code-coordinator 0.5.173__tar.gz → 0.5.175__tar.gz

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.173
+Version: 0.5.175
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.173
+Version: 0.5.175
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/code_coordinator.egg-info/SOURCES.txt

@@ -810,6 +810,7 @@ tests/acceptance/ms-65/detail_substate_2285.rs
 tests/acceptance/ms-65/manifest.yml
 tests/acceptance/ms-65/pipeline_tabs_2284.rs
 tests/acceptance/ms-65/tabs_discoverability_2287.rs
+tests/acceptance/ms-65/tabs_persistence_2286.rs
 tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
 tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
 tests/acceptance/ms-65/mocks/board-preview-tab.screen

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/code_coordinator.egg-info/scm_file_list.json

@@ -456,6 +456,7 @@
     "tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
     "tests/acceptance/ms-65/pipeline_tabs_2284.rs",
     "tests/acceptance/ms-65/tabs_discoverability_2287.rs",
+    "tests/acceptance/ms-65/tabs_persistence_2286.rs",
     "tests/acceptance/ms-example/mocks/home-active.html",
     "tests/conftest.py",
     "tests/fixtures/board-pipeline-basic.json",

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.173",
+  "tag": "0.5.175",
   "distance": 0,
-  "node": "g3e3dcca5954ea1c1094878c1f81ed18e515e641f",
+  "node": "g517152e1c6b8bcb5f78fa7edd29915934fa18cc9",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-19"

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/coord/ci_github.py

@@ -146,6 +146,49 @@ class GitHubCi:
         return True
 
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Checks the merge gate evaluates — narrowed to what GitHub's own
+        branch protection actually REQUIRES, when that's determinable
+        (#2388/#2446).
+
+        A repo can report far more `gh pr checks` entries than GitHub's
+        required-status-check list (this repo: 9 reported, 5 required), and
+        every merge-gate predicate downstream of this method
+        (`failed_checks`, `in_flight_checks`, `checks_are_stale`) otherwise
+        waits on advisory jobs GitHub itself doesn't — a hung/flaky ADVISORY
+        check (e.g. `Acceptance (web)`, or an unconditional Playwright/
+        Chromium install with no timeout) then blocks `coord merge`
+        indefinitely even though the PR is already `MERGEABLE`. Never
+        filters (returns everything :meth:`list_all_checks_for_pr` does)
+        when the required list can't be determined — #1525's bias: unknown
+        reads as "wait on everything reported", not as a free pass to stop
+        waiting on something that might matter.
+
+        #2446: this is deliberately the ONLY narrowed view — see
+        :meth:`list_all_checks_for_pr` for the full, unfiltered set that
+        feeds `coord merge --plan`'s CI summary, so a regressed advisory
+        check stays visible to an operator even though it can no longer gate
+        a merge attempt.
+        """
+        checks = self._all_checks(repo, number)
+        required = self._required_contexts(repo)
+        if required:
+            return [c for c in checks if c.name in required]
+        return checks
+
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Every check `gh pr checks` reports, required or advisory (#2446).
+
+        Purely a visibility view — `coord merge --plan`/the TUI's CI badges
+        read this so a regressed ADVISORY check (one GitHub's branch
+        protection doesn't require, and :meth:`list_checks_for_pr` therefore
+        no longer waits on) is still something an operator can see, per
+        #2446's suggested fix: "still visible ... but should never gate a
+        merge attempt." Shares :meth:`list_checks_for_pr`'s cached fetch —
+        one `gh pr checks` subprocess call backs both views, never two.
+        """
+        return self._all_checks(repo, number)
+
+    def _all_checks(self, repo: str, number: int) -> list[CheckRun]:
         key = (repo, number)
         now = time.time()
         cached = self._cache.get(key)
@@ -367,7 +410,13 @@ class GitHubCi:
             return [_unreadable_check(repo, number, str(e))]
         if not isinstance(raw, list):
             return [_unreadable_check(repo, number, "gh pr checks returned non-list JSON")]
-        checks = [
+        # #2446: `_all_checks` (this method's only caller) is the single
+        # unfiltered fetch shared by both `list_checks_for_pr` (narrowed to
+        # required contexts) and `list_all_checks_for_pr` (everything) — the
+        # required-contexts narrowing used to happen here, which meant an
+        # advisory check's regression was invisible everywhere, not just to
+        # the merge gate. See both methods' docstrings.
+        return [
             CheckRun(
                 name=str(entry.get("name", "")),
                 status=_status_from_bucket(str(entry.get("bucket", ""))),
@@ -380,22 +429,6 @@ class GitHubCi:
             for entry in raw
             if isinstance(entry, dict)
         ]
-        # #2388: narrow to what branch protection actually REQUIRES, when
-        # that's determinable — a repo can report far more `gh pr checks`
-        # entries than GitHub's own required list (this repo: 9 reported, 5
-        # required), and every merge-gate predicate downstream of this
-        # method (`failed_checks`, `in_flight_checks`, `checks_are_stale`)
-        # otherwise waits on advisory jobs GitHub itself doesn't. A hung
-        # advisory job (e.g. an unconditional Playwright/Chromium install
-        # with no timeout) would then block `coord merge` indefinitely even
-        # though the PR is already `MERGEABLE`. `_required_contexts` returns
-        # `None` (never filters) when it can't determine the required list
-        # — #1525's bias: unknown reads as "wait on everything reported",
-        # not as a free pass to stop waiting on something that might matter.
-        required = self._required_contexts(repo)
-        if required:
-            checks = [c for c in checks if c.name in required]
-        return checks
 
