code-coordinator 0.5.92__tar.gz → 0.5.93__tar.gz

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.92
+Version: 0.5.93
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.92
+Version: 0.5.93
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/code_coordinator.egg-info/SOURCES.txt

@@ -676,6 +676,7 @@ tests/test_reconcile_merges.py
 tests/test_reconcile_usage_limit_done.py
 tests/test_refine_chat.py
 tests/test_release_cordon_2101.py
+tests/test_release_cordon_daemon_leads_2176.py
 tests/test_release_cordon_deadlock_2240.py
 tests/test_release_propagate.py
 tests/test_release_unified_1242.py

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/code_coordinator.egg-info/scm_file_list.json

@@ -706,6 +706,7 @@
     "tests/test_reconcile_usage_limit_done.py",
     "tests/test_refine_chat.py",
     "tests/test_release_cordon_2101.py",
+    "tests/test_release_cordon_daemon_leads_2176.py",
     "tests/test_release_cordon_deadlock_2240.py",
     "tests/test_release_propagate.py",
     "tests/test_release_unified_1242.py",

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.92",
+  "tag": "0.5.93",
   "distance": 0,
-  "node": "g7d880a1fd7fca3a73143f80edb90e5e9ebffef63",
+  "node": "g827590698265fe1d05e3d77e84c364f63d767405",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-15"

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/coord/commands/release.py

@@ -694,11 +694,25 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
     )
     current = rp.hosts_already_current(_lane_versions_by_host(before), record.target_version)
 
+    # #2176: resolved here, ahead of cordoning, so the cordon plan can honour
+    # the same daemon-leads invariant the roll itself is bound by (see below).
+    # Purely a derivation from data already in hand (`machine_health`) — this
+    # does not move the "unorderable fleet" REFUSAL, which stays below the
+    # deferral branch on purpose (see its own comment).
+    daemon_name = _daemon_machine_name(config, daemon_host_override, machine_health)
+
     # ── 3b. cordon the hosts that are behind, so they DRAIN (#2101) ──────
     #
     # Before the deferral return below, on purpose: cordoning is the thing
     # that turns "no window" into "a window in a few minutes". A run that
     # defers without cordoning has changed nothing about why it deferred.
+    #
+    # #2176: a non-daemon host with no busy signal of its own is exempted
+    # while the daemon host is itself busy and behind — see `plan_cordons`'s
+    # `daemon_host` handling. It cannot roll ahead of a busy daemon host
+    # regardless of its own drain state (the daemon-leads invariant below),
+    # so cordoning it protects nothing and just spends fleet capacity for an
+    # unbounded wait.
     record.cordons = _apply_cordons(
         hosts=hosts,
         report=before,
@@ -712,6 +726,7 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         state_dir=state_dir,
         max_deferrals=cordon_max_deferrals,
         release_cooldown=cordon_cooldown,
+        daemon_host=daemon_name,
     )
 
     if fully_busy and not force:
@@ -722,12 +737,12 @@ def release_propagate(  # noqa: PLR0912, PLR0915 — a pipeline; the decisions a
         # meets a fleet that is actually draining.
         _finish(rp.STATUS_DEFERRED, 0)
 
-    # #2101: resolved AFTER the deferral above, deliberately. This refusal is
-    # about the ORDER a roll happens in; a run that is going to roll nothing
-    # has no order to get wrong, and turning "the fleet is busy" into a
-    # `failed` record (exit 1, systemd marks the unit failed) would teach an
-    # operator to ignore the one signal that matters.
-    daemon_name = _daemon_machine_name(config, daemon_host_override, machine_health)
+    # #2101: this refusal is checked AFTER the deferral above, deliberately.
+    # This refusal is about the ORDER a roll happens in; a run that is going
+    # to roll nothing has no order to get wrong, and turning "the fleet is
+    # busy" into a `failed` record (exit 1, systemd marks the unit failed)
+    # would teach an operator to ignore the one signal that matters.
+    # (`daemon_name` itself was resolved earlier, before cordoning — #2176.)
     if daemon_name is None and len(hosts) > 1:
         # #2052 fault 2: this used to warn and roll in coordinator.yml order.
         # It then briefly put the daemon host BEHIND both its callers during a
@@ -1082,6 +1097,7 @@ def _apply_cordons(  # noqa: PLR0912 — one linear apply-the-plan pass
     state_dir: Path | None = None,
     max_deferrals: int | None = None,
     release_cooldown: float | None = None,
+    daemon_host: str | None = None,
 ) -> dict:
     """Plan and apply this run's cordons. Returns the journal fragment.
 
