code-coordinator 0.5.126__tar.gz → 0.5.128__tar.gz

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/CLAUDE.md

@@ -261,6 +261,7 @@ reviewer can stop reading here.
 - [`docs/GRAPHIFY_SETUP.md`](docs/GRAPHIFY_SETUP.md) — installing the knowledge graph on a new machine (four layers, all of which fail *silently*).
 - [`docs/EPHEMERAL_WORKERS.md`](docs/EPHEMERAL_WORKERS.md) — on-demand Azure worker VMs per epic. **The tailnet ACL is the security boundary** — `agent_app.py` has no authentication.
 - [`docs/MAC_MINI.md`](docs/MAC_MINI.md) — adding a Mac mini; sizing, provisioning, and what non-macOS work routes there. The port itself is [`docs/CROSS_PLATFORM.md`](docs/CROSS_PLATFORM.md) (milestone #39).
+- [`docs/WSL_WINDOWS_WORKER.md`](docs/WSL_WINDOWS_WORKER.md) — using a Tailscale-connected WSL2 box as the Windows worker for quadraui/vimcode's Win-GUI ports. Not the coord-itself Windows port.
 - [`docs/FORGE_MIGRATION.md`](docs/FORGE_MIGRATION.md) — surviving a forge outage (cheap) versus leaving a forge (expensive); milestone #58 / epic #1902.
 
 **Two deploy facts that bite most often:**

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.126
+Version: 0.5.128
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.126
+Version: 0.5.128
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/code_coordinator.egg-info/SOURCES.txt

@@ -389,6 +389,7 @@ docs/SECOND_BACKEND.md
 docs/STORE_SERVICE.md
 docs/TEST_FIRST_BUG_LANE.md
 docs/WEB_CONTROL_CENTER.md
+docs/WSL_WINDOWS_WORKER.md
 docs/mocks/web/README.md
 docs/mocks/web/_tokens.css
 docs/mocks/web/issue-detail.html
@@ -827,6 +828,7 @@ tui/src/app/audit.rs
 tui/src/app/chat.rs
 tui/src/app/data.rs
 tui/src/app/dialogs.rs
+tui/src/app/doc_tabs.rs
 tui/src/app/drive.rs
 tui/src/app/drive_queue.rs
 tui/src/app/escalation.rs

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/code_coordinator.egg-info/scm_file_list.json

@@ -367,6 +367,7 @@
     "docs/STORE_SERVICE.md",
     "docs/TEST_FIRST_BUG_LANE.md",
     "docs/WEB_CONTROL_CENTER.md",
+    "docs/WSL_WINDOWS_WORKER.md",
     "docs/mocks/web/README.md",
     "docs/mocks/web/_tokens.css",
     "docs/mocks/web/issue-detail.html",
@@ -803,6 +804,7 @@
     "tui/src/app/chat.rs",
     "tui/src/app/data.rs",
     "tui/src/app/dialogs.rs",
+    "tui/src/app/doc_tabs.rs",
     "tui/src/app/drive.rs",
     "tui/src/app/drive_queue.rs",
     "tui/src/app/escalation.rs",

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.126",
+  "tag": "0.5.128",
   "distance": 0,
-  "node": "gd69faff040adaad7a346ab65c483934e1eca4c66",
+  "node": "gdb3e5a50ffe1a0bb743d2cc2f791188761858441",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-17"

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/coord/commands/acceptance.py

@@ -420,6 +420,37 @@ def _acceptance_worktree_path(repo_name: str, issue_number: int) -> Path:
     return COORD_DIR / "acceptance-worktrees" / f"{repo_name}-{issue_number}"
 
