code-coordinator 0.5.221__tar.gz → 0.5.223__tar.gz

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.221
+Version: 0.5.223
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.221
+Version: 0.5.223
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/code_coordinator.egg-info/SOURCES.txt

@@ -483,6 +483,7 @@ tests/test_deploy_coord_web_dist.py
 tests/test_deploy_coord_web_rollback.py
 tests/test_deploy_drive_queue_unit.py
 tests/test_deploy_manifest.py
+tests/test_deploy_notify_unit.py
 tests/test_deploy_units_lane.py
 tests/test_deploy_web_unit.py
 tests/test_deps.py

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/code_coordinator.egg-info/scm_file_list.json

@@ -553,6 +553,7 @@
     "tests/test_deploy_coord_web_rollback.py",
     "tests/test_deploy_drive_queue_unit.py",
     "tests/test_deploy_manifest.py",
+    "tests/test_deploy_notify_unit.py",
     "tests/test_deploy_units_lane.py",
     "tests/test_deploy_web_unit.py",
     "tests/test_deps.py",

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.221",
+  "tag": "0.5.223",
   "distance": 0,
-  "node": "g27baf026f5785418120546b37450a2213ff910ab",
+  "node": "g744223e42f4d266aef3954a9aaed09de74827289",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-22"

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/coord/commands/drive_queue.py

@@ -1916,14 +1916,21 @@ def _fetch_live_ci_gate(
     gate ``coord merge --plan`` computes, taken live, right now, this tick
     (#2182).
 
-    The second dict (#2347) carries the reason text
+    The second dict (#2347, extended by #2556) carries the reason text
     :func:`coord.merge_queue.entry_gate_status` returned alongside each
-    still-blocked verdict — used ONLY to let :func:`coord.drive_queue.
-    plan_tick` rewrite a still-``parked`` entry's ``last_reason`` when the
-    fresh reading is specifically "GitHub unreachable"
-    (``is_ci_unreadable_reason``) and differs from what is currently stored;
-    see that function's ``live_ci_gate_reason`` parameter. Never consulted
-    to decide whether to resume — that remains the first dict's job alone.
+    still-blocked verdict, and is handed to :func:`coord.drive_queue.
+    plan_tick` as its ``live_ci_gate_reason`` parameter, which now gives it
+    a first, decisive job (#2556): when this text carries none of the
+    self-refreshing prefixes (``is_ci_pending_reason``/``is_ci_infra_reason``/
+    ``is_ci_flaky_reason``/``is_ci_unreadable_reason``), ``plan_tick``
+    overrides the first dict's still-blocked verdict into a resume — a
+    completed, *failing* CI run must never be indistinguishable from a slow
+    one. When it DOES carry one of those prefixes, this reason is used the
+    pre-#2556 way: only to rewrite a still-``parked`` entry's
+    ``last_reason`` when the fresh reading is specifically "GitHub
+    unreachable" (``is_ci_unreadable_reason``) and differs from what is
+    currently stored. See ``plan_tick``'s own ``live_ci_gate_reason``
+    docstring for the full account.
 
     THE GAP THIS CLOSES. On the daemon host — the only machine that ever
     runs this tick (``docs/AGENT_OPERATIONS.md``) — ``_fetch_board_view``

{code_coordinator-0.5.221 → code_coordinator-0.5.223/coord}/deploy/coord-notify.service

@@ -48,6 +48,22 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
+# #2561: this unit carried NO Environment=PATH= at all, so every subprocess
+# `coord notify` spawns — the #2464 out-of-band confirmation pass
+# (coord/confirm_test.py) re-running the repo's real build+test, and any
+# `coord_argv()` (coord/drive.py) escalation resolving `shutil.which("coord")`
+# — ran under systemd's bare user-manager PATH
+# (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:
+# /usr/local/games:/snap/bin), which does NOT contain ~/.local/bin (where the
+# pinned `coord` shim lives) or ~/.cargo/bin (where rustup puts `cargo`). That
+# let this daemon's confirmation runs resolve a *different* toolchain than a
+# dev shell or coord-serve.service would for the identical command — and cost
+# a real dispatch when it refuted a genuinely clean CC#2556 branch over a
+# PATH-dependent test assertion having nothing to do with the diff under
+# review. Byte-identical to coord-serve.service's line (same host, same role
+# family, same #1831/#1117 reasoning — see that unit's comment for why each
+# entry is there and why the ordering matters).
+Environment=PATH=%h/.cargo/bin:%h/.local/bin:%h/src/code-coordinator/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 ExecStart=%h/.coord-venv/bin/coord notify --config %h/.coord/coordinator.yml
 # #2464: sized off `coord.confirm_test.notify_client_timeout_seconds()` — the
 # HTTP timeout the CLI gives its `/notify` POST — plus slack, because this is