     def _required_contexts(self, repo: str) -> frozenset[str] | None:
         now = time.time()

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/coord/ci_store.py

@@ -125,6 +125,28 @@ class CiStore(Protocol):
 
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]: ...
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Every check reported for *repo*/*number*, required or advisory
+        (#2446) — the unfiltered counterpart to :meth:`list_checks_for_pr`,
+        which narrows to what branch protection actually requires so the
+        merge gate never blocks on a merely-advisory check (see that
+        method's docstring on :class:`coord.ci_github.GitHubCi`).
+
+        Purely a visibility view: `coord merge --plan`'s CI summary reads
+        this so a regressed advisory check is still visible to an operator
+        even though it can no longer gate a merge attempt — matching what
+        GitHub's own merge button already allows.
+
+        Optional/duck-typed like :meth:`rerun_failed_for_pr` — call sites
+        use ``getattr(ci_store, "list_all_checks_for_pr", None)`` and fall
+        back to :meth:`list_checks_for_pr` for a stand-in (a test stub, or
+        :class:`coord.gate_snapshot.GateSnapshot` when its own snapshot
+        wasn't refreshed with the unfiltered view) that predates this
+        capability — read as "no separate advisory view available", not an
+        error.
+        """
+        ...
+
     @property
     def is_available(self) -> bool: ...
 
@@ -232,6 +254,11 @@ class NoOpCi:
     def list_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
         return []
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """No-op: CI gating is disabled entirely, so there is nothing to
+        show either the gate or an operator (#2446)."""
+        return []
+
     @property
     def is_available(self) -> bool:
         return False

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/coord/commands/merge.py

@@ -944,6 +944,60 @@ def _reconcile_via_daemon(svc, params: dict) -> None:
         sys.exit(int(code))
 