 
+def _acceptance_worktree_lock_path(repo_name: str, issue_number: int) -> Path:
+    """The ``flock`` guarding :func:`_acceptance_worktree_path` (#2352).
+
+    That path is deliberately ONE per ``(repo, issue)``, reused across every
+    SHA/round for that issue (same incremental-build rationale as `coord
+    test`'s #561) — but nothing serialised *access* to it. Two concurrent
+    ``coord acceptance record`` calls for the same issue (an orphaned drive
+    process — #1660 — racing a fresh queue relaunch, or a by-hand re-run
+    overlapping an in-flight one) each did an unconditional ``git worktree
+    remove --force`` + ``add --force`` on the SAME directory: the second
+    invocation's remove ripped the tree out from under the first's
+    in-flight build/test, mid-compile. The corrupted build then printed
+    ordinary-looking compiler errors and exited non-zero having run zero
+    tests — indistinguishable from a genuinely red suite to
+    ``_scoped_verdict``, so it landed on the board as a real
+    ``acceptance_state=failed`` and burned a drive's fix-round budget on a
+    PR that was never actually broken.
+
+    A sibling ``.lock`` file next to the worktree directory itself (not one
+    global lock for the whole ``acceptance-worktrees/`` tree) so unrelated
+    ``(repo, issue)`` pairs never wait on each other.
+
+    Derived from :func:`_acceptance_worktree_path` (module-level lookup, so
+    a test monkeypatching that name — e.g. to redirect it under
+    ``tmp_path`` — redirects this lock alongside it) rather than
+    re-deriving ``COORD_DIR`` independently, which would silently drift the
+    two apart the moment either one's path scheme changes."""
+    wt_path = _acceptance_worktree_path(repo_name, issue_number)
+    return wt_path.with_name(wt_path.name + ".lock")
+
+
 def _remove_acceptance_worktree(repo_dir: Path, wt_path: Path) -> None:
     if not wt_path.exists():
         return
@@ -819,6 +850,7 @@ def _acceptance_record_local(
     config_path: Path,
     route_path: str | None = None,
 ) -> None:
+    from coord.filelock import FileLock  # noqa: PLC0415
     from coord.test_orchestrator import find_local_repo_path  # noqa: PLC0415
 
     cfg = _load_config(config_path)
@@ -835,119 +867,140 @@ def _acceptance_record_local(
         sys.exit(1)
 
     wt_path = _acceptance_worktree_path(repo, issue_number)
-    click.echo(
-        f"Fetching origin and preparing acceptance worktree at {sha!r} "
-        f"(base checkout {repo_dir} stays untouched)..."
-    )
-    try:
-        subprocess.run(
-            ["git", "fetch", "origin", "--prune"], cwd=str(repo_dir),
-            check=True, capture_output=True, text=True,
-        )
-    except subprocess.CalledProcessError as e:
-        click.echo(f"error: git fetch failed: {e.stderr.strip()}", err=True)
-        sys.exit(1)
 
-    _remove_acceptance_worktree(repo_dir, wt_path)
-    wt_path.parent.mkdir(parents=True, exist_ok=True)
-    res = subprocess.run(
-        ["git", "worktree", "add", "--force", "--detach", str(wt_path), sha],
-        cwd=str(repo_dir), capture_output=True, text=True,
-    )
-    if res.returncode != 0:
+    # #2352: everything from here down touches the ONE worktree this
+    # (repo, issue) reuses across every SHA/round — remove+add it, build in
+    # it, read its results. A second concurrent `coord acceptance record`
+    # for the same issue (an orphaned drive racing a fresh queue relaunch,
+    # or a by-hand re-run overlapping an in-flight one — see
+    # _acceptance_worktree_lock_path's docstring) must never interleave
+    # with this, or its `git worktree remove --force` clobbers whatever the
+    # first invocation is mid-build on. Blocking (not fail-fast) is
+    # deliberate: `flock` is released by the kernel even if the holder is
+    # killed, so there is no stale-lock deadlock risk to trade away, and
+    # blocking needs no change to `_decide_acceptance_gate`'s error
+    # handling — the second invocation just waits its turn and then records
+    # its own (correct) verdict, same as if it had been dispatched later.
+    with FileLock(_acceptance_worktree_lock_path(repo, issue_number)):
         click.echo(
-            f"error: could not create acceptance worktree at {sha!r}: "
-            f"{res.stderr.strip()}",
-            err=True,
+            f"Fetching origin and preparing acceptance worktree at {sha!r} "
+            f"(base checkout {repo_dir} stays untouched)..."
         )
-        sys.exit(1)
-
-    # #1125 review finding 2: resolve `{ms}` from the issue's manifest-mapped
-    # ms-NN dir (the worktree just checked out at `sha`) before running —
-    # same fail-soft-to-None rationale as `acceptance_run` above.
-    ms: str | None = None
-    try:
-        ms = ms_dir_for_issue(wt_path / ACCEPTANCE_DIRNAME, issue_number)
-    except Exception:  # noqa: BLE001
-        ms = None
+        try:
+            subprocess.run(
+                ["git", "fetch", "origin", "--prune"], cwd=str(repo_dir),
+                check=True, capture_output=True, text=True,
+            )
+        except subprocess.CalledProcessError as e:
+            click.echo(f"error: git fetch failed: {e.stderr.strip()}", err=True)
+            sys.exit(1)
 
