code-coordinator 0.5.65__tar.gz → 0.5.66__tar.gz

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.65
+Version: 0.5.66
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.65
+Version: 0.5.66
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.65",
+  "tag": "0.5.66",
   "distance": 0,
-  "node": "g58dde32efe3e0c9e230599f9c2fa0eeb9f41671a",
+  "node": "g2a4b596d92f5df37f20c5e4da4b887658112a74f",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-14"

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/coord/agent_app.py

@@ -1463,13 +1463,23 @@ def build_app(
         installed, and keeps a ``.bak`` of each — see
         :mod:`coord.deploy_units` for why both are deliberate.
 
-        Also asserts every installed *timer* is enabled and running
+        Also asserts every installed *timer* is enabled
         (:func:`coord.deploy_units.enable_timers`, #2082): refreshing a
         timer's content has never implied enabling it, and that gap is
         exactly how ``coord-release-propagate.timer`` reached this host with
         matching content and sat disabled for a day with nothing noticing.
-        ``enable --now`` is idempotent, so this runs on every call, not just
-        when content changed — an already-enabled timer is untouched.
+        This runs on every non-dry-run call, not just when content changed —
+        an already-enabled timer's *enablement* is untouched (idempotent).
+
+        It does **not**, as of #2124, force a start (``--now``) on a timer
+        that is already enabled: that used to restart a timer an operator
+        had deliberately stopped moments earlier — the exact window the
+        documented manual-roll sequence exists to create — because ``enable
+        --now`` cannot tell "never enabled" (#2082's actual bug) apart from
+        "enabled, but stopped on purpose" (never a bug at all). See
+        :func:`coord.deploy_units.enable_timers` for how it now tells the
+        two apart, and ``timers_enabled[<unit>]["changed"]`` below for
+        which case each timer landed in.
         """
         from coord import deploy_units as du  # noqa: PLC0415
         from coord.brain import AGENT_PORT  # noqa: PLC0415
@@ -1504,10 +1514,10 @@ def build_app(
         if not dry_run:
             timer_results = du.enable_timers(report)
             payload["timers_enabled"] = {
-                name: {"ok": ok, "detail": detail}
-                for name, (ok, detail) in timer_results.items()
+                name: {"ok": ok, "changed": changed, "detail": detail}
+                for name, (ok, changed, detail) in timer_results.items()
             }
-            if any(not ok for ok, _ in timer_results.values()):
+            if any(not ok for ok, _changed, _detail in timer_results.values()):
                 payload["ok"] = False
         return JSONResponse(payload, status_code=200 if payload.get("ok") else 500)
 

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/coord/commands/release.py

@@ -16,6 +16,7 @@ via setuptools-scm). It does not push, tag, or modify anything itself.
 
 from __future__ import annotations
 
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -1339,7 +1340,26 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
     Returns ``ok=None`` when this host offers no channel for the lane at all
     (see :func:`_roll_tui` and #2052): the run is not accountable for a lane
     it was structurally unable to roll.
+
+    Also names every timer whose *enablement* state this call changed
+    (#2124 item 3) — and, separately, every timer it deliberately left
+    alone because it was already enabled (see
+    :func:`coord.deploy_units.enable_timers`) — so "the queue came back
+    mid-roll" (or, after this fix, "it didn't") is legible in this output
+    rather than reconstructed afterwards from journal timestamps.
+
+    ``ok`` (#2124 review) reflects every way ``agent_app.py``'s
+    ``deploy_units`` endpoint can fail, not just a failed timer: a unit
+    whose install itself failed (``action == "failed"`` — e.g. an unreadable
+    installed unit file, :mod:`coord.deploy_units` lines ~249/264/284), a
+    top-level ``error``, or a ``daemon-reload`` that was attempted and
+    failed. Before this check existed, ``ok`` was derived from
+    ``failed_timers`` alone, so any of those three could return HTTP 500
+    with ``payload["ok"]=False`` and still be recorded here as a green
+    lane — exactly the "unconfirmed success" defect #2096 exists to catch.
     """
+    from coord.deploy_units import ACTION_FAILED  # noqa: PLC0415
+
     status, body, error = _post(
         f"http://{machine.host}:{agent_port}/deploy-units", {}, timeout=30.0
     )
@@ -1352,11 +1372,24 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
         # gate to revert everything else this run got right (#2052).
         return None, ("agent has no /deploy-units yet (predates #1835) — "
                       "the next propagation will roll this lane")
-    if status != 200:
+    # The endpoint (`agent_app.py`'s `deploy_units`) returns HTTP 500 — with
+    # the SAME body shape as 200 — whenever a daemon-reload or a single
+    # timer's enablement fails. That is exactly the partial-failure path
+    # this function exists to narrate in detail, so a 500 *with a `units`
+    # body* must still be parsed below rather than treated as opaque. A 500
+    # WITHOUT a `units` body is a different, genuinely-unexpected failure
+    # (an unhandled exception, a proxy error, ...) and must still
+    # short-circuit, or a real crash would be misread as "nothing to
+    # report" / a false-positive success.
+    if status != 200 and not (status == 500 and "units" in body):
         return False, str(body.get("error") or body.get("summary") or f"HTTP {status}")
     units = body.get("units") or []
     changed = [u.get("name") for u in units if u.get("action") == "updated"]
     new = [u.get("name") for u in units if u.get("action") == "new"]
+    failed_units = {
+        (u.get("name") or "?"): (u.get("detail") or "?")
+        for u in units if u.get("action") == ACTION_FAILED
+    }
     parts = []
     parts.append(f"{len(changed)} unit(s) refreshed" if changed else "units already current")
     if body.get("reloaded"):
@@ -1366,7 +1399,79 @@ def _roll_units(machine, *, agent_port: int) -> tuple[bool | None, str]:
             f"{len(new)} packaged unit(s) NOT installed here ({', '.join(sorted(map(str, new)))}) "
             "— a release does not decide which services a host runs"
         )
-    return True, "; ".join(parts)
+    if failed_units:
+        parts.append(
+            "FAILED to install unit(s): "
+            + ", ".join(f"{u} ({detail})" for u, detail in sorted(failed_units.items()))
+        )
+
+    # A daemon-reload is only attempted when a unit's bytes actually
+    # changed (`agent_app.py`'s `deploy_units`); "not reloaded" is a
+    # failure only when the report itself says a reload was attempted
+    # (`body["changed"]`, `InstallReport.changed`) — absent that, "not
+    # reloaded" just means there was nothing to reload, never a failure.
+    reload_failed = bool(body.get("changed")) and not body.get("reloaded")
+    if reload_failed:
+        parts.append(
+            "daemon-reload FAILED: " + str(body.get("reload_detail") or "?")
+        )
+
+    top_level_error = body.get("error")
+    if top_level_error:
+        parts.append(f"deploy-units error: {top_level_error}")
+
+    timers = body.get("timers_enabled") or {}
+    started = sorted(
+        name for name, r in timers.items()
+        if isinstance(r, dict) and r.get("ok") and r.get("changed")
+    )
+    # Held timers (confirmed already-enabled, left alone) split on the
+    # confirmed `ActiveState` carried in `enable_timers`'s own detail text
+    # (coord/deploy_units.py's `already enabled (ActiveState=...)` branch)
+    # — NOT on `changed` alone, which is equally true for the #2124 case
+    # (operator stopped it) and for the routine, overwhelmingly common case
+    # of a timer that was never touched because it is already enabled AND
+    # already running. Reporting "left stopped as-is" for the latter names
+    # a state (stopped) this call never confirmed — the #2124 review's
+    # reporting-accuracy fix.
+    held_stopped = []
+    held_other = []
+    for name, r in timers.items():
+        if not (isinstance(r, dict) and r.get("ok") and not r.get("changed")):
+            continue
+        match = re.search(r"ActiveState=(\w+)", r.get("detail") or "")
+        if match and match.group(1) == "inactive":
+            held_stopped.append(name)
+        else:
+            held_other.append(name)
+    held_stopped.sort()
+    held_other.sort()
+    failed_timers = {
+        name: (r.get("detail") or "?")
+        for name, r in timers.items() if isinstance(r, dict) and not r.get("ok")
+    }
+    if started:
+        parts.append(f"enabled timer(s): {', '.join(started)}")
+    if held_stopped:
+        # Confirmed inactive (ActiveState=inactive) and deliberately left
+        # alone — the #2124 fix in one word: a timer an operator stopped is
+        # still here.
+        parts.append(
+            f"left stopped as-is (already enabled, #2124): {', '.join(held_stopped)}"
+        )
+    if held_other:
+        # Already enabled and left alone, but NOT confirmed stopped — most
+        # commonly a timer that is already enabled and already running
+        # normally. Reported distinctly so it never gets read as "the
+        # timer I stopped is still stopped" for a timer nobody stopped.
+        parts.append(f"already enabled (unchanged): {', '.join(held_other)}")
+    if failed_timers:
+        parts.append(
+            "FAILED to enable timer(s): "
+            + ", ".join(f"{u} ({detail})" for u, detail in sorted(failed_timers.items()))
+        )
+    ok = not (failed_units or reload_failed or top_level_error or failed_timers)
+    return ok, "; ".join(parts)
 
 
 def _roll_tui(

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/coord/deploy_units.py

@@ -65,6 +65,13 @@ from coord.health.checks.unit_drift import (
     packaged_unit_dir,
 )
 
+# Same reuse rule as above, one module over: `timer_active` is the DETECTOR
+# for "is this timer actually enabled" (#2082); `enable_timers` below is the
+# FIXER for the identical question (#2124). Querying state through its own
+# `_timer_states` — rather than a second `systemctl --user show` parser here
+# — is what keeps those two answers from being able to drift apart.
+from coord.health.checks.timer_active import _INACTIVE_STATES, _timer_states
+
 #: Placeholder -> how to fill it, given the host facts we actually know.
 #: ``unit_drift`` renders these as *shell* text for a copy-pasteable remedy
 #: (``$(hostname -s)``); here they must be real values, so the mapping is
@@ -326,45 +333,102 @@ _PRESENT_ACTIONS = frozenset({ACTION_UNCHANGED, ACTION_UPDATED})
 
 def enable_timers(
     report: InstallReport, *, runner=None, timeout: float = 30.0,
-) -> dict[str, tuple[bool, str]]:
-    """``systemctl --user enable --now <unit>`` for every installed timer in
-    *report* (#2082).
+) -> dict[str, tuple[bool, bool, str]]:
+    """Assert every installed timer in *report* is *enabled* (#2082) —
+    without forcing a *stopped* one back to running (#2124).
 
     #2082: ``coord-release-propagate.timer`` reached three hosts'
     ``~/.config/systemd/user/`` and sat there — :func:`install_units`
     refreshed its *content* on every release, but nothing ever ran
-    ``enable --now`` on it, and nothing noticed because a disabled timer's
-    file looks byte-for-byte identical to an active one's (see
-    :mod:`coord.health.checks.timer_active`, the detector for exactly this).
-
-    A ``.timer`` unit is different from a ``.service`` here: which
-    *services* a host runs is a one-time topology choice
-    (``install-agent.sh``, or a human at machine setup — see this module's
-    docstring), never something a routine refresh should override. A timer
-    that exists at all has no reason to exist disabled — its whole job is to
-    fire on a schedule with nobody watching, so "installed but not enabled"
-    is invisible from the outside and would otherwise self-heal never.
-    Applying this on every deploy makes enablement an assertion this lane
-    re-checks every time it runs, the same way :func:`install_units`
-    re-asserts content every time it runs.
-
-    Both ``enable`` and ``--now`` are idempotent — an already-enabled,
-    already-active timer is untouched — so calling this on every deploy is a
-    correctness check, not a state change, in the common case. Scoped to
-    units *this* report found actually installed (:data:`_PRESENT_ACTIONS`),
-    matching the deploy step's own "only touch what this host already runs"
-    rule.
+    ``systemctl --user enable`` on it, and nothing noticed because a
+    disabled timer's file looks byte-for-byte identical to an active one's
+    (see :mod:`coord.health.checks.timer_active`, the detector for exactly
+    this). The fix that shipped for #2082 was ``enable --now`` on every
+    installed timer, every deploy — and ``--now`` is the collision #2124
+    reports: it also **starts** a timer an operator deliberately stopped,
+    five minutes earlier, to create the very quiescence window the deploy
+    calling this function is running inside of. The daemon host rolls
+    first, so that operator's window closes mid-roll, not after it.
+
+    #2082 and #2124 turn out to be two different questions systemd already
+    answers separately, and this function's whole fix is asking the right
+    one of them *first*:
+
+    * **Persistent enablement** (``UnitFileState`` — ``enabled`` vs.
+      ``disabled``/``linked``/``masked``, :data:`_INACTIVE_STATES`) is what
+      #2082 was actually missing. It is a one-time fact that only becomes
+      false again if something explicitly disables the unit — ``systemctl
+      --user stop`` never touches it.
+    * **Current run state** (``ActiveState``) is what an operator's
+      deliberate ``stop`` changes, and it is *never* this function's business
+      to override: a timer already carrying ``UnitFileState=enabled`` has
+      already had its #2082 assertion satisfied by some earlier deploy (or
+      this one), so nothing here re-starts it. ``enable`` alone is not even
+      called in that case — no subprocess invocation touches the unit at
+      all, so there is no risk of this idempotent-by-design call itself
+      having a side effect an operator did not ask for.
+
+    So: a timer whose queried ``UnitFileState`` is *not* one of
+    :data:`_INACTIVE_STATES` is left completely alone, whatever its
+    ``ActiveState`` — that is the acceptance case "a timer stopped by an
+    operator is still down after a deploy". A timer that *is* in one of
+    those states (never enabled at all, or masked) is the actual #2082
+    defect and gets ``enable --now`` exactly as before — there is no
+    operator intent to preserve for a timer that has never run, and leaving
+    it disabled is the invisible-self-heals-never failure #2082 closed.
+
+    State is queried once, in a single batched ``systemctl --user show``
+    (:func:`coord.health.checks.timer_active._timer_states` — the same
+    query the detector itself uses, so the detector and this fixer cannot
+    silently disagree about what "enabled" means), scoped to units *this*
+    report found actually installed (:data:`_PRESENT_ACTIONS`), matching the
+    deploy step's own "only touch what this host already runs" rule.
+
+    Returns ``{unit: (ok, changed, detail)}``. ``changed`` is true only when
+    this call is confirmed to have moved the unit's state — never true for
+    the "already enabled, left alone" branch (no subprocess call was made to
+    confirm anything), and never true for a failed ``enable --now`` either
+    (an attempt that failed is not a confirmed change) — the deploy's
+    caller uses this to name, precisely, which timers it actually touched
+    (#2124 item 3) rather than reporting a state it did not confirm.
     """
     import subprocess  # noqa: PLC0415
 
     run = runner or subprocess.run
-    out: dict[str, tuple[bool, str]] = {}
+    out: dict[str, tuple[bool, bool, str]] = {}
     timers = sorted(
         u.name
         for u in report.units
         if u.name.endswith(".timer") and u.action in _PRESENT_ACTIONS
     )
+    if not timers:
+        return out
+
+    states = _timer_states(tuple(timers), runner=run, timeout=timeout)
+
     for name in timers:
+        fields = states.get(name) or {}
+        file_state = fields.get("UnitFileState", "")
+        if file_state and file_state not in _INACTIVE_STATES:
+            # Already enabled (#2082's assertion already holds for this
+            # unit) — leave its run state exactly as it is. No systemctl
+            # call at all, so the report below can only ever say what was
+            # actually queried, never what this call assumed.
+            active = fields.get("ActiveState") or "unknown"
+            out[name] = (
+                True,
+                False,
+                f"already enabled (ActiveState={active}) — left its current "
+                "run state alone; a timer an operator stopped stays stopped "
+                "across a deploy (#2124)",
+            )
+            continue
+
+        # Never enabled at all — disabled/linked/masked, or unreadable (no
+        # systemd, or the batched query above failed and this unit simply
+        # has no entry). This is the actual #2082 defect: no operator ever
+        # ran `stop` on a timer that was never running, so forcing a start
+        # here has no operator intent to override.
         try:
             proc = run(
                 ["systemctl", "--user", "enable", "--now", name],
@@ -373,12 +437,12 @@ def enable_timers(
                 timeout=timeout,
             )
         except FileNotFoundError:
-            out[name] = (False, "systemctl not found (no systemd on this host)")
+            out[name] = (False, False, "systemctl not found (no systemd on this host)")
             continue
         except Exception as exc:  # noqa: BLE001 — must never crash a deploy
-            out[name] = (False, f"{type(exc).__name__}: {exc}")
+            out[name] = (False, False, f"{type(exc).__name__}: {exc}")
             continue
         ok = getattr(proc, "returncode", 1) == 0
         detail = (getattr(proc, "stderr", "") or getattr(proc, "stdout", "") or "").strip()
-        out[name] = (ok, detail or ("enabled" if ok else "enable failed"))
+        out[name] = (ok, ok, detail or ("enabled" if ok else "enable failed"))
     return out

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/coord/health/checks/timer_active.py

@@ -65,7 +65,9 @@ _INACTIVE_STATES = frozenset(
 )
 
 
-def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
+def _timer_states(
+    units: tuple[str, ...], *, runner=None, timeout: float = _SYSTEMCTL_TIMEOUT,
+) -> dict[str, dict[str, str]]:
     """One ``systemctl --user show`` call for every timer in *units*.
 
     Batched into a single subprocess the same way
@@ -74,6 +76,13 @@ def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
     subprocess, not N. Returns ``{}`` when there is no systemd on this host
     (macOS, a container, a thin client) — that is "no data", handled by the
     caller, not a crash.
+
+    *runner*/*timeout* are injectable (default: ``subprocess.run`` and this
+    module's own budget) so :mod:`coord.deploy_units` can reuse this exact
+    query — rather than re-implementing "is this timer already enabled" a
+    second time — for its own ``enable --now`` vs. leave-it-alone decision
+    (#2124). Two independent readings of the same systemd state is how a
+    detector and its fixer end up disagreeing about what "enabled" means.
     """
     if not units:
         return {}
@@ -88,12 +97,13 @@ def _timer_states(units: tuple[str, ...]) -> dict[str, dict[str, str]]:
         "--property=SubState",
         *units,
     ]
+    run = runner or subprocess.run
     try:
-        proc = subprocess.run(
+        proc = run(
             argv,
             capture_output=True,
             text=True,
-            timeout=_SYSTEMCTL_TIMEOUT,
+            timeout=timeout,
             check=False,
         )
     except (OSError, subprocess.SubprocessError):

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/docs/AGENT_OPERATIONS.md

@@ -760,6 +760,29 @@ coord release propagate --daemon-host dellserver
 systemctl --user start coord-drive-queue.timer
 ```
 
+**#2124 (fixed 2026-08-13):** step 3 used to undo step 1. `coord release
+propagate`'s own `deploy/**` lane (`POST /deploy-units`) asserts every
+installed timer is enabled (#2082 — a *different* bug: a timer nobody ever
+ran `systemctl --user enable` on at all). #2082's fix was `enable --now`,
+and `--now` **starts** a timer unconditionally — so step 3 restarted the
+timer step 1 had just stopped, on dellserver first (the daemon-leads
+invariant), while precision and elitebook were still mid-roll: the exact
+gap this sequence exists to hold open. `enable` and `--now` are idempotent,
+so this was invisible for every roll where nobody had deliberately stopped
+a timer, and only bit the one sequence documented above.
+
+Fixed: `coord.deploy_units.enable_timers` now asks systemd whether a timer
+is already enabled *before* deciding what to do. `systemctl --user stop`
+never changes a unit's persistent enablement, only its current run state —
+so a timer already `enabled` is left exactly as it is, whatever its run
+state, and only a timer that was never enabled at all still gets `enable
+--now`. Reaching for `systemctl --user mask` instead of `stop` is no longer
+necessary; the sequence above is safe to run literally as written. The
+`deploy/**` lane's own output now names which timers it started and which
+it left alone (`coord release propagate`'s per-lane line for this host), so
+"did step 3 leave my stopped timer alone" is directly checkable in the run
+output rather than something to reconstruct from journal timestamps.
+
 **#2110 (fixed 2026-08-11):** stopping the timer used to deadlock this
 sequence. The reconciler that moves a completed entry from `running` to
 `done` runs inside `coord drive-queue tick`; with the timer stopped, no tick

{code_coordinator-0.5.65 → code_coordinator-0.5.66}/tests/test_agent_deploy_units_endpoint.py

@@ -139,17 +139,42 @@ def test_the_endpoint_enables_installed_timers(client, lane_with_timer, monkeypa
 
     def _fake_enable(report, **_kwargs):
         calls.append(sorted(u.name for u in report.units if u.name.endswith(".timer")))
-        return {"coord-agent.timer": (True, "enabled")}
+        return {"coord-agent.timer": (True, True, "enabled")}
 
     monkeypatch.setattr(du, "enable_timers", _fake_enable)
 
     resp = client.post("/deploy-units", json={})
     assert resp.status_code == 200
     body = resp.json()
-    assert body["timers_enabled"] == {"coord-agent.timer": {"ok": True, "detail": "enabled"}}
+    assert body["timers_enabled"] == {
+        "coord-agent.timer": {"ok": True, "changed": True, "detail": "enabled"}
+    }
     assert calls == [["coord-agent.timer"]]
 
 
+def test_the_endpoint_reports_a_timer_it_left_alone(client, lane_with_timer, monkeypatch):
+    """#2124: a timer `enable_timers` found already enabled (e.g. stopped by
+    an operator on purpose) is reported with `changed: False` — the signal
+    `coord release propagate`'s own output (`_roll_units`) uses to name it
+    as held rather than started."""
+    monkeypatch.setattr(
+        du, "enable_timers",
+        lambda report, **k: {
+            "coord-agent.timer": (True, False, "already enabled (ActiveState=inactive)"),
+        },
+    )
+    resp = client.post("/deploy-units", json={})
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["ok"] is True
+    assert body["timers_enabled"] == {
+        "coord-agent.timer": {
+            "ok": True, "changed": False,
+            "detail": "already enabled (ActiveState=inactive)",
+        }
+    }
+
+
 def test_a_dry_run_never_enables_timers(client, lane_with_timer, monkeypatch):
     calls: list = []
     monkeypatch.setattr(
@@ -164,20 +189,25 @@ def test_a_dry_run_never_enables_timers(client, lane_with_timer, monkeypatch):
 def test_a_failed_timer_enable_fails_the_response(client, lane_with_timer, monkeypatch):
     monkeypatch.setattr(
         du, "enable_timers",
-        lambda report, **k: {"coord-agent.timer": (False, "enable failed")},
+        lambda report, **k: {"coord-agent.timer": (False, False, "enable failed")},
     )
     resp = client.post("/deploy-units", json={})
     assert resp.status_code == 500
     body = resp.json()
     assert body["ok"] is False
     assert body["timers_enabled"]["coord-agent.timer"]["ok"] is False
+    assert body["timers_enabled"]["coord-agent.timer"]["changed"] is False
 
 
 def test_the_real_enable_timers_is_exercised_end_to_end(client, lane_with_timer, monkeypatch):
     """No monkeypatch of `enable_timers` itself here — only the subprocess
     boundary — so this exercises the real wiring from HTTP request through
     `install_units` to the actual `systemctl --user enable --now` argv,
-    which is the thing that was silently never happening before #2082."""
+    which is the thing that was silently never happening before #2082.
+    `coord-agent.timer` has no prior state as far as this fake is
+    concerned (empty `show` output), which `enable_timers` (#2124) must
+    read the same way it reads genuinely never-enabled: go ahead and
+    enable it."""
     calls: list = []
 
     def _fake_run(argv, **_kwargs):
@@ -193,8 +223,47 @@ def test_the_real_enable_timers_is_exercised_end_to_end(client, lane_with_timer,
     monkeypatch.setattr(subprocess, "run", _fake_run)
     resp = client.post("/deploy-units", json={})
     assert resp.status_code == 200
-    assert resp.json()["timers_enabled"] == {"coord-agent.timer": {"ok": True, "detail": "enabled"}}
-    assert calls == [["systemctl", "--user", "enable", "--now", "coord-agent.timer"]]
+    assert resp.json()["timers_enabled"] == {
+        "coord-agent.timer": {"ok": True, "changed": True, "detail": "enabled"}
+    }
+    assert calls[0][:3] == ["systemctl", "--user", "show"]
+    assert calls[-1] == ["systemctl", "--user", "enable", "--now", "coord-agent.timer"]
+
+
+def test_the_real_enable_timers_leaves_a_stopped_timer_stopped_end_to_end(
+    client, lane_with_timer, monkeypatch
+):
+    """#2124's acceptance shape, exercised through the same real wiring as
+    the test above: `coord-agent.timer` is already enabled but its
+    `ActiveState` is `inactive` — exactly what `systemctl --user stop`
+    leaves behind. No `enable`/`start` call may reach systemd for it."""
+    calls: list = []
+
+    def _fake_run(argv, **_kwargs):
+        calls.append(list(argv))
+
+        class _Proc:
+            returncode = 0
+            stdout = ""
+            stderr = ""
+
+        if len(argv) > 2 and argv[2] == "show":
+            _Proc.stdout = (
+                "Id=coord-agent.timer\n"
+                "UnitFileState=enabled\n"
+                "ActiveState=inactive\n"
+                "SubState=dead\n"
+            )
+        return _Proc()
+
+    monkeypatch.setattr(subprocess, "run", _fake_run)
+    resp = client.post("/deploy-units", json={})
+    assert resp.status_code == 200
+    body = resp.json()["timers_enabled"]["coord-agent.timer"]
+    assert body["ok"] is True
+    assert body["changed"] is False
+    assert "ActiveState=inactive" in body["detail"]
+    assert all(argv[2] != "enable" for argv in calls)
 
 
 def test_a_bodyless_post_is_accepted(client, lane):