 
+def _ci_field(summary, name: str, default=0):
+    """Read *name* off a CI rollup, tolerating both shapes ``p.ci_summary``/
+    ``p.ci_summary_all`` can arrive in (#2446).
+
+    ``coord.merge_queue.plan()`` (the local, in-process path) hands back
+    real :class:`~coord.ci_store.CiCheckSummary` instances. ``coord merge
+    --plan`` against a daemon instead reconstructs ``PlannedMerge`` from the
+    ``/board`` JSON payload (``_show_plan_from_daemon`` below) — the server
+    side flattens each rollup with ``dataclasses.asdict`` and nothing
+    re-hydrates it, so on that path both fields arrive as plain ``dict``s
+    instead. ``summary`` is ``None`` on either path when there's nothing to
+    report (no PR yet, no ``ci_store``, …).
+    """
+    if summary is None:
+        return default
+    if isinstance(summary, dict):
+        return summary.get(name, default)
+    return getattr(summary, name, default)
+
+
+def _advisory_ci_note(p) -> str:
+    """#2446: describe any check failing/still-running in the unfiltered
+    (required + advisory) CI rollup that the required-only rollup
+    (``p.ci_summary`` — the same view the merge gate itself evaluates)
+    doesn't already account for.
+
+    A regression here is on a check GitHub's own branch protection doesn't
+    require — `coord merge`'s gate correctly no longer blocks on it (see
+    ``coord.ci_github.GitHubCi.list_checks_for_pr``'s docstring), but an
+    operator staring at a READY row while a real job is red/hung nearby
+    still deserves to see it. Returns ``""`` when there's nothing extra to
+    report (no ``ci_summary_all``, or it agrees with ``ci_summary``).
+    """
+    if p.ci_summary_all is None:
+        return ""
+    req_failed = _ci_field(p.ci_summary, "failed")
+    req_running = _ci_field(p.ci_summary, "running")
+    req_failed_names = set(_ci_field(p.ci_summary, "failed_names", []) or [])
+    extra_failed = _ci_field(p.ci_summary_all, "failed") - req_failed
+    extra_running = _ci_field(p.ci_summary_all, "running") - req_running
+    if extra_failed <= 0 and extra_running <= 0:
+        return ""
+    all_failed_names = _ci_field(p.ci_summary_all, "failed_names", []) or []
+    advisory_failed_names = [n for n in all_failed_names if n not in req_failed_names]
+    bits = []
+    if advisory_failed_names:
+        bits.append("failing: " + ", ".join(advisory_failed_names))
+    elif extra_failed > 0:
+        bits.append(f"{extra_failed} failing")
+    if extra_running > 0:
+        bits.append(f"{extra_running} running")
+    return "   [advisory CI, not blocking — " + "; ".join(bits) + "]"
+
+
 def _print_merge_plan_entries(planned: list) -> None:
     """Print a list of PlannedMerge entries grouped by repo → target_branch."""
     if not planned:
@@ -963,7 +1017,7 @@ def _print_merge_plan_entries(planned: list) -> None:
             _status_str = f"{_p.status}   {_p.reason}"
         click.echo(
             f"  {_p.rank}. #{_p.issue_number}  {_size_str}   "
-            f"{_status_str}     {_p.issue_title}"
+            f"{_status_str}     {_p.issue_title}{_advisory_ci_note(_p)}"
         )
 
 

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/coord/gate_snapshot.py

@@ -136,6 +136,16 @@ class GateSnapshot:
     """
 
     checks: dict[tuple[str, int], list[CheckRun]] = field(default_factory=dict)
+    # #2446: the unfiltered counterpart to `checks` above — `checks` is
+    # already narrowed to branch-protection-required contexts (see
+    # `coord.ci_github.GitHubCi.list_checks_for_pr`'s docstring), so a
+    # regressed ADVISORY check (one GitHub's own merge button doesn't wait
+    # on either) would otherwise be invisible to `coord merge --plan`'s CI
+    # summary, not just to the merge gate. Populated from
+    # `list_all_checks_for_pr` when the inner `CiStore` offers it; falls
+    # back to the same (already-narrowed) data as `checks` for a backend
+    # that doesn't, same fail-open shape as `workflows_declared` below.
+    all_checks: dict[tuple[str, int], list[CheckRun]] = field(default_factory=dict)
     commit_messages: dict[tuple[str, int], list[str]] = field(default_factory=dict)
     epic_issues: dict[tuple[str, int], bool] = field(default_factory=dict)
     # #1640: (repo, branch) -> HEAD SHA, and (repo, base, head) -> patch-id,
@@ -180,6 +190,19 @@ class GateSnapshot:
                 return [_stale_check(age)]
         return self.checks.get((repo, number), [])
 
