code-coordinator 0.5.147__tar.gz → 0.5.150__tar.gz

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.147
+Version: 0.5.150
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT
@@ -506,6 +506,8 @@ after publication.
   overnight drives.
 - [`docs/PHONE_WEBAPP.md`](docs/PHONE_WEBAPP.md) — build and serve the phone control-center PWA
   over Tailscale.
+- [`docs/ADR_COORD_WEB_DIST.md`](docs/ADR_COORD_WEB_DIST.md) — how a built `coord-web` bundle
+  reaches the daemon host, and the alternatives rejected.
 - [`docs/AGENT_OPERATIONS.md`](docs/AGENT_OPERATIONS.md) — agent install, upgrade, and
   releasing to PyPI.
 - [`docs/OPERATING_GOTCHAS.md`](docs/OPERATING_GOTCHAS.md) — traps that cost a real dispatch or

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/README.md

@@ -466,6 +466,8 @@ after publication.
   overnight drives.
 - [`docs/PHONE_WEBAPP.md`](docs/PHONE_WEBAPP.md) — build and serve the phone control-center PWA
   over Tailscale.
+- [`docs/ADR_COORD_WEB_DIST.md`](docs/ADR_COORD_WEB_DIST.md) — how a built `coord-web` bundle
+  reaches the daemon host, and the alternatives rejected.
 - [`docs/AGENT_OPERATIONS.md`](docs/AGENT_OPERATIONS.md) — agent install, upgrade, and
   releasing to PyPI.
 - [`docs/OPERATING_GOTCHAS.md`](docs/OPERATING_GOTCHAS.md) — traps that cost a real dispatch or

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.147
+Version: 0.5.150
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT
@@ -506,6 +506,8 @@ after publication.
   overnight drives.
 - [`docs/PHONE_WEBAPP.md`](docs/PHONE_WEBAPP.md) — build and serve the phone control-center PWA
   over Tailscale.
+- [`docs/ADR_COORD_WEB_DIST.md`](docs/ADR_COORD_WEB_DIST.md) — how a built `coord-web` bundle
+  reaches the daemon host, and the alternatives rejected.
 - [`docs/AGENT_OPERATIONS.md`](docs/AGENT_OPERATIONS.md) — agent install, upgrade, and
   releasing to PyPI.
 - [`docs/OPERATING_GOTCHAS.md`](docs/OPERATING_GOTCHAS.md) — traps that cost a real dispatch or

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/code_coordinator.egg-info/SOURCES.txt

@@ -365,6 +365,7 @@ deploy/coord-web-dist-build.timer
 deploy/coord-web-rollback.sh
 deploy/coord-web.service
 deploy/node-shim.sh
+docs/ADR_COORD_WEB_DIST.md
 docs/AGENT_OPERATIONS.md
 docs/ARCHITECTURE.md
 docs/ARCH_SECURITY_GATES.md
@@ -795,6 +796,7 @@ tests/acceptance/ms-65/board_tabs_2282.rs
 tests/acceptance/ms-65/board_tabs_close_2283.rs
 tests/acceptance/ms-65/contract.md
 tests/acceptance/ms-65/manifest.yml
+tests/acceptance/ms-65/pipeline_tabs_2284.rs
 tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
 tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
 tests/acceptance/ms-65/mocks/board-preview-tab.screen

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/code_coordinator.egg-info/scm_file_list.json

@@ -343,6 +343,7 @@
     "deploy/coord-web-rollback.sh",
     "deploy/coord-web.service",
     "deploy/node-shim.sh",
+    "docs/ADR_COORD_WEB_DIST.md",
     "docs/AGENT_OPERATIONS.md",
     "docs/ARCHITECTURE.md",
     "docs/ARCH_SECURITY_GATES.md",
@@ -444,6 +445,7 @@
     "tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen",
     "tests/acceptance/ms-65/mocks/board-tabs-overflow.screen",
     "tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
+    "tests/acceptance/ms-65/pipeline_tabs_2284.rs",
     "tests/acceptance/ms-example/mocks/home-active.html",
     "tests/conftest.py",
     "tests/fixtures/board-pipeline-basic.json",

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.147",
+  "tag": "0.5.150",
   "distance": 0,
-  "node": "gbf9c09b2b36fbbb594b25c03bc8ef7844050cd84",
+  "node": "gc5a2f06d7b06f02a99cd61319d19c371a1a49f96",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-18"

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/coord/commands/lifecycle.py

@@ -404,7 +404,7 @@ def web(
     # #1237: function-local + guarded — see _start_agent_server for why.
     with server_extra_guard("web"):
         import uvicorn
-        from coord.dashboard.server import build_app
+        from coord.dashboard.server import build_app, dist_has_bundle
         from coord.dashboard.terminal import resolve_web_token
 
     fixture = None
@@ -438,7 +438,26 @@ def web(
     app = build_app(cfg, token=token, fixture=fixture, dist_path=dist_path)
     click.echo(f"coord web: dashboard at http://{bind_host}:{bind_port}")
     if dist_path is not None:
-        click.echo(f"  serving webapp bundle from {dist_path} (#1543)")
+        # #2003: this used to unconditionally claim "serving webapp bundle
+        # from {dist_path}" even when that path was missing or empty — the
+        # server itself silently falls back to the legacy single-file
+        # dashboard in that case (build_app / index()), so the operator saw
+        # a success message for what was actually a silent regression to the
+        # legacy UI. Share the exact predicate build_app's index() route uses
+        # (dist_has_bundle) so this message can never drift from what
+        # actually gets served (#2096: two surfaces answering the same
+        # question must call the same function).
+        if dist_has_bundle(dist_path):
+            click.echo(f"  serving webapp bundle from {dist_path} (#1543)")
+        else:
+            click.echo(
+                f"  warning: --dist {dist_path} has no index.html (missing "
+                "or empty directory) — falling back to the legacy "
+                "single-file dashboard, NOT the bundle you pointed at. "
+                "Check the path / the build hook that populates it "
+                "(#2003).",
+                err=True,
+            )
     if fixture is not None:
         click.echo(
             f"  fixture mode: seeded board from {fixture_path} — reads are "

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/coord/dashboard/server.py

@@ -46,6 +46,22 @@ DASHBOARD_DIR = Path(__file__).parent
 # that existing behaviour (and the test suite) is completely unaffected.
 WEBAPP_DIST = DASHBOARD_DIR / "webapp" / "dist"
 
+
+def dist_has_bundle(dist_path: Path) -> bool:
+    """Does ``dist_path`` contain a servable built webapp bundle?
+
+    This is the single definition of "valid bundle" for the dashboard: the
+    ``index()`` route below uses it to decide whether to serve the built
+    React app or fall back to the legacy single-file dashboard, and
+    ``coord web``'s CLI (coord/commands/lifecycle.py) uses it to decide
+    whether to print a success or warning message. Both call sites MUST
+    share this function rather than re-deriving the check, so the CLI's
+    message can never drift from what the server actually serves (#2003,
+    epic #2096).
+    """
+    return (dist_path / "index.html").exists()
+
+
 # How often (seconds) the background poller queries agent servers.
 _POLL_INTERVAL = 30.0
 # How long (seconds) an assignment must be running with no agent record before
@@ -698,7 +714,7 @@ def build_app(
         # Serve the built React webapp when available; fall back to the legacy
         # single-file dashboard so existing behaviour is entirely unchanged.
         spa_index = webapp_dist / "index.html"
-        html = spa_index.read_text() if spa_index.exists() else (DASHBOARD_DIR / "index.html").read_text()
+        html = spa_index.read_text() if dist_has_bundle(webapp_dist) else (DASHBOARD_DIR / "index.html").read_text()
         return HTMLResponse(html)
 
     async def api_board(request: Request) -> JSONResponse:

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/coord/merge_queue.py

@@ -3984,6 +3984,17 @@ class PlannedMerge:
     # when no PR is open yet, or `ci_store` has no checks for this PR.
     pr_number: int | None = None
     ci_summary: "CiCheckSummary | None" = None
+    # #2397: mirrors `config.merge.auto_drain` (default False) at plan-build
+    # time — read-only exposure, no gate-logic change. The TUI's per-issue
+    # Merge stage box needs this to tell "nothing retries until a human runs
+    # `coord merge`" (auto_drain off) apart from "an automatic retry tick is
+    # already handling this" (auto_drain on); today it has no way to know
+    # and the box renders identically either way (issue #2397's incident:
+    # `#2284`'s acceptance-authoring slice sat "pending — waiting 2:22" with
+    # no signal that `merge.auto_drain: false` meant nothing was coming on
+    # its own). Same value on every entry in one `plan()` call — it's a
+    # single process-wide config flag, not per-entry state.
+    auto_drain: bool = False
 
