code-coordinator 0.5.56__tar.gz → 0.5.58__tar.gz

{code_coordinator-0.5.56/code_coordinator.egg-info → code_coordinator-0.5.58}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.56
+Version: 0.5.58
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.56 → code_coordinator-0.5.58/code_coordinator.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.56
+Version: 0.5.58
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/code_coordinator.egg-info/SOURCES.txt

@@ -100,6 +100,7 @@ coord/pipeline.py
 coord/plan_parser.py
 coord/plans.py
 coord/platform_paths.py
+coord/portal_bridge.py
 coord/pr_body_lint.py
 coord/prereqs.py
 coord/progress.py
@@ -149,6 +150,7 @@ coord/commands/merge.py
 coord/commands/milestone.py
 coord/commands/plan_followup.py
 coord/commands/plans.py
+coord/commands/portal.py
 coord/commands/release.py
 coord/commands/report.py
 coord/commands/review.py
@@ -484,6 +486,7 @@ tests/test_cli_milestone_ship.py
 tests/test_cli_network.py
 tests/test_cli_new_issue_chat.py
 tests/test_cli_plans.py
+tests/test_cli_portal.py
 tests/test_cli_pull_artifact.py
 tests/test_cli_queue.py
 tests/test_cli_reattach_sessions.py
@@ -634,6 +637,8 @@ tests/test_plan_followup_review_command.py
 tests/test_plan_only.py
 tests/test_plan_parser.py
 tests/test_platform_paths.py
+tests/test_portal_bridge.py
+tests/test_portal_config.py
 tests/test_pr_body_lint.py
 tests/test_prereqs.py
 tests/test_production_db_guard.py

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/code_coordinator.egg-info/scm_file_list.json

@@ -61,6 +61,7 @@
     "coord/commands/milestone.py",
     "coord/commands/plan_followup.py",
     "coord/commands/plans.py",
+    "coord/commands/portal.py",
     "coord/commands/release.py",
     "coord/commands/report.py",
     "coord/commands/review.py",
@@ -272,6 +273,7 @@
     "coord/plan_parser.py",
     "coord/plans.py",
     "coord/platform_paths.py",
+    "coord/portal_bridge.py",
     "coord/pr_body_lint.py",
     "coord/prereqs.py",
     "coord/progress.py",
@@ -514,6 +516,7 @@
     "tests/test_cli_network.py",
     "tests/test_cli_new_issue_chat.py",
     "tests/test_cli_plans.py",
+    "tests/test_cli_portal.py",
     "tests/test_cli_pull_artifact.py",
     "tests/test_cli_queue.py",
     "tests/test_cli_reattach_sessions.py",
@@ -664,6 +667,8 @@
     "tests/test_plan_only.py",
     "tests/test_plan_parser.py",
     "tests/test_platform_paths.py",
+    "tests/test_portal_bridge.py",
+    "tests/test_portal_config.py",
     "tests/test_pr_body_lint.py",
     "tests/test_prereqs.py",
     "tests/test_production_db_guard.py",

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.56",
+  "tag": "0.5.58",
   "distance": 0,
-  "node": "gb8053d5c79cc3a574e1df4a7543e49d6a6d09410",
+  "node": "g36b37b343666fd25278ef49e2b4521e94ec1a50a",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-13"

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/coord/cli.py

@@ -87,6 +87,9 @@ from coord.health.cli import health
 # #1632: same arrangement for the fleet notifier — predicate, baselines,
 # transport seam and CLI all live in coord/notifier/.
 from coord.notifier.cli import notifier_group
+# #2179: coord-portal sync bridge client — coord/portal_bridge.py is the
+# client, coord/commands/portal.py is the CLI over it.
+from coord.commands.portal import portal_group
 from coord.commands.merge import (
     bounce,
     merge,
@@ -391,6 +394,7 @@ main.add_command(gates)
 main.add_command(doctor)
 main.add_command(health)
 main.add_command(notifier_group)
+main.add_command(portal_group)
 main.add_command(issue_group)
 main.add_command(context_group)
 main.add_command(audit)

code_coordinator-0.5.58/coord/commands/portal.py

@@ -0,0 +1,120 @@
+"""``coord portal`` — exercise the coord-portal sync bridge client (#2179).
+
+Everything that automatically decides *when* to push a status, and *which*
+coord-side work a portal submission maps to, is out of scope here (see
+``coord/portal_bridge.py``'s module docstring — that is follow-up work this
+issue deliberately did not take on). What exists today is the thin client
+plus enough CLI surface to:
+
+* prove the credential pair actually works (``coord portal heartbeat``),
+  which is also how an operator manually verifies #2179's acceptance shape
+  end to end once ``BRIDGE_CLIENT_ID``/``BRIDGE_CLIENT_SECRET`` are set — a
+  submission's ``/deliveries`` row going ``queued`` → ``sent`` in production
+  is only reachable at all once something has pushed a status; and
+* push one status update by hand (``coord portal push``), so a submission's
+  status can be moved even before anything automatic drives it.
+"""
+
+from __future__ import annotations
+
+import json
+
+import click
+
+from coord.commands._common import _CONFIG_OPTION, _load_config
+from coord.portal_bridge import (
+    PortalBridgeError,
+    SUBMISSION_STATUSES,
+    client_from_config,
+)
+
+
+@click.group("portal")
+def portal_group() -> None:
+    """coord-portal sync bridge — status, manual push, heartbeat (#2179)."""
+
+
+@portal_group.command("status")
+@_CONFIG_OPTION
+@click.option("--json", "as_json", is_flag=True, default=False)
+def portal_status(config_path, as_json: bool) -> None:
+    """Show whether the portal bridge is configured, without sending anything."""
+    cfg = _load_config(config_path).portal
+    payload = {
+        "enabled": cfg.enabled,
+        "base_url": cfg.base_url,
+        "credentials_set": bool(cfg.bridge_client_id and cfg.bridge_client_secret),
+        "timeout_secs": cfg.timeout_secs,
+        "max_retries": cfg.max_retries,
+    }
+    if as_json:
+        click.echo(json.dumps(payload, indent=2, sort_keys=True))
+        return
+    if not cfg.enabled:
+        click.echo("portal: disabled (no 'portal:' block, or portal.enabled: false)")
+        return
+    click.echo(f"portal: ENABLED  base_url={cfg.base_url}  "
+               f"credentials={'set' if payload['credentials_set'] else 'MISSING'}")
+
+
+@portal_group.command("heartbeat")
+@_CONFIG_OPTION
+def portal_heartbeat(config_path) -> None:
+    """Send one heartbeat, proving the credential pair and base_url work.
+
+    Exits non-zero on failure — a 401 here means BRIDGE_CLIENT_ID/SECRET on
+    this side do not match what the portal has (or Cloudflare Access is
+    rejecting the request before it even gets there).
+    """
+    cfg = _load_config(config_path).portal
+    client = client_from_config(cfg)
+    if client is None:
+        click.secho(
+            "portal is not enabled — nothing to do (see `coord portal status`)",
+            fg="yellow",
+        )
+        raise SystemExit(1)
+    try:
+        ok = client.heartbeat()
+    except PortalBridgeError as exc:
+        click.secho(f"heartbeat failed: {exc}", fg="red")
+        raise SystemExit(1) from exc
+    if ok:
+        click.secho("heartbeat sent", fg="green")
+        return
+    click.secho("heartbeat sent but portal did not confirm 'ok'", fg="red")
+    raise SystemExit(1)
+
+
+@portal_group.command("push")
+@_CONFIG_OPTION
+@click.argument("submission_id")
+@click.argument("revision", type=int)
+@click.argument("status", type=click.Choice(SUBMISSION_STATUSES))
+def portal_push(config_path, submission_id: str, revision: int, status: str) -> None:
+    """Push one status update by hand: SUBMISSION_ID REVISION STATUS.
+
+    REVISION must be strictly greater than whatever the portal last accepted
+    for this submission, or the push comes back `already_applied` (a
+    success, not an error — see coord-portal's src/bridge/updates.ts).
+    """
+    cfg = _load_config(config_path).portal
+    client = client_from_config(cfg)
+    if client is None:
+        click.secho(
+            "portal is not enabled — nothing to do (see `coord portal status`)",
+            fg="yellow",
+        )
+        raise SystemExit(1)
+    try:
+        result = client.push_status(submission_id, revision, status)
+    except PortalBridgeError as exc:
+        click.secho(f"push failed: {exc}", fg="red")
+        raise SystemExit(1) from exc
+    if result.ok:
+        click.secho(f"{result.outcome}: {submission_id}@{revision} -> {status}", fg="green")
+        return
+    click.secho(
+        f"rejected: {submission_id}@{revision} -> {status} ({result.reason})", fg="red"
+    )
+    raise SystemExit(1)

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/coord/config.py

@@ -1671,6 +1671,41 @@ class NotificationsConfig:
     cold_ceiling_mins: dict[str, float] = field(default_factory=dict)
 
 
+@dataclass
+class PortalConfig:
+    """The outbound client to coord-portal's sync bridge (#2179, ``docs/CUSTOMER_PORTAL.md``).
+
+    Absent block == disabled == coord never talks to the portal — unchanged
+    behaviour for every existing deployment, and the correct default until
+    ``BRIDGE_CLIENT_ID``/``BRIDGE_CLIENT_SECRET`` actually exist in production
+    (they do not, as of #2179: ``wrangler secret list`` on the portal has no
+    entry for either).
+
+    The portal is a third party from coord's perspective — a push failure
+    must be retried and surfaced, never fatal to a merge or a dispatch.
+    Nothing in :mod:`coord.portal_bridge` sits on the dispatch path; it is a
+    client other code calls, not a check anything blocks on.
+    """
+
+    enabled: bool = False
+    # e.g. "https://intake.heurontech.com". No default: a client pointed at
+    # nothing by accident is worse than one that refuses to start.
+    base_url: str | None = None
+    # The Cloudflare Access service-token pair coord-portal's
+    # ``isBridgeAuthorized`` requires as a matched, non-empty pair (half a
+    # credential is not a credential, and it fails closed on exactly that).
+    # Support ``${VAR}`` expansion (mirrors ``providers.definitions[*].env``)
+    # so the real secret lives in the environment, never committed in
+    # coordinator.yml.
+    bridge_client_id: str | None = None
+    bridge_client_secret: str | None = None
+    timeout_secs: float = 10.0
+    # Retries are for transient/5xx failures only — see
+    # coord.portal_bridge.PortalBridgeClient. A 401 never retries: a bad
+    # credential does not become a good one on attempt two.
+    max_retries: int = 2
+
+
 @dataclass
 class Config:
     repos: list[Repo]
@@ -1695,6 +1730,8 @@ class Config:
     health: HealthConfig = field(default_factory=HealthConfig)
     # #1632 — absent block == disabled == today's behaviour (silence).
     notifications: NotificationsConfig = field(default_factory=NotificationsConfig)
+    # #2179 — absent block == disabled == coord never talks to coord-portal.
+    portal: PortalConfig = field(default_factory=PortalConfig)
     path: Path | None = None
 
     def repo(self, name: str) -> Repo | None:
@@ -1767,6 +1804,7 @@ def parse_mapping(raw: Any, *, path: Path | None = None) -> Config:
     pricing = _parse_pricing(raw.get("pricing"))
     health = _parse_health(raw.get("health"))
     notifications = _parse_notifications(raw.get("notifications"))
+    portal = _parse_portal(raw.get("portal"))
 
     return Config(
         repos=repos,
@@ -1789,6 +1827,7 @@ def parse_mapping(raw: Any, *, path: Path | None = None) -> Config:
         pricing=pricing,
         health=health,
         notifications=notifications,
+        portal=portal,
         path=p,
     )
 
@@ -3239,6 +3278,85 @@ def _expand_env_vars(value: str) -> str:
     return _ENV_VAR_RE.sub(_replace, value)
 
