codna 0.2.28__tar.gz → 0.2.30__tar.gz

{codna-0.2.28 → codna-0.2.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.28
+Version: 0.2.30
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.28 → codna-0.2.30}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.28"
+__version__ = "0.2.30"

{codna-0.2.28 → codna-0.2.30}/codna/webhook.py

@@ -739,9 +739,12 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
     import signal
     import threading
 
+    from .webhook_procs import prepare_scratch_root
     from .webhook_queue import WebhookQueue
     from .webhook_worker import WorkerPool
 
+    prepare_scratch_root()  # before anything touches tempfile: job scratch lives on the volume
+
     queue = WebhookQueue(default_queue_path())
     pool = WorkerPool(
         queue,

{codna-0.2.28 → codna-0.2.30}/codna/webhook_metering.py

@@ -26,6 +26,23 @@ _ACCOUNT_LINK_URL_ENV = "CODNA_ACCOUNT_LINK_URL"
 # self-hosted operators who provision it directly rather than pointing at a decision-engine.
 _ENGINE_URL_ENV = "CODNA_ENGINE_URL"
 _ENGINE_INTERNAL_SECRET_ENV = "CODNA_WEBHOOK_INTERNAL_SECRET"
+# How long the QUEUE holds a job back before it can be claimed again after the bridge gave no
+# answer (webhook_queue.complete(retry_after_s=...)); no worker thread sleeps through it. The
+# control plane is unreachable for ~1-2 min on each of its redeploys; two holds plus the retries
+# themselves cover that window.
+BRIDGE_RETRY_WAIT_S = 30.0
+
+
+class BridgeUnavailable(RuntimeError):
+    """The account-linking bridge is configured but could not answer right now.
+
+    Distinct from "not linked" (a definite 404) and from a misconfigured secret (401/403): those
+    ARE answers about the installation. A connection error, a timeout, a 429 or any 5xx is not --
+    the control plane answers 502/503 for a minute or two on every redeploy, and on 2026-09-18
+    01:44Z a review that landed in that window was reported to a linked org as "link your
+    account" (a neutral Check Run in place of the required review). The worker retries instead,
+    and on its last attempt posts :func:`unreachable_summary` rather than the link prompt.
+    """
 
 
 def included_monthly_usd() -> str:
@@ -53,7 +70,15 @@ def resolve_engine_key(installation_id: int | None) -> str | None:
     """
     if not installation_id:
         return None
-    live = _fetch_live_credentials(installation_id)
+    try:
+        live = _fetch_live_credentials(installation_id, raise_unavailable=True)
+    except BridgeUnavailable:
+        # A self-hosted static store still answers while the bridge is down; without one there
+        # is no answer, and "no answer" must not become "not linked" (see BridgeUnavailable).
+        static = _resolve_engine_key_from_static_store(installation_id)
+        if static:
+            return static
+        raise
     if live is not None:
         key = live.get("engine_key")
         if key:
@@ -107,11 +132,14 @@ def resolve_fix_enabled(installation_id: int | None) -> bool:
     return bool(value)
 