-    try:
-        result = run_driver(
-            driver_cfg.kind, driver_cfg.run, cwd=str(wt_path), ms=ms,
-            setup_command=driver_cfg.setup,
-        )
-    except DriverError as e:
-        click.echo(f"error: {e}", err=True)
         _remove_acceptance_worktree(repo_dir, wt_path)
-        sys.exit(1)
-
-    # #944 review: _scoped_verdict exits(1) internally for a manifest that
-    # hasn't been authored yet / has no slice for this issue — a
-    # configuration error, not a real (kept-for-inspection) test failure, so
-    # the throwaway worktree must still be cleaned up on the way out.
-    try:
-        verdict = _scoped_verdict(
-            result.tests, wt_path / ACCEPTANCE_DIRNAME, issue_number,
-            entrypoint=driver_cfg.entrypoint,
+        wt_path.parent.mkdir(parents=True, exist_ok=True)
+        res = subprocess.run(
+            ["git", "worktree", "add", "--force", "--detach", str(wt_path), sha],
+            cwd=str(repo_dir), capture_output=True, text=True,
         )
-    except SystemExit:
-        _remove_acceptance_worktree(repo_dir, wt_path)
-        raise
+        if res.returncode != 0:
+            click.echo(
+                f"error: could not create acceptance worktree at {sha!r}: "
+                f"{res.stderr.strip()}",
+                err=True,
+            )
+            sys.exit(1)
 
-    from coord.board_service import read_board  # noqa: PLC0415
-    from coord.diagnose import stage_assignments  # noqa: PLC0415
+        # #1125 review finding 2: resolve `{ms}` from the issue's
+        # manifest-mapped ms-NN dir (the worktree just checked out at
+        # `sha`) before running — same fail-soft-to-None rationale as
+        # `acceptance_run` above.
+        ms: str | None = None
+        try:
+            ms = ms_dir_for_issue(wt_path / ACCEPTANCE_DIRNAME, issue_number)
+        except Exception:  # noqa: BLE001
+            ms = None
 
-    board = read_board()
-    work_rows = stage_assignments(board, repo, issue_number, "work")
-    if not work_rows:
-        click.echo(
-            f"error: no work assignment found for {repo} #{issue_number}; "
-            "cannot record verdict",
-            err=True,
-        )
-        # Same rationale: a lookup error, not a failing-verdict "kept for
-        # inspection" case — don't leak the worktree.
-        _remove_acceptance_worktree(repo_dir, wt_path)
-        sys.exit(1)
-    assignment_id = work_rows[0].assignment_id
-
-    from coord.state import record_acceptance_verdict  # noqa: PLC0415
-
-    acceptance_state = "passed" if verdict["green"] else "failed"
-    reason = failure_summary(verdict) or None
-    record_acceptance_verdict(
-        assignment_id=assignment_id,
-        acceptance_state=acceptance_state,
-        acceptance_reason=reason,
-        acceptance_sha=sha,
-        # #932: per-test counts so the Acceptance box can show partial
-        # progress ("3/7 acceptance green") instead of a bare verdict.
-        acceptance_total=verdict["total"],
-        acceptance_passed=verdict["passed"],
-    )
+        try:
+            result = run_driver(
+                driver_cfg.kind, driver_cfg.run, cwd=str(wt_path), ms=ms,
+                setup_command=driver_cfg.setup,
+            )
+        except DriverError as e:
+            click.echo(f"error: {e}", err=True)
+            _remove_acceptance_worktree(repo_dir, wt_path)
+            sys.exit(1)
 
