code-coordinator 0.5.583__tar.gz → 0.5.585__tar.gz

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.583
+Version: 0.5.585
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.583
+Version: 0.5.585
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.583",
+  "tag": "0.5.585",
   "distance": 0,
-  "node": "g7a2c5345c680bb8cf246a98b62f7a92cdd561b3f",
+  "node": "g6570ba34fa9c63377f21997b6b8a6170f499b760",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-03"

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/coord/commands/_common.py

@@ -330,7 +330,23 @@ def _save_config_snapshot(
                 pass
 
 
-def _load_config(path: Path | None, *, allow_thin_client: bool = True) -> Config:
+def resolve_and_load_config(path: Path | None, *, allow_thin_client: bool = True) -> Config:
+    """Resolve *path* (thin-client aware) and parse it — the one place this
+    question is asked, so every caller that needs a *freshly loaded* config
+    (not just the one-time CLI boot in :func:`_load_config`, which also
+    writes the DB snapshot and exits the process on a parse failure) gets
+    the SAME resolution rule rather than a second, drifting copy (#2096,
+    "one question, one answer"). :func:`coord.drive.Driver`'s per-poll
+    config reload (#1654) is the other caller: unlike `_load_config`, it
+    must never call ``sys.exit`` (a bad mid-run edit must warn, not kill the
+    drive) and must never re-run ``_save_config_snapshot`` every poll (a
+    DELETE+INSERT into the shared ``machines`` table, meant for "this
+    process just booted", not "it's still running 50 polls later").
+
+    Raises :class:`ConfigError` on any resolution/parse failure — never
+    exits, never echoes. Callers that want the CLI's print-and-exit-2
+    behavior still go through :func:`_load_config`.
+    """
     # Resolve the default location ($COORD_CONFIG → ~/.coord/coordinator.yml →
     # ./coordinator.yml) when no explicit --config was given, so `coord` works on
     # a machine without a repo checkout and isn't sensitive to the CWD.
@@ -366,24 +382,28 @@ def _load_config(path: Path | None, *, allow_thin_client: bool = True) -> Config
     # caller of ``_load_config`` legitimately wants thin-client resolution
     # (they ARE clients of the daemon's board) — this flag exists so ONLY
     # `coord serve`'s own bootstrap can opt out.
+    if allow_thin_client:
+        from coord.client import resolve_board_service  # noqa: PLC0415
+
+        svc = resolve_board_service()
+        if svc is not None:
+            from coord.client import fetch_remote_config  # noqa: PLC0415
+
+            try:
+                path = fetch_remote_config(svc)
+            except Exception as exc:  # noqa: BLE001 — do NOT fall through to
+                # load(path): path may point at a local file that happens to
+                # exist (the exact bypass this issue closes). Fail loudly
+                # instead of silently trusting whatever is on disk.
+                raise ConfigError(
+                    f"could not fetch config from {svc.url}: {exc}"
+                ) from exc
+    return load(path)
+
+
+def _load_config(path: Path | None, *, allow_thin_client: bool = True) -> Config:
     try:
-        if allow_thin_client:
-            from coord.client import resolve_board_service  # noqa: PLC0415
-
-            svc = resolve_board_service()
-            if svc is not None:
-                from coord.client import fetch_remote_config  # noqa: PLC0415
-
-                try:
-                    path = fetch_remote_config(svc)
-                except Exception as exc:  # noqa: BLE001 — do NOT fall through to
-                    # load(path): path may point at a local file that happens to
-                    # exist (the exact bypass this issue closes). Fail loudly
-                    # instead of silently trusting whatever is on disk.
-                    raise ConfigError(
-                        f"could not fetch config from {svc.url}: {exc}"
-                    ) from exc
-        cfg = load(path)
+        cfg = resolve_and_load_config(path, allow_thin_client=allow_thin_client)
     except ConfigError as e:
         click.echo(f"error: {e}", err=True)
         sys.exit(2)

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/coord/config.py

@@ -1933,21 +1933,44 @@ def _default_pricing() -> dict[str, ModelRates]:
 
 @dataclass
 class PricingConfig:
-    """``pricing:`` block (#1118) — per-canonical-model per-1M-token USD rates.
-
-    ``models`` maps a canonical model key (``"sonnet"``, ``"opus"``,
-    ``"haiku"``, or any operator-added key) to its :class:`ModelRates`. An
-    absent ``pricing:`` block in coordinator.yml still yields the built-in
-    defaults via :func:`_default_pricing`. A model key with no entry here
-    (e.g. ``"(unknown)"``, or a genuinely unrecognized model string) has no
-    rate — :mod:`coord.usage_rollup` treats that as "no estimate possible"
-    and flags the group rather than silently reporting $0.
+    """``pricing:`` block (#1118) — per-1M-token USD rates, keyed by model.
+
+    ``models`` maps a pricing key to its :class:`ModelRates`. The key shape
+    is whatever :func:`coord.usage_rollup.normalize_model` resolves a leg's
+    raw ``model`` field to, and there are exactly two cases (#1651):
+
+    - One of the four built-in Anthropic tiers — ``"sonnet"``, ``"opus"``,
+      ``"haiku"``, ``"fable"`` — which ``normalize_model`` also maps every
+      versioned id of (e.g. ``"claude-sonnet-4-6"``) onto.
+    - Any other model's **own route key, spelled exactly as the route that
+      dispatches it identifies it** — e.g. the escalation ladder's (#55)
+      OpenCode Zen ``provider/model`` strings, ``"opencode/glm-5.2"`` or
+      ``"deepseek/deepseek-chat"`` (see ``ProviderDef.model`` /
+      ``coord.config.model_plausible_for_provider_type``). There is
+      deliberately only ONE spelling of a given non-Anthropic model across
+      this config — the same string ``coordinator.yml``'s ``providers:`` /
+      ``models.labels``/``escalation`` already uses to route to it — rather
+      than a second "pricing alias" that could drift out of sync with the
+      routing key.
+
+    An absent ``pricing:`` block in coordinator.yml still yields the
+    built-in Anthropic defaults via :func:`_default_pricing`; a
+    non-Anthropic key is simply absent until an operator adds it. A model
+    key with no entry here (e.g. ``"(unknown)"``, a genuinely unrecognized
+    model string, or a real but un-configured route key) has no rate —
+    :mod:`coord.usage_rollup` treats that as "no estimate possible" and
+    flags the leg/group as unknown rather than silently reporting $0.
     """
 
     models: dict[str, ModelRates] = field(default_factory=_default_pricing)
 
     def rates_for(self, canonical_model: str) -> ModelRates | None:
-        """Look up rates for a canonical model key, or ``None`` if unpriced."""
+        """Look up rates for a pricing key, or ``None`` if unpriced.
+
+        *canonical_model* is whatever :func:`coord.usage_rollup.
+        normalize_model` returned — a built-in Anthropic tier name, or a
+        passed-through non-Anthropic route key (see the class docstring).
+        """
         return self.models.get(canonical_model)
 
 

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/coord/drive.py

@@ -384,6 +384,33 @@ def _current_self_head() -> str | None:
     return self_freshness(fetch=False).head_sha
 
 
+def _load_config_for_drive(config_path: str) -> Any:
+    """Real default for `Driver.config_loader` (#1654): re-read
+    coordinator.yml fresh — ``config_path`` empty resolves the usual
+    ``$COORD_CONFIG`` → ``~/.coord/coordinator.yml`` → ``./coordinator.yml``
+    chain, AND the thin-client (board_service) redirect, exactly like the
+    construction-time load in ``coord.commands._common._load_config`` —
+    calls the SAME ``resolve_and_load_config`` helper that function now
+    wraps, so a mid-run reload can never resolve a *different* file (or
+    skip the thin-client branch an ordinary client is expected to take)
+    than the one this drive started with (#2096, "one question, one
+    answer"). Deliberately NOT ``_load_config`` itself: that one also
+    ``sys.exit``s on a parse failure (a bad mid-run edit must warn, never
+    kill the drive — see ``Driver._reload_config``) and re-writes the
+    shared ``machines`` DB snapshot (meant for a one-time boot, not every
+    poll).
+
+    Imported lazily: ``coord.commands._common`` pulls in ``click``/
+    ``httpx``, and every pure decision function in this module already
+    takes an already-loaded config rather than touching disk itself — this
+    keeps that true for every caller except the one that's explicitly an
+    I/O shell.
+    """
+    from coord.commands._common import resolve_and_load_config  # noqa: PLC0415
+
+    return resolve_and_load_config(Path(config_path) if config_path else None)
+
+
 def _bounded_tail(text: str, limit: int = _CAPTURED_OUTPUT_LIMIT) -> str:
     """*text*, or its last *limit* characters if longer — the tail, because
     the actionable line (a traceback's final "raise ...", a guard's remedy)
@@ -2111,6 +2138,39 @@ class Preflight:
     warnings: tuple[str, ...] = ()
 
 
+def check_usage_gate(
+    config: Any, usage_limits: PlanLimits | None,
+) -> str | None:
+    """Evaluate the usage gate — raise on ``block``, return a warn message
+    on ``warn``, ``None`` otherwise.
+
+    #1654: the SOLE place this question is asked, so :func:`preflight`'s
+    one-time call at the top of a run and :meth:`Driver._loop`'s per-poll
+    re-check (added for #1654, since the gate's own ``mode``/thresholds can
+    change mid-run) can never drift into two different answers for the
+    same inputs (#2096, "one question, one answer").
+
+    *config* of ``None`` skips the gate entirely (no ``usage_gate`` section
+    to consult) — mirrors every pre-#1466 caller.
+    """
+    if config is None:
+        return None
+    gate_cfg = config.usage_gate
+    limits = usage_limits if usage_limits is not None else PlanLimits(status="unknown")
+    gate_result = evaluate_usage_gate(limits, gate_cfg)
+    if gate_result.action == "block":
+        raise DriveError(
+            f"{gate_result.message} (usage_gate.mode: block) — refusing to "
+            "dispatch. Wait for the window to reset, or lower urgency by "
+            "raising the threshold / setting usage_gate.mode: warn in "
+            "coordinator.yml.",
+            EXIT_USAGE,
+        )
+    if gate_result.action == "warn":
+        return f"{gate_result.message} (usage_gate.mode: warn — proceeding anyway)"
+    return None
+
+
 def preflight(
     state: IssueState,
     opts: DriveOptions,
@@ -2165,20 +2225,9 @@ def preflight(
 
     warnings: list[str] = []
 
-    if config is not None:
-        gate_cfg = config.usage_gate
-        limits = usage_limits if usage_limits is not None else PlanLimits(status="unknown")
-        gate_result = evaluate_usage_gate(limits, gate_cfg)
-        if gate_result.action == "block":
-            raise DriveError(
-                f"{gate_result.message} (usage_gate.mode: block) — refusing to "
-                "dispatch. Wait for the window to reset, or lower urgency by "
-                "raising the threshold / setting usage_gate.mode: warn in "
-                "coordinator.yml.",
-                EXIT_USAGE,
-            )
-        if gate_result.action == "warn":
-            warnings.append(f"{gate_result.message} (usage_gate.mode: warn — proceeding anyway)")
+    gate_warning = check_usage_gate(config, usage_limits)
+    if gate_warning:
+        warnings.append(gate_warning)
 
     if not state.auto_loop:
         warnings.append(
@@ -5399,6 +5448,13 @@ class Driver:
     # without a real git checkout — same shape as *usage_prober* above.
     # Defaults to the real, local-only (`fetch=False`) probe.
     self_head_probe: Callable[[], str | None] = _current_self_head
+    # #1654: injected so tests can script a fake coordinator.yml reload
+    # sequence without real YAML I/O — same injection shape as
+    # *usage_prober*/*self_head_probe* above. Defaults to the real loader,
+    # re-reading ``self.opts.config_path`` (empty string resolves the usual
+    # ``$COORD_CONFIG`` → ``~/.coord/coordinator.yml`` → ``./coordinator.yml``
+    # chain) fresh every call — see ``_reload_config``.
+    config_loader: Callable[[str], Any] = _load_config_for_drive
 
     _run_log: Path | None = field(default=None, init=False, repr=False)
     # #2443: this session's own on-disk `coord` HEAD, captured once by
@@ -5426,6 +5482,17 @@ class Driver:
     # call, so it is only ever trustworthy read immediately after one, which
     # is exactly how `_loop` uses it.
     _last_run_output: str = field(default="", init=False, repr=False)
+    # #1654: latches so a coordinator.yml that fails to parse mid-run (an
+    # operator mid-edit, a truncated write) warns ONCE for the whole broken
+    # window, not once per poll — `_reload_config` sets this on a failed
+    # reload and clears it (with a short recovery log line) the first time a
+    # reload succeeds again.
+    _config_reload_broken: bool = field(default=False, init=False, repr=False)
+    # #1654: the last usage-gate WARN message this run already printed, so a
+    # `mode: warn` config that stays warn-worthy across many polls (the
+    # common case — the usage window doesn't reset every poll) logs once per
+    # DISTINCT message rather than spamming the identical line every tick.
+    _last_usage_gate_warning: str | None = field(default=None, init=False, repr=False)
 
     def __post_init__(self) -> None:
         self.out = self.out or sys.stdout
@@ -5473,6 +5540,68 @@ class Driver:
         except DriveStateError as exc:
             raise DriveError(str(exc), EXIT_USAGE) from exc
 
+    def _reload_config(self) -> None:
+        """Re-read coordinator.yml at the top of every poll (#1654).
+
+        `self.config` used to be a pure construction-time snapshot the poll
+        loop never revisited — a ladder/usage-gate edit made while a drive
+        was already running had no effect until the NEXT invocation, which
+        is exactly backwards for a lever (#1649's reroute mode, a tightened
+        threshold) most likely to be flipped reactively, mid-window, because
+        a drive is already running and burning credits. Cheap: one YAML
+        parse against a loop that already shells out to a `coord`
+        subprocess (`run_coord`) every tick.
+
+        A config that fails to parse (an operator mid-edit, a truncated
+        write) must never kill an otherwise-healthy run: this keeps the
+        last-good `self.config` and only warns — exactly ONCE for the whole
+        broken window (`_config_reload_broken` latches it), not once per
+        poll. `self.opts` (this invocation's own identity — the CLI flags)
+        is never touched here; only `self.config` is replaced.
+        """
+        try:
+            new_config = self.config_loader(self.opts.config_path)
+        except Exception as exc:  # noqa: BLE001 — a bad edit must never kill the drive
+            if not self._config_reload_broken:
+                self.warn(
+                    "coordinator.yml reload failed, keeping the last-known-"
+                    f"good config: {exc}"
+                )
+                self._config_reload_broken = True
+            return
+        if self._config_reload_broken:
+            self.log(
+                "coordinator.yml reload recovered — back to a fresh config"
+            )
+            self._config_reload_broken = False
+        self._log_config_change(self.config, new_config)
+        self.config = new_config
+
+    def _log_config_change(self, old: Any, new: Any) -> None:
+        """Narrate a reload that changes a decision this loop actually makes
+        (#1654), so a mid-run behaviour change is explicable from this run's
+        own log afterwards rather than looking like nondeterminism.
+
+        Deliberately narrow — only the usage gate, the one knob this loop
+        re-consults every poll (see `check_usage_gate` below) — rather than
+        a full recursive diff of the whole `Config` object, which would be
+        noisy (most fields are per-repo/machine topology this driver never
+        reads for THIS issue) and risks echoing a secret accidentally pasted
+        into coordinator.yml into this run's log.
+        """
+        old_gate, new_gate = old.usage_gate, new.usage_gate
+        old_shape = (old_gate.mode, old_gate.session_threshold_pct, old_gate.week_threshold_pct)
+        new_shape = (new_gate.mode, new_gate.session_threshold_pct, new_gate.week_threshold_pct)
+        if old_shape != new_shape:
+            self.log(
+                "coordinator.yml reload: usage_gate changed "
+                f"mode {old_gate.mode!r} -> {new_gate.mode!r}, "
+                f"session_threshold_pct {old_gate.session_threshold_pct!r} -> "
+                f"{new_gate.session_threshold_pct!r}, week_threshold_pct "
+                f"{old_gate.week_threshold_pct!r} -> {new_gate.week_threshold_pct!r} "
+                "— this run's next dispatch decision reflects the new config."
+            )
+
     # ── execution ───────────────────────────────────────────────────────
     def run_coord(self, args: tuple[str, ...], *, serialize_merge: bool = False) -> int:
         """Run a ``coord`` subcommand, echoing its output and appending to the log.
@@ -5751,12 +5880,15 @@ class Driver:
         if state is None:
             raise DriveError("could not read board state", EXIT_USAGE)
 
-        # #1466: probe ONCE here (not per-poll) — the underlying `claude -p
-        # "/usage"` call is itself cached ~60s (coord.usage_limits), but
-        # there's no reason to re-shell-out every loop iteration for a
-        # decision only made at the top of the run. Skipped entirely when
-        # the gate is off, so a `disabled` config never pays the subprocess
-        # cost.
+        # #1466: this is the ONE-TIME preflight check — raises/warns before
+        # the loop below ever starts, using whatever config this run was
+        # launched with. #1654 added a SECOND, per-poll re-check
+        # (`check_usage_gate`, called again right before every RUN action
+        # below) against `self.config` AS RELOADED THAT TICK, so a mid-run
+        # `usage_gate.mode`/threshold edit reaches the very next dispatch —
+        # this first call only ever decides whether the run gets to start at
+        # all. Skipped entirely when the gate is off, so a `disabled`
+        # config never pays the subprocess cost.
         usage_limits = (
             self.usage_prober() if self.config.usage_gate.mode != "disabled" else None
         )
@@ -5876,6 +6008,12 @@ class Driver:
                     )
                 return EXIT_DEADLINE
 
+            # #1654: re-read coordinator.yml before every decision this tick
+            # makes — see `_reload_config`'s own docstring for why (a
+            # construction-time snapshot made a mid-run ladder/usage-gate
+            # edit invisible for the drive's entire remaining life).
+            self._reload_config()
+
             state = self.read_state()
             if state is None:
                 self.sleeper(self.opts.poll)
@@ -6076,6 +6214,22 @@ class Driver:
                 self.log(action.label)
 
             if action.kind == RUN:
+                # #1654: re-check the usage gate against THIS poll's
+                # (possibly just-reloaded) config, not the snapshot
+                # `preflight()` consulted once before the loop started —
+                # `check_usage_gate` is the SAME question preflight asks, so
+                # a mid-run `usage_gate.mode` edit (warn -> block, or a
+                # tightened threshold) reaches the very next dispatch
+                # instead of only the next `coord drive` invocation.
+                usage_limits = (
+                    self.usage_prober()
+                    if self.config.usage_gate.mode != "disabled"
+                    else None
+                )
+                gate_warning = check_usage_gate(self.config, usage_limits)
+                if gate_warning and gate_warning != self._last_usage_gate_warning:
+                    self.warn(gate_warning)
+                    self._last_usage_gate_warning = gate_warning
                 rc = self.run_coord(
                     action.command, serialize_merge=action.serialize_merge
                 )

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/coord/usage_rollup.py

@@ -46,24 +46,42 @@ from coord.config import ModelRates, PricingConfig
 
 # ── Model normalization ──────────────────────────────────────────────────────
 
-# Canonical keys this module recognizes out of the box. Anything else is
-# "(unknown)" — never guessed, never silently priced at $0.
+# Canonical keys this module recognizes out of the box (the four Anthropic
+# tiers). Anything else PASSES THROUGH verbatim (lowercased/stripped) rather
+# than collapsing to "(unknown)" — see #1651: once the escalation ladder
+# (#55) routes to a non-Anthropic model, its board `model` field is whatever
+# key that route identifies itself by (e.g. the OpenCode Zen `provider/model`
+# shape, `"opencode/glm-5.2"`, `"deepseek/deepseek-chat"` — see
+# `coord.config.model_plausible_for_provider_type`). A `pricing.models` entry
+# keyed with that EXACT string (same spelling as the route/`ProviderDef.model`
+# that produced it — there is deliberately only one spelling, never a second
+# "friendly" alias to keep in sync) now reaches `PricingConfig.rates_for`
+# instead of being shadowed by a hardcoded "(unknown)". A key with no such
+# entry still resolves to no rate (`rates_for` returns `None`) and is flagged
+# unknown exactly as before — nothing is ever *guessed* into a tier.
 _KNOWN_CANONICAL = ("sonnet", "opus", "haiku", "fable")
 
 UNKNOWN_MODEL = "(unknown)"
 
 
 def normalize_model(model: str | None) -> str:
-    """Normalize a raw ``model`` field to a canonical pricing key.
+    """Normalize a raw ``model`` field to a pricing key.
 
-    Handles bare aliases (``"sonnet"``, ``"opus"``, ``"haiku"``, ``"fable"``),
-    versioned ids (``"claude-sonnet-4-6"``, ``"claude-opus-4-7"``,
+    Handles bare Anthropic aliases (``"sonnet"``, ``"opus"``, ``"haiku"``,
+    ``"fable"``), versioned ids (``"claude-sonnet-4-6"``, ``"claude-opus-4-7"``,
     ``"claude-haiku-4-5"``, ``"claude-fable-5"``, and future dated variants —
     matched by substring so a new date suffix doesn't need a code change),
-    and the empty/``None``/``"(unknown)"`` cases. Anything that doesn't match
-    one of the four known tiers returns ``"(unknown)"`` — the estimator
-    treats that as "no rate available" and flags it, rather than defaulting
-    to a tier that might be wrong.
+    and the empty/``None``/``"(unknown)"`` cases, which all map to
+    ``"(unknown)"``.
+
+    Anything else — notably a non-Anthropic route key from the escalation
+    ladder (#55), e.g. ``"opencode/glm-5.2"`` — is returned **unchanged**
+    (just lowercased/stripped) rather than forced to ``"(unknown)"``. That
+    passthrough is what lets :meth:`coord.config.PricingConfig.rates_for`
+    see the model's own key and find an operator-configured rate for it
+    (#1651); a key nobody configured still produces no rate there (``None``)
+    and the estimator flags it unknown exactly as before — this function
+    never *guesses* a tier for an unrecognized string.
     """
     if not model:
         return UNKNOWN_MODEL
@@ -75,7 +93,7 @@ def normalize_model(model: str | None) -> str:
     for canonical in _KNOWN_CANONICAL:
         if canonical in text:
             return canonical
-    return UNKNOWN_MODEL
+    return text
 
 
 # ── Timestamp parsing ─────────────────────────────────────────────────────────
@@ -232,9 +250,11 @@ def leg_cost(row: dict, pricing: PricingConfig) -> tuple[float, float, bool]:
     verbatim as ``cost_captured`` and never also gets an estimate (no
     double-counting). A leg with ``cost_usd`` in ``{None, 0}`` **and** any
     tokens gets an estimate from *pricing*, keyed by the leg's normalized
-    model — unless the model doesn't map to a priced tier, in which case no
-    estimate is produced and ``unknown_model`` is ``True`` (never a silent
-    $0). A leg with no tokens and no captured cost is simply zero everywhere.
+    model (see :func:`normalize_model` — a canonical Anthropic tier, or a
+    non-Anthropic model's own route key, e.g. ``"opencode/glm-5.2"``) —
+    unless *pricing* has no rate for that key, in which case no estimate is
+    produced and ``unknown_model`` is ``True`` (never a silent $0). A leg
+    with no tokens and no captured cost is simply zero everywhere.
     """
     raw_cost = row.get("cost_usd")
     try:

{code_coordinator-0.5.583 → code_coordinator-0.5.585}/tests/test_drive.py

@@ -428,6 +428,102 @@ def test_driver_loop_disabled_gate_never_calls_the_prober(driver_factory):
     assert calls == []
 
 
+# ── #1654: the poll loop re-reads coordinator.yml every tick ───────────────
+
+
+def test_driver_loop_picks_up_a_mid_run_usage_gate_change_on_the_next_poll(
+    driver_factory, capsys,
+):
+    """A `usage_gate.mode` edit made WHILE a drive is already polling must
+    reach the very next dispatch decision, not just the next `coord drive`
+    invocation (#1654's motivating #1653 scenario). Scripts a config_loader
+    that hands back the construction-time (`warn`) config on the first
+    reload and a `block`-mode config on every reload after — exactly like
+    an operator editing coordinator.yml between two polls."""
+    cfg_warn = _config_with_gate(mode="warn", session_threshold_pct=50.0)
+    cfg_block = _config_with_gate(mode="block", session_threshold_pct=50.0)
+    reloads = [cfg_warn, cfg_block]
+    calls = {"n": 0}
+
+    def loader(_path):
+        idx = min(calls["n"], len(reloads) - 1)
+        calls["n"] += 1
+        return reloads[idx]
+
+    driver = driver_factory(
+        [{"assignments": []}],
+        opts=DriveOptions(machine="precision", poll=1.0, deadline_mins=10.0),
+        config=cfg_warn,
+        usage_prober=lambda: PlanLimits(status="ok", session_pct=95.0),
+        config_loader=loader,
+    )
+    with pytest.raises(DriveError) as exc:
+        driver.run()
+    assert exc.value.exit_code == EXIT_USAGE
+    assert "block" in str(exc.value)
+    # Exactly one `coord assign` reached the subprocess boundary — the FIRST
+    # poll's reload still saw `warn` (construction-time config, unchanged),
+    # so it dispatched; the SECOND poll's reload already saw `block`, so the
+    # usage gate refused before a second `coord assign` was ever spawned.
+    assert len(driver.recorded) == 1
+    captured = capsys.readouterr()
+    # The reload's own narration is informational (`self.log`, not
+    # `self.warn`) — it goes to stdout, distinct from the usage gate's own
+    # warn-level lines on stderr asserted above via `exc.value`.
+    assert "usage_gate changed" in captured.out
+    assert "'warn' -> 'block'" in captured.out
+
+
+def test_driver_loop_survives_a_mid_run_config_parse_failure(driver_factory, capsys):
+    """A coordinator.yml an operator is mid-editing (truncated write, a
+    YAML typo) must never kill an otherwise-healthy drive: the last-good
+    config stays in force, the drive keeps running to its deadline, and the
+    warning is printed exactly once for the whole broken window — not once
+    per poll."""
+    cfg = make_config()
+
+    def broken_loader(_path):
+        raise ValueError("while parsing a block mapping")
+
+    driver = driver_factory(
+        [board(status="running")],
+        opts=DriveOptions(machine="precision", poll=1.0, deadline_mins=2.5 / 60.0),
+        config=cfg,
+        config_loader=broken_loader,
+    )
+    assert driver.run() == EXIT_DEADLINE
+    assert driver.config is cfg  # last-good snapshot, never replaced
+    err = capsys.readouterr().err
+    assert err.count("coordinator.yml reload failed") == 1
+
+
+def test_driver_loop_config_reload_never_mutates_opts(driver_factory):
+    """`self.opts` is this invocation's own identity (the CLI flags) — a
+    config reload must never touch it, even across several successful
+    reloads that DO change `self.config`."""
+    cfg_a = _config_with_gate(mode="warn", session_threshold_pct=50.0)
+    cfg_b = _config_with_gate(mode="disabled")
+    reloads = [cfg_a, cfg_b, cfg_a, cfg_b]
+    calls = {"n": 0}
+
+    def loader(_path):
+        idx = min(calls["n"], len(reloads) - 1)
+        calls["n"] += 1
+        return reloads[idx]
+
+    opts = DriveOptions(machine="precision", poll=1.0, deadline_mins=3.5 / 60.0)
+    driver = driver_factory(
+        [board(status="running")], opts=opts, config=cfg_a, config_loader=loader,
+    )
+    assert driver.run() == EXIT_DEADLINE
+    assert driver.opts is opts
+    assert driver.opts.machine == "precision"
+    assert driver.opts.poll == 1.0
+    # The reload really did run (and really did change self.config) —
+    # otherwise this test would trivially pass by never exercising reload.
+    assert calls["n"] >= 2
+
+
 # ═══════════════════════════════════════════════════════════════════════════
 # no work yet: plan / dispatch
 # ═══════════════════════════════════════════════════════════════════════════
@@ -6294,7 +6390,7 @@ def driver_factory(tmp_path, monkeypatch, capsys):
 
     def make(
         payloads, *, opts=None, verifier=None, config=None, oracle_gate=None,
-        usage_prober=None, self_head_probe=None, ticks=200,
+        usage_prober=None, self_head_probe=None, config_loader=None, ticks=200,
     ):
         clock = {"t": 0.0}
         recorded: list[list[str]] = []
@@ -6305,14 +6401,24 @@ def driver_factory(tmp_path, monkeypatch, capsys):
 
         monkeypatch.setattr("coord.drive.subprocess.run", fake_run)
 
+        resolved_config = config or make_config()
         driver = Driver(
             repo=REPO,
             issue=ISSUE,
             opts=opts or DriveOptions(machine="precision", poll=1.0),
-            config=config or make_config(),
+            config=resolved_config,
             fetcher=FakeFetcher(payloads),
             verifier=verifier or FakeVerifier(),
             oracle_gate=oracle_gate,
+            # #1654: default to a no-op reload (hands back the SAME config
+            # object every poll) — a real driver re-reads coordinator.yml
+            # from disk every tick, but defaulting to that here would make
+            # every existing test in this module implicitly depend on
+            # `$COORD_CONFIG`/`~/.coord/coordinator.yml` resolving
+            # successfully (or silently latching the one-warn-only path),
+            # neither of which is what those tests are about. Tests
+            # exercising the reload itself pass their own.
+            config_loader=config_loader or (lambda _path: resolved_config),
             # #1466: never let a Driver test shell out to a real `claude -p
             # "/usage"` — default to a stub reporting "unknown" (same as no
             # probe at all), which the gate always treats as "proceed,