 
-def _fetch_live_credentials(installation_id: int) -> dict[str, Any] | None:
+def _fetch_live_credentials(installation_id: int, *, raise_unavailable: bool = False) -> dict[str, Any] | None:
     """Ask decision-engine, live, whether this installation is linked to a metered Codna
-    account. Unconfigured (no engine URL / no shared secret), unreachable, or any non-200
-    response (401 misconfigured secret, 404 not linked) all fall through to None. Always a
-    fresh call, never cached (see :func:`resolve_provider_credentials`)."""
+    account. Unconfigured (no engine URL / no shared secret) and definite non-200 answers (401
+    misconfigured secret, 404 not linked) fall through to None. A transient failure -- connection
+    error, timeout, 429, any 5xx -- also returns None by default, or raises
+    :class:`BridgeUnavailable` when ``raise_unavailable`` is set (the credential gate wants to
+    retry; the BYOK and kill-switch lookups keep their fail-open defaults). Always a fresh call,
+    never cached (see :func:`resolve_provider_credentials`)."""
     base_url = os.environ.get(_ENGINE_URL_ENV)
     secret = os.environ.get(_ENGINE_INTERNAL_SECRET_ENV)
     if not base_url or not secret:
@@ -127,7 +155,13 @@ def _fetch_live_credentials(installation_id: int) -> dict[str, Any] | None:
             headers={"Authorization": f"Bearer {secret}"},
             timeout=10.0,
         )
-    except Exception:  # noqa: BLE001 — a network hiccup must fail closed, not crash the job
+    except Exception as exc:  # noqa: BLE001 — a network hiccup must fail closed, not crash the job
+        if raise_unavailable:
+            raise BridgeUnavailable(f"{type(exc).__name__}: {exc}") from exc
+        return None
+    if resp.status_code == 429 or resp.status_code >= 500:
+        if raise_unavailable:
+            raise BridgeUnavailable(f"HTTP {resp.status_code}") from None
         return None
     if resp.status_code != 200:
         return None
@@ -169,3 +203,12 @@ def unlinked_summary() -> str:
         f"{account_link_url()}  (or add your own model key there for uncapped, self-billed usage). "
         f"The Codna CLI runs on your machine and never needs this."
     )
+
+
+def unreachable_summary(kind: str, detail: str) -> str:
+    """The Check Run / comment text when the bridge gave no answer on the job's last attempt."""
+    return (
+        "Codna could not reach its account service to check this installation's plan "
+        f"({detail}), so nothing ran and nothing was spent. Push again or comment "
+        f"`@codna {kind}` to retry."
+    )

{codna-0.2.28 → codna-0.2.30}/codna/webhook_procs.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
 import signal
 import subprocess
 import sys
@@ -166,3 +167,38 @@ def _teardown_job_runtime(tmp: str) -> int:
             flush=True,
         )
     return len(pids)
+
+
+_SCRATCH_PREFIX = "codna-"
+
+
+def prepare_scratch_root() -> Path | None:
+    """Make ``TMPDIR`` this process's default temp dir and clear stale codna scratch from it.
+
+    On the hosted webhook ``TMPDIR`` points at the mounted volume (``/data/tmp`` in
+    ``infra/fly/codna-webhook.fly.toml``). The machine's root filesystem is 7.8 GB with ~6.5 GB
+    taken by the image, and one review of a large repository needs ~1.1 GB of scratch (its clone,
+    the checkout, the agent's worktree) -- reviews died there with ENOSPC (thyn-ai/algenta#1023).
+    Everything a job creates lands under this root: the worker's per-job directory is made here
+    and the job's own TMPDIR points inside it. Every ``codna-*`` directory still present when the
+    process starts belongs to a job that no longer exists (a previous process killed mid-job, or an
+    older CLI's leaked review clone), so it is removed; entries with any other name are left
+    alone. No-op when ``TMPDIR`` is unset.
+    """
+    raw = os.environ.get("TMPDIR")
+    if not raw:
+        return None
+    root = Path(raw)
+    root.mkdir(parents=True, exist_ok=True)
+    import tempfile
+
+    tempfile.tempdir = str(root)  # the documented override for every tempfile call's default dir
+    removed = 0
+    for entry in root.iterdir():
+        if entry.name.startswith(_SCRATCH_PREFIX) and not entry.is_symlink() and entry.is_dir():
+            shutil.rmtree(entry, ignore_errors=True)
+            removed += 1
+    if removed:
+        print(json.dumps({"event": "scratch_sweep", "root": str(root), "removed": removed}),
+              file=sys.stderr)
+    return root