-    click.echo(json.dumps(verdict, indent=2))
-    click.echo(f"\nAcceptance {acceptance_state.upper()} for {repo} #{issue_number} @ {sha}")
-
-    if acceptance_state == "passed":
-        # #2164 review: clearing expected_red here (before Test/Review/the
-        # actual merge to the default branch have happened) was the bug —
-        # it could reopen "red default branch" for reasons unrelated to
-        # whatever CI run next observed this issue's still-unmerged fix.
-        # The clear now happens in `coord.merge_queue.process`, right after
-        # this SHA's PR actually merges — see
-        # `coord.acceptance.clear_expected_red_via_pr`'s docstring. Nothing
-        # to do here beyond pointing the operator at how to check.
-        if ms is not None:
+        # #944 review: _scoped_verdict exits(1) internally for a manifest
+        # that hasn't been authored yet / has no slice for this issue — a
+        # configuration error, not a real (kept-for-inspection) test
+        # failure, so the throwaway worktree must still be cleaned up on
+        # the way out.
+        try:
+            verdict = _scoped_verdict(
+                result.tests, wt_path / ACCEPTANCE_DIRNAME, issue_number,
+                entrypoint=driver_cfg.entrypoint,
+            )
+        except SystemExit:
+            _remove_acceptance_worktree(repo_dir, wt_path)
+            raise
+
+        from coord.board_service import read_board  # noqa: PLC0415
+        from coord.diagnose import stage_assignments  # noqa: PLC0415
+
+        board = read_board()
+        work_rows = stage_assignments(board, repo, issue_number, "work")
+        if not work_rows:
             click.echo(
-                f"  note: any expected_red entries for #{issue_number} clear "
-                f"automatically once its fix merges — see `coord acceptance "
-                f"expected-red {repo}` to check current state."
+                f"error: no work assignment found for {repo} #{issue_number}; "
+                "cannot record verdict",
+                err=True,
             )
-        _remove_acceptance_worktree(repo_dir, wt_path)
-    else:
-        click.echo(f"  worktree kept for inspection: {wt_path}")
-        sys.exit(1)
+            # Same rationale: a lookup error, not a failing-verdict "kept
+            # for inspection" case — don't leak the worktree.
+            _remove_acceptance_worktree(repo_dir, wt_path)
+            sys.exit(1)
+        assignment_id = work_rows[0].assignment_id
+
+        from coord.state import record_acceptance_verdict  # noqa: PLC0415
+
+        acceptance_state = "passed" if verdict["green"] else "failed"
+        reason = failure_summary(verdict) or None
+        record_acceptance_verdict(
+            assignment_id=assignment_id,
+            acceptance_state=acceptance_state,
+            acceptance_reason=reason,
+            acceptance_sha=sha,
+            # #932: per-test counts so the Acceptance box can show partial
+            # progress ("3/7 acceptance green") instead of a bare verdict.
+            acceptance_total=verdict["total"],
+            acceptance_passed=verdict["passed"],
+        )
+
+        click.echo(json.dumps(verdict, indent=2))
+        click.echo(
+            f"\nAcceptance {acceptance_state.upper()} for {repo} #{issue_number} @ {sha}"
+        )
+
+        if acceptance_state == "passed":
+            # #2164 review: clearing expected_red here (before
+            # Test/Review/the actual merge to the default branch have
+            # happened) was the bug — it could reopen "red default branch"
+            # for reasons unrelated to whatever CI run next observed this
+            # issue's still-unmerged fix. The clear now happens in
+            # `coord.merge_queue.process`, right after this SHA's PR
+            # actually merges — see
+            # `coord.acceptance.clear_expected_red_via_pr`'s docstring.
+            # Nothing to do here beyond pointing the operator at how to
+            # check.
+            if ms is not None:
+                click.echo(
+                    f"  note: any expected_red entries for #{issue_number} clear "
+                    f"automatically once its fix merges — see `coord acceptance "
+                    f"expected-red {repo}` to check current state."
+                )
+            _remove_acceptance_worktree(repo_dir, wt_path)
+        else:
+            click.echo(f"  worktree kept for inspection: {wt_path}")
+            sys.exit(1)
 
