code-coordinator 0.5.643__tar.gz → 0.5.644__tar.gz

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.643
+Version: 0.5.644
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.643
+Version: 0.5.644
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

code_coordinator-0.5.644/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.644",
+  "distance": 0,
+  "node": "g634dd923ef760cbdf3bb66239d0470e25f7af742",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-16"
+}

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/coord/diagnose.py

@@ -1441,10 +1441,19 @@ def _recover_test(
             from coord.reconcile import (  # noqa: PLC0415
                 propagate_smoke_terminal_failure,
             )
-
+            from coord.state import load_assignment_exit_code  # noqa: PLC0415
+
+            # #3705: the board projection carries no `exit_code`, so read the
+            # smoke child's recorded exit status directly — without it every
+            # reason-less failure would reclassify as a silent #1605 death and
+            # earn a bounded retry instead of a work failure.  A `cancelled`
+            # row is the operator's own `coord stop`, whose exit status is the
+            # kill signal rather than a verdict on the code under test.
             propagate_smoke_terminal_failure(
                 parent_assignment_id=latest.assignment_id,
                 failure_reason=smoke.failure_reason,
+                operator_cancelled=(smoke.status or "") == "cancelled",
+                exit_code=load_assignment_exit_code(smoke.assignment_id),
             )
             res.actions_taken.append(
                 f"resolved stuck test_state='running' from smoke child "

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/coord/failure_class.py

@@ -98,6 +98,11 @@ KIND_NETWORK = "network"
 #: diagnosis of a lost Test-stage leg, never a verdict about the code
 #: under test.
 KIND_INFRA = "infra"
+#: #3705: a Test-stage worker died with literally no `failure_reason` to
+#: classify — not "classified as work because the text didn't match any
+#: environmental pattern" (that case has real diagnostic text and stays
+#: `KIND_WORK`), but zero evidence at all. See :func:`silent_test_death`.
+KIND_SILENT = "silent"
 KIND_WORK = "work"
 
 #: HTTP statuses from the Claude API that mean "the provider, not the work".
@@ -353,6 +358,40 @@ def _usage_limit(reset_at_raw: str | None, signal: str) -> FailureClassification
     )
 
 
+def silent_test_death() -> FailureClassification:
+    """#3705: classification for a Test-stage worker that died reporting
+    literally nothing — no usage-limit/API/network/infra signal and no
+    ``failure_reason`` text at all for :func:`classify_failure` to have
+    scanned in the first place (a dead agent, a killed process group, a
+    terminal API error with the summary itself lost — the #1605 class).
+
+    Deliberately **not** a branch inside :func:`classify_failure`: that
+    function's "everything else is WORK, including no evidence" rule is
+    correct for a failure that has *some* terminal text which simply didn't
+    match an environmental pattern (that IS a real, if unrecognized, work
+    failure with diagnostic content worth handing a fix worker). This is
+    the narrower case of *zero* content — nothing to classify, let alone
+    hand to a fix worker — which only
+    :func:`coord.reconcile.propagate_smoke_terminal_failure` can tell apart
+    from the ordinary case (it alone sees whether ``failure_reason`` itself
+    was ever populated). Classified ``ENVIRONMENTAL`` so it gets the same
+    bounded clear-and-retry-then-park treatment as a usage limit or network
+    drop — a silent death is no more evidence of a code defect than either
+    of those, and parking (never a blind ``coord fix``) is the correct
+    escalation once the shared retry budget is exhausted.
+    """
+    return FailureClassification(
+        failure_class=ENVIRONMENTAL,
+        kind=KIND_SILENT,
+        reason=(
+            "environmental (silent #1605 death): the Test-stage worker "
+            "died without recording any reason — no usage-limit, API, "
+            "network, or infra signal, and no terminal output at all"
+        ),
+        signal=None,
+    )
+
+
 def _reset_at_from_reason(reason: str | None) -> str | None:
     """Pull the raw reset string back out of a stamped ``failure_reason``."""
     if not is_usage_limit_reason(reason):

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/coord/notify.py

@@ -4623,17 +4623,26 @@ def post_transition(transition: Transition, record: dict, entry: dict) -> None:
                 # can protect a still-live/already-passed sibling partition
                 # from a false aggregate failure instead of folding this
                 # leg's cancellation straight into the parent's verdict.
+                # #3705: `exit_code` is the deciding evidence for the
+                # silent-death branch — a leg that actually ran and exited
+                # non-zero is a genuine work failure even with no classified
+                # reason text, while a leg whose process left no exit status
+                # at all is the #1605 class that gets a bounded retry. Same
+                # forwarding as `coord.reconcile`'s own call site, so both
+                # surfaces answer "silent or genuine?" identically.
                 propagate_smoke_terminal_failure(
                     parent_assignment_id=transition.assignment_id,
                     failure_reason=_failure_reason,
                     fanout_parent_id=parent_id,
                     operator_cancelled=entry.get("status") == "cancelled",
+                    exit_code=transition.exit_code,
                 )
                 finalize_smoke_fanout(parent_id)
             else:
                 propagate_smoke_terminal_failure(
                     parent_assignment_id=parent_id,
                     failure_reason=_failure_reason,
+                    exit_code=transition.exit_code,
                 )
     elif transition.event == EVENT_COMPLETION:
         # #2188: a `deliverable:analysis` issue that legitimately ended with

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/coord/reconcile.py

@@ -590,6 +590,7 @@ def reconcile_completed_assignments(
             propagate_smoke_terminal_failure(
                 parent_assignment_id=a.review_of_assignment_id,
                 failure_reason=_failure_reason,
+                exit_code=entry.get("exit_code"),
             )
 
         # #666 Gap A: best-effort cost/token capture from the agent completed
@@ -940,9 +941,14 @@ def _environmental_cause_phrase(classification: "FailureClassification") -> str:
         KIND_API_ERROR,
         KIND_INFRA,
         KIND_NETWORK,
+        KIND_SILENT,
         KIND_USAGE_LIMIT,
     )
 
+    if classification.kind == KIND_SILENT:
+        # #3705: a Test-stage worker that died reporting nothing at all —
+        # not a provider signal, just no diagnostic to hand anyone.
+        return "a Test-stage worker repeatedly dying with no reason recorded (#1605)"
     if classification.kind == KIND_USAGE_LIMIT:
         return "an exhausted account usage limit"
     if classification.kind == KIND_API_ERROR:
@@ -969,6 +975,7 @@ def propagate_smoke_terminal_failure(
     environmental: bool | None = None,
     fanout_parent_id: str | None = None,
     operator_cancelled: bool = False,
+    exit_code: int | None = None,
 ) -> None:
     """#1605: resolve a work row's ``test_state`` when its Test-stage
     (``type="smoke"``) child dies without ever reporting pass/fail.
@@ -1036,6 +1043,30 @@ def propagate_smoke_terminal_failure(
       ``test_state="failed"`` exactly like a normal non-zero-exit smoke
       completion already does (`coord/notify.py`'s completion handler), so
       the existing bounded `coord fix` loop picks it up from there.
+    * **silent** (#3705: *failure_reason* itself is empty — no usage-limit,
+      API, network, or infra token to classify, because there is no text at
+      all) — this is the #1605 class the module docstring above describes,
+      and it is treated like **environmental**, not **work**: there is
+      nothing for a `coord fix` worker to act on, so dispatching one only
+      adds a full Work→Test→Review cycle onto a row whose original Work may
+      already be approved, for zero actionable content. Reclassified via
+      :func:`coord.failure_class.silent_test_death` and folded into the same
+      bounded clear-and-retry-then-park machinery as a genuine environmental
+      death, sharing its budget and tally. Deliberately distinct from
+      **work**'s "no RECOGNIZED signal" case, which still has real
+      diagnostic text worth a fix worker's time and keeps its current
+      ``test_state="failed"`` handling unchanged.
+
+    *exit_code* (#3705) is the deciding evidence for that **silent** branch,
+    and every automatic caller must forward it: the dying worker's own
+    process exit status, when the agent recorded one. A non-zero exit means
+    the worker ran and returned an error — real evidence of a work failure,
+    even with no reason text — so only ``exit_code in {0, None}`` reclassifies
+    as silent. *operator_cancelled* overrides this, since a `coord stop`
+    kills the process group and its exit status reflects the operator's
+    signal rather than the code under test. Leaving *exit_code* unset means
+    "no exit status is known", which is itself the #1605 shape, so a caller
+    that CAN see one and omits it would reclassify genuine failures as silent.
 
     *environmental* (#2275) overrides that classification when the CALLER
     already knows the answer.  Default ``None`` means "classify from
@@ -1134,6 +1165,48 @@ def propagate_smoke_terminal_failure(
     if environmental is None:
         is_environmental = classification.is_environmental
         cause = classification.reason
+        if (
+            not is_environmental
+            and not (failure_reason or "").strip()
+            and (operator_cancelled or exit_code in (0, None))
+        ):
+            # #3705: `classify_failure` correctly calls this WORK — its own
+            # "no evidence at all defaults to WORK" rule — but that rule is
+            # about an UNRECOGNIZED signal, not an ABSENT one. There is a
+            # real difference between "the worker's own terminal text didn't
+            # match any environmental pattern" (real diagnostic content, a
+            # genuine work failure worth a fix worker's time) and "there is
+            # no `failure_reason` text at all" (a dead agent, a killed
+            # process group — the #1605 class this function exists for,
+            # with nothing for a fix worker to act on). Only this caller can
+            # tell the two apart, since only it sees whether
+            # *failure_reason* itself was ever populated.
+            #
+            # The additional *exit_code* guard keeps a non-zero exit code
+            # (e.g. exit_code=1: the `claude -p` process actually ran and
+            # returned an error) as a genuine WORK failure even when the
+            # agent captured no classified reason text — a non-zero exit IS
+            # a signal, just one without a human-readable reason string.
+            # Only `exit_code in {0, None}` qualifies as truly silent.
+            #
+            # *operator_cancelled* overrides that guard: a `coord stop` kills
+            # the worker's process group, so its exit status reports the
+            # OPERATOR'S signal, not a verdict on the code under test. Every
+            # cancellation is therefore silent by construction, whatever exit
+            # code the kill happened to leave behind — the same reasoning as
+            # the sibling-protection branch above, applied to a solo leg that
+            # has no live sibling left to protect.
+            # Treat all of the above like an environmental death: bounded
+            # clear-and-retry of the Test stage, parking (never a blind
+            # `coord fix`) once the shared #3315 budget is exhausted —
+            # instead of ever recording a `test_state="failed"` work verdict
+            # with a synthetic placeholder reason and no actual failure
+            # behind it.
+            from coord.failure_class import silent_test_death  # noqa: PLC0415
+
+            classification = silent_test_death()
+            is_environmental = True
+            cause = classification.reason
     else:
         is_environmental = bool(environmental)
         cause = failure_reason or classification.reason

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/coord/state.py

@@ -4587,6 +4587,51 @@ def load_assignment_test_reason(assignment_id: str) -> str | None:
     return row["test_reason"] if hasattr(row, "keys") else row[0]
 
 
+def load_assignment_exit_code(assignment_id: str) -> int | None:
+    """#3705: the recorded process ``exit_code`` for one assignment.
+
+    The single-row read that lets a caller holding only an
+    :class:`coord.models.Assignment` (whose projection carries no
+    ``exit_code``) answer "did this worker actually run and return an error?"
+    — the deciding evidence
+    :func:`coord.reconcile.propagate_smoke_terminal_failure` needs to tell a
+    genuine work failure from a silent #1605 death.
+
+    Same daemon-first, local-fallback routing as
+    :func:`load_assignment_test_reason`. Returns ``None`` when the row is
+    absent, the column is NULL (the agent recorded no exit status), or a
+    remote read failed — all three mean "no exit status I can see", which is
+    itself the silent shape, so callers must treat it as absence of evidence
+    rather than as a successful exit.
+    """
+    if not assignment_id:
+        return None
+    svc = _board_service()
+    if svc is not None:
+        try:
+            from coord.client import fetch_assignment  # noqa: PLC0415
+
+            row = fetch_assignment(svc, assignment_id)
+            if row is not None:
+                code = row.get("exit_code")
+                return int(code) if code is not None else None
+            return None
+        except Exception:  # noqa: BLE001 — degraded fallback, never blocking
+            return None
+    try:
+        conn = get_connection()
+        row = sql.execute(conn,
+            "SELECT exit_code FROM assignments WHERE assignment_id=?",
+            (assignment_id,),
+        ).fetchone()
+    except Exception:  # noqa: BLE001
+        return None
+    if row is None:
+        return None
+    code = row["exit_code"] if hasattr(row, "keys") else row[0]
+    return int(code) if code is not None else None
+
+
 def load_assignment_test_state(assignment_id: str) -> str | None:
     """#2244: the current ``test_state`` for one assignment.
 

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/tests/test_diagnose.py

@@ -1712,10 +1712,9 @@ def test_stuck_test_state_with_terminal_smoke_child_is_recovered(monkeypatch, co
     calls: list[dict] = []
     monkeypatch.setattr(
         "coord.reconcile.propagate_smoke_terminal_failure",
-        lambda *, parent_assignment_id, failure_reason: calls.append(
-            {"parent_assignment_id": parent_assignment_id, "failure_reason": failure_reason}
-        ),
+        lambda **kw: calls.append(kw),
     )
+    monkeypatch.setattr("coord.state.load_assignment_exit_code", lambda aid: None)
     work = _assign(aid="w1", typ="work", status="done")
     work.test_state = "running"
     smoke = _assign(
@@ -1728,12 +1727,75 @@ def test_stuck_test_state_with_terminal_smoke_child_is_recovered(monkeypatch, co
 
     assert any("test_state='running'" in f and "s1" in f for f in res.findings)
     assert calls == [
-        {"parent_assignment_id": "w1", "failure_reason": "api_error: aborted_streaming"}
+        {
+            "parent_assignment_id": "w1",
+            "failure_reason": "api_error: aborted_streaming",
+            "operator_cancelled": False,
+            "exit_code": None,
+        }
     ]
     assert any("resolved stuck test_state" in a for a in res.actions_taken)
     assert res.recovered is True
 
 
+def test_stuck_test_state_forwards_the_smoke_child_exit_code(monkeypatch, config) -> None:
+    """#3705: a smoke child that ran and exited non-zero is a genuine work
+    failure even with no reason text recorded, so the repair must forward the
+    child's own exit status — the board projection does not carry it, and
+    omitting it would reclassify the failure as a silent #1605 death and earn
+    it a bounded Test-stage retry instead."""
+    _stub(monkeypatch, session="dead")
+    calls: list[dict] = []
+    monkeypatch.setattr(
+        "coord.reconcile.propagate_smoke_terminal_failure",
+        lambda **kw: calls.append(kw),
+    )
+    monkeypatch.setattr(
+        "coord.state.load_assignment_exit_code",
+        lambda aid: 1 if aid == "s1" else None,
+    )
+    work = _assign(aid="w1", typ="work", status="done")
+    work.test_state = "running"
+    smoke = _assign(aid="s1", typ="smoke", status="failed", review_of="w1")
+    board = Board(completed=[work, smoke])
+
+    diagnose.diagnose_stage(board, config, "api", 42, "test")
+
+    assert calls and calls[0]["exit_code"] == 1, (
+        "the smoke child's recorded exit status must reach "
+        f"propagate_smoke_terminal_failure — got {calls!r}"
+    )
+    assert calls[0]["operator_cancelled"] is False
+
+
+def test_stuck_test_state_marks_a_cancelled_smoke_child_operator_cancelled(
+    monkeypatch, config
+) -> None:
+    """#3705/#3333: an operator `coord stop` leaves the smoke row `cancelled`
+    and its exit status is the kill signal, not a verdict on the code under
+    test — so the repair must flag the cancellation and keep the clear-and-retry
+    treatment rather than letting the signal's exit code read as a work
+    failure."""
+    _stub(monkeypatch, session="dead")
+    calls: list[dict] = []
+    monkeypatch.setattr(
+        "coord.reconcile.propagate_smoke_terminal_failure",
+        lambda **kw: calls.append(kw),
+    )
+    monkeypatch.setattr("coord.state.load_assignment_exit_code", lambda aid: -15)
+    work = _assign(aid="w1", typ="work", status="done")
+    work.test_state = "running"
+    smoke = _assign(aid="s1", typ="smoke", status="cancelled", review_of="w1")
+    board = Board(completed=[work, smoke])
+
+    diagnose.diagnose_stage(board, config, "api", 42, "test")
+
+    assert calls and calls[0]["operator_cancelled"] is True, (
+        f"a cancelled smoke child must be reported as operator-cancelled — got {calls!r}"
+    )
+    assert calls[0]["exit_code"] == -15
+
+
 def test_stuck_test_state_dry_run_reports_without_writing(monkeypatch, config) -> None:
     _stub(monkeypatch, session="dead")
 

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/tests/test_failure_class.py

@@ -32,6 +32,7 @@ from coord.failure_class import (
     KIND_API_ERROR,
     KIND_INFRA,
     KIND_NETWORK,
+    KIND_SILENT,
     KIND_USAGE_LIMIT,
     KIND_WORK,
     WORK,
@@ -45,6 +46,7 @@ from coord.failure_class import (
     parse_reset_at,
     plan_usage_limit_resume,
     probe_environment_liveness,
+    silent_test_death,
 )
 from coord.worker_events import UsageLimitKill, format_usage_limit_reason
 
@@ -822,3 +824,21 @@ def test_classification_is_frozen() -> None:
     with pytest.raises(Exception):
         c.failure_class = WORK  # type: ignore[misc]
     assert isinstance(c, FailureClassification)
+
+
+def test_silent_test_death_is_environmental_and_distinct_from_plain_work() -> None:
+    """#3705: a Test-stage worker that died reporting literally nothing (no
+    `failure_reason` at all) classifies ENVIRONMENTAL via
+    :func:`silent_test_death`, with its own `KIND_SILENT` — distinct from
+    the ordinary `classify_failure(failure_reason=None)` WORK default, which
+    stays unchanged for every other caller (notably the WORK-stage retry
+    logic in `coord/drive.py`, out of scope for this Test-stage-only fix)."""
+    c = silent_test_death()
+    assert c.failure_class == ENVIRONMENTAL
+    assert c.kind == KIND_SILENT
+    assert c.is_environmental
+    assert "1605" in c.reason
+
+    # The ordinary classifier is untouched: no evidence still defaults WORK.
+    assert classify_failure(failure_reason=None).failure_class == WORK
+    assert classify_failure(failure_reason=None).kind == KIND_WORK

{code_coordinator-0.5.643 → code_coordinator-0.5.644}/tests/test_notify.py

@@ -2849,13 +2849,15 @@ class TestSmokeCompletionVerdict:
     ) -> None:
         """#3182 review (non-blocking): the `EVENT_FAILURE` branch in
         `post_transition` mirrors the `EVENT_COMPLETION` one above — a
-        capability-partition leg whose WORKER died (#1605: killed process,
-        terminal API error, anything short of the worker printing its own
-        `SMOKE:` verdict) resolves onto its OWN row via
-        `propagate_smoke_terminal_failure`, never straight onto the shared
-        parent, then folds through `finalize_smoke_fanout` exactly like a
-        leg that reports a real `SMOKE: fail`. Before this test, only the
-        EVENT_COMPLETION half of that symmetry had coverage."""
+        capability-partition leg whose WORKER died resolves onto its OWN row
+        via `propagate_smoke_terminal_failure`, never straight onto the
+        shared parent, then folds through `finalize_smoke_fanout` exactly
+        like a leg that reports a real `SMOKE: fail`.
+
+        This leg exited NON-ZERO (#3705): it actually ran and returned an
+        error, so it is a genuine work failure and must fold into the
+        aggregate as `failed` — the silent #1605 retry path is only for a leg
+        that left no exit status at all (covered by the next test)."""
         from coord.notify import (  # noqa: PLC0415
             EVENT_COMPLETION,
             EVENT_FAILURE,
@@ -2938,7 +2940,11 @@ class TestSmokeCompletionVerdict:
 
         # The leg's OWN row carries the terminal verdict — never a straight
         # write onto the shared parent (#1797's shape).
-        assert load_assignment_test_state("leg-win2") == "failed"
+        assert load_assignment_test_state("leg-win2") == "failed", (
+            "a leg that ran and exited non-zero is a genuine work failure "
+            "even with no classified reason text — got "
+            f"{load_assignment_test_state('leg-win2')!r}"
+        )
 
         conn = get_connection()
         row = conn.execute(
@@ -2954,6 +2960,93 @@ class TestSmokeCompletionVerdict:
             f"{row['test_reason']!r}"
         )
 
+    def test_silent_fanout_leg_death_clears_the_leg_for_a_bounded_retry(
+        self, coord_db, tmp_path,
+    ) -> None:
+        """#3705 on the live, event-driven path: a fan-out leg whose worker
+        died leaving NO exit status and NO classifiable reason (a reaped
+        agent, a lost process group — the #1605 class) must be cleared for a
+        bounded automatic retry of its partition, never recorded as a work
+        failure with a synthetic placeholder reason behind it. That synthetic
+        verdict is what used to dispatch a full blind Work→Test→Review
+        smoke-fix cycle for zero actionable content.
+
+        `coord.notify`'s `_failure_reason` is built only from a fixed set of
+        coordinator-authored structured fields (usage-limit, API error, …) —
+        a worker's own free-text `entry["error"]` never feeds it, by design
+        (`classify_failure`'s vocabulary is restricted to named wire tokens,
+        never arbitrary worker prose) — so this shape reaches
+        `propagate_smoke_terminal_failure` with an empty `failure_reason`."""
+        from coord.notify import EVENT_FAILURE, Transition, post_transition  # noqa: PLC0415
+        from coord.state import (  # noqa: PLC0415
+            get_connection,
+            load_assignment_test_reason,
+            load_assignment_test_state,
+            record_test_verdict,
+        )
+
+        self._record_work("work-silent")
+        self._record_fanout_leg(
+            "leg-gtk-silent", parent_id="work-silent", capabilities=("gtk",),
+        )
+        self._record_fanout_leg(
+            "leg-win-silent", parent_id="work-silent", capabilities=("windows",),
+        )
+        record_test_verdict(
+            assignment_id="work-silent", test_state="running",
+            test_reason=(
+                "[[smoke-fanout:leg-gtk-silent=gtk,leg-win-silent=windows]]\n"
+                "Test stage running across 2 capability-partition leg(s) "
+                "(#3182): [gtk]; [windows]."
+            ),
+        )
+
+        failure = Transition(
+            assignment_id="leg-win-silent", machine_name="dell64",
+            repo_name="api", issue_number=42, event=EVENT_FAILURE,
+            exit_code=None,
+        )
+        failure_record = {
+            "repo_github": "acme/api", "type": "smoke",
+            "review_of_assignment_id": "work-silent",
+            "issue_title": "[smoke:windows] Fix thing",
+        }
+        failure_entry = {
+            "started_at": 1000.0, "finished_at": 1010.0,
+            "branch": "issue-42-fix-thing", "log_path": None,
+        }
+        with (
+            patch("coord.notify.post_completion"),
+            patch("coord.notify.post_failure"),
+            patch("coord.notify.mark_notified"),
+            patch("coord.notify._capture_cost"),
+            patch("coord.notify._capture_smoke_tests"),
+            patch("coord.notify._capture_completion_summary"),
+            patch("coord.notify._capture_claude_session_id"),
+        ):
+            post_transition(failure, failure_record, failure_entry)
+
+        assert load_assignment_test_state("leg-win-silent") is None, (
+            "a leg that died with no exit status and no reason must clear "
+            "for automatic retry, never fail the leg outright — got "
+            f"{load_assignment_test_state('leg-win-silent')!r}"
+        )
+        assert "#1605" in (load_assignment_test_reason("leg-win-silent") or "")
+
+        conn = get_connection()
+        row = conn.execute(
+            "SELECT test_state, test_reason FROM assignments WHERE assignment_id=?",
+            ("work-silent",),
+        ).fetchone()
+        assert row["test_state"] == "running", (
+            "a silent #1605 leg death must hold the fan-out's aggregate at "
+            "'running' — not everyone has reported in yet — rather than "
+            f"fold a synthetic failure into it — got {row['test_state']!r}"
+        )
+        assert "environmental" in (row["test_reason"] or "").lower(), (
+            f"expected the #3315 environmental tally — got {row['test_reason']!r}"
+        )
+
     def test_operator_cancelled_leg_does_not_fail_the_parent_while_sibling_runs(
         self, coord_db,
     ) -> None:
@@ -3045,13 +3138,19 @@ class TestSmokeCompletionVerdict:
             f"folded in as a verdict; got {row['test_state']!r}"
         )
 
-    def test_operator_cancelled_leg_fails_the_parent_when_no_sibling_survives(
+    def test_operator_cancelled_leg_clears_for_retry_when_no_sibling_survives(
         self, coord_db,
     ) -> None:
-        """The guard only protects a LIVE/passed sibling. When every other
-        leg is already a non-verdict terminal row too (nothing left to
+        """The sibling guard only protects a LIVE/passed sibling. When every
+        other leg is already a non-verdict terminal row too (nothing left to
         protect), an operator cancellation falls through to the ordinary
-        classification unchanged."""
+        classification — where #3705 still treats it as silent: a `coord
+        stop` leaves no `failure_reason` text for `classify_failure` to scan,
+        and the non-zero exit status it leaves behind is the OPERATOR'S kill
+        signal (a SIGTERM'd process group), never a verdict on the code under
+        test. So the partition is cleared for a bounded automatic retry
+        exactly like the sibling-protection branch does, rather than recorded
+        as a work failure with nothing actionable behind it."""
         from coord.notify import EVENT_FAILURE, Transition, post_transition  # noqa: PLC0415
         from coord.state import (  # noqa: PLC0415
             get_connection,
@@ -3074,7 +3173,7 @@ class TestSmokeCompletionVerdict:
 
         cancel = Transition(
             assignment_id="leg-macos-solo", machine_name="macmini", repo_name="api",
-            issue_number=42, event=EVENT_FAILURE, exit_code=None,
+            issue_number=42, event=EVENT_FAILURE, exit_code=-15,
         )
         cancel_record = {
             "repo_github": "acme/api", "type": "smoke",
@@ -3097,13 +3196,22 @@ class TestSmokeCompletionVerdict:
         ):
             post_transition(cancel, cancel_record, cancel_entry)
 
-        assert load_assignment_test_state("leg-macos-solo") == "failed"
+        # No structured or free-text reason survives a `coord stop` cancel,
+        # and its SIGTERM exit status says nothing about the code, so the
+        # fall-through classification treats this exactly like any other
+        # silent #1605 death: clear the leg for a bounded automatic retry
+        # rather than fail it outright with nothing actionable.
+        assert load_assignment_test_state("leg-macos-solo") is None
         conn = get_connection()
         row = conn.execute(
-            "SELECT test_state FROM assignments WHERE assignment_id=?",
+            "SELECT test_state, test_reason FROM assignments WHERE assignment_id=?",
             ("work-cancel-solo",),
         ).fetchone()
-        assert row["test_state"] == "failed"
+        assert row["test_state"] == "running", (
+            "the fan-out aggregate must stay 'running' while the solo leg "
+            f"is retried — got {row['test_state']!r}"
+        )
+        assert "environmental" in (row["test_reason"] or "").lower()
 
     def test_interactive_smoke_mode_not_auto_certified(
         self, coord_db