 
 def _load_milestones_for_queue(
@@ -4058,6 +4069,10 @@ def plan(
     """
     items = load_queue()
     milestones = _load_milestones_for_queue(items)
+    # #2397: read once, stamped on every entry below — see `PlannedMerge
+    # .auto_drain`'s doc comment for why the TUI needs this alongside
+    # `reason`.
+    auto_drain = bool(getattr(getattr(config, "merge", None), "auto_drain", False))
 
     # ── Group by (repo_github, target_branch) ──────────────────────────────
     group_order: list[tuple[str, str]] = []
@@ -4133,6 +4148,7 @@ def plan(
                 enqueued_at=entry.enqueued_at,
                 last_attempt=entry.last_attempt,
                 milestone=milestones.get((entry.repo_name, entry.issue_number)),
+                auto_drain=auto_drain,
             ))
 
     return result

code_coordinator-0.5.150/docs/ADR_COORD_WEB_DIST.md

@@ -0,0 +1,158 @@
+# ADR: How a built `coord-web` bundle reaches the daemon host
+
+**Status:** Accepted
+**Date:** 2026-08-18
+**Issue:** #2004 (UX-2, Phase 1 of milestone #62, epic #2002). Blocks UX-4
+("CI must know what it publishes") and UX-7.
+
+## Context
+
+`coord/dashboard/webapp/**` is moving out of this repo into its own
+`coord-web` repo. Today, before that split, the same question already has a
+shipped answer: **[`docs/PHONE_WEBAPP.md`](PHONE_WEBAPP.md), "Going live
+automatically (#1543)."** `deploy/coord-web-dist-build.timer` fires every 10
+minutes (retuned from 1 minute by #2122; see that unit's header), fetches
+`origin/main` read-only, builds it in a dedicated worktree
+(`~/.coord-web-checkout`), health-checks the result on a scratch port before
+ever publishing it (#1560), and atomically repoints `~/coord-web-dist` —
+which `coord web --dist` serves — at the new release. A one-command rollback
+(`coord-web-rollback.sh`) with a rollback-sentinel anti-flap guard exists for
+the class of bug the health check can't see. `coord release verify` already
+has a lane for it: `webapp_bundle` (#1834 lane 5), which grades the live
+bundle's staleness against the `coord/dashboard/webapp/` source tree it
+claims to be built from — deliberately *not* against `--expected`/PyPI,
+because the bundle is versioned by `origin/main`'s SHA on its own continuous
+publish timer, decoupled on purpose from the `~/.coord-venv` release
+cadence. `webapp_build_heartbeat` (#2122) catches the timer going silently
+dead, independent of whether there's unbuilt source to expose it.
+
+The question #2004 poses is really: **once the thing that timer builds lives
+in a different repo, does any of this change in kind, or only in which
+repo(s) it points at?**
+
+## Decision
+
+**Extend the existing mechanism to track `coord-web`'s `main`, instead of
+`coord/dashboard/webapp/` inside this repo.** This is Option 1 from the
+issue, and it is not a new lane so much as a redirection of a lane this
+fleet already built, hardened, and has a release-verify check for.
+
+Concretely, once the split lands:
+
+- `coord-web-dist-build.sh`'s `BASE_CHECKOUT`/`WEBAPP_CHECKOUT` point at a
+  dedicated clone of `coord-web` (never the operator's own checkout, same
+  rule #1543 already enforces) instead of a worktree of this repo.
+- The build step becomes `npm ci && npm run build` at `coord-web`'s repo
+  root instead of `coord/dashboard/webapp/`.
+- The health-check-before-cutover, atomic symlink publish, rollback script,
+  and rollback-sentinel guard carry over **unchanged** — none of that logic
+  is specific to which repo it's building.
+- `coord.health.checks.deploy_lane_facts.resolve_webapp_source_dir` (which
+  scans `ctx.checkouts` for a directory that looks like the webapp source)
+  gets pointed at a `coord-web` checkout's layout instead of
+  `<checkout>/coord/dashboard/webapp/src`. The `webapp_bundle` check's
+  *shape* — dist mtime vs. source mtime, WARN on staleness, never a version
+  comparison — does not change; only the path it looks under does.
+- The PyPI-wheel-bundled fallback path (`coord/dashboard/webapp/dist`
+  vendored into `claude-coordinator`'s own release, #758) stays, unchanged
+  in role: it is the answer for `pip install code-coordinator` on a machine
+  with no `--dist` configured (fresh installs, CI, one-off dev boxes), not
+  the primary path to a running daemon host. This is Option 4, kept
+  deliberately as the fallback it already is today rather than promoted to
+  primary — see "Rejected alternatives" below for why it can't be primary
+  post-split.
+
+## Rejected alternatives
+
+**Option 2 — GitHub release artifact (tarball per `coord-web` release).**
+Versioned and auditable, but it reintroduces exactly the coupling #1543 was
+built to remove: a webapp fix would sit merged-but-not-live until someone
+cuts a release, and nothing today gives that step the ~10-minute, unattended
+cadence the timer already provides. It would also need the health-check
+gate and rollback machinery rebuilt around a fetch/verify/unpack step
+instead of a `git fetch` + worktree build — real new surface for no
+capability the current mechanism lacks. Revisit if `coord-web` ever needs a