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/coord/drive_queue.py

@@ -95,7 +95,7 @@ from coord.merge_queue import (
     PLAN_READY,
     is_ci_flaky_reason,
     is_ci_infra_reason,
-    is_ci_pending_reason,
+    is_ci_terminal_reason,
     is_ci_unreadable_reason,
     is_stale_smoke_reason,
 )
@@ -1121,12 +1121,7 @@ def build_board_view(
         # board-build time. `plan_reason` already carries it whenever it
         # applies; the live plan reading and a live `coord merge` attempt's
         # raw reading can never disagree about this one.
-        if not (
-            is_ci_pending_reason(reason)
-            or is_ci_infra_reason(reason)
-            or is_ci_flaky_reason(reason)
-            or is_ci_unreadable_reason(reason)
-        ):
+        if is_ci_terminal_reason(reason):
             continue
         # #2158: the same plan row that came back with NO reason of its own
         # also carries `ci_summary` — `summarize_counts` over the very checks
@@ -3180,18 +3175,33 @@ def plan_tick(
     the #2158 ceiling included — see
     :func:`coord.commands.drive_queue._fetch_live_ci_gate` for the shell
     side, which computes this ONLY for the bounded set of entries currently
-    `parked` on a CI reason, never the whole queue.
-
-    *live_ci_gate_reason* (#2347) is *live_ci_gate*'s companion: the reason
-    text the SAME fresh `entry_gate_status` call returned, for entries whose
-    reading is STILL blocked. Never used to decide whether to resume (that
-    remains `live_ci_gate`'s job) — only to rewrite a still-parked entry's
-    `last_reason` when the fresh reading is `CI_UNREADABLE_PREFIX`-shaped and
-    differs from what is currently stored, so `coord drive-queue list`/
-    `status` shows "GitHub could not be reached" the moment that becomes the
-    real cause, instead of silently keeping whatever reason the entry
-    happened to park on originally (which #1891/#1892/#2252's "still shut ⇒
-    no reconcile, no write" rule would otherwise leave frozen indefinitely —
+    `parked` on a CI reason, never the whole queue. `True` is NOT simply
+    "stay parked" any more (#2556): it means the fresh read isn't
+    ``PLAN_READY``, which is true both while checks are still genuinely in
+    flight (or mid one of their own bounded self-refreshing windows —
+    :func:`~coord.merge_queue.is_ci_pending_reason`/`is_ci_infra_reason`/
+    `is_ci_flaky_reason`/`is_ci_unreadable_reason`, stay parked) AND once
+    they have reported a TERMINAL verdict against the code (a plain "CI
+    failed: ..." reading with none of those prefixes — resume instead, so a
+    completed, failing run can never be indistinguishable from a slow one).
+    See *live_ci_gate_reason* just below, which is what makes that
+    distinction possible.
+
+    *live_ci_gate_reason* (#2347, extended by #2556) is *live_ci_gate*'s
+    companion: the reason text the SAME fresh `entry_gate_status` call
+    returned, for entries whose reading is STILL not `PLAN_READY`. #2556
+    gives it a first, decisive job: when this text carries none of the
+    self-refreshing prefixes (`is_ci_pending_reason`/`is_ci_infra_reason`/
+    `is_ci_flaky_reason`/`is_ci_unreadable_reason`), `live_ci_gate`'s `True`
+    is overridden into a resume — see `plan_tick`'s body. When it DOES carry
+    one of those prefixes, this reason is used the pre-#2556 way: only to
+    rewrite a still-parked entry's `last_reason` when the fresh reading is
+    `CI_UNREADABLE_PREFIX`-shaped and differs from what is currently stored,
+    so `coord drive-queue list`/`status` shows "GitHub could not be reached"
+    the moment that becomes the real cause, instead of silently keeping
+    whatever reason the entry happened to park on originally (which
+    #1891/#1892/#2252's "still shut ⇒ no reconcile, no write" rule would
+    otherwise leave frozen indefinitely —
     see the issue for the observed incident: a stale "CI running: ..."
     reason surviving a run of transient GitHub API 503s for most of
     `PARK_STALE_SECONDS` with no operator-visible signal of the real cause).
@@ -3524,6 +3534,60 @@ def plan_tick(
         live_override = (live_ci_gate or {}).get(entry.key)
         if live_override is not None:
             if live_override:
+                live_reason = (live_ci_gate_reason or {}).get(entry.key)
+                # #2556: `live_override=True` only means the FRESH read
+                # taken THIS tick isn't PLAN_READY — but "not ready" folds
+                # together two very different facts. One is "checks are
+                # genuinely still in flight" (`is_ci_pending_reason`), or one
+                # of the other self-refreshing, no-verdict-yet classes
+                # (`is_ci_infra_reason`'s verdictless failure mid its own
+                # bounded auto-rerun, `is_ci_flaky_reason`'s one-shot re-run
+                # to rule out a flake, `is_ci_unreadable_reason`'s bare
+                # GitHub-unreachable read, handled specially just below) —
+                # for all of these, "still shut ⇒ stay parked" (#1891/#2182)
+                # is exactly right, because there is no fresh verdict to act
+                # on yet. The other is "checks already reported a TERMINAL
+                # verdict against the code" — a plain "CI failed: ..."
+                # reading carrying none of those prefixes. This entry's own
+                # park message promises "the queue resumes it automatically
+                # once they do [report]" — a completed, failing run
+                # satisfies that in every ordinary reading, so staying
+                # parked on it forever (as every prior tick did — the #2158
+                # staleness ceiling never even runs, because it only applies
+                # when `live_override` is absent) is the bug: a red CI on a
+                # parked row was indistinguishable from a slow CI on one,
+                # unboundedly. Resume here exactly like the "reads READY"
+                # branch below (no attempt spent — a fresh GitHub read is
+                # not a failed launch attempt) so this falls straight into
+                # the SAME `waiting` walk, on the SAME tick; whatever
+                # relaunches `coord drive` finds the terminal CI reading and
+                # routes it through `_decide_merge`'s existing checks_failed
+                # handling (dispatch a fix, or block with a real reason) —
+                # exactly the path any other red-CI entry already takes.
+                if live_reason and is_ci_terminal_reason(live_reason):
+                    reason = (
+                        f"live re-check of {entry.key}'s gate this tick "
+                        f"reads a terminal, non-pending result ({live_reason}) "
+                        "— resuming from parked without spending an attempt "
+                        "so the normal checks_failed handling can take over "
+                        "(#2556)"
+                    )
+                    reconciles.append(
+                        Reconcile(
+                            entry.key,
+                            "resumed",
+                            reason,
+                            occupies=False,
+                            updates={
+                                "state": STATE_WAITING,
+                                "attempts": 0,
+                                "last_reason": reason,
+                            },
+                        )
+                    )
+                    states[entry.key] = STATE_WAITING
+                    effective_attempts[entry.key] = 0
+                    continue
                 # #2347: CONFIRMED still blocked — but if the FRESH reading
                 # taken THIS tick says the real cause is "GitHub could not
                 # be reached" (not a real CI verdict) and that differs from
@@ -3535,7 +3599,6 @@ def plan_tick(
                 # rule does for every other still-blocked reading. State
                 # stays `parked`, no attempt spent — this changes only what
                 # the operator is told, never the decision.
-                live_reason = (live_ci_gate_reason or {}).get(entry.key)
                 if (
                     live_reason
                     and is_ci_unreadable_reason(live_reason)

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/coord/merge_queue.py

@@ -1525,6 +1525,41 @@ def is_ci_flaky_reason(reason: str | None) -> bool:
     return (reason or "").startswith(CI_FLAKY_PREFIX)
 
 
+def is_ci_terminal_reason(reason: str | None) -> bool:
+    """True when *reason* is a CONCLUDED CI verdict — a plain "checks
+    failed: ..." (or similarly final) reading carrying none of the four
+    self-refreshing, no-verdict-yet prefixes above (#2556).
+
+    ``not is_ci_terminal_reason(r)`` is exactly "this reading is still
+    genuinely in flight, or mid one of its own bounded self-refreshing
+    windows, and answers nothing yet about whether the code is any good" —
+    :func:`is_ci_pending_reason` (checks exist and are still running),
+    :func:`is_ci_infra_reason` (a check completed but said nothing about the
+    code, mid its own auto-rerun), :func:`is_ci_flaky_reason` (a real
+    verdict, but only observed once, mid its one-shot re-run to rule out a
+    flake), or :func:`is_ci_unreadable_reason` (GitHub could not even be
+    asked the question). Anything else — most commonly a plain "checks
+    failed: ..." with none of those prefixes — is terminal: a concluded
+    result the queue can act on now, never indistinguishable from a slow or
+    still-resolving one.
+
+    The single implementation of this classification. Two call sites used to
+    each spell out the identical four-way disjunction inline — a `parked`
+    entry's "is this still self-refreshing?" gate in this module's own
+    `process()`, and `coord.drive_queue.plan_tick`'s #2556 resume-on-
+    terminal-failure branch — which is exactly the "two independent
+    implementations that agree today are a split-brain waiting to happen"
+    shape this repo's own review checklist warns against. Call this instead
+    of re-deriving the disjunction at a new call site.
+    """
+    return not (
+        is_ci_pending_reason(reason)
+        or is_ci_infra_reason(reason)
+        or is_ci_flaky_reason(reason)
+        or is_ci_unreadable_reason(reason)
+    )
+
+
 # #1892: auto-reruns `process()` will trigger for a single entry's verdictless
 # CI failure (via `CiStore.rerun_for_pr`) before giving up and parking it for
 # a human instead of the queue's own #1891 machinery. A workflow genuinely

{code_coordinator-0.5.221/coord → code_coordinator-0.5.223}/deploy/coord-notify.service

@@ -48,6 +48,22 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
+# #2561: this unit carried NO Environment=PATH= at all, so every subprocess
+# `coord notify` spawns — the #2464 out-of-band confirmation pass
+# (coord/confirm_test.py) re-running the repo's real build+test, and any
+# `coord_argv()` (coord/drive.py) escalation resolving `shutil.which("coord")`
+# — ran under systemd's bare user-manager PATH
+# (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:
+# /usr/local/games:/snap/bin), which does NOT contain ~/.local/bin (where the
+# pinned `coord` shim lives) or ~/.cargo/bin (where rustup puts `cargo`). That
+# let this daemon's confirmation runs resolve a *different* toolchain than a
+# dev shell or coord-serve.service would for the identical command — and cost
+# a real dispatch when it refuted a genuinely clean CC#2556 branch over a
+# PATH-dependent test assertion having nothing to do with the diff under
+# review. Byte-identical to coord-serve.service's line (same host, same role
+# family, same #1831/#1117 reasoning — see that unit's comment for why each
+# entry is there and why the ordering matters).
+Environment=PATH=%h/.cargo/bin:%h/.local/bin:%h/src/code-coordinator/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
 ExecStart=%h/.coord-venv/bin/coord notify --config %h/.coord/coordinator.yml
 # #2464: sized off `coord.confirm_test.notify_client_timeout_seconds()` — the
 # HTTP timeout the CLI gives its `/notify` POST — plus slack, because this is

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/tests/test_cli_drive_queue.py

@@ -1835,6 +1835,15 @@ def _green_check(name: str = "test (3.12)"):
     )
 
 
+def _failed_check(name: str = "test (3.12)"):
+    from coord.ci_store import CheckRun
+
+    return CheckRun(
+        name=name, status="completed", conclusion="failure",
+        url="", run_id="1", started_at=100.0, completed_at=160.0,
+    )
+
+
 def _running_check(name: str = "test (3.12)"):
     from coord.ci_store import CheckRun
 
@@ -1914,6 +1923,45 @@ def test_a_parked_entry_with_ci_still_genuinely_running_stays_parked(
     assert "1 parked" in cli_no_gates("status").output
 
 
+def test_a_parked_entry_resumes_once_ci_reports_a_confirmed_failure(
+    cli_no_gates, seed, launches, coord_db, live_ci_backend,
+):
+    """#2556, reproduced rather than injected.
+
+    coord-portal#131 (live, 2026-08-22): a row parked on "CI running: e2e
+    smoke (playwright)" never noticed the check it was watching completed as
+    FAILURE — it stayed `parked`, with `last_reason` still reading "CI
+    running: ..." over an hour after the run finished. The #2182 live
+    re-check correctly asks GitHub again every tick, but collapsed "still
+    running" and "confirmed failed" into the same "stay parked" branch,
+    because both merely fail to read `PLAN_READY`. A completed run — even a
+    red one — satisfies this entry's own park promise ("the queue resumes it
+    automatically once they do [report]"); it must resume and let the normal
+    `waiting`/launch path route the failure through `coord drive`'s existing
+    checks_failed handling, exactly like any other red-CI entry.
+    """
+    _park_with_pr(cli_no_gates, seed, coord_db)
+    assert "CI running" in (queued(2159)["last_reason"] or "")
+
+    live_ci_backend([_failed_check()])
+
+    result = cli_no_gates("tick")
+    assert result.exit_code == 0, result.output
+    # The resume itself is visible in this tick's own reconcile line — the
+    # entry then launches in the SAME tick (like the #2182 green-check case
+    # above), which clears `last_reason` to "" on success, so the CI-failed
+    # reading is only observable in the tick's rendered output, not the
+    # post-launch row.
+    assert "resumed" in result.output
+    assert "CI failed" in result.output
+    entry = queued(2159)
+    assert entry["state"] != "parked", entry  # no longer wedged
+    assert entry["attempts"] == 0  # #1891/#2273: still free — no attempt spent
+    assert len(launches) == 2, launches  # resumed straight into a fresh launch
+
+    assert "parked" not in cli_no_gates("status").output
+
+
 def test_a_parked_entrys_reason_is_corrected_when_github_is_unreachable(
     cli_no_gates, seed, launches, coord_db, live_ci_backend,
 ):

code_coordinator-0.5.223/tests/test_deploy_notify_unit.py

@@ -0,0 +1,119 @@
+"""Regression guard for `deploy/coord-notify.service` (#2561 `Environment=PATH`).
+
+Mirrors `tests/test_deploy_drive_queue_unit.py`'s `Environment=PATH=` section
+for `coord-notify.service`'s own #2561 fix: this unit carried NO
+`Environment=PATH=` at all, so every subprocess it spawns —
+`coord_argv()`-resolved escalation dispatch, and the #2464 out-of-band
+confirmation pass (`coord.confirm_test`) re-running the repo's own build/test
+commands — ran under systemd's bare user-manager PATH instead of the pinned
+release. That silent divergence refuted a genuinely clean branch (CC#2556)
+over a PATH-dependent test assertion having nothing to do with the diff under
+review. See `deploy/coord-notify.service`'s own header comment for the full
+story, and `deploy/coord-serve.service`'s for why each PATH entry is there —
+this unit's line is byte-identical to that one's (same host, same daemon
+family), unlike `coord-drive-queue.service`'s bespoke #2314 ordering.
+"""
+
+from __future__ import annotations
+
+import configparser
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+UNIT_PATH = REPO_ROOT / "deploy" / "coord-notify.service"
+SERVE_UNIT_PATH = REPO_ROOT / "deploy" / "coord-serve.service"
+
+
+def _parse_unit(path: Path) -> configparser.RawConfigParser:
+    # RawConfigParser (not ConfigParser): systemd's `%h`/`%%` specifiers
+    # collide with configparser's default `%`-interpolation syntax and raise
+    # otherwise (e.g. the `ExecStart=` line below).
+    cp = configparser.RawConfigParser(strict=False)
+    cp.read(path)
+    return cp
+
+
+def _unit_path_entries(path: Path) -> list[str]:
+    """*path*'s `Environment=PATH=` value, split into entries.
+
+    Asserts its presence first: an absent directive is the exact #2561
+    regression (the unit then silently inherits the user manager's default),
+    and a bare KeyError from configparser would not say so.
+    """
+    unit = _parse_unit(path)
+    assert unit.has_option("Service", "Environment"), (
+        f"{path.name} declares no Environment=PATH= — it will inherit the "
+        "systemd user manager's default PATH, which has neither "
+        "~/.local/bin (the pinned `coord` shim) nor ~/.cargo/bin, so every "
+        "coord_argv()-resolved subprocess it spawns silently resolves a "
+        "different toolchain than a dev shell would (#2561)."
+    )
+    value = unit.get("Service", "Environment")
+    assert value.startswith("PATH="), value
+    return value[len("PATH=") :].split(":")
+
+
+def test_still_a_oneshot_unit() -> None:
+    """The fix's reasoning (systemd's default PATH, not a login shell's)
+    assumes `Type=oneshot`. If this ever changes, re-derive rather than
+    silently carry the assumption forward."""
+    unit = _parse_unit(UNIT_PATH)
+    assert unit.get("Service", "Type") == "oneshot"
+
+
+def test_local_bin_is_on_the_path() -> None:
+    """The actual #2561 fix. `~/.local/bin/coord` is the pinned-release
+    shim (a symlink onto `~/.coord-venv/bin/coord`); without it on PATH,
+    `coord_argv()`'s `shutil.which("coord")` falls back to
+    `[sys.executable, "-m", "coord.cli"]`, a different argv shape that
+    downstream code (and tests asserting on it) do not expect."""
+    assert "%h/.local/bin" in _unit_path_entries(UNIT_PATH)
+
+
+def test_cargo_bin_is_on_the_path() -> None:
+    """rustup installs `cargo` at ~/.cargo/bin and nowhere else — the #2464
+    confirmation pass this unit runs re-executes the repo's own
+    `build_command`/`test_command`, which is `cargo build`/`cargo test` for a
+    `tui/**`-touching branch."""
+    assert "%h/.cargo/bin" in _unit_path_entries(UNIT_PATH)
+
+
+def test_path_is_a_superset_of_the_systemd_user_default() -> None:
+    """Declaring an explicit PATH *replaces* the inherited one, so anything
+    this unit reaches today via the user manager's default must be carried
+    over explicitly or the fix trades one silent breakage for another."""
+    entries = set(_unit_path_entries(UNIT_PATH))
+    # `systemctl --user show-environment` default, minus the games dirs.
+    inherited = [
+        "/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin",
+        "/sbin", "/bin", "/snap/bin",
+    ]
+    missing = [e for e in inherited if e not in entries]
+    assert not missing, f"PATH drops inherited entries: {missing}"
+
+
+def test_path_has_no_editable_checkout_shadow() -> None:
+    """Enforce #1831's rule with #1831's own detector rather than by eye: no
+    `.venv/bin` entry may precede ~/.local/bin or ~/.coord-venv/bin, or the
+    `unit_drift` health check goes CRIT on this unit the moment it installs."""
+    from coord.health.checks.unit_drift import find_path_shadow
+
+    assert find_path_shadow(UNIT_PATH.read_text()) is None
+
+
+def test_path_matches_coord_serve_byte_for_byte() -> None:
+    """#2561 asked for byte-identity with `coord-serve.service`'s line —
+    same host, same daemon family, same #1831/#1117 reasoning for each entry.
+    Unlike `coord-drive-queue.service` (a deliberately different, #2314-driven
+    ordering), there is no reason for this unit's PATH to diverge from
+    `coord-serve.service`'s."""
+    assert _unit_path_entries(UNIT_PATH) == _unit_path_entries(SERVE_UNIT_PATH)
+
+
+def test_path_comment_names_the_issue() -> None:
+    """Same rationale as `test_deploy_drive_queue_unit.py`'s comment guard —
+    the reasoning for why this line must never be dropped stays attached to
+    it."""
+    text = UNIT_PATH.read_text()
+    assert "#2561" in text
+    assert "Environment=PATH=" in text

{code_coordinator-0.5.221 → code_coordinator-0.5.223}/tests/test_drive.py

@@ -4662,24 +4662,33 @@ def driver_factory(tmp_path, monkeypatch, capsys):
     monkeypatch.setenv("TMPDIR", str(tmp_path))
     monkeypatch.setattr("coord.drive_state.scratch_dir", lambda: tmp_path)
     monkeypatch.setattr("coord.drive.scratch_dir", lambda: tmp_path)
-    # A per-test notify.lock, so a Driver test's `--notify` nudge never
-    # contends with the OPERATOR'S real ~/.coord/notify.lock — the same
-    # convention `tests/test_notify_drain.py`'s `lock_path` fixture already
-    # documents ("so tests never touch the real ~/.coord one").
+    # #2170-class isolation, fixture-wide: `run_notify()` takes a REAL flock
+    # on `notify_lock_path()` (`Path.home()/".coord"/"notify.lock"`, resolved
+    # at call time) whenever `DriveOptions(notify=True)` is in play. Any
+    # driver test in this module can turn that on, and without isolating it
+    # the lock contends with whatever else on the host legitimately holds it
+    # — on a machine that actually runs the fleet, `coord-notify.timer`
+    # (5-minute cadence) and the board daemon's own drain both hold it for
+    # the length of a full notify pass. The test then burns up to the full
+    # 5-minute `timeout=300` per acquire, logs "could not take
+    # ~/.coord/notify.lock within 5m — skipping nudge", and fails with an
+    # empty call list. That is a race with whatever else is running on the
+    # machine, not a signal about the code under test — exactly the class
+    # `tests/test_ambient_home_isolation.py` and the `populated-home` CI job
+    # exist to keep out.
     #
-    # Without this, `Driver.run_notify()` takes the live lock for real: on
-    # any host that actually runs the fleet, `coord-notify.timer` (5-minute
-    # cadence) and the board daemon's own drain both hold it for the length
-    # of a full notify pass, so every nudge assertion here
-    # (`test_notify_nudges_coord_notify_under_the_shared_lock` and the two
-    # #1593 stall-nudge tests) was one unlucky overlap away from seeing
-    # LockBusy, logging "could not take ~/.coord/notify.lock within 5m —
-    # skipping nudge", and failing with an empty call list after a 5-minute
-    # stall. That is a race with whatever else is running on the machine,
-    # not a signal about the code under test.
-    monkeypatch.setattr(
-        "coord.drive.notify_lock_path", lambda: tmp_path / "notify.lock"
-    )
+    # Redirecting $HOME is the whole mechanism, and it subsumes the earlier
+    # #2536 fix (which pinned `coord.drive.notify_lock_path` at
+    # `tmp_path/"notify.lock"` instead): `notify_lock_path()` resolves
+    # `Path.home()` at call time, so the lock lands at
+    # `tmp_path/".coord"/"notify.lock"` either way — but $HOME also covers
+    # everything *else* in the driver that reaches for `~/.coord`, and it
+    # needs no upkeep as call sites move. Deliberately NOT belt-and-braces:
+    # re-pinning `notify_lock_path` on top of this would move the lock back
+    # out of the redirected $HOME and silently defeat
+    # `test_notify_nudges_coord_notify_under_the_shared_lock`, whose whole
+    # job is to assert the redirection took.
+    monkeypatch.setenv("HOME", str(tmp_path))
 
     def make(
         payloads, *, opts=None, verifier=None, config=None, oracle_gate=None,
@@ -5725,6 +5734,15 @@ def test_notify_is_off_by_default(driver_factory, monkeypatch):
 
 
 def test_notify_nudges_coord_notify_under_the_shared_lock(driver_factory, tmp_path):
+    # #2170-class isolation: `run_notify()` takes a REAL flock on
+    # `notify_lock_path()` — i.e. `Path.home()/".coord"/"notify.lock"`,
+    # resolved at call time. `driver_factory` redirects $HOME to `tmp_path`
+    # fixture-wide (see its definition) precisely so this doesn't contend
+    # with whatever else on the host legitimately holds that lock (a live
+    # `coord notify` / `run_drain` on a daemon host, or simply another
+    # pytest worker running the sibling drain tests) and burn the full
+    # 5-minute `timeout=300` before failing with an empty `seen`. This
+    # assertion just confirms the redirection actually took.
     driver = driver_factory(
         [board(status="merged")], opts=DriveOptions(machine="precision", notify=True)
     )
@@ -5732,6 +5750,8 @@ def test_notify_nudges_coord_notify_under_the_shared_lock(driver_factory, tmp_pa
     driver.run_coord = lambda args, **kw: seen.append(args) or 0  # type: ignore[assignment]
     driver.run_notify()
     assert seen == [("notify",)]
+    # The lock really was taken under the redirected $HOME, not the host's.
+    assert (tmp_path / ".coord" / "notify.lock").exists()
 
 
 def test_stalled_stage_gets_re_nudged_on_every_stall_window(driver_factory, capsys):