code-coordinator 0.5.560__tar.gz → 0.5.561__tar.gz

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.560
+Version: 0.5.561
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.560
+Version: 0.5.561
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.560",
+  "tag": "0.5.561",
   "distance": 0,
-  "node": "g5666afa7cb4eb204e33eebc0db6a4970b8c18242",
+  "node": "g719f616d563fc6b94375e7381da2f4b6bc6c833d",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-02"

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/coord/ci_store.py

@@ -733,7 +733,7 @@ def is_verdictless_job(check: CheckRun, job: JobRun | None) -> bool:
 
 
 def checks_are_stale(checks: list[CheckRun], base_commit_time: float | None) -> bool:
-    """True when a **green** *checks* result predates *base_commit_time* (#1851).
+    """True when *checks* predate *base_commit_time* (#1851).
 
     GitHub attaches ``pull_request`` check runs to the PR's *head* SHA and
     re-runs them on head ``synchronize`` — never on base movement — so a
@@ -742,10 +742,17 @@ def checks_are_stale(checks: list[CheckRun], base_commit_time: float | None) ->
     what matters is what the base looked like when the run *began*, not when
     it finished.
 
-    Callers should apply :func:`failed_checks`/:func:`in_flight_checks`
-    first — this function assumes *checks* is the all-passing remainder and
-    doesn't re-derive that itself, so it never contradicts "CI failed"/"CI
-    running" with a third, competing reading of the same checks. An empty
+    Originally written for the caller's all-**passing** remainder — apply
+    :func:`failed_checks`/:func:`in_flight_checks` first and pass what's
+    left, so this never contradicts "CI failed"/"CI running" with a third,
+    competing reading of the same checks. #1986 also calls this with the
+    FAILED remainder instead (``coord.merge_queue``'s ``checks_failed``
+    path): the comparison itself never inspects ``conclusion``, only
+    ``started_at``, so "did this run predate the base?" is the identical
+    question either way — there is no second notion of CI staleness for the
+    red case, only a second caller asking the same one (#2096: one question,
+    one answer). Which verdict a stale run carries decides what the caller's
+    message says; it never decides whether the merge blocks. An empty
     *checks* list (nothing to compare) reads as not-stale; the caller's own
     "no checks" handling covers that case — see :meth:`CiStore.expects_checks`
     and ``coord.merge_queue``'s ``checks_absent`` gate (#1904), which now

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/coord/merge_queue.py

@@ -2770,9 +2770,19 @@ def _ci_checks_are_stale(
     *,
     fail_closed: bool = True,
 ) -> bool:
-    """True when *checks* — already confirmed by the caller to have no
-    failed/in-flight entries — are stale relative to *target_branch*'s
-    current base (#1851).
+    """True when *checks* are stale relative to *target_branch*'s current
+    base (#1851).
+
+    Originally written for the caller's all-PASSING remainder (no
+    failed/in-flight entries) — the ``checks_stale`` path below. #1986 reuses
+    it unchanged for the FAILED remainder too: the underlying comparison
+    (``started_at`` vs. the base's current commit time, via
+    :func:`coord.ci_store.checks_are_stale`) never reads ``conclusion``, so
+    "did this run see the base's current tip?" has exactly one answer
+    regardless of which way the run concluded (#2096: one question, one
+    answer). A stale FAILING check still blocks the merge either way — this
+    only changes whether the refusal names the staleness, never the
+    pass/fail verdict itself.
 
     GitHub does not re-run ``pull_request`` workflows on a base-only move
     (only on head ``synchronize``), so a green check can silently outlive the
@@ -2906,6 +2916,50 @@ def ci_stale_reason(
     )
 
