code-coordinator 0.5.251__tar.gz → 0.5.254__tar.gz

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.251
+Version: 0.5.254
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.251
+Version: 0.5.254
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.251",
+  "tag": "0.5.254",
   "distance": 0,
-  "node": "ga297b60b58a3ad1b5c13f4a8173011ce3c4378dc",
+  "node": "g83ff84b37c57af71b3aa15734da48e4c5a1f2c5f",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-27"

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/commands/_common.py

@@ -19,6 +19,7 @@ the server stack at import time. Keep it that way:
 from __future__ import annotations
 
 import json
+import logging
 import socket
 import sys
 import time
@@ -42,6 +43,8 @@ from coord.config import (
 if TYPE_CHECKING:  # pragma: no cover — typing only
     from collections.abc import Iterator
 
+log = logging.getLogger(__name__)
+
 # Canonical constant in coord.brain.AGENT_PORT — duplicated here as a literal
 # so the CLI decorator default doesn't have to import the brain (and, through
 # it, the provider stack) on every `coord` invocation.
@@ -470,6 +473,104 @@ def _apply_label_change(
     click.echo(success_message)
 
 
+# #2839: Pipeline membership label set — shared by `coord track` (the
+# interactive "send to Pipeline" door, above) and `coord drive-queue add`
+# (the queueing door, `coord/commands/drive_queue.py`). Enqueueing a drive is
+# a strictly STRONGER statement than "send to Pipeline", so its label write
+# must never be weaker than `track`'s own — kept as one literal pair so the
+# two doors cannot drift apart.
+PIPELINE_TRACK_LABELS_ADD = {"coord", "status:ready"}
+PIPELINE_TRACK_LABELS_REMOVE_IF_PRESENT = {"status:refining", "status:backlog"}
+
+
+def resolve_repo_slug_best_effort(config: Config | None, repo: str) -> str | None:
+    """Non-fatal sibling of :func:`_resolve_repo_slug` (#2839 review).
+
+    Returns the GitHub ``OWNER/REPO`` slug for *repo*, or ``None`` when it
+    cannot be determined. Unlike ``_resolve_repo_slug`` it never calls
+    ``sys.exit`` — it is for callers whose own job is not "talk to the
+    forge", where an unresolvable name must degrade rather than abort.
+
+    *config* is ``None`` when the caller could not load one at all (a thin
+    client whose board daemon is momentarily unreachable); that is a
+    legitimate, expected input, not an error.
+    """
+    if config is not None:
+        repo_entry = config.repo(repo)
+        if repo_entry is not None:
+            return repo_entry.github
+    # Not in coordinator.yml (or no config at all): a raw `OWNER/REPO` slug is
+    # still directly usable by the forge backend — same accepted fallback
+    # `_resolve_repo_slug` validates. Anything else is a bare local name we
+    # cannot map, so say so with `None` rather than guessing.
+    if "/" in repo:
+        return repo
+    return None
+
+
+def apply_pipeline_track_labels_best_effort(
+    repo: str, issue: int, *, config: Config | None,
+) -> None:
+    """Best-effort ``coord`` + ``status:ready`` label application (#2839).
+
+    Non-blocking sibling of :func:`_apply_label_change` for a caller whose
+    own job is NOT "change labels" — today, only ``coord drive-queue add``.
+    Enqueuing a drive must succeed even when GitHub is unreachable: the board
+    row is the source of truth for queue membership, and this label is only
+    a best-effort projection of it onto the Pipeline. Every failure (a
+    missing repo, an unreachable daemon, a `gh` error) is logged and
+    swallowed here — never raised — so the caller's own success can never
+    turn on this call landing.
+
+    Idempotent by construction: ``apply_issue_labels`` (and the ``gh``
+    backend underneath it) tolerates already-present ``add`` labels and
+    already-absent ``remove`` labels, so re-running this on an
+    already-tracked issue is a silent no-op, not a duplicate write.
+
+    *config* is passed IN, already loaded, rather than loaded here — the two
+    halves of the #2839 review, together:
+
+    * It must not be loaded via ``_load_config`` inside this function.
+      ``_load_config`` turns a config-load failure (a thin client's
+      ``fetch_remote_config`` round-trip to a momentarily-unreachable board
+      daemon; a briefly-unreadable ``coordinator.yml``) into ``sys.exit(2)``,
+      and ``SystemExit`` is a ``BaseException``, not an ``Exception``, so it
+      would blow straight through the ``except`` below and kill the whole
+      ``drive-queue add`` process *after* the board row was written.
+    * But the slug must still be RESOLVED. ``coordinator.yml``'s ``name:``
+      key is routinely not the GitHub slug (this repo's own
+      ``coordinator.example.yml`` documents ``name: code-coordinator`` vs
+      ``github: JDonaghy/claude-coordinator``), and
+      ``_apply_issue_labels_local``'s ``repo_github or repo_name`` fallback
+      would hand that bare local name to ``gh issue edit --repo``, which
+      requires ``[HOST/]OWNER/REPO`` and errors out — so the label would
+      still never land for exactly the repos #2839 was filed about, only
+      now silently.
+
+    Taking the caller's already-loaded ``Config`` satisfies both: real slug
+    resolution, no second (uncachable, per-``add``) round trip to the daemon,
+    and no ``SystemExit`` path inside a best-effort helper. ``config=None``
+    is accepted and simply degrades to the ``repo_name`` fallback.
+    """
+    from coord.state import apply_issue_labels  # noqa: PLC0415
+
+    try:
+        apply_issue_labels(
+            repo, issue,
+            add=PIPELINE_TRACK_LABELS_ADD,
+            remove=PIPELINE_TRACK_LABELS_REMOVE_IF_PRESENT,
+            repo_github=resolve_repo_slug_best_effort(config, repo),
+        )
+    except Exception as exc:  # noqa: BLE001 — see docstring: must never block the enqueue
+        log.warning(
+            "drive-queue add: failed to apply Pipeline labels (coord + "
+            "status:ready) to %s#%s: %s — the queue row was still written; "
+            "the label is a projection, not the source of truth, so the "
+            "enqueue proceeds",
+            repo, issue, exc,
+        )
+
+
 @dataclass
 class PollOutcome:
     """Result of polling an agent's ``/status`` for one assignment until it

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/commands/drive_queue.py

@@ -35,12 +35,12 @@ import socket
 import subprocess
 import time
 from pathlib import Path
-from typing import Any, Mapping
+from typing import TYPE_CHECKING, Any, Mapping
 
 import click
 
 from coord.block_log import INTERVENTION_CATEGORIES, STALL_STATES
-from coord.commands._common import _CONFIG_OPTION
+from coord.commands._common import _CONFIG_OPTION, apply_pipeline_track_labels_best_effort
 from coord.drive_state import WORK_LIKE
 from coord.drive_queue import (
     DEFAULT_MAX_ATTEMPTS,
@@ -105,6 +105,9 @@ from coord.overlap_predict import (
     tally,
 )
 
+if TYPE_CHECKING:  # pragma: no cover — typing only
+    from coord.config import Config
+
 log = logging.getLogger(__name__)
 
 # Wall-clock ceiling for the `coord drive --tmux` launch subprocess.  The
@@ -335,12 +338,18 @@ def drive_queue_add(
     existing_entries = entries_from_rows(list_drive_queue())
     if max_fix_rounds is not None and max_fix_rounds < 1:
         raise click.ClickException("--max-fix-rounds must be a positive integer")
+    # #2839: reused below for the Pipeline label write's slug resolution, so
+    # that best-effort projection costs no SECOND config load (a `GET /config`
+    # round trip to the board daemon on a thin client). `None` on the
+    # documented fail-open path — an unloadable config never blocks an
+    # enqueue, and never blocks the label write either.
+    cfg: Config | None = None
     try:
         after = parse_after_spec(after_specs, repo)
         # #2603: reuses `--after`'s own `N` / `REPO#N` parsing — a rejected
         # edge is named the same way an operator would name a real one.
         reject_after = set(parse_after_spec(reject_after_specs, repo))
-        validate_config_repo(config_path, repo)
+        cfg = validate_config_repo(config_path, repo)
         validate_hold_flags(hold_after, hold_reason, resume_when, hold_scope)
         validate_enqueue(existing_entries, repo, issue, after)
     except QueueError as exc:
@@ -402,6 +411,21 @@ def drive_queue_add(
         max_fix_rounds=max_fix_rounds,
         no_acceptance=no_acceptance,
     )
+    # #2839: queueing a drive is a strictly STRONGER statement than "send to
+    # Pipeline" (`coord track`), so it must never leave the issue in a
+    # weaker label state — apply the same `coord` + `status:ready` labels
+    # `track` does, resolved through the SAME `cfg` already loaded above
+    # (coordinator.yml's `name:` is routinely not the GitHub slug, so the
+    # forge needs the resolved `github:` value, not `repo`). Best-effort/
+    # non-blocking (a GitHub outage warns and carries on; the board row above
+    # is already written and is the
+    # source of truth for queue membership) and skipped for an entry that is
+    # already `running` — #2821 was mid-drive with `coord` but no
+    # `status:*`, and re-adding `status:ready` to a running card would
+    # misrepresent it as not-yet-started. This is enqueue-time ONLY: never
+    # mirrored onto `coord drive-queue remove`, which must not untrack.
+    if previous is None or previous.state != STATE_RUNNING:
+        apply_pipeline_track_labels_best_effort(repo, issue, config=cfg)
     if auto_after:
         _record_overlap_prediction(repo, issue, prediction, auto_after)
     suffix = f" after {', '.join(after)}" if after else ""
@@ -713,7 +737,12 @@ def _repo_coordinates(config_path: Path, repo: str) -> tuple[str, str] | None:
         from coord.commands._common import _load_config  # noqa: PLC0415
 
         repo_cfg = _load_config(config_path).repo(repo)
-    except Exception:  # noqa: BLE001 — a config that won't load means no prediction
+    except (Exception, SystemExit):  # noqa: BLE001 — a config that won't load
+        # means no prediction. `SystemExit` is listed for the same reason as in
+        # `validate_config_repo` (#2839 review): `_load_config` reports a
+        # `ConfigError` as `click.echo` + `sys.exit(2)`, a `BaseException`, so
+        # `except Exception` alone would abort `drive-queue add` here instead
+        # of degrading to "no overlap prediction" as documented.
         return None
     if repo_cfg is None:
         return None
@@ -878,7 +907,7 @@ def validate_hold_flags(
         )
 
 
-def validate_config_repo(config_path: Path, repo: str) -> None:
+def validate_config_repo(config_path: Path, repo: str) -> Config | None:
     """Refuse a repo coordinator.yml has never heard of.
 
     `coord drive <repo> <issue>` would fail at preflight anyway
@@ -886,16 +915,29 @@ def validate_config_repo(config_path: Path, repo: str) -> None:
     ``add`` time turns a mysterious tick-time block into an immediate typo
     report.  Fail-OPEN on a config that won't load at all: a thin client whose
     config cache is momentarily unreadable must still be able to queue work.
+
+    Returns the loaded ``Config`` (``None`` when it could not be loaded, i.e.
+    the fail-open path) so the caller does not have to load it a SECOND time
+    — on a thin client each load is a `GET /config` round trip to the board
+    daemon, and #2839's best-effort label write needs the same config only to
+    resolve `repo`'s GitHub slug.
+
+    ``SystemExit`` is caught alongside ``Exception`` deliberately (#2839
+    review): ``_load_config`` reports a ``ConfigError`` as ``click.echo`` +
+    ``sys.exit(2)``, which is a ``BaseException`` — so a bare ``except
+    Exception`` here would NOT fail open at all, it would abort `add` with
+    exit code 2, the exact opposite of this function's documented posture.
     """
     try:
         from coord.commands._common import _load_config  # noqa: PLC0415
 
         config = _load_config(config_path)
-    except Exception:  # noqa: BLE001 — see the fail-open note above
-        return
+    except (Exception, SystemExit):  # noqa: BLE001 — see the fail-open note above
+        return None
     if config.repo(repo) is None:
         known = ", ".join(sorted(r.name for r in config.repos)) or "(none)"
         raise QueueError(f"repo {repo!r} is not in coordinator.yml (known: {known})")
+    return config
 
 
 # ── list ─────────────────────────────────────────────────────────────────────
@@ -1413,7 +1455,13 @@ def drive_queue_log_intervention(
 @click.argument("issue", type=int)
 @_CONFIG_OPTION
 def drive_queue_remove(repo: str, issue: int, config_path: Path) -> None:
-    """Drop REPO ISSUE from the queue (positions are renumbered dense)."""
+    """Drop REPO ISSUE from the queue (positions are renumbered dense).
+
+    #2839: deliberately does NOT touch the `coord`/`status:*` labels `add`
+    applies — dropping out of the drive queue is not eviction from the
+    Pipeline. `coord untrack` stays the only way to evict a card; do not
+    "fix" this asymmetry by mirroring `add`'s label write here.
+    """
     from coord.state import dequeue_drive_queue, get_drive_queue_entry  # noqa: PLC0415
 
     # #2235 Phase 0: read the row BEFORE deleting it, because `remove` on a

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/commands/issues.py

@@ -14,6 +14,8 @@ from coord.commands._common import (
     _CONFIG_OPTION,
     _load_config,
     _resolve_repo_slug,
+    PIPELINE_TRACK_LABELS_ADD,
+    PIPELINE_TRACK_LABELS_REMOVE_IF_PRESENT,
 )
 
 
@@ -783,8 +785,8 @@ def track(repo: str, issue: int, config_path: Path) -> None:
     slug = _resolve_repo_slug(cfg, repo)
     _apply_label_change(
         repo, issue, config_path,
-        add={"coord", "status:ready"},
-        remove_if_present={"status:refining", "status:backlog"},
+        add=PIPELINE_TRACK_LABELS_ADD,
+        remove_if_present=PIPELINE_TRACK_LABELS_REMOVE_IF_PRESENT,
         success_message=(
             f"#{issue} ({slug}) sent to Pipeline (coord + status:ready)"
         ),

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/commands/release.py

@@ -1337,16 +1337,17 @@ def _python_lane_versions(
     """``{host: the OLDEST version its python lane reports}`` (#2101).
 
     "Python lane" is whatever :func:`coord.release_propagate.verify_lane_kind`
-    grades as one — the venv itself plus the live `coord-serve` process —
-    rather than a second list that could drift from the one the roll and the
-    gate already use.
+    grades as one — the venv itself plus the live `coord-serve` and
+    `coord-agent` processes — rather than a second list that could drift
+    from the one the roll and the gate already use.
 
     Two deliberate readings:
 
     * the OLDEST readable version wins, because a host is as behind as its
-      most stale python lane. A venv that swapped while `coord-serve` still
-      runs the old generation is #2069's exact defect, and it must read as
-      "behind", not as "done";
+      most stale python lane. A venv that swapped while `coord-serve` (or,
+      on the daemon host, `coord-agent` — #2841) still runs the old
+      generation is #2069's exact defect, and it must read as "behind", not
+      as "done";
     * a host with an unreadable lane and no readable lane BEHIND the target is
       ``None`` — "no data", never "current" (#1834). `None` is what stops the
       host being cordoned on a guess *and* what stops an existing cordon being

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/release_propagate.py

@@ -271,10 +271,21 @@ ALL_LANES: tuple[str, ...] = (LANE_PYTHON, LANE_UNITS, LANE_TUI)
 #: spawns`` (what it would hand subprocesses), and the one #2069's restart
 #: actually targets, so it needs its own exact entry rather than falling out
 #: of the ``" spawns"`` suffix rule below.
+#:
+#: ``coord-agent process`` (:func:`coord.release_verify.lanes_for_host`) is
+#: #2069 for ``coord-agent``: the agent's own frozen-at-start ``__version__``,
+#: as distinct from ``coord-agent spawns`` (a fresh subprocess re-resolving
+#: the venv on every poll, which flips the instant a swap lands whether or
+#: not the agent restarted). On the daemon host the agent can *never*
+#: self-restart (`agent_app.py`'s `_idle_restart_target` refuses there on
+#: purpose), so this is the only lane that still reads a staged-but-
+#: unrestarted swap as behind on that host — see the module docstring's
+#: "REACH MUST GROW TO MEET THE GATE" section.
 _VERIFY_LANE_EXACT: dict[str, str] = {
     "~/.coord-venv": LANE_PYTHON,
     "coord-tui": LANE_TUI,
     "coord-serve process": LANE_PYTHON,
+    "coord-agent process": LANE_PYTHON,
 }
 
 #: Units whose *live process* a python-lane roll actually replaces. ``POST

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/coord/release_verify.py

@@ -245,6 +245,36 @@ def lanes_for_host(host: str, health: dict | None) -> list[Lane]:
             )
         )
 
+    # ── coord-agent process — the agent's OWN running version (#2841) ────
+    # `version` is `coord.__version__`, imported once at process start and
+    # frozen for that process's whole life (`coord/agent_app.py`'s health
+    # handler: `data["version"] = __version__`). That is exactly what #1834
+    # means by "verify the running process, not the venv" — unlike
+    # `coord-agent spawns` above, which resolves a *fresh* `coord --version`
+    # subprocess through the service PATH and therefore reports the new
+    # version the instant a blue/green swap flips `~/.coord-venv`, whether or
+    # not the agent that would spawn it has itself restarted.
+    #
+    # That distinction is cosmetic almost everywhere, because the agent
+    # self-restarts on an idle swap (`_idle_restart_target`) and the two
+    # lanes reconverge within one poll cycle. It stops being cosmetic on the
+    # daemon host: `_idle_restart_target` deliberately returns `None` there
+    # (a self-restarted agent would out-rank the `coord-serve` sitting next
+    # to it — see that function's docstring), so the daemon host's agent is
+    # the one case where nothing but this lane ever reads a staged-but-
+    # unrestarted swap as behind. #2069 gave `coord-serve` a `process` lane
+    # for the identical reason; this is that fix one unit over, for
+    # `coord-agent`.
+    if health is not None and "version" in health:
+        lanes.append(
+            Lane(
+                host=host,
+                lane="coord-agent process",
+                version=health.get("version") or None,
+                process=True,
+            )
+        )
+
     return lanes
 
 

{code_coordinator-0.5.251 → code_coordinator-0.5.254}/tests/test_cli_drive_queue.py

@@ -38,9 +38,17 @@ from coord.drive_queue import (
     QUEUE_ALERT_ISSUE,
     QUEUE_ALERT_REPO,
     STATE_BLOCKED,
+    STATE_RUNNING,
     QueueEntry,
 )
 
+#: The genuine `coord.state.apply_issue_labels`, captured at import time —
+#: before `_default_pipeline_labels` (autouse) replaces the module attribute
+#: with an inert no-op. A test that needs the REAL seam chain
+#: (state -> `_apply_issue_labels_local` -> `github_ops`) monkeypatches this
+#: back in; see `test_add_labels_gh_with_the_resolved_slug_...`.
+_REAL_APPLY_ISSUE_LABELS = state.apply_issue_labels
+
 REPO = "claude-coordinator"
 # A SECOND repo, so #1972's per-repo capacity has something to be per-repo
 # about: the whole point is that a quadraui entry can ride alongside an
@@ -130,6 +138,33 @@ def no_tmux(monkeypatch):
     monkeypatch.setattr("coord.drive.list_drive_sessions", lambda *a, **k: [])
 
 
+@pytest.fixture(autouse=True)
+def _default_pipeline_labels(monkeypatch):
+    """#2839: `add` now also projects `coord`/`status:ready` onto the issue
+    via `coord.state.apply_issue_labels` — default that to an inert no-op for
+    every test in this file that doesn't care about it (the overwhelming
+    majority).
+
+    Without this, `add`'s real label write falls through to `github_ops._gh`
+    and, in any test that has ALSO mocked `subprocess.run` (the `launches`
+    fixture below, used to capture `coord drive --tmux` argvs across the
+    file), lands in that SAME capture — `subprocess.run` is one singleton
+    module attribute, so a mock installed for one caller is a mock for
+    every caller, `gh` included (see conftest's `_no_live_gh` docstring).
+    That polluted `launches` with spurious `gh issue view`/`gh issue edit`
+    entries for every test that calls `add` before asserting on `launches`.
+
+    The dedicated `labels` fixture (see the #2839 section below) requests
+    this same seam explicitly and, being function-scoped with no dependency
+    on this one, resolves after it — so its more specific mock simply
+    overrides this default for the handful of tests that actually assert on
+    the label call.
+    """
+    monkeypatch.setattr(
+        "coord.state.apply_issue_labels", lambda *a, **k: ([], False)
+    )
+
+
 @pytest.fixture(autouse=True)
 def tick_lock(monkeypatch, tmp_path) -> Path:
     """Give every test its own tick lock.
@@ -272,6 +307,171 @@ def test_add_refuses_a_malformed_after_entry(cli):
     assert state._list_drive_queue_local() == []
 
