code-coordinator 0.5.311__tar.gz → 0.5.313__tar.gz

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.311
+Version: 0.5.313
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.311
+Version: 0.5.313
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.311",
+  "tag": "0.5.313",
   "distance": 0,
-  "node": "g8003167b7c6ac292c1b0e3a06e71cc4dd08761b2",
+  "node": "g55f6fe539f84cd3b47398af2d29c746352db15e2",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/commands/lifecycle.py

@@ -24,7 +24,13 @@ def _print_housekeeping_result(resp: dict) -> None:
     archived_a = resp.get("archived_assignments", 0)
     archived_n = resp.get("archived_notifications", 0)
     days = resp.get("retention_days")
-    if not archived_a and not archived_n:
+    # #2974: the confirm-worktree sweep runs on its own age window,
+    # independent of `retention_days` above, and must be reported even when
+    # there was nothing terminal to archive — that used to be the ONLY thing
+    # this sweep did, so a run that only reclaimed leaked worktrees must not
+    # print "nothing to archive" and hide it.
+    removed_wt = resp.get("removed_confirm_worktrees", 0)
+    if not archived_a and not archived_n and not removed_wt:
         click.echo(
             f"housekeeping: nothing to archive (no terminal rows older than {days}d)."
         )
@@ -35,6 +41,12 @@ def _print_housekeeping_result(resp: dict) -> None:
         f"housekeeping: {verb} {archived_a} assignment(s) + "
         f"{archived_n} notification(s) (terminal, older than {days}d).{suffix}"
     )
+    if removed_wt:
+        wt_verb = "would remove" if dry else "removed"
+        click.echo(
+            f"housekeeping: {wt_verb} {removed_wt} stale confirm-worktree(s) "
+            "(#2974)."
+        )
 
 
 @click.command(

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/commands/release.py

@@ -2319,10 +2319,26 @@ def _roll_tui(machine, *, local_name: str | None) -> tuple[bool | None, str]:
     (:func:`coord.tui_release.fetch_latest_release_tag`) — that is the
     :data:`~coord.release_propagate.CHANNEL_TUI` channel doing its own version
     selection, not this run guessing across a channel boundary.
+
+    #2981 — AN EMPTY CHANNEL IS NOT A FAILED ROLL.
+    A channel with zero releases/tags 404s on every ``coord tui update``
+    forever, until someone cuts a first release — that is a fact about
+    ``coord-tui``'s Releases, not about whatever this host just attempted.
+    ``coord tui update`` exits :data:`~coord.commands.tui.EXIT_EMPTY_CHANNEL`
+    specifically for that case (``EmptyReleaseChannelError``, raised at the
+    source in :func:`coord.tui_release.fetch_latest_release_tag`), so this
+    reads that exact exit code and returns ``ok=None`` — the same "no channel
+    to roll" treatment already given to a remote host above, which
+    :func:`coord.release_propagate.scope_verification` excludes from the
+    gate that ``--rollback-on-red`` acts on. A *genuine* failure (a real
+    release exists but the asset/checksum/install step fails) still exits
+    ``1`` here and stays ``ok=False`` — still blocking, still eligible to
+    trigger a rollback.
     """
     import subprocess  # noqa: PLC0415
 
     from coord import release_propagate as rp  # noqa: PLC0415
+    from coord.commands.tui import EXIT_EMPTY_CHANNEL  # noqa: PLC0415
 
     if local_name is None or machine.name != local_name:
         return None, (
@@ -2343,7 +2359,13 @@ def _roll_tui(machine, *, local_name: str | None) -> tuple[bool | None, str]:
             if installed
             else f"coord-tui updated from the {rp.CHANNEL_TUI} channel"
         )
-    return False, (proc.stderr or proc.stdout or f"exit {proc.returncode}").strip()[:300]
+    detail = (proc.stderr or proc.stdout or f"exit {proc.returncode}").strip()[:300]
+    if proc.returncode == EXIT_EMPTY_CHANNEL:
+        return None, (
+            f"{rp.CHANNEL_TUI} channel has no published release yet — "
+            f"nothing to install, not a roll failure (#2981): {detail}"
+        )
+    return False, detail
 
 
 def _installed_tui_version(stdout: str) -> str | None:

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/commands/tui.py

@@ -49,6 +49,7 @@ from coord.tui_release import (
     DEFAULT_INSTALL_PATH,
     DEFAULT_REPO,
     DEV_BUILD_SENTINEL_VERSION,
+    EmptyReleaseChannelError,
     ReleaseAssetNotFoundError,
     UnsupportedPlatformError,
     detect_target,
@@ -63,6 +64,15 @@ from coord.tui_release import (
     sha256_file,
 )
 
+#: `tui update`'s exit code when the channel has never published a release
+#: (#2981) — distinct from the generic ``1`` used for every other failure so
+#: `coord/commands/release.py`'s `_roll_tui` can tell "nothing to install
+#: yet" apart from "the roll actually failed" by exit code alone, with no
+#: string-matching of the error message. Kept here (not in `tui_release.py`)
+#: because it is a detail of *this command's* process-exit contract, the
+#: same reason `3` (the dev-build refusal below) lives here too.
+EXIT_EMPTY_CHANNEL = 4
+
 
 def _dest_path(dest: str | None) -> Path:
     return Path(dest).expanduser() if dest else Path(DEFAULT_INSTALL_PATH).expanduser()
@@ -310,6 +320,15 @@ def tui_update(
             target_version = fetch_latest_release_tag(
                 repo=repo, api_base=api_base, timeout=timeout
             )
+        except EmptyReleaseChannelError as exc:
+            # #2981: this channel has never published a release -- there is
+            # nothing to install, but that is a fact about the CHANNEL, not
+            # evidence that this run's attempt failed. A distinct exit code
+            # (rather than the generic `1` below) lets a caller such as
+            # `coord release propagate` grade the two differently without
+            # parsing this message.
+            click.echo(f"error: {exc}", err=True)
+            sys.exit(EXIT_EMPTY_CHANNEL)
         except Exception as exc:  # noqa: BLE001 -- surface any network/HTTP failure plainly
             click.echo(
                 f"error: could not resolve coord-tui's latest release from "

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/confirm_test.py

@@ -104,6 +104,7 @@ existed.
 from __future__ import annotations
 
 import os
+import shutil
 import subprocess
 import threading
 import time
@@ -484,6 +485,106 @@ def confirm_lock_path(repo_name: str, branch: str) -> Path:
     return COORD_DIR / "confirm-worktrees" / f"{safe}.lock"
 
 
+#: #2974: default age (hours) a directory under ``confirm-worktrees/`` may sit
+#: unremoved before :func:`sweep_stale_confirm_worktrees` reclaims it outright.
+#: Every entry under that root is throwaway by construction (#561) and
+#: `confirm_branch`'s own `finally` now removes its worktree on every exit —
+#: so anything still here this long survived something worse than an ordinary
+#: failure (a hard kill of the whole process, `coord-agent`/`coord-serve`
+#: restarting mid-run before #2974's `finally` fix ever ran, a full disk
+#: mid-cleanup). Generous relative to :data:`CONFIRM_DEFAULT_TIMEOUT_SECONDS`
+#: (20 min) so this never races a confirmation that is still legitimately
+#: in flight.
+#:
+#: Footgun to remember if either ceiling ever moves: the margin here is
+#: relative, not enforced. `sweep_stale_confirm_worktrees` doesn't know
+#: whether a given `confirm-worktrees/<repo>-<branch>` entry has a
+#: `confirm_branch` call still running against it — it reclaims purely on
+#: directory mtime. If `CONFIRM_DEFAULT_TIMEOUT_SECONDS` (or a future
+#: per-repo override of it) is ever raised to within a few hours of this
+#: constant, a still-in-flight confirmation's worktree (and its `.lock`
+#: file) could be `rmtree`'d out from under it by this sweep. Keep this
+#: comfortably above whatever the longest configured confirmation timeout
+#: is, not just the current default.
+STALE_WORKTREE_MAX_AGE_HOURS = 6.0
+
+
+def sweep_stale_confirm_worktrees(
+    *,
+    max_age_hours: float = STALE_WORKTREE_MAX_AGE_HOURS,
+    dry_run: bool = False,
+    now: float | None = None,
+) -> dict:
+    """Reclaim ``confirm-worktrees/`` entries older than *max_age_hours* (#2974).
+
+    Belt-and-suspenders over the `finally`-based cleanup in
+    :func:`confirm_branch`: that fix stops the leak going forward, but does
+    nothing about the hundreds of directories (189G measured on one host,
+    #2974) a build that never reaches this fix — or any future bug in the
+    cleanup path itself — can still leave behind. This sweep is the backstop
+    that ages them out regardless of cause.
+
+    Deliberately filesystem-only: it reclaims disk with a plain
+    ``shutil.rmtree`` keyed on directory mtime, and does **not** attempt a
+    ``git worktree prune`` in the originating repo's checkout (that would
+    need to map each ``<repo>-<branch>`` directory name back to a configured
+    repo, which is ambiguous when a repo or branch name itself contains a
+    ``-``). The admin metadata that leaves behind in the base checkout's
+    ``.git/worktrees/`` is a few KB per entry — negligible next to the build
+    trees this reclaims — and self-heals the next time :func:`confirm_branch`
+    or :func:`coord.revalidate.revalidate` runs `git worktree prune` for that
+    repo anyway.
+
+    Called from :func:`coord.housekeeping.sweep`'s existing low-cadence
+    daemon tick and ``coord housekeeping``, so it needs no new wiring or
+    schedule of its own. Returns
+    ``{"removed": [names], "dry_run": bool, "max_age_hours": float}`` —
+    ``removed`` lists what was (or, for ``dry_run``, would be) deleted.
+    Silently a no-op if the directory does not exist yet.
+    """
+    from coord.state import COORD_DIR  # noqa: PLC0415
+
+    root = COORD_DIR / "confirm-worktrees"
+    result: dict = {
+        "removed": [],
+        "dry_run": dry_run,
+        "max_age_hours": max_age_hours,
+    }
+    if not root.exists():
+        return result
+
+    cutoff = (now if now is not None else time.time()) - max_age_hours * 3600.0
+    try:
+        entries = sorted(root.iterdir())
+    except OSError:
+        return result
+
+    for entry in entries:
+        # Lock files (`confirm_lock_path`) are tiny and self-explanatory by
+        # name; only the worktree directories themselves are the disk cost
+        # this sweep exists to reclaim. A stray lock with no matching
+        # worktree directory is harmless — the next `confirm_branch` call for
+        # that (repo, branch) simply re-creates and re-locks it.
+        if entry.name.endswith(".lock") or not entry.is_dir():
+            continue
+        try:
+            mtime = entry.stat().st_mtime
+        except OSError:
+            continue
+        if mtime >= cutoff:
+            continue
+        result["removed"].append(entry.name)
+        if dry_run:
+            continue
+        shutil.rmtree(entry, ignore_errors=True)
+        lock_path = root / f"{entry.name}.lock"
+        try:
+            lock_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+    return result
+
+
 def branch_touched_files(repo_dir: Path, branch: str, base_branch: str) -> list[str]:
     """Paths the branch changes vs its merge-base with *base_branch*.
 
@@ -915,9 +1016,9 @@ def confirm_branch(
                 test_command,
             )
 
-        # Green, and observed rather than reported. Clean up: nothing to
-        # inspect.
-        _remove_worktree(repo_dir, wt_path)
+        # Green, and observed rather than reported. Nothing to inspect —
+        # cleanup happens in `finally` below, same as every other exit from
+        # this block.
         return ConfirmationResult(
             kind=KIND_OK,
             reason=(
@@ -928,6 +1029,31 @@ def confirm_branch(
             returncode=0,
         )
     finally:
+        # #2974: EVERY exit from the block above — including KIND_TIMEOUT
+        # (a hung/slow suite), KIND_SIGNAL (a coord-agent/coord-serve restart
+        # landing mid-run, #2527), and a genuine refutation (KIND_BUILD/
+        # KIND_SUITE) — must remove this worktree, not just the green path.
+        #
+        # `coord.revalidate`'s sibling helper deliberately KEEPS a failed
+        # worktree "for inspection" (see its `_remove_worktree` docstring and
+        # `format_failure`'s "worktree kept for inspection" line) because
+        # `coord merge --revalidate` is opt-in, operator-initiated, and rare —
+        # a human is watching and can go look at the tree it names.
+        # `confirm_branch` is the opposite shape: it runs unattended, on every
+        # PASS claim, inside the automatic reap path, keyed by (repo, branch)
+        # — and a branch is rarely revisited, so nothing was ever going to
+        # remove a "kept for inspection" tree here. That is exactly how this
+        # leaked to 189G / 346 dirs on one host in nine days (#2974): the
+        # biggest trees came from the slowest repos, i.e. precisely the
+        # KIND_TIMEOUT/KIND_SIGNAL runs that used to fall through this
+        # `finally` without cleanup.
+        #
+        # Nothing of diagnostic value is lost: the captured output tail
+        # (`ConfirmationResult.output`) is already persisted to
+        # `test_output/<assignment_id>.txt` by `write_confirmation_output`
+        # regardless of outcome — the worktree itself was never the thing an
+        # operator actually inspected.
+        _remove_worktree(repo_dir, wt_path)
         lock.release()
 
 
@@ -942,6 +1068,7 @@ __all__ = [
     "NOTIFY_BASE_CLIENT_TIMEOUT_SECONDS",
     "PERMISSION_DENIED_EXIT",
     "REFUTING_KINDS",
+    "STALE_WORKTREE_MAX_AGE_HOURS",
     "ConfirmationResult",
     "begin_confirmation_pass",
     "branch_touched_files",
@@ -952,6 +1079,7 @@ __all__ = [
     "confirmation_timeout",
     "notify_client_timeout_seconds",
     "spend_confirmation_budget",
+    "sweep_stale_confirm_worktrees",
     "unmet_confirmation_capabilities",
     "write_confirmation_output",
 ]

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/housekeeping.py

@@ -33,6 +33,14 @@ declog. ``coord.merge_queue.merged_issue_keys()`` unions the live table with
 the archive so the "already merged, don't re-enqueue" dedup in
 ``enqueue_approved_work``/``staging_items`` keeps working after a row ages
 out.
+
+#2974: this is also the one existing low-cadence, filesystem-safe hook the
+daemon already calls on a timer (and that ``coord housekeeping`` calls on
+demand) — so it is where :func:`coord.confirm_test.sweep_stale_confirm_worktrees`
+is wired in too, reclaiming ``~/.coord/confirm-worktrees/`` entries that
+outlived ``confirm_branch``'s own per-run cleanup. That is disk hygiene, not
+DB archiving, but reusing this sweep's cadence beats inventing a second timer
+for a second maintenance job.
 """
 
 from __future__ import annotations
@@ -140,12 +148,13 @@ def _move_rows(
 
 def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     """Archive stale terminal assignments + their notifications + merged
-    merge_queue entries.
+    merge_queue entries, and reclaim leaked confirm-worktree directories.
 
     Returns ``{"archived_assignments": N, "archived_notifications": M,
-    "archived_merge_queue": K, "dry_run": bool, "retention_days": D}``.
-    ``archived_*`` are the counts that were (or, for ``dry_run``, would be)
-    moved.  A no-op returns zeros.
+    "archived_merge_queue": K, "removed_confirm_worktrees": W, "dry_run": bool,
+    "retention_days": D}``. ``archived_*``/``removed_confirm_worktrees`` are
+    the counts that were (or, for ``dry_run``, would be) moved/deleted.  A
+    no-op returns zeros.
 
     Conservative by construction: nothing active, recent (within the archive
     window), queued-for-merge, latest-of-an-open-issue, or review-linked to any
@@ -153,17 +162,29 @@ def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     are in the terminal ``MERGED`` state (#1107 Part 3) — non-terminal /
     conflicted entries are left for ``prune_stale_queue_entries`` or manual
     ``coord merge --drop``.
+
+    #2974: ``removed_confirm_worktrees`` is independent of the DB-archiving
+    ``cutoff``/``retention_days`` above (it has its own, much shorter,
+    :data:`coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS` window) and runs
+    even when DB archiving itself is disabled (``COORD_ARCHIVE_RETENTION_DAYS``
+    ``<= 0``) — a disk leak on the daemon host is not something an operator
+    who merely turned off DB archiving meant to also keep.
     """
+    from coord.confirm_test import sweep_stale_confirm_worktrees  # noqa: PLC0415
+
+    swept_worktrees = sweep_stale_confirm_worktrees(dry_run=dry_run, now=now)
+
     cutoff = _archive_cutoff(now)
     result = {
         "archived_assignments": 0,
         "archived_notifications": 0,
         "archived_merge_queue": 0,
+        "removed_confirm_worktrees": len(swept_worktrees["removed"]),
         "dry_run": dry_run,
         "retention_days": _archive_retention_days(),
     }
     if cutoff is None:
-        return result  # archiving disabled
+        return result  # DB archiving disabled; the worktree sweep above still ran
 
     conn = get_connection()
     index = [

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/serve_app.py

@@ -739,7 +739,9 @@ def _audit_housekeeping_sweep(swept: dict) -> None:
             f"housekeeping: archived {swept.get('archived_assignments', 0)} "
             f"assignment(s), {swept.get('archived_notifications', 0)} "
             f"notification(s), {swept.get('archived_merge_queue', 0)} "
-            "merge_queue entry(ies)"
+            "merge_queue entry(ies), removed "
+            f"{swept.get('removed_confirm_worktrees', 0)} stale "
+            "confirm-worktree(s) (#2974)"
         ),
         details=swept,
     )
@@ -9477,13 +9479,16 @@ def build_app(store: CoordStore, config: Config, *, token: str | None = None) ->
                             swept.get("archived_assignments")
                             or swept.get("archived_notifications")
                             or swept.get("archived_merge_queue")
+                            or swept.get("removed_confirm_worktrees")
                         ):
                             log.info(
                                 "housekeeping: archived %d assignment(s), "
-                                "%d notification(s), %d merge_queue entry(ies)",
+                                "%d notification(s), %d merge_queue entry(ies), "
+                                "removed %d stale confirm-worktree(s)",
                                 swept["archived_assignments"],
                                 swept["archived_notifications"],
                                 swept.get("archived_merge_queue", 0),
+                                swept.get("removed_confirm_worktrees", 0),
                             )
                             _audit_housekeeping_sweep(swept)
                     except Exception:  # noqa: BLE001

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/coord/tui_release.py

@@ -127,6 +127,25 @@ class ReleaseAssetNotFoundError(RuntimeError):
     """The release exists but doesn't carry the asset this host needs."""
 
 
+class EmptyReleaseChannelError(RuntimeError):
+    """The channel has never published a release at all (#2981).
+
+    Distinct from :class:`ReleaseAssetNotFoundError` on purpose: that one
+    means a real release exists but is missing something (an asset, a usable
+    ``tag_name``); this one means there is **no release to even look at** —
+    ``/releases/latest`` 404s because the repo has zero releases and zero
+    tags, not because of a network problem or a malformed one.
+
+    The distinction matters to callers precisely because the two are not
+    graded the same way: "nothing has been published yet" is a fact about
+    the channel, not about whatever this run tried to do, so it must never
+    be treated as evidence that an install/roll attempt itself failed (see
+    ``coord/commands/tui.py``'s ``tui update`` and
+    ``coord/commands/release.py``'s ``_roll_tui``, which special-case this
+    exact exception type rather than string-matching an error message).
+    """
+
+
 @dataclass(frozen=True)
 class ReleaseAsset:
     name: str
@@ -220,9 +239,21 @@ def fetch_latest_release_tag(
     invocation, or worse, an accidental match on an unrelated release that
     happened to share a number.
 
-    Raises on any HTTP/network failure, or when the channel has no release at
-    all — callers decide whether that is fatal (``coord tui update`` has
-    nothing to install) or a soft "could not check" (``coord tui status``).
+    Raises :class:`EmptyReleaseChannelError` when the channel has no release
+    at all — a bare 404 from ``/releases/latest`` (GitHub's own signal for
+    "this repo has never published a release"), or a 200 whose body carries
+    no usable ``tag_name`` (belt-and-braces; not observed from the real API
+    but no less "nothing to resolve" if it ever happened). Any *other*
+    HTTP/network failure (5xx, auth, timeout, DNS) is left to raise as-is —
+    that is a real "could not check", not "nothing published yet".
+
+    #2981: this distinction is exactly what callers need to decide whether
+    an empty channel is fatal (``coord tui update`` has nothing to install)
+    or a soft "could not check" (``coord tui status``) *without* also
+    swallowing a genuine failure into the same bucket. Before this, a bare
+    404 escaped as an undifferentiated ``httpx.HTTPStatusError`` — callers
+    that wanted to tell "empty channel" apart from "the roll failed" had
+    nothing but the error message to match against.
     """
     import httpx  # noqa: PLC0415 — keep import cost off the non-network path
 
@@ -231,11 +262,16 @@ def fetch_latest_release_tag(
     if token:
         headers["Authorization"] = f"Bearer {token}"
     response = httpx.get(url, timeout=timeout, headers=headers, follow_redirects=True)
+    if response.status_code == 404:
+        raise EmptyReleaseChannelError(
+            f"{repo} has no published release to resolve a latest version "
+            f"from (GET {url} -> 404 — this repo has zero releases/tags)"
+        )
     response.raise_for_status()
     data = response.json()
     version = normalize_version((data or {}).get("tag_name"))
     if not version:
-        raise ReleaseAssetNotFoundError(
+        raise EmptyReleaseChannelError(
             f"{repo} has no published release to resolve a latest version from"
         )
     return version

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/tests/test_board_cap_762.py

@@ -20,6 +20,33 @@ RECENT = NOW - 2 * 86400      # 2 days ago  → inside the 14d board window
 OLD = NOW - 40 * 86400        # 40 days ago → outside both windows
 
 
+@pytest.fixture(autouse=True)
+def _isolated_confirm_worktrees_dir(monkeypatch, tmp_path):
+    """#2974: ``housekeeping.sweep()`` now also calls
+    ``coord.confirm_test.sweep_stale_confirm_worktrees`` on every invocation
+    (even ``dry_run=False`` calls made directly, as most tests below do), and
+    that helper resolves its sweep root from the real, lazily-resolved
+    ``coord.state.COORD_DIR`` (``~/.coord`` on POSIX absent a ``$COORD_DIR``
+    override).  Before this fixture, every test in this file that calls the
+    real (non-dry-run) ``housekeeping.sweep()`` — or drives it through the
+    real ``/housekeeping`` endpoint — would ``shutil.rmtree`` anything under
+    the OPERATOR's real ``~/.coord/confirm-worktrees/`` older than
+    ``coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS`` as an untracked side
+    effect of running `pytest`.  Pin ``coord.state.COORD_DIR`` to a private
+    ``tmp_path`` for every test in this module — mirrors
+    ``tests/test_confirm_test.py``'s own ``isolated_coord_dir`` fixture,
+    which the real ``sweep_stale_confirm_worktrees`` call site already
+    trusts (it re-imports ``coord.state.COORD_DIR`` fresh on every call, so
+    a plain ``monkeypatch.setattr`` here is picked up with no further
+    wiring). A file-local autouse fixture (rather than a global one in
+    ``tests/conftest.py``) is deliberate: ``tests/test_platform_paths.py``
+    has real tests that assert ``coord.state.COORD_DIR`` reflects the
+    *actual* default resolution with nothing overriding it, which a global
+    override would break.
+    """
+    monkeypatch.setattr("coord.state.COORD_DIR", tmp_path / "coord-state")
+
+
 def _ins_assignment(
     conn: sqlite3.Connection,
     aid: str,

{code_coordinator-0.5.311 → code_coordinator-0.5.313}/tests/test_cli_release_propagate.py

@@ -1393,6 +1393,99 @@ def test_2026_08_09_a_good_roll_is_not_reverted_by_lanes_it_cannot_roll(
     assert "advisory" in result.output
 
 
+def test_2981_an_empty_tui_channel_does_not_roll_back_the_python_lanes(
+    valid_config_path, state_dir, no_network, monkeypatch
+):
+    """THE #2981 regression, end to end.
+
+    `JDonaghy/coord-tui` had zero releases/tags, so `coord tui update` 404s
+    from `/releases/latest` on every run, forever, until someone cuts a
+    first release. `_roll_tui` on the one host that actually has an install
+    path (`dellserver` in the real incident, `server` here) used to read
+    that 404 exactly like a genuine install failure and report `ok=False` —
+    a BLOCKING result. That put `(tui, server)` inside this run's attempted
+    scope, so a merely-advisory "coord-tui is stale" verify finding on that
+    same host turned blocking, `gate.red` went true, and
+    `--rollback-on-red` reverted the two good python rolls right alongside
+    the tui lane that was never actually broken — a fleet rolled forward
+    and straight back for nothing, twice in a row, per the issue.
+
+    `coord tui update` now exits `EXIT_EMPTY_CHANNEL` for exactly this case
+    (`EmptyReleaseChannelError`, raised at the source in
+    `fetch_latest_release_tag`), and `_roll_tui` reads that exit code back
+    into `ok=None` — the same "no channel to roll" treatment already given
+    to a remote host with no install path at all. `ok=None` excludes the
+    lane from `attempted_scope`, so the verify finding below stays
+    advisory, the gate stays green, and nothing gets rolled back."""
+    from coord import release_verify as rv
+
+    calls = _stub_lanes(monkeypatch)
+
+    def _tui(machine, **kwargs):
+        calls.append(("tui", machine.name))
+        if machine.name == "server":
+            # What `_roll_tui` itself now returns when `coord tui update`
+            # exits `EXIT_EMPTY_CHANNEL` — see its #2981 docstring section.
+            return None, (
+                f"{rp.CHANNEL_TUI} channel has no published release yet — "
+                "nothing to install, not a roll failure (#2981): "
+                "404 Not Found"
+            )
+        return None, "coord-tui is a per-host binary with no remote install path"
+
+    monkeypatch.setattr(release_cmd, "_roll_tui", _tui)
+    _stub_verify(
+        monkeypatch,
+        versions={"laptop": ["0.4.110"], "server": ["0.4.110"]},
+        findings=[
+            # Even a CRIT finding, on the very host that attempted this
+            # lane, must not turn the gate red once the attempt itself is
+            # `ok=None` — that is the whole point of #2052's scoping.
+            rv.Finding(severity="crit", host="server", lane="coord-tui",
+                       summary="coord-tui is 40h older than source"),
+        ],
+    )
+    monkeypatch.setattr(
+        release_cmd, "_rollback_host",
+        lambda *a, **k: pytest.fail(
+            "an empty coord-tui channel is not a failed roll — it must "
+            "never trigger --rollback-on-red"
+        ),
+    )
+    result = CliRunner().invoke(
+        main,
+        ["release", "propagate", "--config", str(valid_config_path),
+         "--target", "0.4.111", "--daemon-host", "server"],
+    )
+    assert result.exit_code == 0, result.output
+
+    record = _records(state_dir)[0]
+    # The run completed and verified — it was never reverted.
+    assert record["status"] == rp.STATUS_VERIFIED
+    # The python lanes for BOTH hosts stayed rolled.
+    for host in ("server", "laptop"):
+        python_lane = next(
+            l for l in record["lanes"] if l["lane"] == "python" and l["host"] == host
+        )
+        assert python_lane["ok"] is True, f"{host}'s good python roll must survive"
+
+    # The tui lane itself is recorded as unrollable, not failed.
+    server_tui = next(
+        l for l in record["lanes"] if l["lane"] == "tui" and l["host"] == "server"
+    )
+    assert server_tui["ok"] is None
+    assert server_tui["unrollable"] is True
+
+    # The verify finding is still journalled in full...
+    assert record["verification"]["severity"] == "crit"
+    assert len(record["verification"]["findings"]) == 1
+    # ...but the gate that `--rollback-on-red` actually acts on is clean.
+    assert record["gate"]["severity"] == "ok"
+    assert len(record["gate"]["blocking"]) == 0
+    assert len(record["gate"]["advisory"]) == 1
+    assert "advisory" in result.output
+
+
 def test_the_outside_reach_message_names_the_manual_remedy(
     valid_config_path, state_dir, no_network, monkeypatch
 ):
@@ -2386,3 +2479,47 @@ def test_roll_tui_surfaces_a_failed_update(monkeypatch):
     ok, detail = release_cmd._roll_tui(_machine(name="server"), local_name="server")
     assert ok is False
     assert "could not resolve" in detail
+
+
+def test_roll_tui_treats_an_empty_channel_as_unrollable_not_failed(monkeypatch):
+    """#2981: `coord tui update` exits `EXIT_EMPTY_CHANNEL` (not the generic
+    `1`) specifically when the channel has never published a release —
+    `JDonaghy/coord-tui`'s actual state, which 404s from `/releases/latest`
+    on every run forever. `_roll_tui` must read that exit code back into
+    `ok=None`, exactly like the "no remote install path" case, so this
+    lane never lands inside a run's attempted scope and can never be
+    grounds for `--rollback-on-red` — see
+    `test_2981_an_empty_tui_channel_does_not_roll_back_the_python_lanes` for
+    the full propagate-level regression this unlocks."""
+    from coord.commands.tui import EXIT_EMPTY_CHANNEL
+
+    class _Proc:
+        returncode = EXIT_EMPTY_CHANNEL
+        stdout = ""
+        stderr = (
+            "error: JDonaghy/coord-tui has no published release to resolve "
+            "a latest version from (GET .../releases/latest -> 404 — this "
+            "repo has zero releases/tags)"
+        )
+
+    monkeypatch.setattr("subprocess.run", lambda argv, **kw: _Proc())
+    ok, detail = release_cmd._roll_tui(_machine(name="server"), local_name="server")
+    assert ok is None
+    assert "not a roll failure" in detail
+    assert "no published release" in detail
+
+
+def test_roll_tui_a_real_failure_still_blocks_after_the_2981_fix(monkeypatch):
+    """The other half of the #2981 acceptance bar: a GENUINE failure (a real
+    release exists, but e.g. the asset/checksum/install step failed) must
+    still exit the generic `1`, and `_roll_tui` must still report `ok=False`
+    -- still blocking, still eligible to trigger a rollback."""
+    class _Proc:
+        returncode = 1
+        stdout = ""
+        stderr = "error: checksum mismatch for coord-tui-x86_64-linux"
+
+    monkeypatch.setattr("subprocess.run", lambda argv, **kw: _Proc())
+    ok, detail = release_cmd._roll_tui(_machine(name="server"), local_name="server")
+    assert ok is False
+    assert "checksum mismatch" in detail