 
+def checks_failed_stale_suffix(
+    failed: "list[CheckRun]",
+    gh_ops: "GhOps | None",
+    repo_github: str | None,
+    target_branch: str | None,
+) -> str:
+    """Clause appended to a ``checks failed: ...`` refusal when the failing
+    run(s) predate *target_branch*'s current base (#1986).
+
+    Hit while merging #1895: a `windows` check was red for `ModuleNotFoundError:
+    No module named 'fcntl'` — a bug #1156 had already fixed on `main` 33
+    commits before this branch's base. The gate reported it as a bare,
+    current-looking failure, inviting either pointless debugging of a defect
+    that no longer exists, or a `--force-merge` reasoned on "it's probably
+    just flaky" — neither of which an operator should have to guess at when
+    the gate already has the evidence.
+
+    #1851/:func:`ci_stale_reason` already answers "did this run see the
+    base's current tip?" for a stale PASSING check; this is the exact same
+    question for a FAILING one, so it reuses :func:`ci_staleness_note` for
+    the anchor wording rather than inventing a second rendering of "predates
+    the base" (#2096: one question, one answer). Callers decide staleness
+    first via :func:`_ci_checks_are_stale` — this never makes that call
+    itself, only renders the clause once asked to.
+
+    Returns ``""`` when the anchors can't be read — the same unreadable case
+    :func:`ci_staleness_note` itself falls back on — so the caller's plain
+    ``checks failed: ...`` message prints unchanged rather than asserting
+    staleness evidence this can't actually produce. Either way the refusal
+    still BLOCKS: this only ever adds provenance to an existing block, never
+    removes or downgrades it.
+    """
+    note = ci_staleness_note(failed, gh_ops, repo_github, target_branch)
+    if not note:
+        return ""
+    branch = target_branch or "the target branch"
+    return (
+        " — but that run predates the current base" + note + " — rebase "
+        f"onto {branch} and push (`git push --force-with-lease`) and let CI "
+        "re-run before trusting this result; a CI re-run against the same "
+        "base cannot see a moved base"
+    )
+
+
 # #1826: `--force-merge` still overrides the CI gate, but the override must
 # never be SILENT — the same posture `epic_closing_keyword_in_commit_forced`
 # already takes for the #1318 gate. A waived stale-CI merge is precisely the
@@ -7649,11 +7703,26 @@ def process(
                             summary = ", ".join(
                                 f"{c.name} ({c.conclusion})" for c in failed
                             )
-                            msg = (
-                                unreadable_reason
-                                or infra_reason
-                                or f"checks failed: {summary}"
-                            )
+                            if unreadable_reason:
+                                msg = unreadable_reason
+                            elif infra_reason:
+                                msg = infra_reason
+                            else:
+                                # #1986: preview the same staleness
+                                # provenance the live path now adds to a
+                                # bare `checks failed: ...` — see
+                                # `checks_failed_stale_suffix`'s docstring.
+                                # Preview-only: never mutates, just shows
+                                # what a real attempt would compute.
+                                msg = f"checks failed: {summary}"
+                                if _ci_checks_are_stale(
+                                    failed, gh_ops, entry.repo_github,
+                                    entry.target_branch, _smoke,
+                                ):
+                                    msg += checks_failed_stale_suffix(
+                                        failed, gh_ops, entry.repo_github,
+                                        entry.target_branch,
+                                    )
                             events.append(MergeEvent(
                                 entry, "checks_failed",
                                 f"(dry run) would be blocked: {msg}",
@@ -8283,6 +8352,20 @@ def process(
                         # this already-confirmed streak as a flake.
                         entry.ci_flaky_pending = ""
                     msg = f"checks failed: {summary}"
+                    # #1986: a RED check can be exactly as stale as a GREEN
+                    # one (#1851) — it just looks like a current defect
+                    # instead of an obvious re-test candidate, which is what
+                    # invites either pointless debugging of a bug already
+                    # fixed on the current base, or a wrong `--force-merge`.
+                    # Reports provenance only; the entry still blocks either
+                    # way (see `checks_failed_stale_suffix`'s docstring).
+                    if _ci_checks_are_stale(
+                        failed, gh_ops, entry.repo_github, entry.target_branch,
+                        smoke,
+                    ):
+                        msg += checks_failed_stale_suffix(
+                            failed, gh_ops, entry.repo_github, entry.target_branch,
+                        )
                     entry.error = msg
                     events.append(MergeEvent(entry, "checks_failed", msg))
                     continue  # #292: skip, don't halt the group