 
+# ── #2839: enqueueing projects `coord` + `status:ready` onto the issue ───────
+#
+# Pipeline membership IS the `coord` label (`coord untrack`'s own help text)
+# but `drive_queue_add` used to write only the board row — GitHub never heard
+# about it, so a queued issue could sit invisible in the Pipeline until an
+# operator ran `coord track` by hand. This mirrors `coord track`'s own label
+# write on every `add`: idempotent (asserted via `test_add_writes_a_row...`'s
+# sibling below re-running cleanly), non-blocking on a GitHub outage, and
+# never re-applied to an entry that is already running (#2821 was mid-drive
+# with `coord` but no `status:*` — forcing `status:ready` back onto it would
+# misrepresent it as not-yet-started).
+
+
+@pytest.fixture
+def labels(monkeypatch):
+    """Capture ``coord.state.apply_issue_labels`` calls instead of touching GitHub."""
+    calls: list[dict[str, Any]] = []
+
+    def _fake(repo_name, issue_number, *, add, remove, repo_github=None):
+        calls.append(
+            {
+                "repo_name": repo_name,
+                "issue_number": issue_number,
+                "add": add,
+                "remove": remove,
+                "repo_github": repo_github,
+            }
+        )
+        return (sorted(add), True)
+
+    monkeypatch.setattr("coord.state.apply_issue_labels", _fake)
+    return calls
+
+
+def test_add_applies_coord_and_status_ready_on_a_fresh_issue(cli, labels):
+    result = cli("add", REPO, "1650")
+    assert result.exit_code == 0, result.output
+    assert len(labels) == 1
+    call = labels[0]
+    assert call["repo_name"] == REPO
+    assert call["issue_number"] == 1650
+    assert call["add"] == {"coord", "status:ready"}
+    assert call["remove"] == {"status:refining", "status:backlog"}
+    # #2839 review: the RESOLVED GitHub slug, not the bare coordinator.yml
+    # `name:`. The two diverge in `_CONFIG_YAML` above exactly as they do in
+    # this repo's own `coordinator.example.yml` (`name: code-coordinator` vs
+    # `github: JDonaghy/claude-coordinator`), and `gh issue edit --repo`
+    # requires `[HOST/]OWNER/REPO` — handing it `claude-coordinator` errors
+    # out, so the label would never land for precisely the repos #2839 was
+    # filed about.
+    assert call["repo_github"] == "john/claude-coordinator"
+
+
+def test_add_survives_a_failing_label_write(cli, monkeypatch):
+    def _boom(*_a, **_k):
+        raise RuntimeError("gh unreachable")
+
+    monkeypatch.setattr("coord.state.apply_issue_labels", _boom)
+    result = cli("add", REPO, "1650")
+    assert result.exit_code == 0, result.output
+    assert f"{REPO}#1650" in result.output
+    # The board row is the source of truth for queue membership — it must
+    # land even though the label write (a projection of it) failed.
+    assert queued(1650) is not None
+
+
+def test_add_labels_gh_with_the_resolved_slug_not_the_local_repo_name(cli, monkeypatch):
+    """#2839 review (blocking): the slug that actually reaches the forge.
+
+    The `labels` fixture above stubs `coord.state.apply_issue_labels`, so it
+    can only see what the CLI *asked* for — it cannot catch a `repo_github`
+    that is wrong by the time `gh` runs. This test un-stubs that seam and
+    lets the real `apply_issue_labels` ->
+    `_apply_issue_labels_local` -> `github_ops.change_issue_labels` chain run,
+    stubbing only the last hop (which shells out to
+    `gh issue edit --repo <slug>`, and `gh` rejects anything that is not
+    `[HOST/]OWNER/REPO`).
+
+    `_CONFIG_YAML` deliberately diverges `name: claude-coordinator` from
+    `github: john/claude-coordinator`, the same way this repo's own
+    `coordinator.example.yml` does. If `add` ever regresses to passing
+    `repo_github=None`, `_apply_issue_labels_local`'s `repo_github or
+    repo_name` fallback hands `gh` the bare local name, `gh` errors, and the
+    best-effort helper silently swallows it — the #2839 label never lands,
+    only now without a traceback.
+    """
+    seen: list[str] = []
+
+    def _fake_change_issue_labels(slug, issue_number, *, add, remove):
+        seen.append(slug)
+        return (sorted(add), True)
+
+    monkeypatch.setattr("coord.state.apply_issue_labels", _REAL_APPLY_ISSUE_LABELS)
+    monkeypatch.setattr(
+        "coord.github_ops.change_issue_labels", _fake_change_issue_labels
+    )
+
+    result = cli("add", REPO, "1650")
+    assert result.exit_code == 0, result.output
+    assert seen == ["john/claude-coordinator"]
+
+
+def test_add_survives_a_config_that_will_not_load(cli, monkeypatch, labels):
+    """#2839 review (iteration 1): a config-load failure must not kill `add`.
+
+    `_load_config` reports a `ConfigError` — a thin client's
+    `fetch_remote_config` timing out against a momentarily-unreachable board
+    daemon, a briefly-unreadable `coordinator.yml` — as `click.echo(...)` +
+    `sys.exit(2)`, i.e. `SystemExit`, which is a `BaseException` and so
+    escapes a bare `except Exception`. The enqueue must still succeed (the
+    board row is the source of truth), and the label write must still be
+    attempted, degraded to an unresolved slug rather than skipped.
+    """
+    from coord.commands import _common
+
+    def _boom_exit(*_a, **_k):
+        raise SystemExit(2)
+
+    monkeypatch.setattr(_common, "_load_config", _boom_exit)
+
+    result = cli("add", REPO, "1650")
+    assert result.exit_code == 0, result.output
+    assert queued(1650) is not None
+    assert len(labels) == 1
+    assert labels[0]["add"] == {"coord", "status:ready"}
+    # No config to resolve `name:` -> `github:` with, and `claude-coordinator`
+    # is not itself a slug, so this degrades to the `repo_name` fallback
+    # rather than inventing one.
+    assert labels[0]["repo_github"] is None
+
+
+@pytest.mark.parametrize(
+    ("repo_arg", "expected"),
+    [
+        # Known local name -> its `github:` slug, even when the two diverge.
+        (REPO, "john/claude-coordinator"),
+        # Unknown to coordinator.yml but already a slug: usable as-is (the
+        # same fallback `_resolve_repo_slug` validates).
+        ("someone/untracked-repo", "someone/untracked-repo"),
+        # Unknown AND not a slug: unresolvable, so say so instead of guessing.
+        ("typo-repo", None),
+    ],
+)
+def test_resolve_repo_slug_best_effort(config_file: Path, repo_arg, expected):
+    """The non-fatal sibling of `_resolve_repo_slug` never calls `sys.exit`."""
+    from coord.commands._common import _load_config, resolve_repo_slug_best_effort
+
+    cfg = _load_config(config_file)
+    assert resolve_repo_slug_best_effort(cfg, repo_arg) == expected
+    # `config=None` (the fail-open path) degrades, it does not explode.
+    assert resolve_repo_slug_best_effort(None, repo_arg) == (
+        repo_arg if "/" in repo_arg else None
+    )
+
+
+def test_add_does_not_relabel_an_already_running_entry(cli, labels):
+    assert cli("add", REPO, "1650").exit_code == 0
+    labels.clear()
+    state.update_drive_queue_entry(REPO, 1650, state=STATE_RUNNING)
+
+    result = cli("add", REPO, "1650", "--machine", "dellserver")
+    assert result.exit_code == 0, result.output
+    assert labels == []
+
+
 # ── #2247: predicted file-overlap ordering ───────────────────────────────────
 #
 # The acceptance bar from the issue, driven end to end through the real CLI: