code-coordinator 0.5.648__tar.gz → 0.5.649__tar.gz

{code_coordinator-0.5.648 → code_coordinator-0.5.649}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.648
+Version: 0.5.649
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.648 → code_coordinator-0.5.649}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.648
+Version: 0.5.649
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.648 → code_coordinator-0.5.649}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.648",
+  "tag": "0.5.649",
   "distance": 0,
-  "node": "g24bda09de37c4892fe2faaad63b17e81bfcba919",
+  "node": "g86804ec8747c96b5ade7034cf0c6d0a6f617febb",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-18"

{code_coordinator-0.5.648 → code_coordinator-0.5.649}/coord/commands/drive_queue.py

@@ -31,6 +31,7 @@ from __future__ import annotations
 
 import json as _json
 import logging
+import re
 import socket
 import subprocess
 import time
@@ -95,7 +96,9 @@ from coord.drive_queue import (
     is_fix_round_ceiling_blocked,
     is_merge_gate_block_reason,
     is_permanent_block_reason,
+    is_policy_refusal_reason,
     is_pre_dispatch_block_reason,
+    is_premise_refusal_reason,
     is_test_stage_routing_dead_end_reason,
     is_unsatisfiable_prereq_reason,
     merge_gate_remedy_command,
@@ -2304,6 +2307,36 @@ def drive_queue_remove(repo: str, issue: int, config_path: Path) -> None:
     )
 
 
+#: Shapes an un-filled-in ``--reason`` template takes: an angle-bracketed
+#: prompt (``<describe why the premise now holds>``) or a bare ellipsis
+#: (``"..."``) — the two forms this repo's own remediation strings use.
+_TEMPLATED_REASON_RE = re.compile(r"<[^<>]*>|^[.…\s]+$")
+
+
+def _is_templated_reason(reason: str) -> bool:
+    """True when *reason* is still a copy-pasted placeholder, not an assertion.
+
+    #3339's premise recheck is "a human's explicit, auditable assertion …
+    its mere presence — never inferred, never re-derived" (`coord/drive.py`'s
+    `decide()`), so the one thing `--reason` must never accept is the template
+    text out of a remediation string. Several surfaces print that chain with a
+    placeholder in it — `coord diagnose`'s `refused_premise` finding, the
+    premise park reason, and the `proposed_command` on the #3719 refusal-park
+    escalation, which `coord escalate run` executes blind with no confirmation
+    prompt. Rejecting the placeholder is what makes such a blind run exit
+    non-zero (so nothing is requeued and the escalation is not dismissed)
+    instead of recording a fabricated assertion and dispatching paid work at
+    a premise nobody rechecked.
+
+    The angle-bracket arm over-matches: a genuine reason that quotes a
+    bracketed URL (`PR <https://…> landed`) is rejected too. That is the
+    deliberate direction to err in — the rejection names the offending
+    string and shows a usable example, so the cost is one retyped sentence,
+    whereas the other direction records an assertion nobody made.
+    """
+    return bool(_TEMPLATED_REASON_RE.search(reason))
+
+
 @drive_queue_group.command("clear-refusal")
 @click.argument("repo")
 @click.argument("issue", type=int)
@@ -2336,6 +2369,13 @@ def drive_queue_clear_refusal(
     row that will actually tick. Re-scope the issue FIRST if the remaining
     work has changed — this command only unblocks dispatch, it does not
     touch the issue body.
+
+    `--reason` must be your own words. A still-templated placeholder — the
+    `<...>`/`"..."` text the remediation chains printed by `coord diagnose`,
+    the premise park reason and the #3719 refusal-park escalation all carry
+    — is rejected, so running one of those chains verbatim (including blind,
+    via `coord escalate run`) fails here rather than fabricating the
+    assertion and redispatching paid work at an unverified premise.
     """
     from coord.drive_state import WORK_LIKE  # noqa: PLC0415
     from coord.state import mark_premise_rechecked  # noqa: PLC0415
@@ -2343,6 +2383,16 @@ def drive_queue_clear_refusal(
     reason = reason.strip()
     if not reason:
         raise click.ClickException("--reason must not be empty")
+    if _is_templated_reason(reason):
+        raise click.ClickException(
+            f"--reason is still the placeholder text ({reason!r}) — it must be "
+            "your own assertion of why the premise now holds (e.g. "
+            '--reason "quadraui#971 landed, re-scoped to a pin move"). This '
+            "is recorded as a human's explicit, auditable claim that the "
+            "prerequisite exists now, and `coord drive` dispatches fresh "
+            "paid work off its mere presence, so it is never inferred and "
+            "never filled in from a template."
+        )
 
     aid, status, _machine = _latest_work_assignment(repo, issue)
     if not aid:
@@ -6759,7 +6809,15 @@ def _apply_writes(plan: TickPlan) -> None:
         update_drive_queue_entry(parsed[0], parsed[1], **updates)
 