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/conftest.py

@@ -1304,3 +1304,33 @@ def _no_frozen_coord_dir_constants():
     _scrub_lazy_coord_dir_constants()
     yield
     _scrub_lazy_coord_dir_constants()
+
+
+@pytest.fixture(autouse=True)
+def _non_wsl_host_by_default(monkeypatch):
+    """#3532: ``coord.win_native_bridge.is_wsl_host`` detects the REAL host
+    it's running on (``WSL_DISTRO_NAME``/``/proc/version``) — fine for
+    production, but it means every ``win-native`` acceptance-driver test
+    that doesn't scripts its own ``run_native_spec``/bridge fake implicitly
+    assumed "whatever machine runs this test suite is not WSL". That held
+    for every machine except dell64 (a genuine WSL2 host with a working
+    Windows-side Python, #3519): there, ``is_wsl_host()`` legitimately
+    returns ``True`` and ``coord.acceptance_drivers._run_win_native`` takes
+    the real WSL->Windows bridge path instead of the scripted fake these
+    tests set up on ``coord.win_native_driver.run_native_spec`` — a
+    baseline-red latch (#3386), not a test bug in the assertions themselves.
+
+    Forcing the DEFAULT to non-WSL here, once, is the same "one question,
+    one answer" posture as this file's other ``_no_real_*``/``_no_live_*``
+    fixtures: every test in the suite gets a hermetic answer to "is this
+    host WSL" regardless of which machine actually runs it. A test that
+    means to exercise the WSL/bridge branch (``TestRunDriverWinNativeWslBridge``
+    in ``tests/test_acceptance_drivers.py``) monkeypatches
+    ``win_native_bridge.is_wsl_host`` back to ``True`` itself, inside the
+    test body — that call reuses this same function-scoped ``monkeypatch``
+    fixture and so simply wins (last ``setattr`` on the same attribute),
+    no ordering trick needed.
+    """
+    import coord.win_native_bridge as win_native_bridge
+
+    monkeypatch.setattr(win_native_bridge, "is_wsl_host", lambda: False)

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/test_acceptance_drivers.py

@@ -1699,6 +1699,32 @@ class TestRunDriverWinNativeWslBridge:
         result = run_driver("win-native", "./vimcode.exe", cwd=str(tmp_path), entrypoint="native.yaml")
         assert result.exit_code == 0
 
+    def test_hermetic_default_beats_a_real_looking_wsl_environ(self, tmp_path, monkeypatch) -> None:
+        """#3532: dell64 is a genuine WSL host, so ``conftest.py``'s
+        ``_non_wsl_host_by_default`` autouse fixture must win over
+        ``is_wsl_host``'s OWN detection inputs outright — not merely happen
+        to agree with them because the box running this particular test
+        suite isn't WSL. Forcing ``WSL_DISTRO_NAME`` (the stronger of
+        ``is_wsl_host``'s two signals, and the one WSL sets for every
+        interactive/non-interactive shell alike) to look exactly like
+        dell64, and confirming the in-process (non-bridge) path still runs,
+        proves the fixture actually overrides the real signal rather than
+        coincidentally matching a non-WSL test runner."""
+        monkeypatch.setenv("WSL_DISTRO_NAME", "Ubuntu")
+
+        spec = tmp_path / "native.yaml"
+        spec.write_text("steps:\n  - type: launch\n")
+
+        import coord.win_native_driver as win_native_driver
+
+        def fake_run_native_spec(spec_text, *, launch_command, cwd, timeout=None):
+            return [{"id": "000 launch", "status": "pass", "message": ""}]
+
+        monkeypatch.setattr(win_native_driver, "run_native_spec", fake_run_native_spec)
+
+        result = run_driver("win-native", "./vimcode.exe", cwd=str(tmp_path), entrypoint="native.yaml")
+        assert result.exit_code == 0
+
 
 class TestRunDriverMacNative:
     """#3485: the ``mac-native`` driver — the actual Quartz/AX calls, the

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/test_drive_queue.py

@@ -7364,6 +7364,27 @@ def test_merge_gate_remedy_command_falls_back_to_inspect_for_red_ci():
     assert "drive-queue remove" not in command
 
 
+def test_merge_gate_remedy_command_recognizes_a_stale_checks_failed_reason():
+    """#1986: a RED check that predates the current base still carries the
+    plain `checks failed` prefix (`coord/merge_queue.py`'s
+    `checks_failed_stale_suffix` only ever APPENDS to it) — so this must
+    keep matching here exactly as the bare #2983-less red-CI shape does
+    above, not fall through to "not a merge-gate block" just because the
+    message now also names the stale base."""
+    reason = (
+        "checks failed: windows (failure) — but that run predates the "
+        "current base (ran against main as of 2026-08-07T03:33:48Z, main "
+        "now 2026-08-08T01:02:03Z) — rebase onto main and push (`git push "
+        "--force-with-lease`) and let CI re-run before trusting this "
+        "result; a CI re-run against the same base cannot see a moved base"
+    )
+    assert is_merge_gate_block_reason(reason) is True
+    command = merge_gate_remedy_command(reason, REPO, 1986)
+    assert command == merge_plan_inspect_command(REPO)
+    assert "revalidate" not in command
+    assert "drive-queue remove" not in command
+
+
 def test_merge_gate_remedy_command_falls_back_to_inspect_for_review_required():
     reason = (
         "review_required — coord merge's own gate reports 'review missing', "

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/test_install_agent_wsl_bridge_3515.py

@@ -73,9 +73,33 @@ exit 1
     _write_exe(fake_bin / "systemctl", "#!/usr/bin/env bash\nexit 0\n")
     for noop in ("loginctl", "claude"):
         _write_exe(fake_bin / noop, "#!/usr/bin/env bash\nexit 0\n")
+    _write_exe(fake_bin / "grep", _GREP_STUB)
     return fake_bin
 
 
+#: #3532: `install-agent.sh`'s WSL-detection fallback is literally
+#: `grep -qi microsoft /proc/version` (consulted only when `WSL_DISTRO_NAME`
+#: is unset) — run for real, that reads the actual host's `/proc/version`,
+#: which says "microsoft" on a genuine WSL2 host (dell64) regardless of
+#: which branch THIS test means to exercise. Intercepting exactly that one
+#: invocation and answering from `$COORD_TEST_PROC_VERSION_IS_WSL` (set by
+#: `_run_installer` below, from the same `wsl=` flag the test author
+#: already passed) makes the installer's WSL detection hermetic the same
+#: way `tests/conftest.py`'s `_non_wsl_host_by_default` does for the Python
+#: driver path — every OTHER `grep` call (e.g. the `python3 --version`
+#: compatibility check) is forwarded to the real binary unchanged.
+_GREP_STUB = """#!/usr/bin/env bash
+if [ "$1" = "-qi" ] && [ "$2" = "microsoft" ] && [ "$3" = "/proc/version" ]; then
+    if [ "${COORD_TEST_PROC_VERSION_IS_WSL:-0}" = "1" ]; then
+        exit 0
+    else
+        exit 1
+    fi
+fi
+exec /usr/bin/grep "$@"
+"""
+
+
 def _bridge_log(tmp_path: Path) -> Path:
     return tmp_path / "home" / "bridge-ensure.log"
 
@@ -111,6 +135,12 @@ def _run_installer(
         env["WSL_DISTRO_NAME"] = "Ubuntu"
     else:
         env.pop("WSL_DISTRO_NAME", None)
+    # #3532: back the installer's `/proc/version` fallback check with the
+    # same `wsl=` flag, via the `grep` stub in `_make_fake_bin`, instead of
+    # leaving it to read the REAL host's `/proc/version` — a genuine WSL2
+    # host (dell64) would otherwise always win that check regardless of
+    # what `WSL_DISTRO_NAME` above says.
+    env["COORD_TEST_PROC_VERSION_IS_WSL"] = "1" if wsl else "0"
     return subprocess.run(
         [POSIX_BASH, str(INSTALLER), "--machine", "testhost", *extra_args],
         cwd=tmp_path,

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/test_merge_queue.py

@@ -44,14 +44,20 @@ def _check(
     status: str = "completed",
     conclusion: str | None = "failure",
     run_id: str = "1",
+    started_at: float | None = None,
 ) -> CheckRun:
     """#1892 test helper: a `CheckRun` with a settable `run_id`, needed to
     exercise `_ci_infra_reason`'s per-run job lookup — mirrors
-    `tests/test_ci_store.py`'s `_check`, which has no `run_id` parameter."""
+    `tests/test_ci_store.py`'s `_check`, which has no `run_id` parameter.
+
+    `started_at` (#1986) lets a caller position the run before/after a
+    fake base timestamp, to exercise the `checks_failed` staleness wording
+    — defaults to `None` (unreadable anchor) exactly like every pre-#1986
+    caller of this helper, so none of them need updating."""
     return CheckRun(
         name=name, status=status, conclusion=conclusion,
         url=f"https://gh/runs/{run_id}", run_id=run_id,
-        started_at=None, completed_at=None,
+        started_at=started_at, completed_at=None,
     )
 