 
 def _stall_push_wip_snapshot(cwd: Path) -> str:

code_coordinator-0.5.128/docs/WSL_WINDOWS_WORKER.md

@@ -0,0 +1,77 @@
+# A WSL2 box as the Windows worker — for quadraui/vimcode, not for coord
+
+> **Status:** proposal, not yet provisioned (2026-08-17). Captures a plan discussed for using an
+> existing Tailscale-connected Windows machine with WSL2 as the fleet's Windows build/test worker
+> for **quadraui's Win-GUI backend** (milestone #3, issues #19–31) and **vimcode's Win-GUI issues**
+> (#160, #162, #164, #165, #176) — not for porting code-coordinator itself to Windows. That's a
+> different, much larger effort scoped in [`CROSS_PLATFORM.md`](CROSS_PLATFORM.md) and explicitly
+> **out of scope here** — there is no interest in running `coord` natively on Windows.
+
+## The core idea
+
+`coord agent` runs **inside WSL2** as an ordinary Linux process — WSL2 is a real Linux VM with its
+own kernel, so none of `coord/agent.py`'s POSIX assumptions (tmux, `os.killpg`, `pty.fork`) need to
+change. As far as the coordinator is concerned this machine is just another Linux box, same shape
+as precision/elitebook/dellserver.
+
+The only thing that's different: when a worker needs to build/test something gated behind quadraui's
+`win` Cargo feature (real Direct2D/DirectWrite/Win32/COM), it shells out to the **Windows-native**
+toolchain instead of the Linux one. WSL2's interop lets a Linux process exec Windows `.exe`s
+directly (they're on `$PATH`), so this is just:
+
+```bash
+cargo.exe build --target x86_64-pc-windows-msvc --features win
+```
+
+run from a bash tool call inside the same WSL2 session — no separate machine, no RDP, no manual
+hand-off.
+
+> `CROSS_PLATFORM.md` rejected WSL2 for a different question — running the whole *coordinator*
+> Windows-native for one operator's own laptop. This is not that: it's one more fleet worker, and
+> its POSIX side is genuinely just Linux.
+
+## Setup checklist
+
+1. **Windows side:** rustup + MSVC Build Tools + Windows SDK (needed for `link.exe`/`rc.exe` —
+   Direct2D/DirectWrite/COM need the real toolchain, not a WSL2 cross-compile).
+2. **Checkout location:** clone `quadraui`/`vimcode` onto the Windows-native drive, e.g.
+   `C:\src\quadraui` (visible from WSL2 as `/mnt/c/src/quadraui`). `coord agent`'s git/Python ops
+   run fine against that path from the Linux side; `cargo.exe` gets native NTFS speed from the
+   Windows side — no `\\wsl$` cross-VM I/O penalty either direction.
+3. **Networking — Tailscale *inside* WSL2, not host port-forwarding.** Install the Tailscale Linux
+   client inside the WSL2 distro and `tailscale up` there. It gets its own tailnet IP on WSL2's own
+   network namespace; `coord agent` binds directly to it on `:7433`. This avoids `netsh interface
+   portproxy` + Windows Firewall rules entirely — Tailscale's interface isn't intercepted by the
+   Windows Firewall, and portproxy rules are fragile anyway (WSL2's internal IP changes across
+   restarts unless pinned). Check `ls /dev/net/tun` first; `sudo modprobe tun` if it's missing.
+4. **Keep it "online":** WSL2 shuts its VM down when idle. Enable systemd (`/etc/wsl.conf` →
+   `[boot] systemd=true`) and run `coord agent` as a systemd service, plus a Windows Task Scheduler
+   entry that launches the distro at logon/boot — otherwise the fleet will see this machine flicker
+   offline.
+5. **Register in `coordinator.yml`** with a new `win` capability (mirrors the existing `gtk`
+   build-capability pattern) once the box is actually reachable, and add a
+   `smoke_tests.capability_rules` entry routing `src/win/` → `requires: [win]`.
+
+## Ceiling — what this does and doesn't prove
+
+This gets real compile-truth plus headless testing via #24's offscreen `ID2D1Bitmap` surface (no
+visible window needed) — the same tier that let quadraui's macOS backend get built and merged
+without a Mac in the fleet, verified through CI instead. It does **not** get you interactive/visual
+smoke — real window behavior, DPI scaling, mouse feel — which still needs eyes on the actual Windows
+desktop (RDP or physical access). Same distinction the fleet already draws between `gtk` (build) and
+a hypothetical `gtk-display`; add a `win-display` capability later only if that's ever actually
+needed.
+
+## Payoff
+
+Unblocks quadraui's Win-GUI milestone (#19 bootstrap → #20 events → #21 text → #23/#24 services +
+headless surface → #25–30 rasterisers → #31 examples) and vimcode's already-filed, currently-stalled
+Win-GUI issues (#160, #162, #164, #165, #176) — the second set has been waiting on exactly this.
+
+## Related
+
+- [`CROSS_PLATFORM.md`](CROSS_PLATFORM.md) — the *coord-itself* Windows port (out of scope here);
+  its §9 already anticipates `os:windows`/`os:macos` capability routing.
+- [`MAC_MINI.md`](MAC_MINI.md) — the same "add a real-OS worker to the fleet" playbook, run for
+  macOS; useful as a structural template (provisioning order, capability staging, PATH gotchas)
+  even though the mechanics differ (no interop trick needed there — it's native macOS).

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/tests/test_cli_acceptance.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 import json
 import subprocess
+import threading
+import time
 from pathlib import Path
 from unittest.mock import patch
 
@@ -995,6 +997,115 @@ acceptance:
         wt_path = tmp_path / "acceptance-worktrees" / "coord-tui-944"
         assert not wt_path.exists(), "worktree leaked on manifest-missing error path"
 
+    def test_concurrent_record_calls_for_same_issue_are_serialized(
+        self, tmp_path: Path, coord_db, monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        """#2352 direct regression: two concurrent `coord acceptance record`
+        calls for the SAME (repo, issue) — e.g. an orphaned drive process
+        (#1660) racing a fresh queue relaunch, or a by-hand re-run
+        overlapping an in-flight one — must never interleave their
+        worktree-prep + driver run. Before the fix, `_acceptance_record_local`
+        did an unconditional `git worktree remove --force` + `add --force`
+        on the ONE path this (repo, issue) reuses across every SHA/round,
+        with no lock guarding it: a second invocation's remove could rip
+        the worktree out from under the first's in-flight build, producing
+        a corrupted build that looks exactly like a genuine red suite (a
+        false `acceptance_state=failed`) instead of raising anything
+        distinguishable.
+
+        This drives two threads through `_acceptance_record_local` for the
+        same repo/issue/sha concurrently, with `run_driver` slowed down and
+        instrumented, and asserts at most one thread is ever inside the
+        locked region (worktree-prep through verdict write) at a time.
+        """
+        import sqlite3
+
+        from coord import db, state
+        from coord.acceptance_drivers import DriverResult
+        from coord.commands.acceptance import _acceptance_record_local
+        from coord.db import _ensure_schema
+
+        # #2352 test-only wrinkle: the autouse `coord_db` fixture's
+        # in-memory connection is opened with sqlite3's default
+        # `check_same_thread=True`, which raises the instant a background
+        # thread touches it — unrelated to the race this test is actually
+        # driving at. Production's real singleton (`coord.db._open`)
+        # already opens with `check_same_thread=False` (the coordinator
+        # legitimately writes from more than one thread), so swapping in a
+        # thread-safe in-memory connection here just matches production
+        # instead of tripping over a fixture-only restriction. Use `conn`
+        # (not the `coord_db` fixture argument, which still points at the
+        # now-orphaned original connection) for any DB reads below.
+        conn = sqlite3.connect(":memory:", check_same_thread=False)
+        conn.row_factory = sqlite3.Row
+        _ensure_schema(conn)
+        db.override_connection(conn)
+
+        repo_dir = tmp_path / "repo"
+        sha = _init_git_repo(repo_dir, manifest={"ms01::a": 944})
+        config_path = _write_config(
+            tmp_path, repo_path=str(repo_dir), run_cmd="echo unused",
+        )
+
+        state.record_dispatched(
+            assignment_id="aid-race",
+            proposal=Proposal(
+                id=1, machine_name="laptop", repo_name="coord-tui",
+                issue_number=944, issue_title="oracle loop runner", rationale="",
+            ),
+            repo_github="acme/coord-tui",
+        )
+
+        state_lock = threading.Lock()
+        active = 0
+        max_active = 0
+
+        def _slow_driver(kind, run_command, cwd, ms=None, setup_command=None):
+            nonlocal active, max_active
+            with state_lock:
+                active += 1
+                max_active = max(max_active, active)
+            try:
+                # Wide enough that, without the #2352 lock, the second
+                # thread's (fast) git worktree remove/add would complete
+                # and reach this same function while the first thread is
+                # still "mid-build" here — reproducing the race window
+                # that corrupted the real cargo build in the incident.
+                time.sleep(0.3)
+                return DriverResult(
+                    exit_code=0, tests=[{"id": "ms01::a", "status": "pass"}],
+                )
+            finally:
+                with state_lock:
+                    active -= 1
+
+        monkeypatch.setattr("coord.commands.acceptance.run_driver", _slow_driver)
+
+        errors: list[BaseException] = []
+
+        def _run() -> None:
+            try:
+                _acceptance_record_local("coord-tui", 944, sha, config_path)
+            except BaseException as e:  # noqa: BLE001 - captured for assertion
+                errors.append(e)
+
+        threads = [threading.Thread(target=_run) for _ in range(2)]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join(timeout=30)
+
+        assert not any(t.is_alive() for t in threads), "record call hung"
+        assert not errors, f"_acceptance_record_local raised: {errors!r}"
+        assert max_active == 1, (
+            "both threads ran the driver concurrently — the #2352 lock did "
+            "not serialize concurrent `coord acceptance record` calls for "
+            "the same (repo, issue)"
+        )
+
+        row = _acceptance_row(conn, "aid-race")
+        assert row["acceptance_state"] == "passed"
+
 
 def _init_git_repo_with_expected_red(
     path: Path, *, tests: dict[str, int], expected_red: dict[int, list[str]],

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/tui/Cargo.lock

@@ -1846,7 +1846,7 @@ checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 [[package]]
 name = "quadraui"
 version = "0.0.1"
-source = "git+https://github.com/JDonaghy/quadraui?rev=d70da7dff7ef9f1eb578ee48aca69297e548348e#d70da7dff7ef9f1eb578ee48aca69297e548348e"
+source = "git+https://github.com/JDonaghy/quadraui?rev=d6ae247c007721284dc895d4fbf42b5f4a5ba47f#d6ae247c007721284dc895d4fbf42b5f4a5ba47f"
 dependencies = [
  "arboard",
  "gtk4",

{code_coordinator-0.5.126 → code_coordinator-0.5.128}/tui/Cargo.toml

@@ -54,7 +54,7 @@ test-support = []
 # quadraui checkout during co-development (a one-line, opt-in
 # `.cargo/config.toml` `paths` override — see
 # `tui/cargo-config-local-quadraui.toml.example`).
-quadraui = { git = "https://github.com/JDonaghy/quadraui", rev = "d70da7dff7ef9f1eb578ee48aca69297e548348e", features = ["tui", "terminal"] }
+quadraui = { git = "https://github.com/JDonaghy/quadraui", rev = "d6ae247c007721284dc895d4fbf42b5f4a5ba47f", features = ["tui", "terminal"] }
 rusqlite = { version = "0.32", features = ["bundled"] }
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }