code-coordinator 0.5.88__tar.gz → 0.5.89__tar.gz

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.88
+Version: 0.5.89
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.88
+Version: 0.5.89
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

code_coordinator-0.5.89/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.89",
+  "distance": 0,
+  "node": "gfa2f63e730c0e6f6a87687f5f4143b0f9b74f38f",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-15"
+}

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/ci_github.py

@@ -18,7 +18,7 @@ from dataclasses import dataclass, field
 from datetime import datetime
 
 from coord import github_ops
-from coord.ci_store import CheckRun, JobRun, JobStep
+from coord.ci_store import CheckRun, JobRun, JobStep, failed_checks
 
 
 def _parse_ts(raw: str | None) -> float | None:
@@ -236,6 +236,40 @@ class GitHubCi:
                 self._jobs_cache.pop((repo, str(run_id)), None)
         return all_ok and any_ok
 
+    def rerun_failed_for_pr(self, repo: str, number: int) -> bool:
+        """Re-run only the FAILING job(s) behind *repo*#*number*'s current
+        checks via ``gh run rerun <id> --failed`` (#2252).
+
+        Same shape as :meth:`rerun_for_pr` above, narrowed to the run ids
+        behind :func:`coord.ci_store.failed_checks` rather than every run id
+        among the PR's checks — a passing check's run is left untouched, so
+        the caller's #2252 flake re-check can't accidentally spend CI
+        minutes re-proving a check that already reported green, and the
+        green evidence itself (timestamps, logs) survives intact for the
+        board to keep showing.
+
+        Same best-effort / return-value / cache-invalidation contract as
+        `rerun_for_pr`: ``True`` only when at least one run id was found
+        among the currently-failing checks *and* every ``gh run rerun
+        --failed`` call issued exited zero.
+        """
+        checks = self.list_checks_for_pr(repo, number)
+        run_ids = sorted({c.run_id for c in failed_checks(checks) if c.run_id})
+        if not run_ids:
+            return False
+        all_ok = True
+        any_ok = False
+        for run_id in run_ids:
+            if github_ops.rerun_workflow_run_failed(repo, run_id):
+                any_ok = True
+            else:
+                all_ok = False
+        if any_ok:
+            self.invalidate(repo, number)
+            for run_id in run_ids:
+                self._jobs_cache.pop((repo, str(run_id)), None)
+        return all_ok and any_ok
+
     def list_jobs_for_run(self, repo: str, run_id: str) -> list["JobRun"]:
         """Job/step detail for Actions run *run_id* on *repo* via ``gh api``
         (#1892) — backs :func:`coord.ci_store.is_verdictless_job`.

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/ci_store.py

@@ -195,6 +195,31 @@ class CiStore(Protocol):
         """
         ...
 
+    def rerun_failed_for_pr(self, repo: str, number: int) -> bool:
+        """Re-run ONLY the currently-failing job(s) behind *repo*#*number*'s
+        checks (#2252). Returns whether it worked.
+
+        Narrower than :meth:`rerun_for_pr`, which reruns every distinct
+        Actions run id behind ALL of a PR's checks — passing ones included.
+        Re-running the whole run would also re-trigger jobs that already
+        reported green, discarding that first-pass evidence for nothing:
+        #2252 asks "is the RED one flaky?", not "run the suite again", and
+        wants the answer without paying for (or risking a second read of)
+        checks that already settled.
+
+        This is the mechanism behind :mod:`coord.merge_queue`'s one-shot
+        flake re-check (``MAX_CI_FLAKY_RERUNS`` — deliberately ONE re-run,
+        not a retry loop: two independent observations is the whole ask).
+        Call sites duck-type via ``getattr(ci, "rerun_failed_for_pr",
+        None)`` so a `CiStore` stand-in that predates this capability (most
+        duck-typed test stubs, :class:`coord.gate_snapshot.GateSnapshot`)
+        simply doesn't offer it — read as "could not trigger a re-run",
+        the same fail-safe fallback an actual `gh` failure produces (#2252:
+        "if the re-run cannot be triggered, fall back to today's
+        behaviour").
+        """
+        ...
+
 
 class NoOpCi:
     """Always-available fallback that returns no checks and reruns nothing.
@@ -226,6 +251,11 @@ class NoOpCi:
         detail to fetch (#1892)."""
         return []
 
+    def rerun_failed_for_pr(self, repo: str, number: int) -> bool:
+        """No-op: CI gating is disabled entirely, so there is nothing to
+        re-run (#2252)."""
+        return False
+
 
 # ── Classification helpers ──────────────────────────────────────────────────
 

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/db.py

@@ -189,7 +189,9 @@ def _ensure_schema(conn: sqlite3.Connection) -> None:
             assignment_type TEXT DEFAULT 'work',
             required_gates TEXT,
             ci_infra_reruns INTEGER NOT NULL DEFAULT 0,
-            ci_stale_reruns INTEGER NOT NULL DEFAULT 0
+            ci_stale_reruns INTEGER NOT NULL DEFAULT 0,
+            ci_flaky_reruns INTEGER NOT NULL DEFAULT 0,
+            ci_flaky_pending TEXT NOT NULL DEFAULT ''
         );
 
         CREATE TABLE IF NOT EXISTS plans (
@@ -857,6 +859,15 @@ def _migrate_add_columns(conn: sqlite3.Connection) -> None:
         # 0 for every row predating this migration, same as the column's own
         # default for a freshly-enqueued entry.
         "ALTER TABLE drive_queue ADD COLUMN resumes INTEGER NOT NULL DEFAULT 0",
+        # #2252: the flake-recheck auto-rerun's OWN counter/pending-state —
+        # see `coord.merge_queue.MAX_CI_FLAKY_RERUNS` and
+        # `QueuedMerge.ci_flaky_reruns`/`ci_flaky_pending`'s docstrings for
+        # why they're kept separate from `ci_infra_reruns`/`ci_stale_reruns`
+        # above rather than sharing either. 0/'' for every row predating
+        # this migration — no flake re-run ever spent/pending — same as the
+        # columns' own defaults for a freshly-enqueued entry.
+        "ALTER TABLE merge_queue ADD COLUMN ci_flaky_reruns INTEGER NOT NULL DEFAULT 0",
+        "ALTER TABLE merge_queue ADD COLUMN ci_flaky_pending TEXT NOT NULL DEFAULT ''",
     ]
     for sql in migrations:
         try:

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/drive.py

@@ -130,6 +130,7 @@ from coord.worker_events import is_usage_limit_reason
 # See `_STALE_SMOKE_MARKERS` / `_is_stale_smoke_reason` below.
 from coord.merge_queue import (
     STALE_SMOKE_MARKERS as _mq_stale_smoke_markers,
+    is_ci_flaky_reason,
     is_ci_infra_reason,
     is_ci_pending_reason,
     is_stale_smoke_reason as _mq_is_stale_smoke_reason,
@@ -2513,9 +2514,10 @@ def _effective_merge_gate_reason(
       own resolution path (#1474/#241's conflict-fix dispatch, reached
       through the bounded retry below). A re-test does not rebase a branch,
       and diverting to one is the same stall this issue is about, inverted.
-    - a CI reason (#1891/#1892) — `merge_reason` already carries a live,
-      recognised signal whose only resolution is more real time. Those two
-      bare waits sit right after the divergence check and must keep winning.
+    - a CI reason (#1891/#1892/#2252) — `merge_reason` already carries a
+      live, recognised signal whose only resolution is more real time.
+      These bare waits sit right after the divergence check and must keep
+      winning.
 
     The bool is the caller's warning label: a diagnostic-derived reason is a
     SNAPSHOT of the last real attempt, refreshed by nothing but another
@@ -2528,8 +2530,10 @@ def _effective_merge_gate_reason(
         return state.merge_reason, False
     if state.merge_status == "" or state.merge_status.upper() == "CONFLICT":
         return state.merge_reason, False
-    if is_ci_pending_reason(state.merge_reason) or is_ci_infra_reason(
-        state.merge_reason
+    if (
+        is_ci_pending_reason(state.merge_reason)
+        or is_ci_infra_reason(state.merge_reason)
+        or is_ci_flaky_reason(state.merge_reason)
     ):
         return state.merge_reason, False
     fallback = _extract_gate_refusal_reason(counters.last_merge_diagnostic)
@@ -2851,6 +2855,27 @@ def _decide_merge(
             )
         )
 
+    # #2252: the OTHER sibling case — a CI verdict DID arrive AND said
+    # something real about the code, but `coord merge`'s own live attempt
+    # has only observed it fail ONCE so far and is already re-running the
+    # failed job(s) to rule out a flake (see
+    # `coord.merge_queue.MAX_CI_FLAKY_RERUNS`) before spending a drive
+    # attempt on it. Retrying `coord merge` here would just re-observe the
+    # same in-flight re-run and spend an attempt for nothing — same bare
+    # wait as #1891/#1892 above, for the identical reason: only more real
+    # time (the re-run landing) resolves it, never another `coord merge`
+    # retry. Once the re-run's answer is in, this reason either clears
+    # (flake — merge proceeds, zero attempts spent) or reverts to the plain
+    # "checks failed" wording (confirmed real — spends the attempt exactly
+    # like today), so this wait is bounded by construction, never open-ended.
+    if is_ci_flaky_reason(state.merge_reason):
+        return _wait(
+            label=(
+                "MERGE: CI failed — re-running once to rule out a flake, "
+                f"not retrying (#2252): {state.merge_reason}"
+            )
+        )
+
     status = state.merge_status
     if status.upper() == "HUMAN_REQUIRED":
         return _die(

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/drive_queue.py

@@ -72,7 +72,12 @@ from typing import Any, Iterable, Mapping, Sequence
 
 from coord.drive_state import TERMINAL_STATUSES, WORK_LIKE
 from coord.gate_a import is_gate_a_refusal_reason
-from coord.merge_queue import PLAN_READY, is_ci_infra_reason, is_ci_pending_reason
+from coord.merge_queue import (
+    PLAN_READY,
+    is_ci_flaky_reason,
+    is_ci_infra_reason,
+    is_ci_pending_reason,
+)
 from coord.models import is_policy_refusal_reason
 
 # ── queue states ─────────────────────────────────────────────────────────────
@@ -119,6 +124,17 @@ STATE_FAILED = "failed"
 # relaunching a fresh `coord drive` right now would just observe the same
 # rerun-in-progress and wait again, so this parks instead of spending an
 # attempt. See `build_board_view`'s population of `merge_ci_pending` below.
+#
+# #2252 extends the SAME state to a THIRD trigger:
+# `coord.merge_queue.is_ci_flaky_reason` — a CI verdict that DID arrive AND
+# said something real about the code, but has only been observed failing
+# ONCE so far. The "more real time" that un-parks the entry is the one
+# scoped re-run (`MAX_CI_FLAKY_RERUNS`) landing — a coin-flip flake clears
+# and the entry resumes having spent zero attempts, a confirmed-real failure
+# reverts to a plain `checks_failed` block (spends the attempt exactly like
+# today) on the very next tick. Same reasoning as #1892 for why this parks
+# rather than spends: relaunching right now would just observe the same
+# re-run-in-progress and wait again.
 STATE_PARKED = "parked"
 
 TERMINAL_QUEUE_STATES: frozenset[str] = frozenset(
@@ -816,17 +832,34 @@ def build_board_view(
         if is_ci_infra_reason(raw_reason) and not is_ci_infra_reason(plan_reason):
             reason = raw_reason
             reason_is_live = False
-        if not (is_ci_pending_reason(reason) or is_ci_infra_reason(reason)):
+        # #2252: same recovery, for the sibling CI_FLAKY_PREFIX
+        # classification — a `checks_failed` streak currently mid its one
+        # #2252 re-run to rule out a flake. `_entry_gate_status` re-derives
+        # this identically to a plain "checks failed: ..." block (it has no
+        # notion of the raw row's `ci_flaky_reruns`/`ci_flaky_pending`
+        # state), so the raw reading must win here too or this entry would
+        # never park — it would instead sit `checks_failed` and burn a
+        # drive-queue launch attempt for the exact transient #2252 exists
+        # to catch. `elif`: the two classifications are mutually exclusive
+        # per entry (see the identical `elif` in `drive_state._merge_entry`).
+        elif is_ci_flaky_reason(raw_reason) and not is_ci_flaky_reason(plan_reason):
+            reason = raw_reason
+            reason_is_live = False
+        if not (
+            is_ci_pending_reason(reason)
+            or is_ci_infra_reason(reason)
+            or is_ci_flaky_reason(reason)
+        ):
             continue
         # #2158: the same plan row that came back with NO reason of its own
         # also carries `ci_summary` — `summarize_counts` over the very checks
         # `_entry_gate_status` just consulted, on the same board build. When
         # that rollup positively shows every check finished and none failed,
         # it is direct evidence AGAINST the raw row's frozen "CI running:" /
-        # "CI infra:" string, which no read path ever rewrites. Believing the
-        # write-path string over it is what wedged claude-coordinator#2138
-        # parked for 7h25m on CI that had gone green 41s before the park was
-        # written.
+        # "CI infra:" / "CI re-checking:" string, which no read path ever
+        # rewrites. Believing the write-path string over it is what wedged
+        # claude-coordinator#2138 parked for 7h25m on CI that had gone green
+        # 41s before the park was written.
         #
         # The override is deliberately POSITIVE-evidence-only, and only where
         # the plan itself is silent:

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/drive_state.py

@@ -34,7 +34,7 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any
 
-from coord.merge_queue import is_ci_infra_reason
+from coord.merge_queue import is_ci_flaky_reason, is_ci_infra_reason
 from coord.models import WORK_LIKE_TYPES, test_mode_from_labels
 
 # Assignment types that can carry the Test/Review gates for an issue.  Sourced
@@ -582,6 +582,21 @@ def _merge_entry(
         raw_reason = raw_entry.get("error")
         if is_ci_infra_reason(raw_reason) and not is_ci_infra_reason(reason):
             reason = raw_reason
+        # #2252: same recovery, for the SAME reason, for the sibling
+        # CI_FLAKY_PREFIX classification — `_entry_gate_status`'s fresh
+        # re-derivation has no notion of "this entry already spent its one
+        # #2252 re-run and is waiting on the answer" (that state lives only
+        # in `QueuedMerge.ci_flaky_reruns`/`ci_flaky_pending`, updated by
+        # the live `merge_queue.process()` path and persisted onto the raw
+        # row's `error`), so it would otherwise re-derive the SAME failing
+        # checks as the plain "checks failed: ..." wording every tick,
+        # shadowing the more specific CI-re-checking reading the raw row
+        # already has. `elif` — the two classifications are mutually
+        # exclusive per entry (one failure streak is either infra or
+        # flaky-pending, never both at once), so only one raw-preference
+        # branch can ever legitimately fire for a given raw_reason.
+        elif is_ci_flaky_reason(raw_reason) and not is_ci_flaky_reason(reason):
+            reason = raw_reason
 
     return {
         "status": status,

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/github_ops.py

@@ -1630,6 +1630,32 @@ def rerun_workflow_run(repo: str, run_id: str) -> bool:
     return result.returncode == 0
 
 
+def rerun_workflow_run_failed(repo: str, run_id: str) -> bool:
+    """Re-run only the FAILING job(s) of Actions workflow run *run_id* on
+    *repo* via ``gh run rerun <id> --failed`` (#2252).
+
+    The single ``gh`` sink for :meth:`coord.ci_github.GitHubCi.
+    rerun_failed_for_pr` — the narrower sibling of
+    :func:`rerun_workflow_run` (#1851/#1892), which restarts the WHOLE run
+    including jobs that already reported green. ``--failed`` is exactly
+    #2252's own scoping ask: cheaper, and it keeps the first pass's green
+    evidence intact instead of discarding it for no reason.
+
+    Returns ``True`` only on a clean (exit 0) rerun; any subprocess failure
+    (missing ``gh``, timeout, non-zero exit — e.g. the run is already in
+    progress, or the id is stale/invalid) returns ``False`` rather than
+    raising, matching :func:`rerun_workflow_run`'s own best-effort contract.
+    """
+    try:
+        result = subprocess.run(
+            ["gh", "run", "rerun", str(run_id), "--repo", repo, "--failed"],
+            capture_output=True, text=True, timeout=30,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    return result.returncode == 0
+
+
 def truncate_diff_text(diff: str, max_chars: int = 60000) -> str:
     """Truncate *diff* to *max_chars* with a trailing note, if it's over.
 

{code_coordinator-0.5.88 → code_coordinator-0.5.89}/coord/merge_queue.py

@@ -801,6 +801,52 @@ def _record_gate_bypass_audit(entry: "QueuedMerge", config) -> list[str]:
     return bypassed
 
 
+def _record_ci_flake_audit(entry: "QueuedMerge", pending_json: str) -> None:
+    """Emit one ``ci_flake_detected`` operational audit row (#2252): a check
+    that failed once, was re-run exactly once, and came back clean.
+
+    *pending_json* is the JSON blob :func:`process` stashed on
+    ``entry.ci_flaky_pending`` at the moment it triggered the re-run — the
+    failing check names/conclusions and the branch SHA they failed against,
+    captured then because ``branch_head_sha`` is transient (recomputed every
+    tick, never persisted) and the checks themselves may already read
+    differently on ``gh`` by the time the re-run resolves.
+
+    This audit row is the thing #2252 asks for explicitly: without a durable
+    record, a check that is flaky 30% of the time gets silently waved
+    through every time instead of surfacing as a repeat offender someone
+    should fix — ``record_audit`` (queryable via ``coord audit`` /
+    ``query_audit_log``) is that durable record. Best-effort like every
+    other audit call site in this module: ``record_audit`` never raises,
+    and a malformed/missing blob (should not happen — this module is the
+    only writer of ``ci_flaky_pending``) degrades to an empty ``checks``
+    list rather than raising into the merge loop.
+    """
+    try:
+        payload = json.loads(pending_json) if pending_json else {}
+    except (TypeError, ValueError):
+        payload = {}
+    record_audit(
+        tier="operational",
+        category="ci",
+        event_type="ci_flake_detected",
+        actor="system",
+        summary=(
+            f"CI flake on {entry.repo_name}#{entry.issue_number} "
+            f"(PR #{entry.pr_number}): failed once, passed on re-run — "
+            "zero drive attempts spent (#2252)"
+        ),
+        repo=entry.repo_name,
+        issue=entry.issue_number,
+        assignment_id=entry.assignment_id,
+        details={
+            "pr_number": entry.pr_number,
+            "sha": payload.get("sha"),
+            "checks": payload.get("checks", []),
+        },
+    )
+
+
 @dataclass(frozen=True)
 class MergeGateFailure:
     """One un-satisfied merge gate for a work row / queue entry (#1695).
@@ -1408,6 +1454,32 @@ def is_ci_infra_reason(reason: str | None) -> bool:
     return (reason or "").startswith(CI_INFRA_PREFIX)
 
 
+# #2252: the reason string prefix for a `checks_failed` entry whose failing
+# check(s) carry a REAL verdict about the code — unlike `CI_INFRA_PREFIX`
+# above — but have only been observed failing ONCE so far. `process()` has
+# triggered exactly one scoped re-run of the failed job(s) (#2252's whole
+# ask: "before a failed check consumes a drive attempt, re-run the failed
+# job(s) once and re-read" — a 1-in-N flaky test reports the identical
+# completed/failure verdict a genuine regression does, so the verdict alone
+# can't tell them apart; a second, independent observation can) and is
+# waiting on its answer.
+#
+# Distinctly named from the plain "checks failed: ..." wording a CONFIRMED
+# failure produces (this entry's one-shot re-run budget already spent,
+# still red on the second read) so `coord.drive`'s retry accounting and
+# `coord.drive_queue`'s `parked` state can extend the SAME "self-refreshing,
+# no attempt yet" treatment #1891/#1892 already give
+# `CI_PENDING_PREFIX`/`CI_INFRA_PREFIX` to this one — see
+# :func:`is_ci_flaky_reason` and `MAX_CI_FLAKY_RERUNS`.
+CI_FLAKY_PREFIX = "CI re-checking:"
+
+
+def is_ci_flaky_reason(reason: str | None) -> bool:
+    """True when *reason* names a `checks_failed` block currently mid its
+    ONE #2252 re-run to rule out a flake — see :data:`CI_FLAKY_PREFIX`."""
+    return (reason or "").startswith(CI_FLAKY_PREFIX)
+
+
 # #1892: auto-reruns `process()` will trigger for a single entry's verdictless
 # CI failure (via `CiStore.rerun_for_pr`) before giving up and parking it for
 # a human instead of the queue's own #1891 machinery. A workflow genuinely
@@ -1430,6 +1502,15 @@ MAX_CI_INFRA_RERUNS = 2
 # without masking a PR that just isn't going to catch up unattended.
 MAX_CI_STALE_RERUNS = 2
 
+# #2252: at most one auto-rerun per failure streak before a genuinely-
+# verdicted (non-infra) `checks_failed` spends the drive attempt exactly as
+# it does today. "One re-run, not a retry loop" is the issue's own bound:
+# two independent observations (the original run and this one re-run) is
+# enough to tell "broken" from "flaky" without starting to mask code that is
+# genuinely, repeatedly broken — a higher cap here would blur back into the
+# thing #1892's own cap already guards against for the verdictless case.
+MAX_CI_FLAKY_RERUNS = 1
+
 
 def _ci_infra_reason(
     ci: "CiStore", repo: str, number: int, failed: "list[CheckRun]"
@@ -2251,6 +2332,26 @@ class QueuedMerge:
     # Capped at `MAX_CI_STALE_RERUNS`. 0 for every entry that has never gone
     # CI-stale, and for rows predating this column.
     ci_stale_reruns: int = 0
+    # #2252: count of automatic `CiStore.rerun_failed_for_pr` calls
+    # `process()` has issued for this entry's CURRENT streak of genuinely-
+    # verdicted (non-infra) CI failures — capped at `MAX_CI_FLAKY_RERUNS`.
+    # Kept separate from `ci_infra_reruns`/`ci_stale_reruns` above for the
+    # same reason those two are kept apart from each other: independently
+    # capped, independently legible in the audit trail. 0 for every entry
+    # that has never hit a genuine-verdict failure, and for rows predating
+    # this column.
+    ci_flaky_reruns: int = 0
+    # #2252: JSON blob of the failing check names/conclusions and the
+    # branch SHA they failed against, captured at the moment `process()`
+    # triggered this entry's one flake-checking re-run. `branch_head_sha`
+    # itself is transient (recomputed from GitHub every tick, never
+    # persisted) — this is the only durable record of WHAT failed once the
+    # re-run's answer arrives on a later tick. `""` (falsy) means no re-run
+    # is currently pending an answer; set only while `ci_flaky_reruns`
+    # reflects an in-flight re-run, cleared the moment its answer (pass ->
+    # flake recorded via `record_audit`, fail -> confirmed real, no flake)
+    # is known.
+    ci_flaky_pending: str = ""
 
 
 class GhOps(Protocol):
@@ -2568,6 +2669,10 @@ def load_queue() -> list[QueuedMerge]:
             # #2197: same NULL-to-0 decoding as ci_infra_reruns above, for
             # rows predating this column.
             ci_stale_reruns=row["ci_stale_reruns"] or 0,
+            # #2252: same NULL-to-0/'' decoding as the other rerun counters
+            # above, for rows predating these columns.
+            ci_flaky_reruns=row["ci_flaky_reruns"] or 0,
+            ci_flaky_pending=row["ci_flaky_pending"] or "",
         )
         for row in rows
     ]
@@ -2585,8 +2690,8 @@ def save_queue(items: list[QueuedMerge]) -> None:
                     target_branch, issue_number, issue_title, state,
                     pr_number, pr_url, size, last_attempt, error, enqueued_at,
                     assignment_type, required_gates, ci_infra_reruns,
-                    ci_stale_reruns
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+                    ci_stale_reruns, ci_flaky_reruns, ci_flaky_pending
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
                 (
                     item.assignment_id, item.repo_name, item.repo_github,
                     item.branch, item.target_branch, item.issue_number,
@@ -2594,6 +2699,7 @@ def save_queue(items: list[QueuedMerge]) -> None:
                     item.size, item.last_attempt, item.error, item.enqueued_at,
                     item.assignment_type, json.dumps(list(item.required_gates or [])),
                     item.ci_infra_reruns, item.ci_stale_reruns,
+                    item.ci_flaky_reruns, item.ci_flaky_pending,
                 ),
             )
 
@@ -5110,6 +5216,69 @@ def process(
                         entry.error = msg
                         events.append(MergeEvent(entry, "checks_failed", msg))
                         continue  # #292: skip, don't halt the group
+                    # #2252: reached only when `infra_reason is None` —
+                    # every failing check carries a REAL verdict about the
+                    # code (#1892's verdictless case is handled/exhausted
+                    # above). A real verdict is still not enough to tell
+                    # "broken" from "flaky": a 1-in-N random-tempdir
+                    # collision reports exactly the same completed/failure
+                    # conclusion a genuine regression does. Re-run the
+                    # failed job(s) once — scoped via `rerun_failed_for_pr`
+                    # so the green evidence from checks that already passed
+                    # is never touched — and re-read before spending the
+                    # drive attempt this failure would otherwise cost.
+                    if entry.ci_flaky_reruns < MAX_CI_FLAKY_RERUNS:
+                        rerun_failed_for_pr = getattr(
+                            ci, "rerun_failed_for_pr", None
+                        )
+                        reran = (
+                            rerun_failed_for_pr(entry.repo_github, entry.pr_number)
+                            if rerun_failed_for_pr is not None
+                            else False
+                        )
+                        if reran:
+                            entry.ci_flaky_reruns += 1
+                            entry.ci_flaky_pending = json.dumps({
+                                "checks": [
+                                    {"name": c.name, "conclusion": c.conclusion}
+                                    for c in failed
+                                ],
+                                "sha": entry.branch_head_sha,
+                            })
+                            msg = (
+                                f"{CI_FLAKY_PREFIX} {summary} — re-running "
+                                "once before treating as broken "
+                                f"({entry.ci_flaky_reruns}/"
+                                f"{MAX_CI_FLAKY_RERUNS}, #2252)"
+                            )
+                            entry.error = msg
+                            _log.info(
+                                "#2252 flake re-check %d/%d for %s#%d "
+                                "(PR #%s): %s (rerun_failed_for_pr triggered)",
+                                entry.ci_flaky_reruns, MAX_CI_FLAKY_RERUNS,
+                                entry.repo_name, entry.issue_number,
+                                entry.pr_number, summary,
+                            )
+                            events.append(MergeEvent(entry, "ci_flaky_rerun", msg))
+                            continue  # #292: skip, don't halt the group
+                        # #2252 fail-safe: the re-run could not be
+                        # triggered (no `rerun_failed_for_pr` capability, or
+                        # the `gh` call itself failed) — fall straight
+                        # through to the plain `checks_failed` block below,
+                        # spending the attempt exactly as if this feature
+                        # did not exist. Never treat "could not re-run" as
+                        # "passed", and never increment `ci_flaky_reruns`
+                        # for a re-run that never actually happened.
+                    elif entry.ci_flaky_pending:
+                        # Budget already spent for this failure streak and
+                        # it is STILL red on the second read — confirmed
+                        # real, not a flake (#2252's other acceptance
+                        # criterion: "a check that fails twice: attempt
+                        # consumed, entry blocks — identical to today").
+                        # Nothing to record; clear the pending marker so a
+                        # later, unrelated resolution doesn't misattribute
+                        # this already-confirmed streak as a flake.
+                        entry.ci_flaky_pending = ""
                     msg = f"checks failed: {summary}"
                     entry.error = msg
                     events.append(MergeEvent(entry, "checks_failed", msg))
@@ -5150,6 +5319,19 @@ def process(
                 # that case is harmless since such an entry can never have
                 # accrued a nonzero `ci_infra_reruns` to begin with.
                 entry.ci_infra_reruns = 0
+                # #2252: this same "genuinely resolved" point is also where
+                # a suspected-flaky failure gets its answer: nothing failed
+                # and nothing is pending, so the one re-run this entry spent
+                # (see the `ci_flaky_reruns`/`CI_FLAKY_PREFIX` branch above)
+                # came back clean. Record it — the audit trail is what keeps
+                # this from quietly becoming a "just retry until green"
+                # button: a check that is flaky 30% of the time should show
+                # up as thirty recorded flakes, not thirty invisible free
+                # passes.
+                if entry.ci_flaky_pending:
+                    _record_ci_flake_audit(entry, entry.ci_flaky_pending)
+                    entry.ci_flaky_pending = ""
+                entry.ci_flaky_reruns = 0
                 # #1851: a green CI result can itself be stale relative to the
                 # base — see `_ci_checks_are_stale`'s docstring. Named
                 # distinctly (`checks_stale`) from checks_failed/