 
@@ -9590,6 +9596,126 @@ class TestTwoGreenBranchesOneBaseMove:
         assert gh.ts_calls == 1  # the gate's own read, and nothing more
 
 
+class TestChecksFailedStaleness:
+    """#1986: a FAILING check can be exactly as stale as a #1851 PASSING
+    one — this issue's live incident (#1895) was a `windows` check red for
+    `fcntl` import failure that #1156 had already fixed on `main`, 33
+    commits before this branch's base. Unlike a stale pass (reported with
+    full provenance since #1851), a stale failure used to be reported as a
+    bare, current-looking defect, inviting either pointless debugging of a
+    bug that no longer exists, or a wrong `--force-merge`.
+
+    Acceptance: the refusal still BLOCKS either way — only the message
+    changes, never the decision — and a CURRENT failing check must be
+    reported exactly as before (no staleness wording), so the signal stays
+    meaningful."""
+
+    class _Gh(FakeGh):
+        ts: float = 1000.0
+        def get_branch_commit_timestamp(self, repo, branch):
+            return self.ts
+
+    @staticmethod
+    def _ci(failed_started_at: float | None):
+        class _Ci:
+            is_available = True
+            def list_checks_for_pr(self, repo, number):
+                return [_check("windows", started_at=failed_started_at)]
+        return _Ci()
+
+    def test_stale_failure_names_both_anchors_and_still_blocks(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = self._Gh()
+        events = process(items, gh, ci_store=self._ci(failed_started_at=500.0))
+
+        assert items[0].state == PENDING  # still blocks
+        kinds = [e.kind for e in events]
+        assert "checks_failed" in kinds
+        failed = [e for e in events if e.kind == "checks_failed"][0]
+        assert failed.message.startswith("checks failed:")  # #2212: drive_queue matches on this
+        assert "predates the current base" in failed.message
+        assert "rebase" in failed.message
+        assert items[0].error == failed.message
+
+    def test_current_failure_has_no_staleness_wording(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = self._Gh()
+        events = process(items, gh, ci_store=self._ci(failed_started_at=1500.0))
+
+        assert items[0].state == PENDING  # still blocks
+        failed = [e for e in events if e.kind == "checks_failed"][0]
+        assert failed.message == "checks failed: windows (failure)"
+        assert "predates the current base" not in failed.message
+        assert "stale" not in failed.message.lower()
+
+    def test_stale_and_current_failure_reasons_differ(self) -> None:
+        """Acceptance criterion: the two reason strings must differ."""
+        stale_items = [_q("w1", pr=99)]
+        stale_events = process(
+            stale_items, self._Gh(), ci_store=self._ci(failed_started_at=500.0),
+        )
+        current_items = [_q("w2", pr=100)]
+        current_events = process(
+            current_items, self._Gh(), ci_store=self._ci(failed_started_at=1500.0),
+        )
+        stale_msg = [e for e in stale_events if e.kind == "checks_failed"][0].message
+        current_msg = [e for e in current_events if e.kind == "checks_failed"][0].message
+        assert stale_msg != current_msg
+        # Both share the same prefix — only the provenance differs.
+        assert stale_msg.startswith("checks failed: windows (failure)")
+        assert current_msg == "checks failed: windows (failure)"
+
+    def test_dry_run_previews_the_same_staleness_wording(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = self._Gh()
+        events = process(
+            items, gh, ci_store=self._ci(failed_started_at=500.0), dry_run=True,
+        )
+        assert items[0].state == PENDING
+        failed = [e for e in events if e.kind == "checks_failed"][0]
+        assert "would be blocked: checks failed:" in failed.message
+        assert "predates the current base" in failed.message
+
+    def test_dry_run_current_failure_has_no_staleness_wording(self) -> None:
+        items = [_q("w1", pr=99)]
+        gh = self._Gh()
+        events = process(
+            items, gh, ci_store=self._ci(failed_started_at=1500.0), dry_run=True,
+        )
+        failed = [e for e in events if e.kind == "checks_failed"][0]
+        assert failed.message == "(dry run) would be blocked: checks failed: windows (failure)"
+
+    def test_unreadable_base_anchor_omits_the_claim_rather_than_guessing(self) -> None:
+        """When the base timestamp can't be read at all, the stale-looking
+        default inside `_ci_checks_are_stale` must NOT make this function
+        assert staleness it has no evidence for — `ci_staleness_note`'s own
+        anchor read fails the same way and the suffix comes back empty."""
+        class _NoTimestampGh(FakeGh):
+            pass
+
+        items = [_q("w1", pr=99)]
+        events = process(
+            items, _NoTimestampGh(), ci_store=self._ci(failed_started_at=500.0),
+        )
+        failed = [e for e in events if e.kind == "checks_failed"][0]
+        assert failed.message == "checks failed: windows (failure)"
+
+    def test_checks_failed_stale_suffix_direct(self) -> None:
+        """Direct unit coverage of the suffix renderer, independent of the
+        `process()` plumbing around it."""
+        failed = [_check("windows", started_at=500.0)]
+        suffix = mq.checks_failed_stale_suffix(
+            failed, self._Gh(), "acme/api", "main",
+        )
+        assert "predates the current base" in suffix
+        assert "rebase" in suffix
+
+    def test_checks_failed_stale_suffix_empty_when_anchor_unreadable(self) -> None:
+        failed = [_check("windows", started_at=500.0)]
+        suffix = mq.checks_failed_stale_suffix(failed, None, "acme/api", "main")
+        assert suffix == ""
+
+
 class TestProcessConflictedEmptyChecks:
     """#1877: a conflicted PR reports zero CI checks — GitHub can't build a
     merge ref to run a `pull_request`-triggered workflow against it. Before

{code_coordinator-0.5.560 → code_coordinator-0.5.561}/tests/test_throwaway_vm.py

@@ -347,7 +347,14 @@ def test_teardown_fires_on_interrupt(stubs: dict) -> None:
         # before the script installed its teardown trap, leaving no `az group
         # delete` and a 50-attempt wait loop still running, which surfaced as
         # the communicate() timeout rather than an honest failure.
-        deadline = time.monotonic() + 30.0
+        #
+        # #3534: this is poll-and-observe already, not a fixed sleep, but a
+        # 30s ceiling was not generous enough once a Test leg runs the whole
+        # suite in parallel on a busy host -- scheduling delays alone can eat
+        # that budget before the first `ssh ... true` probe even lands in the
+        # log. Widen the ceiling; the loop still exits the instant the
+        # evidence shows up, so this costs nothing on an idle box.
+        deadline = time.monotonic() + 60.0
         while time.monotonic() < deadline:
             if any(c.endswith(" true") for c in _ssh_calls(stubs)):
                 break
@@ -356,13 +363,31 @@ def test_teardown_fires_on_interrupt(stubs: dict) -> None:
             time.sleep(0.05)
         else:
             os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
-            proc.communicate(timeout=5)
+            proc.communicate(timeout=15)
             pytest.fail("script never reached its SSH-reachability wait loop")
         os.killpg(os.getpgid(proc.pid), signal.SIGINT)
-        stdout, _ = proc.communicate(timeout=30)
+
+        # #3534: assert teardown on its OWN observed evidence -- the `az
+        # group delete` call actually landing in the log -- with its own
+        # generous, bounded poll, rather than gating that assertion behind
+        # the *process* having fully exited and its stdout pipe having fully
+        # drained. Those are two different conditions: under heavy parallel
+        # load the pipe can take a while to drain even after teardown has
+        # already run, and `communicate()`'s one combined timeout couples
+        # "did teardown fire" to "did the pipe finish draining" -- the wrong
+        # observation for what this test is actually asserting.
+        teardown_deadline = time.monotonic() + 60.0
+        while time.monotonic() < teardown_deadline:
+            if any(c.startswith("group delete") for c in _az_calls(stubs)):
+                break
+            if proc.poll() is not None:  # process already gone either way
+                break
+            time.sleep(0.05)
+
+        stdout, _ = proc.communicate(timeout=60)
     except subprocess.TimeoutExpired:
         os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
-        proc.communicate(timeout=5)
+        proc.communicate(timeout=15)
         pytest.fail("script did not exit after SIGINT")
 
     assert proc.returncode != 0, stdout