code-coordinator 0.5.64__tar.gz → 0.5.66__tar.gz

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.64
+Version: 0.5.66
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.64
+Version: 0.5.66
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.64",
+  "tag": "0.5.66",
   "distance": 0,
-  "node": "gfd34f94b90b737b1d9df054d5147d16c070c4748",
+  "node": "g2a4b596d92f5df37f20c5e4da4b887658112a74f",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-14"

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/agent_app.py

@@ -1463,13 +1463,23 @@ def build_app(
         installed, and keeps a ``.bak`` of each — see
         :mod:`coord.deploy_units` for why both are deliberate.
 
-        Also asserts every installed *timer* is enabled and running
+        Also asserts every installed *timer* is enabled
         (:func:`coord.deploy_units.enable_timers`, #2082): refreshing a
         timer's content has never implied enabling it, and that gap is
         exactly how ``coord-release-propagate.timer`` reached this host with
         matching content and sat disabled for a day with nothing noticing.
-        ``enable --now`` is idempotent, so this runs on every call, not just
-        when content changed — an already-enabled timer is untouched.
+        This runs on every non-dry-run call, not just when content changed —
+        an already-enabled timer's *enablement* is untouched (idempotent).
+
+        It does **not**, as of #2124, force a start (``--now``) on a timer
+        that is already enabled: that used to restart a timer an operator
+        had deliberately stopped moments earlier — the exact window the
+        documented manual-roll sequence exists to create — because ``enable
+        --now`` cannot tell "never enabled" (#2082's actual bug) apart from
+        "enabled, but stopped on purpose" (never a bug at all). See
+        :func:`coord.deploy_units.enable_timers` for how it now tells the
+        two apart, and ``timers_enabled[<unit>]["changed"]`` below for
+        which case each timer landed in.
         """
         from coord import deploy_units as du  # noqa: PLC0415
         from coord.brain import AGENT_PORT  # noqa: PLC0415
@@ -1504,10 +1514,10 @@ def build_app(
         if not dry_run:
             timer_results = du.enable_timers(report)
             payload["timers_enabled"] = {
-                name: {"ok": ok, "detail": detail}
-                for name, (ok, detail) in timer_results.items()
+                name: {"ok": ok, "changed": changed, "detail": detail}
+                for name, (ok, changed, detail) in timer_results.items()
             }
-            if any(not ok for ok, _ in timer_results.values()):
+            if any(not ok for ok, _changed, _detail in timer_results.values()):
                 payload["ok"] = False
         return JSONResponse(payload, status_code=200 if payload.get("ok") else 500)
 

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/commands/drive_queue.py

@@ -50,6 +50,7 @@ from coord.drive_queue import (
     QUEUE_ALERT_STAGE,
     RESUME_PROBE_TIMEOUT_SECONDS,
     STATE_BLOCKED,
+    STATE_FAILED,
     STATE_PARKED,
     STATE_RUNNING,
     STATE_WAITING,
@@ -59,8 +60,10 @@ from coord.drive_queue import (
     QueueError,
     TickPlan,
     build_board_view,
+    diagnose_blocked_after,
     entries_from_rows,
     entry_key,
+    find_cycle,
     fired_holds,
     parse_after_spec,
     parse_key,
@@ -300,6 +303,50 @@ def validate_config_repo(config_path: Path, repo: str) -> None:
 
 # ── list ─────────────────────────────────────────────────────────────────────
 
+# `blocked`/`failed` are the two states #2183's re-diagnosis applies to: both
+# are in `TERMINAL_QUEUE_STATES` (the tick will never look at this row's
+# `after=` graph again), so both are exactly where a stale `after=` reading
+# can survive indefinitely. `done` is also terminal but carries no live
+# "why is this stuck" question — nothing to re-diagnose.
+_DIAGNOSABLE_STATES = (STATE_BLOCKED, STATE_FAILED)
+
+# How much of a (possibly multi-line, possibly paragraph-length) `last_reason`
+# fits on the summary row itself, next to `attempts=`/`deferrals=`, without
+# wrapping a normal terminal. The FULL text always still prints on the `last:`
+# continuation line right below — this is only the on-row teaser.
+_ROW_CAUSE_MAX_CHARS = 88
+
+_BLOCKED_REMEDY = (
+    "remedy: {state} is terminal — the queue will not re-check this row "
+    "on its own; `coord drive-queue remove` + `add` only helps once the "
+    "cause above is actually fixed, not merely because a pre-req merged"
+)
+
+
+def _row_cause(reason: str) -> str:
+    """The first line of *reason*, clipped to fit the summary row (#2183)."""
+    first_line = reason.strip().splitlines()[0] if reason.strip() else ""
+    if len(first_line) > _ROW_CAUSE_MAX_CHARS:
+        return first_line[: _ROW_CAUSE_MAX_CHARS - 1].rstrip() + "…"
+    return first_line
+
+
+def _board_for_list_diagnosis() -> BoardView | None:
+    """The board, for `list`'s #2183 re-diagnosis — ``None`` when unreachable.
+
+    Unlike `tick`, `list` is a read-only inspection command an operator runs
+    often and expects to be fast and always available, so an unreachable
+    board must never make it fail or hang the way `tick`'s fail-closed abort
+    does. ``None`` here means "skip the re-diagnosis" — every row falls back
+    to exactly today's rendering (the `after=` list unfiltered, no cause on
+    the row itself), never a crash or a misleading empty board's worth of
+    "everything is unsatisfied".
+    """
+    try:
+        return _fetch_board_view()
+    except Exception:  # noqa: BLE001 — see docstring: this must never fail `list`
+        return None
+
 
 @drive_queue_group.command("list")
 @click.option("--repo", "repo", default=None, help="Restrict to one repo (default: every repo).")
@@ -317,12 +364,61 @@ def drive_queue_list(repo: str | None, output_json: bool, config_path: Path) ->
         click.echo("(drive queue is empty)")
         return
     now = time.time()
-    for entry in entries_from_rows(rows):
-        bits = [f"{entry.position:>2}  {entry.key:<28} {entry.state}"]
+    entries = entries_from_rows(rows)
+
+    # #2183: a `blocked`/`failed` row's `after=` graph needs to be re-checked
+    # against the FULL queue (cross-repo pre-reqs), not just whatever `--repo`
+    # filtered down to — otherwise a `--repo` view would misdiagnose an
+    # out-of-repo pre-req as "unknown to the queue" purely from the filter,
+    # not from anything actually true.
+    all_entries = entries if repo is None else entries_from_rows(list_drive_queue())
+    # A row with no `after=` at all has nothing for #2183's re-diagnosis to
+    # do — criterion "entries with no after= are unaffected" — so both the
+    # board fetch and the per-row diagnosis below are gated on `entry.after`
+    # being non-empty, not just on the state being terminal.
+    needs_diagnosis = any(
+        e.state in _DIAGNOSABLE_STATES and e.after for e in entries
+    )
+    board = _board_for_list_diagnosis() if needs_diagnosis else None
+    states = {e.key: e.state for e in all_entries}
+    cycle_keys: dict[str, str] = {}
+    cycle = find_cycle({e.key: list(e.after) for e in all_entries})
+    if cycle is not None:
+        message = "dependency cycle: " + " -> ".join(cycle)
+        for key in cycle:
+            cycle_keys[key] = message
+
+    for entry in entries:
+        diagnosed = (
+            board is not None and entry.state in _DIAGNOSABLE_STATES and bool(entry.after)
+        )
+        unsatisfied = entry.after
+        dependency_reason = ""
+        if diagnosed:
+            diagnosis = diagnose_blocked_after(entry, board, states, cycle_keys)
+            unsatisfied = diagnosis.unsatisfied
+            dependency_reason = diagnosis.dependency_reason
+
+        # A diagnosed row whose block is NOT (or no longer) caused by its
+        # `after=` graph gets its own cause on the state token itself — #2183
+        # point 2: the terminal reason leads, not a dependency list that may
+        # have nothing to do with it. A row that IS dependency-caused (or
+        # wasn't diagnosed at all) keeps the plain state token unchanged.
+        state_label = entry.state
+        if diagnosed and not dependency_reason and entry.last_reason:
+            state_label = f"{entry.state}: {_row_cause(entry.last_reason)}"
+
+        bits = [f"{entry.position:>2}  {entry.key:<28} {state_label}"]
         if entry.machine:
             bits.append(f"machine={entry.machine}")
-        if entry.after:
-            bits.append(f"after={','.join(entry.after)}")
+        # Suppress `after=` entirely on a diagnosed row that is NOT
+        # dependency-caused: every named pre-req is either satisfied or was
+        # never the reason this row is stuck, so showing it invites exactly
+        # the misreading #2183 exists to stop. Otherwise (not diagnosed, or
+        # genuinely dependency-caused) show whatever is still unsatisfied.
+        show_after = () if (diagnosed and not dependency_reason) else unsatisfied
+        if show_after:
+            bits.append(f"after={','.join(show_after)}")
         if entry.attempts:
             bits.append(f"attempts={entry.attempts}")
         if entry.deferrals:
@@ -334,6 +430,11 @@ def drive_queue_list(repo: str | None, output_json: bool, config_path: Path) ->
         click.echo("  ".join(bits))
         if entry.last_reason:
             click.echo(f"      last{_reason_age_suffix(entry, now)}: {entry.last_reason}")
+        if diagnosed:
+            # #2183 point 4: `blocked`/`failed` is terminal — say so where the
+            # operator is already reading the row, not just in an unrelated
+            # operator's hand-written `--hold-after` note.
+            click.echo(f"      {_BLOCKED_REMEDY.format(state=entry.state)}")
         for line in _hold_lines(entry):
             click.echo(line)
 

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/commands/release.py

@@ -16,6 +16,7 @@ via setuptools-scm). It does not push, tag, or modify anything itself.
 
 from __future__ import annotations
 
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -1339,7 +1340,26 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
     Returns ``ok=None`` when this host offers no channel for the lane at all
     (see :func:`_roll_tui` and #2052): the run is not accountable for a lane
     it was structurally unable to roll.
+
+    Also names every timer whose *enablement* state this call changed
+    (#2124 item 3) — and, separately, every timer it deliberately left
+    alone because it was already enabled (see
+    :func:`coord.deploy_units.enable_timers`) — so "the queue came back
+    mid-roll" (or, after this fix, "it didn't") is legible in this output
+    rather than reconstructed afterwards from journal timestamps.
+
+    ``ok`` (#2124 review) reflects every way ``agent_app.py``'s
+    ``deploy_units`` endpoint can fail, not just a failed timer: a unit
+    whose install itself failed (``action == "failed"`` — e.g. an unreadable
+    installed unit file, :mod:`coord.deploy_units` lines ~249/264/284), a
+    top-level ``error``, or a ``daemon-reload`` that was attempted and
+    failed. Before this check existed, ``ok`` was derived from
+    ``failed_timers`` alone, so any of those three could return HTTP 500
+    with ``payload["ok"]=False`` and still be recorded here as a green
+    lane — exactly the "unconfirmed success" defect #2096 exists to catch.
     """
+    from coord.deploy_units import ACTION_FAILED  # noqa: PLC0415
+
     status, body, error = _post(
         f"http://{machine.host}:{agent_port}/deploy-units", {}, timeout=30.0
     )
@@ -1352,11 +1372,24 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
         # gate to revert everything else this run got right (#2052).
         return None, ("agent has no /deploy-units yet (predates #1835) — "
                       "the next propagation will roll this lane")
-    if status != 200:
+    # The endpoint (`agent_app.py`'s `deploy_units`) returns HTTP 500 — with
+    # the SAME body shape as 200 — whenever a daemon-reload or a single
+    # timer's enablement fails. That is exactly the partial-failure path
+    # this function exists to narrate in detail, so a 500 *with a `units`
+    # body* must still be parsed below rather than treated as opaque. A 500
+    # WITHOUT a `units` body is a different, genuinely-unexpected failure
+    # (an unhandled exception, a proxy error, ...) and must still
+    # short-circuit, or a real crash would be misread as "nothing to
+    # report" / a false-positive success.
+    if status != 200 and not (status == 500 and "units" in body):
         return False, str(body.get("error") or body.get("summary") or f"HTTP {status}")
     units = body.get("units") or []
     changed = [u.get("name") for u in units if u.get("action") == "updated"]
     new = [u.get("name") for u in units if u.get("action") == "new"]
+    failed_units = {
+        (u.get("name") or "?"): (u.get("detail") or "?")
+        for u in units if u.get("action") == ACTION_FAILED
+    }
     parts = []
     parts.append(f"{len(changed)} unit(s) refreshed" if changed else "units already current")
     if body.get("reloaded"):
@@ -1366,7 +1399,79 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
             f"{len(new)} packaged unit(s) NOT installed here ({', '.join(sorted(map(str, new)))}) "
             "— a release does not decide which services a host runs"
         )
-    return True, "; ".join(parts)
+    if failed_units:
+        parts.append(
+            "FAILED to install unit(s): "
+            + ", ".join(f"{u} ({detail})" for u, detail in sorted(failed_units.items()))
+        )
+
+    # A daemon-reload is only attempted when a unit's bytes actually
+    # changed (`agent_app.py`'s `deploy_units`); "not reloaded" is a
+    # failure only when the report itself says a reload was attempted
+    # (`body["changed"]`, `InstallReport.changed`) — absent that, "not
+    # reloaded" just means there was nothing to reload, never a failure.
+    reload_failed = bool(body.get("changed")) and not body.get("reloaded")
+    if reload_failed:
+        parts.append(
+            "daemon-reload FAILED: " + str(body.get("reload_detail") or "?")
+        )
+
+    top_level_error = body.get("error")
+    if top_level_error:
+        parts.append(f"deploy-units error: {top_level_error}")
+
+    timers = body.get("timers_enabled") or {}
+    started = sorted(
+        name for name, r in timers.items()
+        if isinstance(r, dict) and r.get("ok") and r.get("changed")
+    )
+    # Held timers (confirmed already-enabled, left alone) split on the
+    # confirmed `ActiveState` carried in `enable_timers`'s own detail text
+    # (coord/deploy_units.py's `already enabled (ActiveState=...)` branch)
+    # — NOT on `changed` alone, which is equally true for the #2124 case
+    # (operator stopped it) and for the routine, overwhelmingly common case
+    # of a timer that was never touched because it is already enabled AND
+    # already running. Reporting "left stopped as-is" for the latter names
+    # a state (stopped) this call never confirmed — the #2124 review's
+    # reporting-accuracy fix.
+    held_stopped = []
+    held_other = []
+    for name, r in timers.items():
+        if not (isinstance(r, dict) and r.get("ok") and not r.get("changed")):
+            continue
+        match = re.search(r"ActiveState=(\w+)", r.get("detail") or "")
+        if match and match.group(1) == "inactive":
+            held_stopped.append(name)
+        else:
+            held_other.append(name)
+    held_stopped.sort()
+    held_other.sort()
+    failed_timers = {
+        name: (r.get("detail") or "?")
+        for name, r in timers.items() if isinstance(r, dict) and not r.get("ok")
+    }
+    if started:
+        parts.append(f"enabled timer(s): {', '.join(started)}")
+    if held_stopped:
+        # Confirmed inactive (ActiveState=inactive) and deliberately left
+        # alone — the #2124 fix in one word: a timer an operator stopped is
+        # still here.
+        parts.append(
+            f"left stopped as-is (already enabled, #2124): {', '.join(held_stopped)}"
+        )
+    if held_other:
+        # Already enabled and left alone, but NOT confirmed stopped — most
+        # commonly a timer that is already enabled and already running
+        # normally. Reported distinctly so it never gets read as "the
+        # timer I stopped is still stopped" for a timer nobody stopped.
+        parts.append(f"already enabled (unchanged): {', '.join(held_other)}")
+    if failed_timers:
+        parts.append(
+            "FAILED to enable timer(s): "
+            + ", ".join(f"{u} ({detail})" for u, detail in sorted(failed_timers.items()))
+        )
+    ok = not (failed_units or reload_failed or top_level_error or failed_timers)
+    return ok, "; ".join(parts)
 