+public, pinned distribution channel independent of the daemon host (it
+doesn't today).
+
+**Option 3 — npm package.** Same coupling-to-publish-cadence problem as
+Option 2, plus it adds a registry-auth and install-on-host step to a
+deploy path that currently needs neither. No requirement in this issue
+calls for the bundle to be consumable outside this fleet's own daemon host,
+which is the only scenario where an npm package would earn its cost back.
+
+**Option 4 — vendored at `claude-coordinator` release time, promoted to
+primary.** Rejected as the *primary* path because it re-couples the two
+repos' release cadences — the coupling the split (epic #2002) exists to
+remove. A `coord/dashboard/webapp/**` merge would go live only on
+`claude-coordinator`'s next PyPI release, not within ~10 minutes of merging.
+Kept as the fallback, because that's a real, already-solved problem
+(bootstrapping a `--dist`-less host, or a fresh install) distinct from
+"how does a live daemon host stay current," and downgrading it doesn't cost
+anything the fleet needs today.
+
+**Why Option 1 is not "a fifth silent lane."** The issue's core objection —
+this fleet already has four deploy lanes that go stale with no signal
+(agent venv, `coord-serve`, local `cargo build`, `~/.coord-cli-venv`) — is
+real, but those four go stale because going live requires an *operator* to
+re-run an install step (`pip install --upgrade`, `cargo build`) and nothing
+polls to catch it if they don't. The webapp-dist lane is structurally
+different: it already has (a) an autonomous timer instead of an
+operator-triggered pull, (b) a pre-cutover health check that refuses to
+publish a broken build in the first place, (c) a heartbeat file
+`coord health`/`coord release verify` already read to distinguish "up to
+date" from "the trigger died silently," and (d) a release-verify lane
+(`webapp_bundle`) already wired into the fleet health surface. Extending it
+to a second repo carries all four properties across unchanged — it doesn't
+have to invent them the way a from-scratch Option 2/3 pipeline would.
+
+## Staleness across the split is a different question than staleness today
+
+Pre-split, `coord-web-dist-build.timer` and `~/.coord-venv` build off the
+*same* repo, so "is the live bundle SHA an ancestor of what the daemon was
+built from" is at least answerable in principle. Post-split, `coord-serve`
+(from `claude-coordinator`, versioned by PyPI release) and the webapp bundle
+(from `coord-web`, versioned by its own `main` SHA) are two independently
+released artifacts with **no shared version number** — and per the
+`webapp_bundle` design already in `release_verify.py`, that's intentional:
+grading the bundle against `--expected`/PyPI would "manufacture permanent,
+meaningless skew rather than report a real one." That reasoning holds even
+harder once the source repos are different.
+
+What that does *not* cover, and what genuinely is new here: a phone hitting
+`http://dellserver:7434` can land on a `coord-web` bundle that expects an
+API shape `coord-serve` hasn't shipped yet (or vice versa), because nothing
+before this ADR pins a compatibility floor between the two repos'
+independent cadences. This is a real risk the split introduces — it isn't
+solved by choosing Option 1 over 2/3/4, and it isn't this ADR's job to
+solve, but it should be named so UX-4/UX-7 pick it up rather than
+rediscover it: the daemon already reports its own version
+(`coord/dashboard/server.py`'s `version=__version__`); the cheapest fix is
+likely a minimum-compatible-API marker the webapp checks against that value
+at load and degrades visibly (banner, not a silent break) on mismatch,
+rather than trying to keep the two repos' releases in lockstep.
+
+Propagation lag itself (a phone briefly on a bundle one merge behind the
+daemon, or vice versa) is not new and not a defect — it's the same ~10-minute
+window the timer already runs at for the single-repo case (retuned from the
+original 1-minute cadence #1543 documents; see #2122 and
+`deploy/coord-web-dist-build.timer`'s header for why). It stays detectable
+the same way: the release directory is named after the
+`coord-web` SHA it was built from, and `webapp_build_heartbeat` proves the
+timer is still alive.
+
+## Consequences
+
+- `coord release verify`'s `webapp_bundle` lane keeps working post-split
+  with a path/repo-target change, not a redesign — satisfying this issue's
+  "whichever option wins should be assertable by it" requirement at close
+  to zero incremental cost.
+- The daemon host needs a second dedicated checkout (`coord-web`, alongside
+  whatever `claude-coordinator` checkout it already keeps for other lanes)
+  and a second instance of the build-timer/rollback pairing pointed at it.
+  That's real setup work, tracked under UX-4/UX-7, not a design question.
+- A `coord-web`↔`coord-serve` compatibility floor is an explicitly named
+  open follow-up, not solved here.
+- Options 2 and 3 remain available to revisit if `coord-web` ever needs a
+  distribution channel independent of this fleet's own daemon host — no
+  requirement in scope today calls for that.

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/docs/PHONE_WEBAPP.md

@@ -126,6 +126,12 @@ cd coord/dashboard/webapp && npm run build
 
 ---
 
+> **Repo split (#2004):** `coord/dashboard/webapp/**` is moving to its own
+> `coord-web` repo (epic #2002). The mechanism below is the answer for how a
+> built bundle reaches this daemon host both before and after that move —
+> see [`docs/ADR_COORD_WEB_DIST.md`](ADR_COORD_WEB_DIST.md) for the decision
+> and the rejected alternatives.
+
 ## Going live automatically (#1543): merged main, not release cadence
 
 **On dellserver in production, a merged `coord/dashboard/webapp/**` change

{code_coordinator-0.5.147 → code_coordinator-0.5.150}/tests/acceptance/ms-65/manifest.yml

@@ -86,6 +86,35 @@ tests:
   # zero-tab state. THIS IS THE GREEN CONTROL — see `expected_red` below.
   board_tabs_close_2283::zero_tabs_render_no_close_or_overflow_glyphs: 2283
 
+  # ── #2284 (W-3) — Pipeline's own independent tab set (contract §3) ────────
+  # Slice: pipeline_tabs_2284.rs · mocks: pipeline-tabs-independent.screen
+  # (plus board-pinned-3-tabs.screen — §3b calls the two "the independence
+  # pair")
+  #
+  # §3a — zero Pipeline tabs render no strip on Pipeline. THIS IS THE GREEN
+  # CONTROL — see the `expected_red` block below.
+  pipeline_tabs_2284::pipeline_with_zero_doc_tabs_renders_no_tab_strip: 2284
+  # §3a — Pipeline has no toolbar, so its strip is the FIRST main-panel content
+  # row, immediately above the Overview/Issue/Log/Summary/Terminal sub-tab bar
+  # (with §3a's own stated contrast: on Board the toolbar precedes the strip)
+  pipeline_tabs_2284::pipeline_doc_tab_strip_is_the_first_main_panel_row_with_no_toolbar_above_it: 2284
+  # §3b bullet 1 — switching to Pipeline shows Pipeline's (empty) set, not the
+  # Board's three tabs, and does not lose them. THIS IS A GREEN RATCHET — see
+  # the `expected_red` block below.
+  pipeline_tabs_2284::switching_to_pipeline_hides_the_boards_tabs_without_losing_them: 2284
+  # §3b + #2284 AC 1 — two Pipeline tabs with three already open on the Board
+  # shows EXACTLY two on Pipeline, and no Board document leaks into the strip
+  pipeline_tabs_2284::pipeline_opens_its_own_two_tabs_while_the_board_keeps_three: 2284
+  # §3b bullet 2 + AC 2 — the milestone's headline round trip: Board →
+  # Pipeline → Board restores the same three tabs, same order, same active tab
+  pipeline_tabs_2284::board_pipeline_board_round_trip_restores_the_boards_tabs_order_and_active_tab: 2284
+  # §3b + AC 3 — each scope owns its own preview slot: a single click in
+  # Pipeline leaves the Board's `∘ ` preview tab exactly where it was
+  pipeline_tabs_2284::each_scope_owns_its_own_preview_slot: 2284
+  # §3b + AC 4 — reveal-on-activate is per scope: activating a Pipeline tab
+  # selects its row in the PIPELINE sidebar and leaves the Board's selection
+  pipeline_tabs_2284::activating_a_pipeline_tab_reveals_its_row_in_the_pipeline_sidebar_not_the_boards: 2284
+
 # ── expected_red (#2164) ───────────────────────────────────────────────────
 # Hand-derived from a REAL run of the sealed suite against origin/main at the
 # time of authoring (`cd tui && cargo test --test acceptance --features
@@ -140,6 +169,34 @@ expected_red:
     - board_tabs_close_2283::activating_a_scrolled_out_tab_scrolls_it_back_into_view_and_renders_the_right_affordance
     - board_tabs_close_2283::closing_the_last_tab_restores_the_zero_tab_baseline
 