@@ -1090,6 +1106,13 @@ def _apply_cordons(  # noqa: PLR0912 — one linear apply-the-plan pass
     Failing the whole propagation because the cordon could not be renewed
     would make #2101's fix strictly worse than not having it.
 
+    *daemon_host* (#2176) lets :func:`~coord.release_cordon.plan_cordons`
+    exempt a non-daemon host with no busy signal of its own from cordoning
+    while the daemon host is itself busy and behind — see that function's
+    docstring for the reasoning. ``None`` (an unorderable fleet) disables
+    the exemption and falls back to cordoning every behind host, same as
+    before #2176.
+
     #2240: *state_dir* is where the propagation journal lives, and the journal
     is where "how many runs in a row has this cordon now deferred?" is stored
     — the process holding the answer in memory is restarted by the roll it is
@@ -1162,10 +1185,13 @@ def _apply_cordons(  # noqa: PLR0912 — one linear apply-the-plan pass
             if release_cooldown is None
             else release_cooldown
         ),
+        daemon_host=daemon_host,
     )
     for line in plan.render():
         click.echo(line)
     outcome.cooling_seconds = plan.cooling_seconds
+    outcome.collateral_spared = list(plan.collateral_spared)
+    outcome.blocked_behind = plan.blocked_behind
     if plan.released is not None:
         outcome.released = plan.released.to_dict()
         # stderr as well as stdout: on the timer host this line IS the

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/coord/release_cordon.py

@@ -142,6 +142,35 @@ and #2082 is the cost of tolerating that. The threshold is a knob
 (``coord release propagate --cordon-after N``) precisely so a future cadence
 change does not need a code change. Trap F.
 
+CORDON-EVERY-BEHIND-HOST DOES NOT COVER A HOST THAT CANNOT ROLL EITHER WAY
+----------------------------------------------------------------------------
+Observed 2026-08-13 00:18 UTC: one busy signal, on dellserver, and the fleet
+cordoned all three machines anyway. elitebook and precision reported
+``online • idle`` throughout and stayed cordoned — launch-blocked — for
+34+ minutes, unable to accept the very review dispatch #2240 needed.
+
+The cordon-every-behind-host rule above is correct for a host whose OWN
+draining is what a run is waiting on: skip it and it never drains, and a run
+that defers without cordoning defers again in 20 minutes for the same
+reason. It does not cover a host that has no busy signal against it AND is
+blocked from rolling by the daemon-leads invariant (see
+:mod:`coord.release_propagate`'s LANE ORDER section) rather than by its own
+work — nothing may roll ahead of a busy daemon host, so such a host cannot
+roll regardless of how drained it gets. Cordoning it protects nothing: its
+drained state cannot be consumed until the daemon host rolls first, which
+may be unbounded (any drive on the daemon host reproduces this, not just a
+wedged one).
+
+:func:`plan_cordons`'s *daemon_host* parameter is the fix: while the daemon
+host is itself busy and behind, only it (and any host with its own busy
+signal) is cordoned. Everyone else stays uncordoned and dispatchable —
+released immediately if a previous run already cordoned them — until the
+daemon host becomes rollable, at which point ordinary drain-everyone-behind
+resumes. :attr:`CordonPlan.collateral_spared` /
+:attr:`CordonPlan.blocked_behind` name exactly who was spared and why, so
+the next puzzle like this one is one line of output, not a 40-minute read of
+`/board`.
+
 PURITY
 ------
 Nothing here reads the clock, the filesystem, the network or the DB — same
@@ -618,6 +647,17 @@ class CordonPlan:
     #: recorded rather than silent, because "no cordons planned" and "cordons
     #: suppressed on purpose" are the same output otherwise.
     cooling_seconds: float = 0.0
+    #: #2176: behind hosts this run deliberately did NOT cordon (and, if
+    #: already cordoned, released) because they have no busy signal of their
+    #: own and cannot roll ahead of `blocked_behind` anyway. Reported
+    #: separately from `uncordon` (which is "proven current") so the journal
+    #: and CLI output can name them as collateral rather than as a drain that
+    #: completed.
+    collateral_spared: tuple[str, ...] = ()
+    #: #2176: the daemon host these hosts are spared on account of — set
+    #: exactly when `collateral_spared` is non-empty. The single fact that
+    #: would have turned a 40-minute puzzle into one line of output.
+    blocked_behind: str | None = None
 
