.drive_queue.is_fix_round_ceiling_blocked`
+    — rather than each re-deriving it (#2096's "one question, one answer").
+
+    A drive-queue row is optional infrastructure (an issue can be worked
+    with no ``coord drive-queue add`` at all), so "no row for this (repo,
+    issue)" reads as "nothing to block on" — ``False`` — same as it always
+    implicitly has for every OTHER stalled-pipeline reason.
+    """
+    from coord.drive_queue import QueueEntry, is_fix_round_ceiling_blocked  # noqa: PLC0415
+    from coord.state import get_drive_queue_entry  # noqa: PLC0415
+
+    row = get_drive_queue_entry(work.repo_name, work.issue_number)
+    if row is None:
+        return False
+    dq_entry = QueueEntry.from_row(row)
+    return is_fix_round_ceiling_blocked(dq_entry.state, dq_entry.last_reason)
+
+
 def _conflict_confined_to_sealed_paths(
     entry: "QueuedMerge", config: Config,
 ) -> list[str] | None:
@@ -1230,7 +1267,11 @@ def dispatch_stalled_pipeline_action(
       the same bulk gate-checked enqueue the daemon passive tick already
       runs on every interval.
     - ``merge_conflict_unresolved`` → :func:`coord.conflict_fix.dispatch_conflict_fix`,
-      the #1474 ``_dispatch_conflict_fixes`` path — UNLESS (#2537) *work* is a
+      the #1474 ``_dispatch_conflict_fixes`` path — UNLESS (#3454) the
+      (repo, issue)'s drive-queue row already gave up on the #2972
+      fix-round ceiling (:func:`_fix_round_ceiling_blocked_for_work`),
+      which returns ``"skipped_fix_round_ceiling_blocked"`` instead, or
+      (#2537) *work* is a
       :data:`coord.models.SEALED_PATH_AUTHOR_TYPES` row AND the conflict can
       be confirmed (via :func:`_conflict_confined_to_sealed_paths`, a
       compare-API-only check) to be confined to the repo's sealed
@@ -1257,7 +1298,9 @@ def dispatch_stalled_pipeline_action(
       ``merge_conflict_unresolved`` dispatches, briefed for a PURE,
       content-preserving rebase (no conflict expected) rather than the
       ordinary conflict-resolution briefing. Guarded by the same
-      :func:`coord.conflict_fix.has_prior_conflict_fix` retry cap.
+      :func:`coord.conflict_fix.has_prior_conflict_fix` retry cap, and
+      (#3454) the same fix-round-ceiling park as ``merge_conflict_
+      unresolved`` above.
 
     Never re-entrant across ticks: the caller only reaches this after
     :func:`detect_stalled_pipeline` has already filtered out any row whose
@@ -1598,6 +1641,18 @@ def dispatch_stalled_pipeline_action(
             return StalledDispatchAction(
                 kind="no_action", detail="merge queue entry no longer found",
             )
+        # #3454: a #2972 fix-round-ceiling give-up parks the row — no further
+        # auto-dispatched conflict-fix for it from ANY caller, this sweep
+        # included. See `_fix_round_ceiling_blocked_for_work`'s docstring.
+        if _fix_round_ceiling_blocked_for_work(work):
+            return StalledDispatchAction(
+                kind="skipped_fix_round_ceiling_blocked",
+                detail=(
+                    "drive-queue row already gave up on the #2972 fix-round "
+                    "ceiling (#3454) — parked; needs `coord drive-queue "
+                    "remove` + `add`, not another auto-dispatched conflict-fix"
+                ),
+            )
         if has_prior_conflict_fix(
             board, entry.assignment_id, current_error=entry.error,
         ):
@@ -1697,6 +1752,18 @@ def dispatch_stalled_pipeline_action(
             return StalledDispatchAction(
                 kind="no_action", detail="merge queue entry no longer found",
             )
+        # #3454: same park as the `merge_conflict_unresolved` arm above — a
+        # #2972 fix-round-ceiling give-up means stop, including the stale-
+        # rebase conflict-fix this arm dispatches.
+        if _fix_round_ceiling_blocked_for_work(work):
+            return StalledDispatchAction(
+                kind="skipped_fix_round_ceiling_blocked",
+                detail=(
+                    "drive-queue row already gave up on the #2972 fix-round "
+                    "ceiling (#3454) — parked; needs `coord drive-queue "
+                    "remove` + `add`, not another auto-dispatched conflict-fix"
+                ),
+            )
         if has_prior_conflict_fix(
             board, entry.assignment_id, current_error=entry.error,
         ):