+  # #2284 — OBSERVED, not intended. Taken from three consecutive real runs of
+  # the sealed suite (`cd tui && RUSTC_BOOTSTRAP=1 cargo test --test acceptance
+  # --features test-support -- -Z unstable-options --format json`, the driver
+  # command in coordinator.yml) at authoring time: of this slice's 7 ids, the
+  # same 5 FAILED and the same 2 passed on every run. The 2 that passed are
+  # deliberately ABSENT below:
+  #
+  #   * `pipeline_with_zero_doc_tabs_renders_no_tab_strip` — the CONTROL.
+  #     Green today (no panel paints a strip with nothing open) and must stay
+  #     green after #2284 lands: an implementation that reserves the Pipeline
+  #     strip row unconditionally, or that renders the Board's tabs on
+  #     Pipeline, breaks exactly this test. Listing it would make its
+  #     inevitable pass a HARD FAILURE.
+  #   * `switching_to_pipeline_hides_the_boards_tabs_without_losing_them` — a
+  #     RATCHET. Green today for the degenerate reason that the single global
+  #     set #2282 shipped renders only on the Board, so nothing leaks onto
+  #     Pipeline and nothing is lost coming back. Both halves become real
+  #     constraints the moment the set is keyed by scope: a per-scope map that
+  #     rebuilds (rather than preserves) the outgoing scope's entry fails the
+  #     return leg, and a strip that paints the focused scope's tabs on the
+  #     wrong panel fails the outbound one.
+  2284:
+    - pipeline_tabs_2284::pipeline_doc_tab_strip_is_the_first_main_panel_row_with_no_toolbar_above_it
+    - pipeline_tabs_2284::pipeline_opens_its_own_two_tabs_while_the_board_keeps_three
+    - pipeline_tabs_2284::board_pipeline_board_round_trip_restores_the_boards_tabs_order_and_active_tab
+    - pipeline_tabs_2284::each_scope_owns_its_own_preview_slot
+    - pipeline_tabs_2284::activating_a_pipeline_tab_reveals_its_row_in_the_pipeline_sidebar_not_the_boards
+
 # ═══════════════════════════════════════════════════════════════════════════
 # FOR THE COORDINATOR — three findings from authoring this slice. None of them
 # is a worker's to fix, and none was resolved by editing the contract (a
@@ -255,3 +312,73 @@ expected_red:
 # (quadraui#593) have also landed (`style_at`/`styled_row`), but §1's ruling
 # stands: the `∘ ` marker remains the pinned preview signal, and this slice
 # asserts no styles.
+
+# ═══════════════════════════════════════════════════════════════════════════
+# FOR THE COORDINATOR — findings from authoring the #2284 slice (contract §3).
+# Independent of the #2282 / #2283 notes above; again, none is a worker's to
+# fix by editing this suite, and none was resolved by editing the contract.
+# ═══════════════════════════════════════════════════════════════════════════
+#
+# 7. LIVE HARNESS BLOCKER (flaky, machine-dependent, and it will bite #2284's
+#    worker on the very first run): **entering the Pipeline panel destroys the
+#    seeded fixture in the sealed suite.** Switching panels runs
+#    `sync_active_view_from_shell` -> `maybe_kick_pipeline_loader` ->
+#    `refresh()` -> `start_data_load()` (`tui/src/app/data.rs:2620`). That
+#    function short-circuits to `BoardData::default()` — so
+#    `apply_pending_data`'s #620 degraded-tick guard keeps the seeded board —
+#    but the short-circuit is gated `#[cfg(test)]` ONLY. `tui/tests/acceptance.rs`
+#    is a separate integration-test crate, so the `coord_tui` it links is built
+#    WITHOUT `cfg(test)`; the loader therefore reads the real local