     @property
     def empty(self) -> bool:
@@ -627,6 +667,7 @@ class CordonPlan:
             or self.escalations
             or self.expired
             or self.released
+            or self.collateral_spared
         )
 
     def to_dict(self) -> dict:
@@ -638,6 +679,8 @@ class CordonPlan:
             "unknown": list(self.unknown),
             "released": self.released.to_dict() if self.released else None,
             "cooling_seconds": self.cooling_seconds,
+            "collateral_spared": list(self.collateral_spared),
+            "blocked_behind": self.blocked_behind,
         }
 
     def render(self) -> list[str]:
@@ -645,6 +688,14 @@ class CordonPlan:
         lines: list[str] = []
         for item in self.cordon:
             lines.append(f"  ⊘ cordon {item.machine}: {item.describe()}")
+        if self.collateral_spared:
+            lines.append(
+                "  · "
+                + ", ".join(sorted(self.collateral_spared))
+                + f": left uncordoned — blocked behind daemon host "
+                f"{self.blocked_behind} either way, cordoning would not help "
+                "(#2176)"
+            )
         for name in self.uncordon:
             lines.append(f"  ✓ uncordon {name}: up to date, work may resume")
         for name in self.expired:
@@ -748,12 +799,15 @@ def plan_cordons(
     pressure: DeferralPressure | None = None,
     max_deferrals: int = DEFAULT_MAX_DEFERRALS,
     release_cooldown: float = DEFAULT_RELEASE_COOLDOWN_SECONDS,
+    daemon_host: str | None = None,
 ) -> CordonPlan:
     """Decide this run's cordon writes. Pure.
 
     *existing* is the store as read (expired records included — this function
     is what notices they lapsed). *busy_reasons* maps a host to why it is not
-    yet drained, purely so an escalation can say what is holding it.
+    yet drained, purely so an escalation can say what is holding it — and
+    (#2176) so this function can tell a genuinely busy host from an idle one
+    when deciding who is collateral.
 
     ``enabled=False`` (``coord release propagate --no-cordon``) plans no new
     cordons but STILL clears the ones this owner already set: turning the
@@ -772,6 +826,21 @@ def plan_cordons(
     Proven-current hosts are uncordoned in every one of these branches: that
     is never the wrong move, and skipping it during a cooldown would leave a
     rolled host cordoned for the length of the cooldown.
+
+    *daemon_host* (#2176) is the machine `coord release propagate` will roll
+    first (see `coord.release_propagate`'s LANE ORDER section) — the
+    daemon-leads invariant means no OTHER host's python lane may roll ahead
+    of it while it is itself busy and behind. A behind host with no busy
+    signal of its own is therefore collateral, not protected, by a cordon
+    while that holds: it cannot roll either way, so draining it buys nothing
+    and just spends fleet capacity for a wait that is unbounded from its own
+    perspective (#2067 made quiescence per-host; this closes the cordon's
+    matching gap). Such a host is left uncordoned — and released immediately
+    if a previous run already cordoned it — until the daemon host is
+    rollable (quiescent, or already on the target), at which point ordinary
+    drain-everyone-behind resumes exactly as before #2176. A host that is
+    itself busy is cordoned regardless: its own drain is still the thing
+    being waited on, whatever the daemon host is doing.
     """
     records = _as_records(existing)
     live = {name: c for name, c in records.items() if c.active(now)}
@@ -782,11 +851,30 @@ def plan_cordons(
     if not enabled:
         return CordonPlan(uncordon=tuple(sorted(live)), expired=expired)
 
-    # Uncordon: PROVEN current, and nothing else. A host whose version could
-    # not be read keeps whatever cordon it has until that cordon EXPIRES —
-    # clearing on "we couldn't read the version" would open the fleet up
-    # mid-roll on the strength of one failed HTTP call.
-    to_uncordon = tuple(sorted(name for name in live if name in drift.current))
+    # ── #2176: who is collateral to a busy, behind daemon host ────────────
+    daemon_blocked = bool(
+        daemon_host
+        and (busy_reasons or {}).get(daemon_host)
+        and daemon_host not in drift.current
+    )
+    collateral = frozenset(
+        host
+        for host in drift.behind
+        if daemon_blocked and host != daemon_host and not (busy_reasons or {}).get(host)
+    )
+    blocked_behind = daemon_host if collateral else None
+
+    # Uncordon: PROVEN current, plus (#2176) any collateral host a previous
+    # run already cordoned — "spared" means dispatchable now, not "merely not
+    # renewed". A host whose version could not be read otherwise keeps
+    # whatever cordon it has until that cordon EXPIRES — clearing on "we
+    # couldn't read the version" would open the fleet up mid-roll on the
+    # strength of one failed HTTP call.
+    to_uncordon = tuple(
+        sorted(
+            {name for name in live if name in drift.current} | (collateral & set(live))
+        )
+    )
 
     # ── #2240: the deadlock bound ────────────────────────────────────────
     pressure = pressure or DeferralPressure()
@@ -797,6 +885,8 @@ def plan_cordons(
             expired=expired,
             cooling_seconds=cooling,
             unknown=tuple(sorted(drift.undecided & set(live))),
+            collateral_spared=tuple(sorted(collateral)),
+            blocked_behind=blocked_behind,
         )
     if max_deferrals > 0 and pressure.consecutive >= max_deferrals:
         return CordonPlan(
@@ -809,11 +899,13 @@ def plan_cordons(
                 cooldown_seconds=release_cooldown,
                 target_version=target_version,
             ),
+            collateral_spared=tuple(sorted(collateral)),
+            blocked_behind=blocked_behind,
         )
 
     to_cordon: list[Cordon] = []
     escalations: list[DrainEscalation] = []
-    for host in sorted(drift.behind):
+    for host in sorted(drift.behind - collateral):
         previous = live.get(host)
         created = previous.created_at if previous and previous.created_at else now
         to_cordon.append(
@@ -844,6 +936,8 @@ def plan_cordons(
         escalations=tuple(escalations),
         expired=expired,
         unknown=tuple(sorted(drift.undecided & set(live))),
+        collateral_spared=tuple(sorted(collateral)),
+        blocked_behind=blocked_behind,
     )
 
 
@@ -883,6 +977,13 @@ class CordonOutcome:
     #: out of the newest record instead of every caller of
     #: :func:`describe_deferral_pressure` assuming the default.
     max_deferrals: int = DEFAULT_MAX_DEFERRALS
+    #: #2176: behind hosts this run spared (or actively released) because
+    #: they have no busy signal of their own and cannot roll ahead of a busy,
+    #: behind daemon host anyway. Mirrors `CordonPlan.collateral_spared`.
+    collateral_spared: list[str] = field(default_factory=list)
+    #: #2176: the daemon host `collateral_spared` was spared on account of.
+    #: Mirrors `CordonPlan.blocked_behind`.
+    blocked_behind: str | None = None
 
     def to_dict(self) -> dict:
         return {
@@ -896,4 +997,6 @@ class CordonOutcome:
             "cooling_seconds": self.cooling_seconds,
             "pressure": dict(self.pressure),
             "max_deferrals": self.max_deferrals,
+            "collateral_spared": list(self.collateral_spared),
+            "blocked_behind": self.blocked_behind,
         }

{code_coordinator-0.5.92 → code_coordinator-0.5.93}/coord/release_propagate.py

@@ -1247,6 +1247,14 @@ def render_record(record: PropagationRecord | Mapping[str, Any]) -> list[str]:
         )
     if cordons.get("uncordoned"):
         lines.append("    uncordoned: " + ", ".join(cordons["uncordoned"]))
+    # #2176: name the collateral hosts AND the single host they're collateral
+    # to — the fact that would have turned a 40-minute puzzle into one line.
+    if cordons.get("collateral_spared"):
+        lines.append(
+            "    spared (blocked behind daemon host "
+            f"{cordons.get('blocked_behind')} anyway): "
+            + ", ".join(cordons["collateral_spared"])
+        )
     if cordons.get("expired"):
         lines.append(
             "    cordons that lapsed on their own: " + ", ".join(cordons["expired"])

code_coordinator-0.5.93/tests/test_release_cordon_daemon_leads_2176.py

@@ -0,0 +1,313 @@
+"""#2176: the release cordon must not take out hosts the daemon-leads
+invariant already forbids from rolling.
+
+`coord release propagate` cordons every host that is behind the target so it
+drains (#2101). That is correct when a host's OWN draining is the thing being
+waited on. It is not correct for a host that is idle, behind, and blocked
+from rolling anyway because the daemon host itself is busy — the daemon-leads
+invariant (`coord/release_propagate.py`'s module docstring) forbids ANY other
+host's python lane from rolling ahead of a busy daemon host, so cordoning an
+idle non-daemon host protects nothing: its drained state cannot be consumed
+until the daemon host rolls first.
+
+Evidence, 2026-08-13 00:18 UTC: dellserver (the daemon host) had a drive
+running and was cordoned correctly. elitebook and precision had no busy
+signal against them, were also cordoned, and stayed that way for 34+ minutes
+— launch-blocked while unable to roll regardless of their own drain state,
+because they could never roll ahead of dellserver.
+
+Every test here fails against the pre-fix code, where `plan_cordons` had no
+`daemon_host` parameter and cordoned every behind host unconditionally.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from click.testing import CliRunner
+
+from coord import machine_pause as mp
+from coord import release_cordon as rc
+from coord.cli import main
+from coord.commands import release as release_cmd
+from coord.drive_queue import STATE_RUNNING
+
+
+# ══════════════════════════════════════════════════════════════════════════
+# Pure `plan_cordons` tests — fast, and precise about which host is which.
+# ══════════════════════════════════════════════════════════════════════════
+
+
+def test_a_busy_behind_daemon_host_spares_idle_behind_hosts_from_cordon():
+    """The exact incident shape: dellserver busy and behind, elitebook and
+    precision idle and behind. Only dellserver may be cordoned."""
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={
+            "dellserver": "0.5.40", "elitebook": "0.5.40", "precision": "0.5.40",
+        },
+        now=0.0,
+        busy_reasons={"dellserver": "drive-queue entry running: claude-coordinator#2164"},
+        daemon_host="dellserver",
+    )
+    assert [c.machine for c in plan.cordon] == ["dellserver"]
+    assert plan.collateral_spared == ("elitebook", "precision")
+    assert plan.blocked_behind == "dellserver"
+
+
+def test_a_quiescent_daemon_host_cordons_every_behind_host_as_before():
+    """Once the daemon host is not itself busy, the existing drain guarantee
+    is unchanged — every behind host is cordoned, same as pre-#2176."""
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={
+            "dellserver": "0.5.40", "elitebook": "0.5.40", "precision": "0.5.40",
+        },
+        now=0.0,
+        busy_reasons={},
+        daemon_host="dellserver",
+    )
+    assert sorted(c.machine for c in plan.cordon) == ["dellserver", "elitebook", "precision"]
+    assert plan.collateral_spared == ()
+    assert plan.blocked_behind is None
+
+
+def test_a_daemon_host_already_on_target_cordons_every_behind_host():
+    """A daemon host busy but already ON the target version is rollable (it
+    needs no roll at all), so it does not block anyone — collateral sparing
+    must not fire."""
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={
+            "dellserver": "0.5.48", "elitebook": "0.5.40", "precision": "0.5.40",
+        },
+        now=0.0,
+        busy_reasons={"dellserver": "drive-queue entry running: claude-coordinator#2164"},
+        daemon_host="dellserver",
+    )
+    assert sorted(c.machine for c in plan.cordon) == ["elitebook", "precision"]
+    assert plan.collateral_spared == ()
+
+
+def test_a_busy_behind_host_is_still_cordoned_regardless_of_daemon_state():
+    """A host that is itself busy is never collateral — its own drain is
+    still the thing being waited on, whatever the daemon host is doing."""
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={
+            "dellserver": "0.5.40", "elitebook": "0.5.40", "precision": "0.5.40",
+        },
+        now=0.0,
+        busy_reasons={
+            "dellserver": "drive-queue entry running: claude-coordinator#2164",
+            "elitebook": "drive-queue entry running: acme/other#3",
+        },
+        daemon_host="dellserver",
+    )
+    assert sorted(c.machine for c in plan.cordon) == ["dellserver", "elitebook"]
+    assert plan.collateral_spared == ("precision",)
+
+
+def test_a_previously_cordoned_collateral_host_is_released_not_just_left():
+    """A host cordoned by an EARLIER run, before the daemon host went busy,
+    must be actively released — "spared" means dispatchable now, not merely
+    "not renewed until it expires"."""
+    existing = {
+        "dellserver": rc.Cordon(machine="dellserver", expires_at=1e12),
+        "elitebook": rc.Cordon(machine="elitebook", expires_at=1e12),
+    }
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={"dellserver": "0.5.40", "elitebook": "0.5.40"},
+        existing=existing,
+        now=0.0,
+        busy_reasons={"dellserver": "drive-queue entry running: claude-coordinator#2164"},
+        daemon_host="dellserver",
+    )
+    assert [c.machine for c in plan.cordon] == ["dellserver"]
+    assert "elitebook" in plan.uncordon
+
+
+def test_no_daemon_host_falls_back_to_cordoning_every_behind_host():
+    """`daemon_host=None` (an unorderable fleet, or a caller that predates
+    #2176) disables the exemption entirely — the safe default."""
+    plan = rc.plan_cordons(
+        target_version="0.5.48",
+        host_versions={"dellserver": "0.5.40", "elitebook": "0.5.40"},
+        now=0.0,
+        busy_reasons={"dellserver": "drive-queue entry running: claude-coordinator#2164"},
+        daemon_host=None,
+    )
+    assert sorted(c.machine for c in plan.cordon) == ["dellserver", "elitebook"]
+    assert plan.collateral_spared == ()
+
+
+# ══════════════════════════════════════════════════════════════════════════
+# CLI black-box test — the acceptance criterion, end to end.
+# ══════════════════════════════════════════════════════════════════════════
+
+THREE_HOST_CONFIG = """\
+repos:
+  - name: api
+    github: acme/api
+
+machines:
+  - name: dellserver
+    host: dellserver.tailnet
+    capabilities: [python]
+    repos: [api]
+  - name: elitebook
+    host: elitebook.tailnet
+    capabilities: [python]
+    repos: [api]
+  - name: precision
+    host: precision.tailnet
+    capabilities: [python]
+    repos: [api]
+"""
+
+
+@pytest.fixture()
+def tmp_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """Isolate the cordon store — it lives at $HOME/.coord/."""
+    monkeypatch.setenv("HOME", str(tmp_path))
+    (tmp_path / ".coord").mkdir()
+    return tmp_path
+
+
+@pytest.fixture()
+def three_host_config_path(tmp_path: Path) -> Path:
+    p = tmp_path / "coordinator.yml"
+    p.write_text(THREE_HOST_CONFIG)
+    return p
+
+
+def _stub_state_dir(monkeypatch, tmp_path):
+    d = tmp_path / "propagation-state"
+    d.mkdir(exist_ok=True)
+    monkeypatch.setattr(release_cmd, "_state_dir", lambda: d)
+    return d
+
+
+def _stub_board(monkeypatch, *, drive_queue=()):
+    monkeypatch.setattr(
+        release_cmd,
+        "_fetch_board",
+        lambda: (
+            {"drive_queue": list(drive_queue), "assignments": [], "issues": []},
+            None,
+        ),
+    )
+
+
+def _serve_health():
+    """A ``/health`` body whose ``spawned_coord`` row names a live
+    coord-serve — how the daemon host is DERIVED rather than guessed."""
+    return {
+        "version": "0.5.40",
+        "health": {"schema": 1, "results": [
+            {"check_id": "spawned_coord", "subject": "coord-serve",
+             "severity": "ok",
+             "values": {"unit": "coord-serve", "pid": 1, "version": "0.5.40"}},
+        ]},
+    }
+
+
+def _stub_verify(monkeypatch, *, versions: dict[str, str], daemon: str):
+    from coord import release_verify as rv
+
+    lanes = [
+        rv.Lane(host=host, lane="~/.coord-venv", version=version)
+        for host, version in versions.items()
+    ]
+    machine_health = {daemon: _serve_health()}
+    monkeypatch.setattr(
+        rv, "gather", lambda *a, **k: (machine_health, {}, None, daemon)
+    )
+    monkeypatch.setattr(
+        rv,
+        "verify",
+        lambda **kwargs: rv.VerifyReport(
+            expected=kwargs.get("expected"), lanes=lanes, findings=[]
+        ),
+    )
+
+
+def test_propagate_cordons_only_the_busy_daemon_host_and_spares_idle_behind_hosts(
+    tmp_home, three_host_config_path, monkeypatch, tmp_path
+):
+    """#2176's exact regression, reproduced through the real CLI command: a
+    drive is running on dellserver (the daemon host), which is also behind.
+    elitebook and precision are behind too, but report nothing busy.
+
+    Pre-fix, this cordoned all three and held elitebook/precision launch-
+    blocked for the entire time dellserver stayed busy — capacity spent on
+    hosts that could not have rolled regardless. Post-fix, only dellserver
+    is cordoned; the other two stay dispatchable.
+    """
+    _stub_state_dir(monkeypatch, tmp_path)
+    _stub_board(
+        monkeypatch,
+        drive_queue=[{"repo_name": "claude-coordinator", "issue_number": 2164,
+                      "state": STATE_RUNNING, "machine": "dellserver",
+                      "launch_host": "dellserver"}],
+    )
+    _stub_verify(
+        monkeypatch,
+        versions={"dellserver": "0.5.40", "elitebook": "0.5.40", "precision": "0.5.40"},
+        daemon="dellserver",
+    )
+
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(three_host_config_path),
+         "--target", "0.5.48"],
+    )
+    assert result.exit_code == 0, result.output
+
+    # This is the regression: pre-fix, all three of these lines were
+    # "⊘ cordon <host>: draining for v0.5.48".
+    assert "cordon dellserver" in result.output
+    assert "cordon elitebook" not in result.output
+    assert "cordon precision" not in result.output
+    # Item 3 — the blast radius is named, not just absent.
+    assert "elitebook, precision" in result.output
+    assert "blocked behind daemon host dellserver" in result.output
+
+    # And the cordon store itself agrees: elitebook/precision are actually
+    # dispatchable, not merely un-mentioned in the printed plan.
+    assert mp.cordoned_names() == {"dellserver"}
+
+
+def test_once_the_daemon_host_is_idle_the_other_behind_hosts_cordon_as_today(
+    tmp_home, three_host_config_path, monkeypatch, tmp_path
+):
+    """The existing drain guarantee, unchanged: with NOTHING busy anywhere,
+    every behind host is cordoned exactly as it was before #2176.
+
+    `--dry-run`, like the regression test above: it changes nothing in the
+    cordon store, but the plan it prints is exactly what a real run would
+    write, and using it here means this test does not need to stub the roll
+    executors to keep a successful run from reaching real network I/O (a
+    successful roll uncordons its own host immediately — see 4b below —
+    which would otherwise make "was it cordoned at all" unobservable here).
+    """
+    _stub_state_dir(monkeypatch, tmp_path)
+    _stub_board(monkeypatch, drive_queue=[])
+    _stub_verify(
+        monkeypatch,
+        versions={"dellserver": "0.5.40", "elitebook": "0.5.40", "precision": "0.5.40"},
+        daemon="dellserver",
+    )
+
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(three_host_config_path),
+         "--target", "0.5.48", "--dry-run"],
+    )
+    assert result.exit_code == 0, result.output
+    assert "cordon dellserver" in result.output
+    assert "cordon elitebook" in result.output
+    assert "cordon precision" in result.output
+    assert "spared" not in result.output