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/tests/test_dr_verify.py

@@ -576,6 +576,77 @@ def test_parity_failure_names_both_board_comparands_not_a_table_count(lane):
     assert "/board (live)" in message
 
 
+def _seed_recent_terminal_assignments(path: Path, *, count: int) -> None:
+    """*count* RECENT terminal rows — inside #762's retention window, but
+    when *count* exceeds `coord.board_wire.MAX_TERMINAL_ASSIGNMENTS`, past
+    #1791's tighter cardinality cap the `/board` route applies on top of
+    retention. This is the #3451 shape: a store where the 14-day window keeps
+    everything, yet `/board` still trims — the case
+    `live_board_assignment_count` silently skipped before this fix.
+    """
+    conn = sqlite3.connect(str(path))
+    conn.row_factory = sqlite3.Row
+    try:
+        _ensure_schema(conn)
+        now = time.time()
+        conn.executemany(
+            "INSERT INTO assignments (assignment_id, machine_name, repo_name, "
+            "repo_github, issue_number, issue_title, status, type, "
+            "dispatched_at, finished_at) VALUES (?,?,?,?,?,?,?,?,?,?)",
+            [
+                (
+                    f"recent-term-{i}",
+                    "precision",
+                    "claude-coordinator",
+                    "JDonaghy/claude-coordinator",
+                    500_000 + i,
+                    f"recent issue {i}",
+                    "done",
+                    "work",
+                    now - i,
+                    now - i,
+                )
+                for i in range(count)
+            ],
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+
+def test_live_board_assignment_count_matches_the_real_board_route_past_the_cap(
+    tmp_path, valid_config_path, coord_db,
+):
+    """#3451: the live side must count exactly what a real `/board` route
+    would serve for the same file — including #1791's `MAX_TERMINAL_ASSIGNMENTS`
+    cardinality cap, not just #762's retention window (#3135's fix stopped
+    short of it). Pins the two paths together with the real route, not a
+    reimplementation of it, so a future cap cannot drift between them again.
+    """
+    pytest.importorskip("uvicorn")
+    from starlette.testclient import TestClient  # noqa: PLC0415
+
+    from coord.board_wire import MAX_TERMINAL_ASSIGNMENTS  # noqa: PLC0415
+    from coord.config import load as load_config  # noqa: PLC0415
+    from coord.dao import SqliteStore  # noqa: PLC0415
+    from coord.serve_app import build_app  # noqa: PLC0415
+
+    db_path = tmp_path / "live-shaped.db"
+    _seed_recent_terminal_assignments(db_path, count=MAX_TERMINAL_ASSIGNMENTS + 150)
+
+    app = build_app(SqliteStore(db_path), load_config(valid_config_path))
+    with TestClient(app) as client:
+        resp = client.get("/board")
+    assert resp.status_code == 200
+    route_served = resp.json()["assignments"]
+
+    # Sanity: the seed really is past the cap — otherwise this test cannot
+    # tell the #3451 fix apart from the bug it regression-tests.
+    assert len(route_served) < MAX_TERMINAL_ASSIGNMENTS + 150
+
+    assert dr_verify.live_board_assignment_count(db_path) == len(route_served)
+
+
 # ==========================================================================
 # Acceptance: the scratch copy is removed on EVERY exit path
 # ==========================================================================

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/tests/test_drive_queue.py

@@ -4355,6 +4355,78 @@ def test_a_dead_end_blocked_entry_is_never_resumed():
     assert plan.launch is None
 