+    def list_all_checks_for_pr(self, repo: str, number: int) -> list[CheckRun]:
+        """Unfiltered counterpart to :meth:`list_checks_for_pr` (#2446) —
+        same staleness handling, but keyed off ``all_checks`` so an
+        advisory check's regression stays visible to `coord merge --plan`
+        even though `list_checks_for_pr` (the gate's own view) no longer
+        waits on it.
+        """
+        if self.ci_available:
+            age = None if self.refreshed_at is None else time.time() - self.refreshed_at
+            if age is None or age > STALE_AFTER_SECONDS:
+                return [_stale_check(age)]
+        return self.all_checks.get((repo, number), [])
+
     def expects_checks(self, repo: str, number: int) -> bool:
         # #1904: unlike `list_checks_for_pr`'s "unknown reads as failing"
         # (#1525) posture, a repo this snapshot hasn't cached an answer for
@@ -286,6 +309,7 @@ class GateSnapshotRefresher:
         entries = [e for e in pending if e.pr_number]
 
         checks: dict[tuple[str, int], list[CheckRun]] = {}
+        all_checks: dict[tuple[str, int], list[CheckRun]] = {}
         messages: dict[tuple[str, int], list[str]] = {}
         epics: dict[tuple[str, int], bool] = {}
         branch_shas: dict[tuple[str, str], str | None] = {}
@@ -342,6 +366,21 @@ class GateSnapshotRefresher:
                     checks[key] = inner.list_checks_for_pr(*key)
                 except Exception:  # noqa: BLE001 — fail-open for this entry
                     checks[key] = []
+                # #2446: the unfiltered view backing `coord merge --plan`'s
+                # CI summary — see `GateSnapshot.all_checks`'s field
+                # comment. `list_all_checks_for_pr` is optional/duck-typed
+                # (a `CiStore` stand-in that predates #2446 doesn't offer
+                # it); falling back to the already-fetched `checks[key]`
+                # degrades to "advisory checks aren't shown separately",
+                # never to an extra `gh` call or a missing key.
+                list_all = getattr(inner, "list_all_checks_for_pr", None)
+                if list_all is not None:
+                    try:
+                        all_checks[key] = list_all(*key)
+                    except Exception:  # noqa: BLE001 — fail-open for this entry
+                        all_checks[key] = checks[key]
+                else:
+                    all_checks[key] = checks[key]
                 # #1904: repo-wide, so dedupe across every pending entry in
                 # the same repo — one `gh api .../actions/workflows` call
                 # per repo per tick, not one per PR. A failure here reads
@@ -372,6 +411,7 @@ class GateSnapshotRefresher:
 
         snap = GateSnapshot(
             checks=checks,
+            all_checks=all_checks,
             commit_messages=messages,
             epic_issues=epics,
             branch_shas=branch_shas,

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/coord/merge_queue.py

@@ -3984,6 +3984,20 @@ class PlannedMerge:
     # when no PR is open yet, or `ci_store` has no checks for this PR.
     pr_number: int | None = None
     ci_summary: "CiCheckSummary | None" = None
+    # #2446: the unfiltered (required + advisory) counterpart to
+    # `ci_summary` above, which is narrowed to what GitHub's branch
+    # protection actually requires — the same scope the merge gate itself
+    # evaluates (see `_entry_gate_status`/`coord.ci_github.GitHubCi.
+    # list_checks_for_pr`'s docstrings). A merely-advisory check regressing
+    # (a flaky/hung job the branch's own protection rules don't wait on
+    # either) must never gate a merge attempt, but it's still worth an
+    # operator seeing — this is what `coord merge --plan` renders that from.
+    # `None` under the same conditions as `ci_summary` (no PR yet, or no
+    # `ci_store`); a `CiStore` that predates `list_all_checks_for_pr` yields
+    # the same value as `ci_summary` rather than `None`, so a plan built
+    # against an older store still shows *something* instead of silently
+    # losing the badge.
+    ci_summary_all: "CiCheckSummary | None" = None
     # #2397: mirrors `config.merge.auto_drain` (default False) at plan-build
     # time — read-only exposure, no gate-logic change. The TUI's per-issue
     # Merge stage box needs this to tell "nothing retries until a human runs
@@ -4101,6 +4115,7 @@ def plan(
             reason: str | None = None
 