 
+_PORTAL_PLAIN_STR_FIELDS = ("base_url",)
+_PORTAL_SECRET_STR_FIELDS = ("bridge_client_id", "bridge_client_secret")
+
+
+def _parse_portal(raw: Any) -> PortalConfig:
+    """Parse the optional ``portal:`` block from coordinator.yml (#2179).
+
+    An absent block returns a **disabled** :class:`PortalConfig` — unchanged
+    behaviour for every existing deployment, and the correct default until
+    ``BRIDGE_CLIENT_ID``/``BRIDGE_CLIENT_SECRET`` exist in production.
+    """
+    if raw is None:
+        return PortalConfig()
+    if not isinstance(raw, dict):
+        raise ConfigError("'portal' must be a mapping")
+
+    cfg = PortalConfig()
+    known = {f.name for f in fields(PortalConfig)}
+    unknown = sorted(set(raw) - known)
+    if unknown:
+        raise ConfigError(
+            f"unknown portal option(s): {', '.join(unknown)} "
+            f"(valid: {', '.join(sorted(known))})"
+        )
+
+    if "enabled" in raw:
+        if not isinstance(raw["enabled"], bool):
+            raise ConfigError("portal.enabled must be a boolean")
+        cfg.enabled = raw["enabled"]
+
+    for key in _PORTAL_PLAIN_STR_FIELDS:
+        if key in raw:
+            value = raw[key]
+            if value is not None and not isinstance(value, str):
+                raise ConfigError(f"portal.{key} must be a string or null")
+            if isinstance(value, str) and not value.strip():
+                raise ConfigError(f"portal.{key} must be a non-empty string or null")
+            setattr(cfg, key, value.strip().rstrip("/") if isinstance(value, str) else None)
+
+    for key in _PORTAL_SECRET_STR_FIELDS:
+        if key in raw:
+            value = raw[key]
+            if value is not None and not isinstance(value, str):
+                raise ConfigError(f"portal.{key} must be a string or null")
+            if isinstance(value, str):
+                # ${VAR} expansion (mirrors providers.definitions[*].env) so the
+                # real secret lives in the environment, never committed here —
+                # coordinator.yml is public-repo-adjacent operator config, and
+                # these two values are exactly what coord-portal is public
+                # about NOT holding on its own side of the boundary.
+                value = _expand_env_vars(value).strip()
+                if not value:
+                    raise ConfigError(f"portal.{key} must be a non-empty string or null")
+            setattr(cfg, key, value if isinstance(value, str) else None)
+
+    if "timeout_secs" in raw:
+        value = raw["timeout_secs"]
+        if isinstance(value, bool) or not isinstance(value, (int, float)) or value <= 0:
+            raise ConfigError("portal.timeout_secs must be a positive number")
+        cfg.timeout_secs = float(value)
+
+    if "max_retries" in raw:
+        value = raw["max_retries"]
+        if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+            raise ConfigError("portal.max_retries must be a non-negative integer")
+        cfg.max_retries = value
+
+    if cfg.enabled and not (cfg.base_url and cfg.bridge_client_id and cfg.bridge_client_secret):
+        # Half a credential is not a credential — coord-portal's
+        # isBridgeAuthorized takes the identical position and fails closed on
+        # exactly this. Refuse at parse time rather than 401-looping forever.
+        raise ConfigError(
+            "portal.enabled is true but base_url/bridge_client_id/bridge_client_secret "
+            "are not all set"
+        )
+
+    return cfg
+
+
 def _parse_providers(raw: Any) -> ProvidersConfig:
     """Parse the optional ``providers:`` block from coordinator.yml.
 

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/coord/db.py

@@ -188,7 +188,8 @@ def _ensure_schema(conn: sqlite3.Connection) -> None:
             enqueued_at REAL,
             assignment_type TEXT DEFAULT 'work',
             required_gates TEXT,
-            ci_infra_reruns INTEGER NOT NULL DEFAULT 0
+            ci_infra_reruns INTEGER NOT NULL DEFAULT 0,
+            ci_stale_reruns INTEGER NOT NULL DEFAULT 0
         );
 
         CREATE TABLE IF NOT EXISTS plans (
@@ -697,6 +698,12 @@ def _migrate_add_columns(conn: sqlite3.Connection) -> None:
         # predating this column (no auto-reruns spent yet), same as the
         # column's own default for freshly-enqueued entries.
         "ALTER TABLE merge_queue ADD COLUMN ci_infra_reruns INTEGER NOT NULL DEFAULT 0",
+        # #2197: the CI-staleness auto-rerun's OWN counter — see
+        # `coord.merge_queue.MAX_CI_STALE_RERUNS` and
+        # `QueuedMerge.ci_stale_reruns`'s docstring for why it is kept
+        # separate from `ci_infra_reruns` rather than sharing it. 0 for
+        # every row predating this column, same as a freshly-enqueued entry.
+        "ALTER TABLE merge_queue ADD COLUMN ci_stale_reruns INTEGER NOT NULL DEFAULT 0",
         # #1956: verdict provenance — WHO recorded `review_verdict` and HOW
         # (see coord.models.Assignment.verdict_source for the three values
         # and why conflating them was the second half of #1956). NULL for

{code_coordinator-0.5.56 → code_coordinator-0.5.58}/coord/merge_queue.py

@@ -1417,6 +1417,19 @@ def is_ci_infra_reason(reason: str | None) -> bool:
 # standing breakage.
 MAX_CI_INFRA_RERUNS = 2
 
+# #2197: same shape as MAX_CI_INFRA_RERUNS above, but for the OTHER CI
+# auto-rerun trigger `process()` supports — a PASSING check recorded against
+# a base that has since moved (:data:`CI_STALE_PREFIX`, #1851's staleness
+# signal), not a failure. Deliberately a SEPARATE constant/counter from
+# `ci_infra_reruns`: the two triggers answer opposite readings of CI ("this
+# failed and needs to prove itself again" vs. "this passed but predates the
+# base and needs a fresh answer") and must be independently capped and
+# independently legible in the audit trail. A base that keeps moving out
+# from under one PR (a busy queue, or a genuinely wedged branch) would
+# otherwise auto-rerun forever; two tries rides out an ordinary busy tick
+# without masking a PR that just isn't going to catch up unattended.
+MAX_CI_STALE_RERUNS = 2
+
 
 def _ci_infra_reason(
     ci: "CiStore", repo: str, number: int, failed: "list[CheckRun]"
@@ -2168,6 +2181,15 @@ class QueuedMerge:
     # forever. 0 for every entry that has never hit a verdictless failure,
     # and for rows predating this column.
     ci_infra_reruns: int = 0
+    # #2197: count of automatic `CiStore.rerun_for_pr` calls `process()` has
+    # issued for this entry's CURRENT run of CI staleness (#1851) — a
+    # PASSING check recorded against a base that has since moved. Kept
+    # separate from `ci_infra_reruns` above on purpose (see
+    # `MAX_CI_STALE_RERUNS`'s comment): the two triggers must be
+    # independently capped and independently legible in the audit trail.
+    # Capped at `MAX_CI_STALE_RERUNS`. 0 for every entry that has never gone
+    # CI-stale, and for rows predating this column.
+    ci_stale_reruns: int = 0
 
 
 class GhOps(Protocol):
@@ -2459,6 +2481,9 @@ def load_queue() -> list[QueuedMerge]:
             # #1892: column added via migration; NULL (pre-migration rows)
             # decodes to 0 — no auto-reruns spent yet, same as a fresh entry.
             ci_infra_reruns=row["ci_infra_reruns"] or 0,
+            # #2197: same NULL-to-0 decoding as ci_infra_reruns above, for
+            # rows predating this column.
+            ci_stale_reruns=row["ci_stale_reruns"] or 0,
         )
         for row in rows
     ]
@@ -2475,15 +2500,16 @@ def save_queue(items: list[QueuedMerge]) -> None:
                     assignment_id, repo_name, repo_github, branch,
                     target_branch, issue_number, issue_title, state,
                     pr_number, pr_url, size, last_attempt, error, enqueued_at,
-                    assignment_type, required_gates, ci_infra_reruns
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+                    assignment_type, required_gates, ci_infra_reruns,
+                    ci_stale_reruns
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
                 (
                     item.assignment_id, item.repo_name, item.repo_github,
                     item.branch, item.target_branch, item.issue_number,
                     item.issue_title, item.state, item.pr_number, item.pr_url,
                     item.size, item.last_attempt, item.error, item.enqueued_at,
                     item.assignment_type, json.dumps(list(item.required_gates or [])),
-                    item.ci_infra_reruns,
+                    item.ci_infra_reruns, item.ci_stale_reruns,
                 ),
             )
 
@@ -4503,16 +4529,69 @@ def process(
                 # distinctly (`checks_stale`) from checks_failed/
                 # checks_pending above so an operator (and `coord merge
                 # --revalidate`, the remedy) can tell the three apart.
+                #
+                # #2197: this used to always block here, escalating to a
+                # human (or, via `coord drive`, spending a merge attempt)
+                # for a condition a re-run resolves on its own — the exact
+                # #2170 regression (a docs-only base move stales a
+                # perfectly good green PR). Mirror #1892's shape exactly:
+                # auto-rerun via the SAME `CiStore.rerun_for_pr` this
+                # module already calls unattended for verdictless
+                # failures, up to `MAX_CI_STALE_RERUNS` — but track it
+                # with its OWN counter (`ci_stale_reruns`), never
+                # `ci_infra_reruns`, so a failed-then-stale (or
+                # stale-then-failed) PR does not have one trigger silently
+                # spend the other's budget, and so the audit trail can
+                # always tell which condition an auto-rerun was answering.
                 if checks and _ci_checks_are_stale(
                     checks, gh_ops, entry.repo_github, entry.target_branch, smoke,
                 ):
+                    if entry.ci_stale_reruns < MAX_CI_STALE_RERUNS:
+                        entry.ci_stale_reruns += 1
+                        reran = ci.rerun_for_pr(entry.repo_github, entry.pr_number)
+                        _log.info(
+                            "#2197 auto-rerun %d/%d for stale CI on %s#%d "
+                            "(PR #%s) (rerun_for_pr %s)",
+                            entry.ci_stale_reruns, MAX_CI_STALE_RERUNS,
+                            entry.repo_name, entry.issue_number,
+                            entry.pr_number,
+                            "triggered" if reran else "FAILED",
+                        )
+                        # #1891: same `CI_PENDING_PREFIX` wording the
+                        # genuinely-still-running case uses above — this is
+                        # what lets `coord drive`'s `is_ci_pending_reason`
+                        # check (coord/drive.py) treat a re-run THIS auto-
+                        # trigger just kicked off exactly like any other
+                        # in-flight CI: a bare wait, never a spent merge
+                        # attempt. The queue resumes it automatically once
+                        # the re-run reports, no operator needed.
+                        msg = (
+                            f"{CI_PENDING_PREFIX} re-run triggered for CI "
+                            "checks that predate the current base (#2197 "
+                            f"auto-rerun {entry.ci_stale_reruns}/"
+                            f"{MAX_CI_STALE_RERUNS} "
+                            f"{'triggered' if reran else 'failed to trigger'})"
+                        )
+                        entry.error = msg
+                        events.append(MergeEvent(entry, "checks_stale_rerun", msg))
+                        continue  # #292: skip, don't halt the group
                     msg = (
                         f"{CI_STALE_PREFIX} checks predate the current base "
-                        "— re-run CI (`coord merge --revalidate`) before merging"
+                        f"— auto-rerun budget exhausted ({entry.ci_stale_reruns}/"
+                        f"{MAX_CI_STALE_RERUNS}); re-run CI (`coord merge "
+                        "--revalidate`) before merging"
                     )
                     entry.error = msg
                     events.append(MergeEvent(entry, "checks_stale", msg))
                     continue  # #292: skip, don't halt the group
+                # #2197: reached only once the checks are genuinely fresh
+                # (or the smoke-side #1738/#1778/#1847 base-move exemption
+                # spared them) — mirrors the `ci_infra_reruns = 0` reset
+                # above and for the identical reason: whatever staleness
+                # streak the budget was tracking has now actually resolved,
+                # so a LATER base move starts its own budget from zero
+                # rather than inheriting an unrelated exhausted count.
+                entry.ci_stale_reruns = 0
             # #1318: cache is_epic_issue lookups for this entry — the same
             # referenced number can show up in both the PR body and one or
             # more commit messages below, and each lookup is a `gh` round