 
+def test_a_fix_round_ceiling_blocked_entry_is_never_resumed():
+    """#3454: same posture as the #1844/#2019 permanent blocks above — a
+    #2972 fix-round-ceiling give-up must not auto-resume just because the
+    merge gate reads clear again. Before this fix, `_reconcile_blocked`
+    treated this reason as an ordinary re-checkable `exhausted` (#309's
+    shape) and would have relaunched with `attempts` reset to 0 — handing
+    the entry a fresh work-leg budget the ceiling exists to deny, exactly
+    the quadraui#625 silent-reset bug #2972 itself closed for the ordinary
+    retry path. Contrast with
+    test_a_blocked_entry_whose_live_gate_reads_clear_resumes_with_attempts_reset,
+    where an entry blocked for an ordinary reason DOES resume on identical
+    gate evidence."""
+    entries = [
+        _blocked_entry(
+            1077,
+            position=1,
+            last_reason=(
+                "fix-round ceiling reached across relaunches (#2972): 3 "
+                "work leg(s) already run against a budget of 3 (1 work "
+                "dispatch + 2 fix round(s)) — giving up rather than "
+                "relaunching with a fresh budget. Stopped (#3454): no "
+                "further relaunch, gate-clear resume, or auto-dispatched "
+                "stale-rebase conflict-fix (from any of this fleet's "
+                "independent dispatchers) will fire for this entry — "
+                "`coord drive-queue remove claude-coordinator 1077` + "
+                "`add` (a fresh row) is the only way to give it another "
+                "attempt."
+            ),
+        )
+    ]
+    key = entry_key(REPO, 1077)
+    plan = plan_tick(
+        entries,
+        board(),
+        capacity=1,
+        live_blocked_gate={key: False},  # gate reads clear
+        merge_only_ready={key: True},  # even Merge-only-ready must not fire
+    )
+    assert plan.reconciles == ()
+    assert plan.blocked == ()
+    assert plan.merge_only == ()
+    assert plan.launch is None
+
+
+def test_fix_round_ceiling_blocked_keys_finds_only_2972_blocked_rows():
+    """#3454: `coord.commands.drive_queue._fix_round_ceiling_blocked_keys` —
+    the filter `_run_auto_revalidate_checks_stale` uses so it never
+    re-dispatches a stale-rebase conflict-fix for an entry that already gave
+    up on the ceiling (quadraui#1077: this mechanism fired one 6h07m after
+    the block). A `waiting`/`running` row and a `blocked` row for an
+    UNRELATED (#1844) reason must both be left out — only a genuinely
+    #2972-blocked row counts."""
+    from coord.commands.drive_queue import _fix_round_ceiling_blocked_keys
+
+    ceiling_reason = (
+        "fix-round ceiling reached across relaunches (#2972): 3 work "
+        "leg(s) already run against a budget of 3 — giving up"
+    )
+    entries = [
+        entry(1077, state=STATE_BLOCKED, last_reason=ceiling_reason),
+        entry(
+            70,
+            state=STATE_BLOCKED,
+            last_reason=(
+                "... (#1844); blocking without spending an attempt"
+            ),
+        ),
+        entry(309, state=STATE_WAITING, last_reason=""),
+    ]
+    assert _fix_round_ceiling_blocked_keys(entries) == {(REPO, 1077)}
+
+
 def test_a_blocked_entry_that_has_hit_the_resume_ceiling_stays_blocked_and_says_so():
     """#2230's churn bound: an entry already resumed MAX_BLOCKED_RESUMES times
     must not oscillate forever — it stays `blocked`, but `last_reason` is
@@ -5194,11 +5266,17 @@ def test_a_parked_entry_with_review_still_pending_falls_through_to_the_ordinary_
     assert plan.launch is not None and plan.launch.issue == 2350
 
 
-def test_is_permanent_block_reason_recognises_both_markers_and_nothing_else():
+def test_is_permanent_block_reason_recognises_all_three_markers_and_nothing_else():
     from coord.drive_queue import is_permanent_block_reason
 
     assert is_permanent_block_reason("... (#1844); blocking without spending an attempt")
     assert is_permanent_block_reason("... (#2019); blocking without spending an attempt")
+    # #3454: the #2972 fix-round ceiling joined the permanent set — see
+    # test_a_fix_round_ceiling_block_never_auto_resumes below for why.
+    assert is_permanent_block_reason(
+        "fix-round ceiling reached across relaunches (#2972): 3 work leg(s) "
+        "already run against a budget of 3 — giving up"
+    )
     assert not is_permanent_block_reason(
         "drive session died without landing the work 2/2 times — giving up"
     )
@@ -5206,6 +5284,47 @@ def test_is_permanent_block_reason_recognises_both_markers_and_nothing_else():
     assert not is_permanent_block_reason(None)
 
 
+def test_is_fix_round_ceiling_reason_matches_only_the_2972_marker():
+    """#3454: the narrower predicate `coord.commands.drive_queue` uses to
+    also stop its OWN independent stale-rebase auto-dispatch — must not
+    fire for the OTHER two permanent-block markers, or that other call site
+    would silently widen to #1844/#2019 rows too."""
+    from coord.drive_queue import is_fix_round_ceiling_reason
+
+    assert is_fix_round_ceiling_reason(
+        "fix-round ceiling reached across relaunches (#2972): giving up"
+    )
+    assert not is_fix_round_ceiling_reason(
+        "... (#1844); blocking without spending an attempt"
+    )
+    assert not is_fix_round_ceiling_reason(
+        "... (#2019); blocking without spending an attempt"
+    )
+    assert not is_fix_round_ceiling_reason(
+        "drive session died without landing the work 2/2 times — giving up"
+    )
+    assert not is_fix_round_ceiling_reason("")
+    assert not is_fix_round_ceiling_reason(None)
+
+
+def test_is_fix_round_ceiling_blocked_requires_both_state_and_reason():
+    """#3454 review: `is_fix_round_ceiling_blocked` is the ONE predicate
+    `coord.commands.drive_queue` (via `_fix_round_ceiling_blocked_keys`) AND
+    `coord.notify` (via `_fix_round_ceiling_blocked_for_work`) now both
+    call — must require the LIVE `blocked` state, not just a reason string
+    that merely mentions #2972 (e.g. a stale/archived one from a row an
+    operator already removed and re-added)."""
+    from coord.drive_queue import STATE_BLOCKED, STATE_WAITING, is_fix_round_ceiling_blocked
+
+    ceiling_reason = "fix-round ceiling reached across relaunches (#2972): giving up"
+    assert is_fix_round_ceiling_blocked(STATE_BLOCKED, ceiling_reason)
+    assert not is_fix_round_ceiling_blocked(STATE_WAITING, ceiling_reason)
+    assert not is_fix_round_ceiling_blocked(
+        STATE_BLOCKED, "... (#1844); blocking without spending an attempt"
+    )
+    assert not is_fix_round_ceiling_blocked(STATE_BLOCKED, None)
+
+
 def test_a_genuinely_dead_drive_without_ci_pending_still_retries_normally():
     """No regression: without `merge_ci_pending`, a dead drive takes the
     EXACT pre-#1891 path — this is byte-for-byte

{code_coordinator-0.5.520 → code_coordinator-0.5.522}/tests/test_sqlite_connect_ratchet.py

@@ -220,7 +220,7 @@ SQLITE_CONNECT_ALLOWLIST: dict[str, Classification] = {
         "it.",
     ),
     "test_dr_verify.py": Classification(
-        4, (BUCKET_A,),
+        5, (BUCKET_A,),
         "#3119's DR-verify lane — the restore half of test_backup.py directly "
         "above, and filed A for the same reason. All four sites build or "
         "mutate a real on-disk SQLite *file* that is then snapshotted, "
@@ -239,6 +239,15 @@ SQLITE_CONNECT_ALLOWLIST: dict[str, Classification] = {
         "restore it. (The zero-assignments parity case reuses "
         "hollow_out_assignments() rather than opening its own connection, so "
         "#3135 added one site, not two.) "
+        "+1 for #3451's _seed_recent_terminal_assignments(), which bulk-"
+        "inserts RECENT terminal rows past #1791's MAX_TERMINAL_ASSIGNMENTS "
+        "cardinality cap into a real on-disk file so the live side can be "
+        "pinned against a genuine /board TestClient response — the case "
+        "live_board_assignment_count silently skipped before this fix, "
+        "because #3135's retention window alone was not enough to trigger "
+        "the cap. Same file, same reason: it has to be an on-disk file "
+        "because the very next thing the test does is open it through both "
+        "SqliteStore(by path) and dr_verify.live_board_assignment_count(). "
         "The autouse coord_db fixture cannot serve any of them — there "
         "is no file to restic — and scratch_database() is out for the usual "
         "backend-following reason: under COORD_TEST_BACKEND=postgres these "