 
-def _escalate(repo: str, issue: int, *, reason: str, gates: str, command: str) -> None:
+def _escalate(
+    repo: str,
+    issue: int,
+    *,
+    reason: str,
+    gates: str,
+    command: str,
+    assignment_id: str | None = None,
+) -> None:
     from coord.state import record_drive_escalation  # noqa: PLC0415
 
     record_drive_escalation(
@@ -6769,6 +6827,7 @@ def _escalate(repo: str, issue: int, *, reason: str, gates: str, command: str) -
         reason=reason,
         gate_readings=gates,
         proposed_command=command,
+        assignment_id=assignment_id,
     )
 
 
@@ -6801,6 +6860,77 @@ def _requeue_command(entry: QueueEntry | None, key: str) -> str:
     )
 
 
+def _refusal_park_escalation_command(
+    entry: QueueEntry | None,
+    key: str,
+    reason: str,
+    kind: str,
+    *,
+    config_path: Path | None = None,
+) -> str:
+    """The command a #3719 policy-/premise-refusal `parked` escalation
+    proposes.
+
+    Both causes need a human DECISION first — retarget the issue (policy,
+    #2234) or confirm the premise now holds (premise, #3164) — and neither
+    decision is itself expressible as a blind CLI command: retargeting means
+    rewriting the GitHub issue title by hand, and `clear-refusal` takes a
+    free-text `--reason` only a human can write. `reason` (passed through
+    verbatim as this escalation's own `reason=`) already states which
+    decision is needed and why, so this only has to supply the mechanical
+    half that runs once that decision is made.
+
+    A parked `refused_premise`/`refused_policy` row IS a completed
+    Work-stage assignment (that is what those statuses mean), so it gets
+    the mechanical half from `_blocked_escalation_command` — the same
+    function every other parked/blocked escalation uses — instead of a
+    bespoke requeue: #2377's open-PR check (never propose a blind requeue
+    when an out-of-band PR already exists for this entry) and #3539's
+    plain-`add` carve-out (a green PR missing only its recorded gates)
+    both apply here as they do for any other parked entry. One corner is
+    inherited from #3539's own design rather than chosen here: it reasons
+    from `state.work_aid` being unset, which for a refusal park it is not,
+    so on a premise refusal whose issue has acquired a green out-of-band PR
+    the plain `add` restarts the Work stage over that PR rather than
+    running only the missing stages forward.
+
+    For `kind == "premise"`, `coord drive`'s `decide()` reads the latest
+    work assignment's own `work_status` column directly — independent of
+    the drive-queue row or any PR — so ANY redispatch (the blind requeue
+    OR the #3539 plain `add`) dies on the same refusal again unless
+    `clear-refusal` first records that the premise now holds. Prepend
+    that step whenever the delegated command would actually redispatch
+    (still names `drive-queue add`); the inspect/merge-existing remedies
+    propose no redispatch at all, so they need no such prefix. The policy
+    case has no `clear-refusal` equivalent — #2234's refusal is cleared by
+    retargeting the GitHub issue by hand, which a redispatch neither needs
+    nor can bypass.
+
+    The `--reason` this emits is a PLACEHOLDER, and this field is executed
+    blind: `coord escalate run` shells the whole string out with no
+    confirmation prompt, and `coord/reports.py` offers it as the card's
+    "Recommended" option. That is safe only because
+    :func:`_is_templated_reason` makes `clear-refusal` reject the
+    placeholder, so a one-key run fails on the FIRST step — nothing is
+    requeued, no premise assertion is recorded, and `escalate run` reports
+    the failure instead of dismissing the escalation as resolved. Keep the
+    two in step: an edit here that produces a reason `clear-refusal` would
+    accept turns this into a blind command that fabricates the one value
+    #3339 says must never be inferred.
+    """
+    tail = _blocked_escalation_command(entry, key, reason, config_path=config_path)
+    if kind != "premise" or "drive-queue add" not in tail:
+        return tail
+    parsed = parse_key(key)
+    if parsed is None:
+        return tail
+    repo, issue = parsed
+    return (
+        f"coord drive-queue clear-refusal {repo} {issue} "
+        f'--reason "<describe why the premise now holds>" && {tail}'
+    )
+
+
 def _blocked_escalation_command(
     entry: QueueEntry | None,
     key: str,
@@ -7771,6 +7901,74 @@ def drive_queue_tick(
                 command=merge_plan_inspect_command(parsed[0]),
             )
 