 
 def _roll_tui(

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/deploy_units.py

@@ -65,6 +65,13 @@ from coord.health.checks.unit_drift import (
     packaged_unit_dir,
 )
 
+# Same reuse rule as above, one module over: `timer_active` is the DETECTOR
+# for "is this timer actually enabled" (#2082); `enable_timers` below is the
+# FIXER for the identical question (#2124). Querying state through its own
+# `_timer_states` — rather than a second `systemctl --user show` parser here
+# — is what keeps those two answers from being able to drift apart.
+from coord.health.checks.timer_active import _INACTIVE_STATES, _timer_states
+
 #: Placeholder -> how to fill it, given the host facts we actually know.
 #: ``unit_drift`` renders these as *shell* text for a copy-pasteable remedy
 #: (``$(hostname -s)``); here they must be real values, so the mapping is
@@ -326,45 +333,102 @@ _PRESENT_ACTIONS = frozenset({ACTION_UNCHANGED, ACTION_UPDATED})
 
 def enable_timers(
     report: InstallReport, *, runner=None, timeout: float = 30.0,
-) -> dict[str, tuple[bool, str]]:
-    """``systemctl --user enable --now <unit>`` for every installed timer in
-    *report* (#2082).
+) -> dict[str, tuple[bool, bool, str]]:
+    """Assert every installed timer in *report* is *enabled* (#2082) —
+    without forcing a *stopped* one back to running (#2124).
 
     #2082: ``coord-release-propagate.timer`` reached three hosts'
     ``~/.config/systemd/user/`` and sat there — :func:`install_units`
     refreshed its *content* on every release, but nothing ever ran
-    ``enable --now`` on it, and nothing noticed because a disabled timer's
-    file looks byte-for-byte identical to an active one's (see
-    :mod:`coord.health.checks.timer_active`, the detector for exactly this).
-
-    A ``.timer`` unit is different from a ``.service`` here: which
-    *services* a host runs is a one-time topology choice
-    (``install-agent.sh``, or a human at machine setup — see this module's
-    docstring), never something a routine refresh should override. A timer
-    that exists at all has no reason to exist disabled — its whole job is to
-    fire on a schedule with nobody watching, so "installed but not enabled"
-    is invisible from the outside and would otherwise self-heal never.
-    Applying this on every deploy makes enablement an assertion this lane
-    re-checks every time it runs, the same way :func:`install_units`
-    re-asserts content every time it runs.
-
-    Both ``enable`` and ``--now`` are idempotent — an already-enabled,
-    already-active timer is untouched — so calling this on every deploy is a
-    correctness check, not a state change, in the common case. Scoped to
-    units *this* report found actually installed (:data:`_PRESENT_ACTIONS`),
-    matching the deploy step's own "only touch what this host already runs"
-    rule.
+    ``systemctl --user enable`` on it, and nothing noticed because a
+    disabled timer's file looks byte-for-byte identical to an active one's
+    (see :mod:`coord.health.checks.timer_active`, the detector for exactly
+    this). The fix that shipped for #2082 was ``enable --now`` on every
+    installed timer, every deploy — and ``--now`` is the collision #2124
+    reports: it also **starts** a timer an operator deliberately stopped,
+    five minutes earlier, to create the very quiescence window the deploy
+    calling this function is running inside of. The daemon host rolls
+    first, so that operator's window closes mid-roll, not after it.
+
+    #2082 and #2124 turn out to be two different questions systemd already
+    answers separately, and this function's whole fix is asking the right
+    one of them *first*:
+
+    * **Persistent enablement** (``UnitFileState`` — ``enabled`` vs.
+      ``disabled``/``linked``/``masked``, :data:`_INACTIVE_STATES`) is what
+      #2082 was actually missing. It is a one-time fact that only becomes
+      false again if something explicitly disables the unit — ``systemctl
+      --user stop`` never touches it.
+    * **Current run state** (``ActiveState``) is what an operator's
+      deliberate ``stop`` changes, and it is *never* this function's business
+      to override: a timer already carrying ``UnitFileState=enabled`` has
+      already had its #2082 assertion satisfied by some earlier deploy (or
+      this one), so nothing here re-starts it. ``enable`` alone is not even
+      called in that case — no subprocess invocation touches the unit at
+      all, so there is no risk of this idempotent-by-design call itself
+      having a side effect an operator did not ask for.
+
+    So: a timer whose queried ``UnitFileState`` is *not* one of
+    :data:`_INACTIVE_STATES` is left completely alone, whatever its
+    ``ActiveState`` — that is the acceptance case "a timer stopped by an
+    operator is still down after a deploy". A timer that *is* in one of
+    those states (never enabled at all, or masked) is the actual #2082
+    defect and gets ``enable --now`` exactly as before — there is no
+    operator intent to preserve for a timer that has never run, and leaving
+    it disabled is the invisible-self-heals-never failure #2082 closed.
+
+    State is queried once, in a single batched ``systemctl --user show``
+    (:func:`coord.health.checks.timer_active._timer_states` — the same
+    query the detector itself uses, so the detector and this fixer cannot
+    silently disagree about what "enabled" means), scoped to units *this*
+    report found actually installed (:data:`_PRESENT_ACTIONS`), matching the
+    deploy step's own "only touch what this host already runs" rule.
+
+    Returns ``{unit: (ok, changed, detail)}``. ``changed`` is true only when
+    this call is confirmed to have moved the unit's state — never true for
+    the "already enabled, left alone" branch (no subprocess call was made to
+    confirm anything), and never true for a failed ``enable --now`` either
+    (an attempt that failed is not a confirmed change) — the deploy's
+    caller uses this to name, precisely, which timers it actually touched
+    (#2124 item 3) rather than reporting a state it did not confirm.
     """
     import subprocess  # noqa: PLC0415
 
     run = runner or subprocess.run
-    out: dict[str, tuple[bool, str]] = {}
+    out: dict[str, tuple[bool, bool, str]] = {}
     timers = sorted(
         u.name
         for u in report.units
         if u.name.endswith(".timer") and u.action in _PRESENT_ACTIONS
     )
+    if not timers:
+        return out
+
+    states = _timer_states(tuple(timers), runner=run, timeout=timeout)
+
     for name in timers:
+        fields = states.get(name) or {}
+        file_state = fields.get("UnitFileState", "")
+        if file_state and file_state not in _INACTIVE_STATES:
+            # Already enabled (#2082's assertion already holds for this
+            # unit) — leave its run state exactly as it is. No systemctl
+            # call at all, so the report below can only ever say what was
+            # actually queried, never what this call assumed.
+            active = fields.get("ActiveState") or "unknown"
+            out[name] = (
+                True,
+                False,
+                f"already enabled (ActiveState={active}) — left its current "
+                "run state alone; a timer an operator stopped stays stopped "
+                "across a deploy (#2124)",
+            )
+            continue
+
+        # Never enabled at all — disabled/linked/masked, or unreadable (no
+        # systemd, or the batched query above failed and this unit simply
+        # has no entry). This is the actual #2082 defect: no operator ever
+        # ran `stop` on a timer that was never running, so forcing a start
+        # here has no operator intent to override.
         try:
             proc = run(
                 ["systemctl", "--user", "enable", "--now", name],
@@ -373,12 +437,12 @@ def enable_timers(
                 timeout=timeout,
             )
         except FileNotFoundError:
-            out[name] = (False, "systemctl not found (no systemd on this host)")
+            out[name] = (False, False, "systemctl not found (no systemd on this host)")
             continue
         except Exception as exc:  # noqa: BLE001 — must never crash a deploy
-            out[name] = (False, f"{type(exc).__name__}: {exc}")
+            out[name] = (False, False, f"{type(exc).__name__}: {exc}")
             continue
         ok = getattr(proc, "returncode", 1) == 0
         detail = (getattr(proc, "stderr", "") or getattr(proc, "stdout", "") or "").strip()
-        out[name] = (ok, detail or ("enabled" if ok else "enable failed"))
+        out[name] = (ok, ok, detail or ("enabled" if ok else "enable failed"))
     return out

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/drive_queue.py

@@ -1182,6 +1182,63 @@ def _resolve_prereqs(
     return _Verdict(True)
 
 
+@dataclass(frozen=True)
+class BlockedAfterDiagnosis:
+    """How #2183's rendering should treat a terminal row's `after=` graph.
+
+    ``unsatisfied`` is *entry*'s declared ``after=`` list with every
+    now-landed pre-req dropped. ``dependency_reason`` is the CURRENT
+    ``_resolve_prereqs`` verdict against that same graph — ``''`` when the
+    graph is not (or no longer) why the entry is stuck.
+    """
+
+    unsatisfied: tuple[str, ...] = ()
+    dependency_reason: str = ""
+
+
+def diagnose_blocked_after(
+    entry: QueueEntry,
+    board: BoardView,
+    states: Mapping[str, str],
+    cycle_keys: Mapping[str, str],
+) -> BlockedAfterDiagnosis:
+    """Re-check a `blocked`/`failed` row's `after=` graph against the CURRENT
+    board, fresh on every render (#2183).
+
+    ``entry.after`` is what ``add`` declared, frozen at enqueue time — and a
+    `blocked`/`failed` entry's own state never re-evaluates it again
+    (:data:`TERMINAL_QUEUE_STATES` is exactly "the tick will not look at this
+    row again"). By the time an operator reads the row, a pre-req that has
+    since merged is stale information still rendered as if current — the
+    quadraui#542 incident this closes: the row's `after=` named a pre-req
+    that had merged an hour earlier, reading as "blocked on a dependency
+    that is already satisfied" when the real cause was an unrelated red
+    slice PR.
+
+    Two things are recomputed, never read off the entry's own frozen
+    ``last_reason``:
+
+    * which of ``entry.after`` are still NOT landed — the merged ones drop
+      out entirely; a satisfied ``after=`` entry displayed on a terminal row
+      is not a dependency, it is a caption for a fact that no longer holds;
+    * whether the CURRENT pre-req graph is even a plausible cause —
+      delegated to :func:`_resolve_prereqs`, the exact function a live tick
+      uses to decide this, so a render can never disagree with what the tick
+      itself would conclude. An empty ``dependency_reason`` means the
+      answer is no: every named pre-req is now satisfied (or the entry
+      declared none), so whatever originally blocked this row — a red build,
+      an exhausted retry budget, a refused pre-dispatch guard — was NOT its
+      ``after=`` list, and the row's own ``last_reason`` is the real story.
+    """
+    unsatisfied = tuple(dep for dep in entry.after if not board.facts(dep).landed)
+    if not entry.after:
+        return BlockedAfterDiagnosis(unsatisfied)
+    verdict = _resolve_prereqs(entry, board, states, cycle_keys, held_gates={})
+    return BlockedAfterDiagnosis(
+        unsatisfied, "" if verdict.satisfied else verdict.reason
+    )
+
+
 # ── reconciliation ───────────────────────────────────────────────────────────
 
 

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/coord/health/checks/timer_active.py

@@ -65,7 +65,9 @@ _INACTIVE_STATES = frozenset(
 )
 
 
-def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
+def _timer_states(
+    units: tuple[str, ...], *, runner=None, timeout: float = _SYSTEMCTL_TIMEOUT,
+) -> dict[str, dict[str, str]]:
     """One ``systemctl --user show`` call for every timer in *units*.
 
     Batched into a single subprocess the same way
@@ -74,6 +76,13 @@ def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
     subprocess, not N. Returns ``{}`` when there is no systemd on this host
     (macOS, a container, a thin client) — that is "no data", handled by the
     caller, not a crash.
+
+    *runner*/*timeout* are injectable (default: ``subprocess.run`` and this
+    module's own budget) so :mod:`coord.deploy_units` can reuse this exact
+    query — rather than re-implementing "is this timer already enabled" a
+    second time — for its own ``enable --now`` vs. leave-it-alone decision
+    (#2124). Two independent readings of the same systemd state is how a
+    detector and its fixer end up disagreeing about what "enabled" means.
     """
     if not units:
         return {}
@@ -88,12 +97,13 @@ def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
         "--property=SubState",
         *units,
     ]
+    run = runner or subprocess.run
     try:
-        proc = subprocess.run(
+        proc = run(
             argv,
             capture_output=True,
             text=True,
-            timeout=_SYSTEMCTL_TIMEOUT,
+            timeout=timeout,
             check=False,
         )
     except (OSError, subprocess.SubprocessError):

{code_coordinator-0.5.64 → code_coordinator-0.5.66}/docs/AGENT_OPERATIONS.md

@@ -760,6 +760,29 @@ coord release propagate --daemon-host dellserver
 systemctl --user start coord-drive-queue.timer
 ```
 
+**#2124 (fixed 2026-08-13):** step 3 used to undo step 1. `coord release
+propagate`'s own `deploy/**` lane (`POST /deploy-units`) asserts every
+installed timer is enabled (#2082 — a *different* bug: a timer nobody ever
+ran `systemctl --user enable` on at all). #2082's fix was `enable --now`,
+and `--now` **starts** a timer unconditionally — so step 3 restarted the
+timer step 1 had just stopped, on dellserver first (the daemon-leads
+invariant), while precision and elitebook were still mid-roll: the exact
+gap this sequence exists to hold open. `enable` and `--now` are idempotent,
+so this was invisible for every roll where nobody had deliberately stopped
+a timer, and only bit the one sequence documented above.
+
+Fixed: `coord.deploy_units.enable_timers` now asks systemd whether a timer
+is already enabled *before* deciding what to do. `systemctl --user stop`
+never changes a unit's persistent enablement, only its current run state —
+so a timer already `enabled` is left exactly as it is, whatever its run
+state, and only a timer that was never enabled at all still gets `enable
+--now`. Reaching for `systemctl --user mask` instead of `stop` is no longer
+necessary; the sequence above is safe to run literally as written. The
+`deploy/**` lane's own output now names which timers it started and which
+it left alone (`coord release propagate`'s per-lane line for this host), so
+"did step 3 leave my stopped timer alone" is directly checkable in the run
+output rather than something to reconstruct from journal timestamps.
+
 **#2110 (fixed 2026-08-11):** stopping the timer used to deadlock this
 sequence. The reconciler that moves a completed entry from `running` to
 `done` runs inside `coord drive-queue tick`; with the timer stopped, no tick