             ci_summary = None
+            ci_summary_all = None
             if entry.state == PENDING:
                 base_status, reason = _entry_gate_status(
                     entry, board, config, ci_store, gh_ops
@@ -4126,11 +4141,43 @@ def plan(
                 # only ever populates checks for entries that are PENDING at
                 # refresh time, so a MERGING/MERGED row never had real
                 # snapshot data to render in the first place.
+                #
+                # #2446: `ci_summary` MUST stay derived from the same
+                # (already required-narrowed) `list_checks_for_pr` view
+                # `_entry_gate_status` just consulted above — do not widen it
+                # to the unfiltered check list. `coord.drive_queue
+                # ._ci_rollup_all_clear` reads this exact field as positive
+                # evidence that a frozen "CI running:" raw-row string has
+                # gone stale, and that evidence is only valid when it is
+                # counting the SAME checks the live gate decision is based
+                # on (see that function's docstring); widening it here would
+                # make a still-pending ADVISORY check block the #2158
+                # park-recovery self-heal even though the gate itself (and
+                # GitHub's own merge button) is already clear. Advisory
+                # visibility is a genuinely separate concern — see
+                # `ci_summary_all` below.
                 if ci_store is not None and ci_store.is_available and entry.pr_number:
                     checks = ci_store.list_checks_for_pr(entry.repo_github, entry.pr_number)
                     if checks:
                         ci_summary = summarize_counts(checks)
 
+                    # #2446: the unfiltered (required + advisory) rollup —
+                    # pure visibility, never consulted by any gate decision
+                    # or self-heal evidence. Lets `coord merge --plan`/the
+                    # TUI still show a regressed advisory check (e.g.
+                    # `Acceptance (web)`) even though it can no longer block
+                    # `_entry_gate_status` above or the #2158 recovery read
+                    # above. Falls back to `ci_summary` for a `CiStore`
+                    # stand-in that predates `list_all_checks_for_pr`.
+                    list_all = getattr(ci_store, "list_all_checks_for_pr", None)
+                    all_checks = (
+                        list_all(entry.repo_github, entry.pr_number)
+                        if list_all is not None
+                        else checks
+                    )
+                    if all_checks:
+                        ci_summary_all = summarize_counts(all_checks)
+
             result.append(PlannedMerge(
                 assignment_id=entry.assignment_id,
                 repo_name=entry.repo_name,
@@ -4145,6 +4192,7 @@ def plan(
                 reason=reason,
                 pr_number=entry.pr_number,
                 ci_summary=ci_summary,
+                ci_summary_all=ci_summary_all,
                 enqueued_at=entry.enqueued_at,
                 last_attempt=entry.last_attempt,
                 milestone=milestones.get((entry.repo_name, entry.issue_number)),

{code_coordinator-0.5.173 → code_coordinator-0.5.175}/tests/acceptance/ms-65/manifest.yml

@@ -186,6 +186,42 @@ tests:
   # §8c — "hidden or inert" on an already-pinned tab, asserted through the
   # outcome both readings share (see finding 17)
   tabs_discoverability_2287::pin_tab_is_hidden_or_inert_on_an_already_pinned_tab: 2287
+  # ── #2286 (T-5) — persistence, `~/.coord/tabs.json` (contract §6) ─────────
+  # Slice: tabs_persistence_2286.rs · mocks: none of its own (§6 is explicitly
+  # mock-less: "No visual mock (this is a file-format contract, not a
+  # screen)"); its rendered halves lean on `board-baseline-no-tabs.screen`
+  # (the zero-tab state a missing/malformed file must produce) and
+  # `board-pinned-3-tabs.screen` (three restored tabs, §2c bracket included).
+  #
+  # §6 bullet 1 (save side) — 3 Board tabs are written as an ORDERED `tabs`
+  # list with `active` set and `preview` null
+  tabs_persistence_2286::three_board_tabs_are_saved_to_tabs_json_in_strip_order_with_the_active_tab: 2286
+  # §6 (`preview` is "the key of the one preview tab […] must also appear in
+  # `tabs`") — the file-level half of "restored as a preview, not promoted"
+  tabs_persistence_2286::a_preview_tab_is_saved_as_the_scopes_preview_slot: 2286
+  # §6 bullet 1 + #2286 AC 1 (Board half) — three Board tabs restored after a
+  # restart, persisted active tab preserved
+  tabs_persistence_2286::board_tabs_are_restored_from_tabs_json_after_a_restart: 2286
+  # §6 + #2286 AC 2 — a restored preview tab keeps §1's `∘ ` marker, i.e. is
+  # not promoted to pinned on load
+  tabs_persistence_2286::a_restored_preview_tab_is_still_a_preview_tab: 2286
+  # §6 bullet 1 + #2286 AC 1 (Pipeline half) — the same file restores two
+  # Pipeline tabs to the PIPELINE panel with its own active tab (see
+  # coordinator finding 15 for the live blocker on entering that panel)
+  tabs_persistence_2286::pipeline_tabs_are_restored_to_the_pipeline_panel_with_its_own_active_tab: 2286
+  # §6 bullet 2 + #2286 AC 3 — a document whose issue is gone from the board is
+  # dropped on load, never rendered, never round-tripped into a re-saved file
+  tabs_persistence_2286::a_document_whose_issue_is_absent_from_the_board_is_pruned_on_load: 2286
+  # §6 bullet 3 (first branch) — the active document being pruned activates a
+  # surviving neighbour (WHICH one is not pinned — see finding 16)
+  tabs_persistence_2286::pruning_the_active_document_activates_a_surviving_neighbour: 2286
+  # §6 bullet 3 (second branch) — nothing survives the prune → no tabs at all.
+  # THIS IS A GREEN RATCHET — see the `expected_red` block below.
+  tabs_persistence_2286::a_scope_whose_documents_are_all_pruned_starts_with_no_tabs: 2286
+  # §6 bullet 4 + #2286 AC 4 — missing / empty / malformed file all start
+  # clean, never a panic, never a partial parse.
+  # THIS IS THE GREEN CONTROL — see the `expected_red` block below.
+  tabs_persistence_2286::a_missing_empty_or_malformed_tabs_json_starts_with_no_tabs: 2286
 
 # ── expected_red (#2164) ───────────────────────────────────────────────────
 # Hand-derived from a REAL run of the sealed suite against origin/main at the
@@ -326,6 +362,41 @@ expected_red:
     - tabs_discoverability_2287::close_menu_item_closes_the_right_clicked_tab_and_no_other
     - tabs_discoverability_2287::pin_tab_promotes_a_preview_tab_without_changing_count_or_order
     - tabs_discoverability_2287::pin_tab_is_hidden_or_inert_on_an_already_pinned_tab
+  # #2286 — OBSERVED, not intended. Taken from real runs of the sealed suite
+  # (`cd tui && RUSTC_BOOTSTRAP=1 cargo test --test acceptance --features
+  # test-support -- -Z unstable-options --format json`, the driver command in
+  # coordinator.yml) at authoring time: of this slice's 9 ids, the same 7
+  # FAILED and the same 2 passed on three consecutive full-suite runs and on
+  # three slice-filtered runs. Every one of the 7 died on a §6 clause — four on
+  # "nothing was restored" (no strip renders after seeding `tabs.json`), three
+  # on "no such file exists after opening tabs" — never on a harness
+  # precondition; verified by reading the panic line of every failure. The
+  # suite's other 6 failures (audit_1039, plans_detail_1122) are PRE-EXISTING:
+  # a `--skip tabs_persistence_2286` baseline run on the same commit reproduces
+  # exactly those 6, so this slice's sandboxed `HOME` (finding 14) is not
+  # destabilising them. The 2 that passed are deliberately ABSENT below:
+  #
+  #   * `a_missing_empty_or_malformed_tabs_json_starts_with_no_tabs` — the
+  #     CONTROL. Green today for the degenerate reason that nothing is ever
+  #     loaded, and it must STAY green once loading lands: an implementation
+  #     that `unwrap()`s the parse (panic) or best-effort restores the
+  #     well-formed prefix of a truncated file breaks exactly this test, which
+  #     is §6 bullet 4's whole point. Listing it would make its inevitable pass
+  #     a HARD FAILURE.
+  #   * `a_scope_whose_documents_are_all_pruned_starts_with_no_tabs` — a
+  #     RATCHET, §6 bullet 3's second branch ("if none survive, start with no
+  #     tabs"). Green today because nothing renders at all; it becomes a real
+  #     constraint the moment restore lands, since an implementation that
+  #     renders a dead tab, or keeps a pruned document active and paints its
+  #     label, fails it.
+  2286:
+    - tabs_persistence_2286::three_board_tabs_are_saved_to_tabs_json_in_strip_order_with_the_active_tab
+    - tabs_persistence_2286::a_preview_tab_is_saved_as_the_scopes_preview_slot
+    - tabs_persistence_2286::board_tabs_are_restored_from_tabs_json_after_a_restart
+    - tabs_persistence_2286::a_restored_preview_tab_is_still_a_preview_tab
+    - tabs_persistence_2286::pipeline_tabs_are_restored_to_the_pipeline_panel_with_its_own_active_tab
+    - tabs_persistence_2286::a_document_whose_issue_is_absent_from_the_board_is_pruned_on_load
+    - tabs_persistence_2286::pruning_the_active_document_activates_a_surviving_neighbour
 
 # ═══════════════════════════════════════════════════════════════════════════
 # FOR THE COORDINATOR — three findings from authoring this slice. None of them
@@ -669,3 +740,87 @@ expected_red:
 # activating an open menu item; a left click on the item's own label is the
 # only activation path any context menu in this app already documents, so that
 # is what the slice sends.
+# FOR THE COORDINATOR — findings from authoring the #2286 slice (contract §6).
+# Independent of the #2282 / #2283 / #2284 / #2285 notes above; again, none is
+# a worker's to fix by editing this suite, and none was resolved by editing the
+# contract (a test-author may not amend one).
+# ═══════════════════════════════════════════════════════════════════════════
+#
+# 14. **A REAL CONSTRAINT ON #2286's IMPLEMENTATION, discovered while making §6
+#     observable: the restore must run on the FIXTURE construction path, and
+#     the coord-dir has no injectable seam.** Two facts force this:
+#
+#       (a) The sealed suite's only way to build an app is #2281's
+#           `make_app_with_board_json` → `make_test_app`, which today sets
+#           `doc_tabs: DocTabs::default()` outright. `CoordApp::new()` is
+#           public but builds the real daemon-backed app with an EMPTY board,
+#           against which every persisted document would be pruned on load
+#           (§6: "drop any document whose issue is absent from the board") — so
+#           it structurally cannot witness a restore. If the load is wired only
+#           into real startup, the five restore/prune ids above stay red no
+#           matter how correct `doc_tabs.rs` is.
+#
+#       (b) Every `~/.coord/…` path resolves through `std::env::var_os("HOME")`
+#           (`TuiSettings::path`, `Workspace::path`, `app::data::coord_dir`).
+#           There is no `COORD_HOME`-style override, so this slice sandboxes
+#           `HOME` to a temp dir (serialised behind a slice-global mutex,
+#           restored on drop including on panic) rather than clobbering the
+#           developer's real `~/.coord/tabs.json`. That window is
+#           process-global: while it is held, concurrently-running tests from
+#           OTHER slices see the sandboxed `HOME` too. Measured at authoring
+#           time it changes nothing — a `--skip tabs_persistence_2286` baseline
+#           reproduces exactly the same 6 pre-existing failures — but it is a
+#           latent cross-slice coupling, and it will get worse: once (a) lands,
+#           EVERY ms-65 slice's zero-tab control (`zero_doc_tabs_render_no_tab_strip`,
+#           `pipeline_with_zero_doc_tabs_renders_no_tab_strip`,
+#           `zero_tabs_render_no_close_or_overflow_glyphs`) will start reading
+#           the developer's REAL `~/.coord/tabs.json` and go red on any machine
+#           where a human has used the shipped feature.
+#
+#     Both halves point at the same cheap fix, which is a coordinator call, not
+#     a worker's: give the coord-dir an injectable seam under
+#     `#[cfg(any(test, feature = "test-support"))]` (the exact widening this
+#     repo already applied to `resolve_board_service()` for #1039, and that
+#     finding 7 asks for on `start_data_load()`), and have the fixture path
+#     restore through it. Absent that, either the restore is untestable or the
+#     rest of ms-65's suite becomes machine-dependent.
+#
+# 15. Entering the Pipeline panel — finding 7's fixture-wipe blocker — did NOT
+#     bite this slice at authoring time, and the reason is worth recording:
+#     under the sandboxed `HOME` there is no `~/.coord/coord.db` to load, so
+#     `start_data_load` has nothing to overwrite the seeded board with.
+#     `pipeline_tabs_are_restored_to_the_pipeline_panel_with_its_own_active_tab`
+#     got cleanly past its `Overview` precondition and failed on its §6 clause
+#     on every run. That is a side effect of the sandbox, not a fix: finding 7
+#     stands for every other slice, and if #2286's worker moves the tab load
+#     off the `HOME` seam the protection disappears with it.
+#
+# 16. §6 bullet 3 says "a surviving neighbour in `tabs` (order preserved)
+#     becomes active" without pinning WHICH neighbour. §4 pins a left-neighbour
+#     rule, but that is #2283's `Ctrl-W` close gesture, and §6 does not extend
+#     it to this load-time prune. `pruning_the_active_document_activates_a_surviving_neighbour`
+#     therefore asserts only what is pinned — exactly one tab is bracketed
+#     (§2c) and it is one of the survivors — and deliberately does not pin left
+#     vs. right. Also a `TODO(test-author)` in the slice. If a specific rule was
+#     meant, it needs a contract amendment.
+#
+# 17. **Per-tab sub-state persistence is asserted by NOBODY.** §6's last bullet
+#     pins that the sub-tab selection is persisted ("as a string — yes") while
+#     scroll offsets may be dropped, but §6's pinned JSON shape carries no
+#     field for it: a document key is `{"repo": …, "issue": …}` and nothing
+#     more. There is therefore no pinned place to look for it in the file, and
+#     no pinned rule for what a restored tab's sub-tab is when the field is
+#     absent. Asserting it would have meant inventing a field name, so no test
+#     covers it. If it is meant to be gated by acceptance, §6's shape needs the
+#     field spelled out.
+#
+# Also worth knowing, not a contract problem: §6 pins that a restart restores,
+# but not WHEN the file is written. `saved_tabs_json()` therefore reads
+# `~/.coord/tabs.json` after the tab edits and, if it is not there yet, again
+# after a `q` quit — so an implementation that flushes on tab mutation and one
+# that flushes on exit both satisfy the two save-side tests; only a run that
+# produces no file at all fails them. The file's field names (`tabs` /
+# `active` / `preview`, and a key's `repo` / `issue`) ARE asserted as written,
+# on §6 Note 5's own authority ("the shape above is what `coord acceptance
+# author` will write fixtures against"; a deviation is "an amendment, not a
+# silent implementation choice").