+#    `~/.coord/coord.db`, and the next dispatched event (`dispatch_handle`
+#    drains the receiver before handling anything) wholesale-replaces
+#    `self.data`. Measured on this machine: two clicks after landing on
+#    Pipeline, the Board sidebar renders the developer's real `api (1)` repo
+#    and the Pipeline tree is empty ("Loading tracked issues…").
+#
+#    It is a RACE, not a certainty — the load runs on a spawned thread, so
+#    whether the fixture survives depends on whether that thread finished
+#    before the next event. Across three authoring runs, 3 of the 5 red ids
+#    died at the harness precondition and 2 got far enough to fail on the real
+#    §3a clause; which is which varied run to run. Every affected assertion
+#    says `HARNESS PRECONDITION (NOT a #2284 defect …)` in its panic message so
+#    the two failure modes are distinguishable from a JSON report alone.
+#
+#    The fix is one line of app code, and this repo has already made it once
+#    for the same reason: `resolve_board_service()`
+#    (`tui/src/app/data.rs:1950`) is gated
+#    `#[cfg(any(test, feature = "test-support"))]` with a comment citing #1039
+#    and naming this exact external-crate `cfg(test)` trap.
+#    `start_data_load()`'s stub needs the same widening. It is NOT in #2284's
+#    "Files" list, so the coordinator should either land it as a prerequisite
+#    or explicitly authorise the worker to widen that cfg — without it the five
+#    red ids below cannot go green reliably no matter how correct the
+#    per-scope tab model is.
+#
+# 8. §3b's "same scroll position as before the switch" is not asserted. The
+#    round-trip test opens three tabs in an 82-column strip, where nothing is
+#    scrolled, and the contract pins no rendered signal for a *restored* strip
+#    scroll offset beyond §4's `‹`/`›` affordances — which are #2283's slice
+#    and whose own mock the #2283 author already flagged (finding 4) as
+#    contradicting §2b's label width. Inventing an observable for it would
+#    have meant inventing a width. Flagged as a `TODO(test-author)` in the
+#    slice.
+#
+# 9. §2f's scroll half is likewise not re-asserted for the Pipeline scope.
+#    #2284's own AC says "reveals its row in the Pipeline sidebar, not the
+#    Board's", and the contract pins the scroll requirement only for the Board
+#    (§2f, five issues on a short viewport). This slice asserts the per-scope
+#    SELECTION (`▸ #201` inside the Pipeline sidebar's columns 3–37, plus the
+#    Board's own `▸ #103` surviving a Pipeline-side activation) and leaves the
+#    scroll half to #2282's slice, which owns §2f. Also a `TODO(test-author)`.
+#
+# Also worth knowing, not a contract problem: the Pipeline sidebar nests
+# tracked issues under state -> repo -> milestone nodes whose innermost node is
+# COLLAPSED by default, and renders rows as `#201  Add retry backoffwork`
+# (two spaces, title truncated to the 35-column sidebar, stage badge butted
+# against it) — nothing like the mocks' `#201 Add retry backoff to fetch`. The
+# slice therefore targets Pipeline rows by their `#<N>` tag restricted to the
+# sidebar columns (§0), never by a full row string, and expands that group as a
+# labelled precondition. The fixture also gives #101–#103 an untracked label
+# and #201–#203 the tracked `coord` one: the Board sidebar lists all six (it
+# does not filter by label) while the Pipeline lists only the 200s, which is
+# what makes the mocks' 100s/200s ranges disjoint in a single seeded board.