{codna-0.2.28 → codna-0.2.30}/codna/webhook_queue.py

@@ -49,7 +49,9 @@ CREATE INDEX IF NOT EXISTS jobs_status_idx ON jobs (status, id);
 # Columns added after the table first shipped. CREATE TABLE IF NOT EXISTS never alters an existing
 # table, so a queue.db already on the Fly volume would be missing these — add them idempotently on
 # open. (pr_number was silently dropped before this; review + comment-fix jobs depend on it.)
-_ADDED_COLUMNS = {"pr_number": "INTEGER", "context": "TEXT"}
+# not_before: a retry the worker asked to hold back (the account bridge gave no answer) is
+# invisible to claim() until this UTC ISO timestamp; NULL = claimable now.
+_ADDED_COLUMNS = {"pr_number": "INTEGER", "context": "TEXT", "not_before": "TEXT"}
 
 
 def _utc_now() -> str:
@@ -133,11 +135,12 @@ class WebhookQueue:
             try:
                 row = conn.execute(
                     "SELECT * FROM jobs WHERE status IN ('queued','retry') "
+                    "AND (not_before IS NULL OR not_before <= ?) "
                     # Reviews first: they are human-facing and, since the org ruleset, a REQUIRED
                     # check -- a burst of CI-failure fix jobs must never starve them (2026-09-17:
                     # 13 red dependabot PRs x N suites x 3 attempts held both threads for minutes).
                     "AND attempts < ? ORDER BY CASE WHEN kind='review' THEN 0 ELSE 1 END, id LIMIT 1",
-                    (_MAX_ATTEMPTS,),
+                    (_utc_now(), _MAX_ATTEMPTS),
                 ).fetchone()
                 if row is None:
                     conn.execute("COMMIT")
@@ -167,20 +170,26 @@ class WebhookQueue:
         )
 
     def complete(self, row_id: int, *, status: str, result: Mapping[str, object] | None = None,
-                 retry: bool = True) -> None:
+                 retry: bool = True, retry_after_s: float | None = None) -> None:
         """Mark a claimed job done/failed. A failed job under the attempt cap becomes 'retry' --
         unless the caller says the failure is deterministic (retry=False), e.g. the CLI rejected
-        the inputs: re-running it three times just repeats the same error."""
+        the inputs: re-running it three times just repeats the same error. ``retry_after_s`` holds
+        the retry back from claim() for that long (the account bridge gave no answer: re-asking
+        immediately would burn every attempt inside the same outage) -- in the QUEUE, so no
+        worker thread sleeps through the wait."""
         final = status
         if status == "failed" and retry:
             with self._conn() as conn:
                 row = conn.execute("SELECT attempts FROM jobs WHERE id=?", (row_id,)).fetchone()
             if row is not None and row["attempts"] < _MAX_ATTEMPTS:
                 final = "retry"
+        not_before = None
+        if final == "retry" and retry_after_s is not None:
+            not_before = (datetime.now(timezone.utc) + timedelta(seconds=retry_after_s)).isoformat()
         with self._conn() as conn:
             conn.execute(
-                "UPDATE jobs SET status=?, finished_at=?, result=? WHERE id=?",
-                (final, _utc_now(), json.dumps(dict(result or {})), row_id),
+                "UPDATE jobs SET status=?, finished_at=?, result=?, not_before=? WHERE id=?",
+                (final, _utc_now(), json.dumps(dict(result or {})), not_before, row_id),
             )
 
     def recover_stale(self) -> dict[str, int]:

{codna-0.2.28 → codna-0.2.30}/codna/webhook_worker.py

@@ -101,6 +101,7 @@ class JobResult:
     ok: bool
     summary: str
     retryable: bool = True  # False = deterministic failure (bad inputs); the queue must not retry it
+    retry_after_s: float | None = None  # hold the retry back in the queue this long (no thread sleeps)
 
 
 # CLI error codes whose failure is a property of the inputs, not of the moment.
@@ -485,7 +486,25 @@ def process_job(
 
     # FAIL CLOSED: no per-installation org credential -> do NOT run a cloud fix on a house key.
     # Prompt the user to link their Codna account (managed allowance) or add BYOK. Never spend.
-    engine_key = resolve_engine_key(job.installation_id)
+    try:
+        engine_key = resolve_engine_key(job.installation_id)
+    except webhook_metering.BridgeUnavailable as exc:
+        # NO answer from the bridge (control plane mid-redeploy) is not "not linked": retry, and
+        # on the last attempt say so honestly instead of posting the link prompt to a linked org.
+        summary = f"account bridge unavailable ({exc})"
+        if qjob.attempts < _MAX_ATTEMPTS:
+            return JobResult(False, summary + " -- will retry", retryable=True,
+                             retry_after_s=webhook_metering.BRIDGE_RETRY_WAIT_S)
+        text = webhook_metering.unreachable_summary(job.kind, str(exc))
+        if token and job.ref:
+            cid = github.create_check_run(job.repo_full_name, token, name=f"codna {job.kind}",
+                                          head_sha=job.ref, summary="codna: account service unreachable")
+            if cid:
+                github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
+                                        summary=text, name=f"codna {job.kind}")
+        if token and job.issue_number and not job.ref:
+            github.post_issue_comment(job.repo_full_name, token, job.issue_number, "⚠️ " + text)
+        return JobResult(False, summary + " -- gave up after retries", retryable=False)
     if not engine_key:
         if token and job.ref:
             cid = github.create_check_run(job.repo_full_name, token, name=f"codna {job.kind}",
@@ -876,7 +895,7 @@ class WorkerPool:
                 _log_worker_failure(qjob, code="job_failed", message=result.summary)
             self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
                                  result={"summary": result.summary, "attempt": qjob.attempts},
-                                 retry=result.retryable)
+                                 retry=result.retryable, retry_after_s=result.retry_after_s)
         except WebhookError as exc:
             _log_worker_failure(qjob, code=exc.code, message=str(exc))
             self._queue.complete(qjob.row_id, status="failed", result={"error": exc.code, "message": str(exc)})

{codna-0.2.28 → codna-0.2.30}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.28
+Version: 0.2.30
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.28 → codna-0.2.30}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.28"
+version = "0.2.30"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.28 → codna-0.2.30}/tests/test_webhook.py

@@ -842,3 +842,59 @@ def test_fix_reply_is_classified_for_any_association_and_carries_the_commenter()
     job = classify_event("pull_request_review_comment", payload)
     assert job is not None and job.kind == "fix" and job.pr_number == 63
     assert job.context["commenter"] == "angelatgithub" and job.context["author_association"] == "CONTRIBUTOR"
+
+
+# ---- job scratch root (TMPDIR on the volume) ----------------------------------------------------
+
+def test_prepare_scratch_root_creates_a_missing_dir_and_makes_it_the_default_temp_dir(monkeypatch, tmp_path):
+    """A fresh volume has no /data/tmp yet; the server must create it and every tempfile call in
+    this process (the worker's per-job TemporaryDirectory first of all) must land inside it."""
+    import tempfile
+    from pathlib import Path
+
+    from codna.webhook_procs import prepare_scratch_root
+
+    scratch = tmp_path / "data" / "tmp"
+    monkeypatch.setenv("TMPDIR", str(scratch))
+    monkeypatch.setattr(tempfile, "tempdir", None)  # drop any cached default; restored after the test
+    assert prepare_scratch_root() == scratch
+    assert scratch.is_dir()
+    assert Path(tempfile.gettempdir()) == scratch
+    with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as job_dir:
+        assert Path(job_dir).parent == scratch
+
+
+def test_prepare_scratch_root_sweeps_only_stale_codna_dirs(monkeypatch, tmp_path):
+    """REGRESSION: 61 codna-* dirs sat in the machine's /tmp on 2026-09-18 -- review clones an
+    older CLI never removed plus per-job dirs of processes killed mid-job. At startup nothing of
+    ours can be live, so every codna-* directory is stale. Anything else on the volume is not
+    ours to delete."""
+    import tempfile
+
+    from codna.webhook_procs import prepare_scratch_root
+
+    scratch = tmp_path / "scratch"
+    scratch.mkdir()
+    (scratch / "codna-webhook-job-old").mkdir()
+    (scratch / "codna-webhook-job-old" / "clone.txt").write_text("x", encoding="utf-8")
+    (scratch / "codna-review-old").mkdir()
+    (scratch / "keep-me").mkdir()
+    (scratch / "codna-notes.txt").write_text("a file, not a dir", encoding="utf-8")
+    monkeypatch.setenv("TMPDIR", str(scratch))
+    monkeypatch.setattr(tempfile, "tempdir", None)
+    prepare_scratch_root()
+    assert not (scratch / "codna-webhook-job-old").exists()
+    assert not (scratch / "codna-review-old").exists()
+    assert (scratch / "keep-me").is_dir()
+    assert (scratch / "codna-notes.txt").is_file()
+
+
+def test_prepare_scratch_root_without_tmpdir_changes_nothing(monkeypatch):
+    import tempfile
+
+    from codna.webhook_procs import prepare_scratch_root
+
+    monkeypatch.delenv("TMPDIR", raising=False)
+    monkeypatch.setattr(tempfile, "tempdir", None)
+    assert prepare_scratch_root() is None
+    assert tempfile.tempdir is None

{codna-0.2.28 → codna-0.2.30}/tests/test_webhook_metering.py

@@ -84,17 +84,60 @@ def test_resolve_engine_key_live_not_linked_falls_through_to_static_store(monkey
     assert m.resolve_engine_key(42) == "static-fallback-key"
 
 
-def test_resolve_engine_key_live_network_error_fails_closed(monkeypatch):
+def _bridge_configured_without_static_store(monkeypatch):
     monkeypatch.setenv(m._ENGINE_URL_ENV, "https://api.algenta.internal")
     monkeypatch.setenv(m._ENGINE_INTERNAL_SECRET_ENV, "shh")
     monkeypatch.delenv("CODNA_WEBHOOK_INSTALL_KEYS_PATH", raising=False)
     monkeypatch.delenv("CODNA_WEBHOOK_INSTALL_KEYS", raising=False)
 
+
+def test_resolve_engine_key_live_network_error_is_no_answer_not_unlinked(monkeypatch):
+    """REGRESSION: a connection error used to resolve to None == "not linked" and the job posted
+    the link-your-account prompt to a linked org. No answer is a distinct outcome the worker retries."""
+    _bridge_configured_without_static_store(monkeypatch)
+
     def _boom(*a, **k):
         raise OSError("connection refused")
 
     monkeypatch.setattr("httpx.get", _boom)
-    assert m.resolve_engine_key(42) is None  # never raises, fails closed
+    with pytest.raises(m.BridgeUnavailable, match="OSError"):
+        m.resolve_engine_key(42)
+
+
+@pytest.mark.parametrize("status", [500, 502, 503, 504, 429])
+def test_resolve_engine_key_live_transient_http_status_is_no_answer(monkeypatch, status):
+    """502/503 is exactly what the control plane serves for a minute or two on every redeploy
+    (the 2026-09-18 01:44Z incident: a review in that window got the link prompt instead)."""
+    _bridge_configured_without_static_store(monkeypatch)
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _FakeResponse(status, {"detail": "upstream"}))
+    with pytest.raises(m.BridgeUnavailable, match=f"HTTP {status}"):
+        m.resolve_engine_key(42)
+
+
+@pytest.mark.parametrize("status", [401, 403, 404])
+def test_resolve_engine_key_live_definite_non_200_still_fails_closed(monkeypatch, status):
+    """A misconfigured secret or an unlinked installation IS an answer: fail closed as before."""
+    _bridge_configured_without_static_store(monkeypatch)
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _FakeResponse(status, {"detail": "no"}))
+    assert m.resolve_engine_key(42) is None
+
+
+def test_resolve_engine_key_static_store_still_answers_while_the_bridge_is_down(monkeypatch):
+    monkeypatch.setenv(m._ENGINE_URL_ENV, "https://api.algenta.internal")
+    monkeypatch.setenv(m._ENGINE_INTERNAL_SECRET_ENV, "shh")
+    monkeypatch.delenv("CODNA_WEBHOOK_INSTALL_KEYS_PATH", raising=False)
+    monkeypatch.setenv("CODNA_WEBHOOK_INSTALL_KEYS", json.dumps({"42": "self-hosted-key"}))
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _FakeResponse(503, {"detail": "upstream"}))
+    assert m.resolve_engine_key(42) == "self-hosted-key"
+
+
+def test_byok_and_kill_switch_lookups_keep_their_fail_open_defaults_while_the_bridge_is_down(monkeypatch):
+    """Only the credential gate retries; these two are consulted after it succeeded and keep the
+    behavior they always had on a hiccup (no BYOK key -> managed allowance; fixes stay enabled)."""
+    _bridge_configured_without_static_store(monkeypatch)
+    monkeypatch.setattr("httpx.get", lambda *a, **k: _FakeResponse(503, {"detail": "upstream"}))
+    assert m.resolve_provider_credentials(42) == (None, None)
+    assert m.resolve_fix_enabled(42) is True
 
 
 # ── the org's own BYOK provider key (Anthropic / OpenAI / Google) ────────────────────────────

{codna-0.2.28 → codna-0.2.30}/tests/test_webhook_queue.py

@@ -174,3 +174,49 @@ def test_non_retryable_failure_is_terminal_on_the_first_attempt(tmp_path):
     q.complete(row.row_id, status="failed", result={"summary": "cli_error"}, retry=False)
     assert q.claim() is None
     assert q.counts().get("failed") == 1
+
+
+def test_retry_after_holds_the_row_in_the_queue_until_due(tmp_path, monkeypatch):
+    """The account bridge gave no answer: the retry must not be re-claimed inside the same outage,
+    and the wait belongs to the QUEUE (a worker thread sleeping through it blocks the pool)."""
+    from datetime import datetime, timedelta, timezone
+
+    from codna import webhook_queue
+
+    q = _q(tmp_path)
+    assert q.enqueue(_job(kind="review"), delivery_id="d1")
+    first = q.claim()
+    q.complete(first.row_id, status="failed", result={"summary": "bridge unavailable"}, retry=True,
+               retry_after_s=60)
+    assert q.claim() is None                                   # held: not claimable yet
+    assert q.counts().get("retry") == 1
+    later = (datetime.now(timezone.utc) + timedelta(seconds=61)).isoformat()
+    monkeypatch.setattr(webhook_queue, "_utc_now", lambda: later)
+    second = q.claim()                                         # due: claimable again, attempt 2
+    assert second is not None and second.row_id == first.row_id and second.attempts == 2
+
+
+def test_retry_without_a_hold_is_claimable_immediately_and_clears_an_old_hold(tmp_path):
+    q = _q(tmp_path)
+    assert q.enqueue(_job(kind="fix"), delivery_id="d1")
+    first = q.claim()
+    q.complete(first.row_id, status="failed", retry=True)      # plain retry: no not_before
+    second = q.claim()
+    assert second is not None and second.attempts == 2
+
+
+def test_not_before_column_is_added_to_a_queue_db_that_predates_it(tmp_path):
+    """The Fly volume carries a queue.db created before this column existed."""
+    import sqlite3
+
+    path = tmp_path / "old.db"
+    conn = sqlite3.connect(path)
+    conn.executescript(
+        "CREATE TABLE jobs (id INTEGER PRIMARY KEY AUTOINCREMENT, delivery_id TEXT UNIQUE, kind TEXT NOT NULL,"
+        " repo TEXT NOT NULL, ref TEXT, installation_id INTEGER, issue_number INTEGER, reason TEXT,"
+        " status TEXT NOT NULL DEFAULT 'queued', attempts INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL,"
+        " claimed_at TEXT, finished_at TEXT, result TEXT);"
+    )
+    conn.close()
+    q = WebhookQueue(path)
+    assert q.enqueue(_job(), delivery_id="d1") and q.claim() is not None   # claim() reads not_before

{codna-0.2.28 → codna-0.2.30}/tests/test_webhook_worker.py

@@ -331,6 +331,49 @@ def test_issue_label_job_unlinked_prompt_comment_failure_is_not_silent():
     assert "failed to post" in result.summary
 
 
+# --- the account bridge gave NO answer (control plane mid-redeploy) --------------------------
+class _RecordingGitHub(_FakeGitHub):
+    def update_check_run(self, repo, token, check_run_id, *, conclusion, summary, name="codna"):
+        self.calls.append(("update_check", conclusion))
+        self.summaries = getattr(self, "summaries", []) + [summary]
+
+
+def _bridge_down(_iid):
+    from codna.webhook_metering import BridgeUnavailable
+    raise BridgeUnavailable("HTTP 503")
+
+
+def test_process_job_retries_instead_of_saying_not_linked_when_the_bridge_is_unavailable(monkeypatch):
+    """REGRESSION (2026-09-18 01:44Z): the control plane was redeploying, the credential lookup got
+    no answer, and a linked org's review was replaced by a neutral "link your account" check."""
+    from codna import webhook_metering
+
+    gh = _RecordingGitHub()
+    ran = []
+    result = process_job(_qjob(kind="review", attempts=1), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: ran.append(1) or JobResult(True, "ran"),
+                         resolve_engine_key=_bridge_down)
+    assert not result.ok and result.retryable
+    assert result.retry_after_s == webhook_metering.BRIDGE_RETRY_WAIT_S  # the QUEUE holds it, no sleep
+    assert "bridge unavailable" in result.summary
+    assert ran == []                                                   # nothing ran, nothing spent
+    assert not any(c[0] in ("create_check", "update_check") for c in gh.calls)  # no false prompt
+
+
+def test_process_job_last_attempt_with_the_bridge_down_posts_an_honest_neutral_check():
+    gh = _RecordingGitHub()
+    ran = []
+    result = process_job(_qjob(kind="review", attempts=3), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: ran.append(1) or JobResult(True, "ran"),
+                         resolve_engine_key=_bridge_down)
+    assert not result.ok and not result.retryable                      # terminal: no 4th attempt
+    assert ran == []
+    assert ("update_check", "neutral") in gh.calls
+    posted = gh.summaries[-1]
+    assert "could not reach its account service" in posted and "@codna review" in posted
+    assert "Link this GitHub install" not in posted                    # never the false link prompt
+
+
 # --- fix_enabled: convenience kill switch, fails OPEN (contrast with resolve_engine_key) ----
 def test_process_job_skips_when_fix_disabled_for_org():
     """An org that turned automatic fixes off gets the same non-silent treatment as "not
@@ -604,7 +647,7 @@ class _RecordingQueue:
     def __init__(self):
         self.completed = []
 
-    def complete(self, row_id, *, status, result=None, retry=True):
+    def complete(self, row_id, *, status, result=None, retry=True, retry_after_s=None):
         self.completed.append((row_id, status, result))
 
 
@@ -756,7 +799,7 @@ class _OneJobQueue:
         self.qjob = None
         return qjob
 
-    def complete(self, row_id, *, status, result=None, retry=True):
+    def complete(self, row_id, *, status, result=None, retry=True, retry_after_s=None):
         self.completed.append((row_id, status, result))
 
 
@@ -1062,7 +1105,7 @@ class _ManyJobQueue:
         return QueuedJob(row_id=row, delivery_id=f"d{row}", attempts=1,
                          job=WebhookJob("fix", "acme/app", ref=f"sha{row}", installation_id=42, reason="test"))
 
-    def complete(self, row_id, *, status, result=None, retry=True):
+    def complete(self, row_id, *, status, result=None, retry=True, retry_after_s=None):
         with self._lock:
             self.completed.append((row_id, status))
 
@@ -1313,7 +1356,7 @@ def test_run_claimed_passes_retryability_to_the_queue():
     seen = {}
 
     class _Q(_RecordingQueue):
-        def complete(self, row_id, *, status, result=None, retry=True):
+        def complete(self, row_id, *, status, result=None, retry=True, retry_after_s=None):
             seen["retry"] = retry
             super().complete(row_id, status=status, result=result, retry=retry)