+        # #3719: a `parked` entry whose park reason names a policy (#2234)
+        # or premise (#3164) refusal never resumes on its own — see
+        # `plan_tick`'s pre-pass above (`is_policy_refusal_reason`/
+        # `is_premise_refusal_reason` both just `continue`, leaving the
+        # entry parked rather than falling through to the CI-park auto-
+        # resume) — so without this it sits invisible until an operator
+        # happens to notice it in `coord drive-queue list`. Gate-A
+        # (#2063), throttle-skip (#2977), `merge_ci_pending` (#1891), and
+        # the issue-cache-stale (#2858) parks are deliberately NOT swept
+        # here: all four are documented, by the same pre-pass, to clear
+        # themselves with no human decision needed — exactly the
+        # auto-resolvable half #3719 says must NOT be escalated.
+        #
+        # This fires once: `plan.reconciles` only carries a `"parked"`
+        # entry for *this* key on the single tick `_reconcile_running`
+        # first parks it (a running entry hitting the refusal) — every
+        # later tick the entry stays parked, the pre-pass above `continue`s
+        # without emitting a `Reconcile` for it at all, so there is no
+        # repeat entry here to re-escalate on.
+        for item in plan.reconciles:
+            if item.outcome != "parked":
+                continue
+            if not (
+                is_policy_refusal_reason(item.reason)
+                or is_premise_refusal_reason(item.reason)
+            ):
+                continue
+            parsed = parse_key(item.key)
+            if parsed is None:
+                continue
+            entry = by_key.get(item.key)
+            kind = "premise" if is_premise_refusal_reason(item.reason) else "policy"
+            # Best-effort, matching `_record_checks_stale_escalation`'s own
+            # posture: the write above (`_apply_writes(plan)`) already
+            # landed, so a failure recording the escalation itself must not
+            # turn an otherwise-successful tick into a reported CLI failure.
+            # The stdout line is the floor, and here it is load-bearing: the
+            # sweep fires once per park, so a failure anywhere in this block
+            # (including inside `_refusal_park_escalation_command`, which
+            # reaches `gh` for #2377's open-PR check) loses this entry's ONLY
+            # escalation permanently — it must at least leave a trace.
+            try:
+                aid, _status, _machine = _latest_work_assignment(
+                    parsed[0], parsed[1]
+                )
+                _escalate(
+                    parsed[0],
+                    parsed[1],
+                    reason=item.reason,
+                    gates=(
+                        f"queue_state=parked | refusal={kind} | position="
+                        f"{entry.position if entry else '?'}"
+                    ),
+                    command=_refusal_park_escalation_command(
+                        entry,
+                        item.key,
+                        item.reason,
+                        kind,
+                        config_path=config_path,
+                    ),
+                    assignment_id=aid or None,
+                )
+            except Exception as exc:  # noqa: BLE001 — the stdout line is the floor
+                click.echo(
+                    f"  (could not record the {kind}-refusal park escalation "
+                    f"for {item.key}: {exc})"
+                )
+
         # #3695 review finding 1: `_apply_writes(plan)` above only ever
         # touches `_DRIVE_QUEUE_UPDATABLE` columns on the DRIVE QUEUE row
         # itself (`update_drive_queue_entry`) — it has no way to reach the

{code_coordinator-0.5.648 → code_coordinator-0.5.649}/tests/test_cli_drive_queue.py

@@ -1093,6 +1093,98 @@ def test_blocked_escalation_command_proposes_a_plain_add_when_pr_is_green_but_un
     assert "remove" not in command
 
 
+# ── #3719: what a refusal park's escalation proposes ────────────────────────
+#
+# `_refusal_park_escalation_command` delegates the mechanical half to
+# `_blocked_escalation_command` (so #2377's open-PR check and #3539's
+# plain-`add` carve-out apply) and prepends `clear-refusal` ONLY when the
+# delegated tail would actually redispatch AND the refusal is a premise one.
+# That branch selector is a substring sniff on the tail, so both of its
+# negative legs are pinned here: a wording change in
+# `existing_pr_relaunch_remedy`/`merge_gate_remedy_command` that silently
+# flipped either direction would otherwise leave the suite green.
+
+
+def test_refusal_park_command_prepends_clear_refusal_for_a_premise_requeue(
+    monkeypatch, config_file,
+):
+    """The positive leg: premise refusal, nothing dispatched out of band, so
+    the tail is the blind requeue — `coord drive`'s `decide()` reads the
+    latest work row's own status, so the requeue must be preceded by the
+    `clear-refusal` that records the premise holds now (#3339)."""
+    from coord.commands.drive_queue import _refusal_park_escalation_command
+    from coord.drive_queue import entry_key
+
+    monkeypatch.setattr(
+        "coord.commands.drive_queue._existing_pr_match",
+        lambda config_path, repo, issue: None,
+    )
+    command = _refusal_park_escalation_command(
+        None, entry_key(REPO, 4219), "refused on the issue's own false premise",
+        "premise", config_path=config_file,
+    )
+
+    assert command.startswith(f"coord drive-queue clear-refusal {REPO} 4219 ")
+    assert command.index("clear-refusal") < command.index("drive-queue remove")
+    assert command.endswith(
+        f"coord drive-queue remove {REPO} 4219 && coord drive-queue add {REPO} 4219"
+    )
+
+
+def test_refusal_park_command_omits_clear_refusal_for_a_policy_refusal(
+    monkeypatch, config_file,
+):
+    """A `refused_policy` verdict (#2234) has no `clear-refusal` equivalent —
+    it is cleared by retargeting the GitHub issue by hand, which no CLI
+    command expresses — so the proposed command is the delegated tail
+    unchanged. #2871's stale-refusal bypass makes that plain requeue
+    genuinely work once the retarget lands."""
+    from coord.commands.drive_queue import _refusal_park_escalation_command
+    from coord.drive_queue import entry_key
+
+    monkeypatch.setattr(
+        "coord.commands.drive_queue._existing_pr_match",
+        lambda config_path, repo, issue: None,
+    )
+    command = _refusal_park_escalation_command(
+        None, entry_key(REPO, 4220), "refused: the deliverable is coordinator-only",
+        "policy", config_path=config_file,
+    )
+
+    assert command == (
+        f"coord drive-queue remove {REPO} 4220 && coord drive-queue add {REPO} 4220"
+    )
+    assert "clear-refusal" not in command
+
+
+def test_refusal_park_command_omits_clear_refusal_when_the_tail_wont_redispatch(
+    monkeypatch, config_file,
+):
+    """#2377's leg, reached through a premise refusal: an out-of-band green PR
+    already exists for this entry, so the tail is `coord merge --only` and
+    nothing is redispatched. Prepending `clear-refusal` there would assert a
+    rechecked premise to unblock a dispatch that is not going to happen."""
+    from coord.commands.drive_queue import _refusal_park_escalation_command
+    from coord.drive_queue import ExistingPrMatch, entry_key
+
+    monkeypatch.setattr(
+        "coord.commands.drive_queue._existing_pr_match",
+        lambda config_path, repo, issue: ExistingPrMatch(
+            number=4321,
+            branch="issue-4219-prereq-landed",
+            url="https://github.com/example/claude-coordinator/pull/4321",
+            all_green=True,
+        ),
+    )
+    command = _refusal_park_escalation_command(
+        None, entry_key(REPO, 4219), "refused on the issue's own false premise",
+        "premise", config_path=config_file,
+    )
+
+    assert command == f"coord merge --only {REPO}#4219"
+    assert "clear-refusal" not in command
+
+
 def test_a_declared_file_is_checked_against_a_live_branchs_real_diff(
     cli, declare, seed, branch_diff,
 ):
@@ -2296,6 +2388,79 @@ def test_clear_refusal_requires_a_nonempty_reason(cli, seed):
     assert "must not be empty" in result.output
 
 
+@pytest.mark.parametrize(
+    "reason",
+    [
+        "<describe why the premise now holds>",
+        "...",
+        "…",
+        "the prerequisite <name it> has landed",
+    ],
+)
+def test_clear_refusal_rejects_a_still_templated_reason(cli, seed, coord_db, reason):
+    """The recorded recheck is "a human's explicit, auditable assertion …
+    never inferred" (`coord/drive.py`'s `decide()`), and `coord drive`
+    dispatches fresh paid work off its mere presence. Several surfaces print
+    the remediation chain WITH a placeholder in the `--reason` — `coord
+    diagnose`'s `refused_premise` finding, the premise park reason, and the
+    #3719 refusal-park escalation's `proposed_command`, which `coord escalate
+    run` shells out blind. Copying one verbatim must fail here rather than
+    record the template text as the assertion."""
+    seed(assignments=[{"issue_number": 1650, "status": "refused_premise"}])
+
+    result = cli("clear-refusal", REPO, "1650", "--reason", reason)
+
+    assert result.exit_code != 0, result.output
+    assert "still the placeholder text" in result.output
+    row = coord_db.execute(
+        "SELECT premise_rechecked_at, premise_rechecked_reason FROM assignments "
+        "WHERE assignment_id = ?",
+        ("a-claude-coordinator-0",),
+    ).fetchone()
+    assert row["premise_rechecked_at"] is None
+    assert row["premise_rechecked_reason"] is None
+
+
+def test_the_refusal_escalations_own_proposed_command_fails_closed(
+    cli, seed, coord_db, monkeypatch, config_file,
+):
+    """`drive_escalations.proposed_command` is executed BLIND: `coord escalate
+    run` shells the whole string out with no confirmation prompt and, unless
+    it exits non-zero, dismisses the escalation as resolved. So the premise
+    remedy's placeholder `--reason` is only safe while `clear-refusal` keeps
+    rejecting it — this reads the placeholder back out of the command the
+    sweep actually proposes and asserts a blind run dies on the FIRST step,
+    before any requeue and with no fabricated recheck recorded."""
+    import shlex
+
+    from coord.commands.drive_queue import _refusal_park_escalation_command
+    from coord.drive_queue import entry_key
+
+    monkeypatch.setattr(
+        "coord.commands.drive_queue._existing_pr_match",
+        lambda config_path, repo, issue: None,
+    )
+    proposed = _refusal_park_escalation_command(
+        None, entry_key(REPO, 1650), "refused on the issue's own false premise",
+        "premise", config_path=config_file,
+    )
+    first_step, _, requeue = proposed.partition(" && ")
+    argv = shlex.split(first_step)
+    assert argv[:4] == ["coord", "drive-queue", "clear-refusal", REPO]
+    assert "drive-queue add" in requeue  # the step that must never be reached
+    reason = argv[argv.index("--reason") + 1]
+
+    seed(assignments=[{"issue_number": 1650, "status": "refused_premise"}])
+    result = cli("clear-refusal", REPO, "1650", "--reason", reason)
+
+    assert result.exit_code != 0, result.output
+    row = coord_db.execute(
+        "SELECT premise_rechecked_at FROM assignments WHERE assignment_id = ?",
+        ("a-claude-coordinator-0",),
+    ).fetchone()
+    assert row["premise_rechecked_at"] is None
+
+
 # ── remove owns the driver it orphans (#3282) ───────────────────────────────
 #
 # Before this fix, `remove` deleted only the queue row: a driver already
@@ -3094,6 +3259,87 @@ def test_a_dead_drives_own_exit_reason_reaches_the_queue_row(
     assert state._get_drive_escalation_local(REPO, 1762) is not None
 
 
+def test_a_premise_refusal_park_escalates_exactly_once(
+    cli, seed, launches, coord_db, monkeypatch,
+):
+    """#3719: a premise refusal (#3164) parks the entry, but unlike a
+    `merge_ci_pending` park it never clears itself — `plan_tick`'s
+    STATE_PARKED pre-pass just `continue`s on it forever (see
+    `test_a_parked_policy_refusal_does_not_auto_resume_next_tick` in
+    tests/test_drive_queue.py). Before this issue, that meant the entry
+    sat parked and invisible until an operator happened to go looking in
+    `coord drive-queue list`. The very tick that first parks it must now
+    also write a `drive_escalations` row naming the human decision needed
+    (confirm the premise now holds) and, as the mechanical half, a
+    `clear-refusal` ahead of the requeue — `coord drive`'s `decide()` keys
+    off the latest work assignment's own status column, so a bare requeue
+    without first clearing the refusal would just die on it again. Because
+    the pre-pass never re-emits a `Reconcile` for an already-parked entry, a
+    second tick must NOT write a second escalation.
+    """
+    from coord.audit import record_audit
+    from coord.models import PREMISE_REFUSAL_MARKER
+    from coord import state as state_module
+
+    calls = []
+    real_record = state_module.record_drive_escalation
+
+    def _spy(*args, **kwargs):
+        calls.append((args, kwargs))
+        return real_record(*args, **kwargs)
+
+    monkeypatch.setattr(state_module, "record_drive_escalation", _spy)
+
+    seed(issues={4219: "open"})
+    cli("add", REPO, "4219")
+    cli("tick")
+
+    reason = (
+        f"drive exited for {REPO}#4219 (exit_code=1): work 721861c90bf3 "
+        "refused on the issue's own false premise rather than doing the "
+        f"dispatched work — the worker did the CORRECT thing (#3164). "
+        f"{PREMISE_REFUSAL_MARKER}"
+    )
+    launched_at = queued(4219)["launched_at"]
+    _backdate(4219, DRIVE_STARTUP_GRACE_SECONDS + 60)
+    record_audit(
+        tier="business", category="drive", event_type="drive_exited",
+        actor="drive", summary=reason, repo=REPO, issue=4219,
+        ts=launched_at + 5,
+    )
+    result = cli("tick")
+    assert result.exit_code == 0, result.output
+
+    entry = queued(4219)
+    assert entry["state"] == "parked"
+    assert entry["attempts"] == 0
+
+    escalation = state._get_drive_escalation_local(REPO, 4219)
+    assert escalation is not None
+    proposed = escalation["proposed_command"]
+    assert "coord drive-queue clear-refusal" in proposed
+    assert "coord drive-queue remove" in proposed
+    assert "coord drive-queue add" in proposed
+    # The clear-refusal must run BEFORE the requeue it precedes, or the
+    # requeue's own redispatch races the still-unset premise-recheck flag.
+    assert proposed.index("clear-refusal") < proposed.index("remove")
+    assert PREMISE_REFUSAL_MARKER in escalation["reason"]
+    assert "refusal=premise" in escalation["gate_readings"]
+    first_created_at = escalation["created_at"]
+    assert len(calls) == 1, calls
+
+    # A second tick: the entry stays parked, no second escalation write.
+    second = cli("tick")
+    assert second.exit_code == 0, second.output
+    assert queued(4219)["state"] == "parked"
+    still = state._get_drive_escalation_local(REPO, 4219)
+    assert still is not None
+    assert still["created_at"] == first_created_at
+    # The actual write call count — not just the preserved `created_at` —
+    # is the assertion that would fail if the sweep re-escalated.
+    assert len(calls) == 1, calls
+
+
 def test_exhausted_ci_stale_escalation_proposes_revalidate_not_a_requeue(
     cli, seed, launches, coord_db, config_file
 ):
@@ -3386,6 +3632,27 @@ def test_a_still_parked_entry_stays_parked_across_a_quiet_tick(
     assert len(launches) == 1, launches  # no second launch attempt
 
 
+def test_a_merge_ci_pending_park_never_escalates(cli, seed, launches, coord_db):
+    """#3719's sweep targets only the two causes a human must decide
+    (policy/premise refusal) — a `merge_ci_pending` park is self-healing
+    (the pre-pass in `plan_tick` resumes it the moment CI reports), so it
+    must never write a `drive_escalations` row, no matter how many quiet
+    ticks it sits through."""
+    seed(issues={1762: "open"})
+    cli("add", REPO, "1762")
+    cli("tick")
+    _seed_ci_pending_merge_row(coord_db, 1762)
+    _backdate(1762, DRIVE_STARTUP_GRACE_SECONDS + 60)
+    cli("tick")
+    assert queued(1762)["state"] == "parked"
+    assert state._get_drive_escalation_local(REPO, 1762) is None
+
+    result = cli("tick")
+    assert result.exit_code == 0, result.output
+    assert queued(1762)["state"] == "parked"
+    assert state._get_drive_escalation_local(REPO, 1762) is None
+
+
 # ── #2158: a park must have an exit that is not the merge it blocks ────────
 #
 # #1891's resume predicate was refreshable ONLY by a live `coord merge`