feat(tactics): Tactics Lab, phases, superiority engine, personnel panel (T-100 epic)

.gitignore

@@ -13,3 +13,6 @@ test-results/
 *.db-shm
 .DS_Store
 *.egg-info/
+# scripts/build_logo_assets.py review composites: not shipped, regenerated
+# on every run.
+build/logo_review/

Makefile

@@ -3,6 +3,44 @@
 VENV := .venv
 PY := $(VENV)/bin/python
 
+# T-109: derive a stable, distinct POP_WEB_PORT / POP_API_PORT pair from
+# this checkout's own path, so `make dev` / `make e2e` / `make verify` no
+# longer collide when several ticket worktrees run them at the same time.
+# Before this, both defaulted to 5173/8000 everywhere (scripts/dev.sh's
+# fallback, playwright.config.ts's fallback), so a second worktree's
+# `make verify` would find the FIRST worktree's dev server already
+# listening (reuseExistingServer is true outside CI) and quietly test the
+# wrong worktree's code against the wrong worktree's database. That
+# doesn't fail loudly, it looks exactly like a flaky assertion, and it
+# cost this epic several false diagnoses (doc 06 section 6, T-109).
+#
+# `?=` means an explicit `POP_WEB_PORT=7673 POP_API_PORT=10500 make
+# verify` (or an exported value from the shell) always wins over this
+# default, so the manual override every ticket in this epic already
+# relied on keeps working unchanged, including running two worktrees on
+# the SAME two ports on purpose (e.g. one at a time, by hand).
+#
+# CURDIR is make's own absolute working directory (set once at startup,
+# unaffected by any `cd` inside a recipe), so it is exactly the
+# per-worktree checkout path. cksum is POSIX and present on both macOS
+# and the Linux CI runner, so this needs no new dependency. Folding the
+# checksum into 0-999 keeps the derived ports inside a low-collision,
+# non-privileged range (5173-6172 for web, 8000-8999 for api) without a
+# real port-availability probe, which is unnecessary here: CI only ever
+# runs one checkout at a time, so its derived pair is simply "some
+# deterministic port instead of 5173", never a coordination problem.
+#
+# `printf '%s'`, not `echo -n`: make always runs shell functions through
+# /bin/sh regardless of the caller's login shell, and /bin/sh's builtin
+# echo does not honour -n on macOS OR on Debian/Ubuntu's dash (the CI
+# runner's /bin/sh), so `echo -n "$(CURDIR)"` hashes the literal 4
+# characters "-n " glued onto the path instead of the path alone. Still
+# deterministic, but needlessly fragile; printf has no such flag ambiguity
+# in any POSIX shell.
+WORKTREE_OFFSET := $(shell printf '%s' "$(CURDIR)" | cksum | awk '{print $$1 % 1000}')
+export POP_WEB_PORT ?= $(shell echo $$(( 5173 + $(WORKTREE_OFFSET) )))
+export POP_API_PORT ?= $(shell echo $$(( 8000 + $(WORKTREE_OFFSET) )))
+
 bootstrap:
 	python3 -m venv $(VENV)
 	$(VENV)/bin/pip install --quiet --upgrade pip
@@ -30,9 +68,12 @@ test:
 e2e:
 	npx playwright test
 
+# Static source guards. check_palette.py is here rather than in the vitest
+# suite because it reads the shipped CSS text, which vitest stubs out.
 check-copy:
 	$(PY) scripts/check_copy.py
 	$(PY) scripts/validate_seeds.py
+	$(PY) scripts/check_palette.py
 
 # The Brief section 3 permission table, every row (backend/tests/test_permissions.py).
 # `make test` already runs it, but this target also fails when a row is

backend/app/main.py

@@ -13,6 +13,7 @@
     roster,
     sessions,
     suggestions,
+    tactics,
     teams,
     whiteboard,
 )
@@ -27,6 +28,7 @@
 app.include_router(formations.router)
 app.include_router(identity.router)
 app.include_router(sessions.router)
+app.include_router(tactics.router)
 
 
 @app.get("/api/health")

backend/app/models/formations.py

@@ -53,7 +53,7 @@ class RondoZone(Base):
 
     formation_code: Mapped[str] = mapped_column(ForeignKey("formations.code"), primary_key=True)
     # first_line | midfield_box | flank_corridor_left | flank_corridor_right
-    # | last_line | counterpress
+    # | last_line | counterpress_ring
     zone_key: Mapped[str] = mapped_column(String(30), primary_key=True)
     polygon_json: Mapped[list] = mapped_column(JSON, nullable=False)
     rondo_name: Mapped[str] = mapped_column(String(120), nullable=False)

backend/app/routers/formations.py

@@ -23,19 +23,24 @@
 FORMATION_ORDER = ("433", "4231", "442", "352", "343", "541")
 
 # Bible 3G.2's rondo map order (first-line build-up through to the
-# counterpress moment); only 433 carries seeded zones today (seeds/
-# rondo_zones.json), but the ordering applies to any formation that gains
-# a rondo map later. flank_corridor split into left/right (T-101,
-# migration 0006, doc 06 section 3.1); left before right matches the
-# repo's own slot-naming convention (formations.json lists every '_l'
-# slot before its '_r' counterpart, e.g. fb_l before fb_r).
+# counterpress moment); T-103 seeds all six zones on all six formations.
+# flank_corridor split into left/right (T-101, migration 0006, doc 06
+# section 3.1); left before right matches the repo's own slot-naming
+# convention (formations.json lists every '_l' slot before its '_r'
+# counterpart, e.g. fb_l before fb_r).
+#
+# The last key is `counterpress_ring`, doc 06 section 2.3's name for it.
+# It read `counterpress` until T-112, the pre-0007 zone key, which no seed
+# has written since T-103. That stale entry sorted the ring to the end by
+# ACCIDENT (an unknown key falls to len(order)) rather than by intent, and
+# would have silently mis-sorted the moment a seventh zone existed.
 ZONE_ORDER = (
     "first_line",
     "midfield_box",
     "flank_corridor_left",
     "flank_corridor_right",
     "last_line",
-    "counterpress",
+    "counterpress_ring",
 )
 
 
@@ -79,6 +84,7 @@ def list_formations(
                     FormationPositionOut(
                         slot=p["slot"],
                         position_code=p["position_code"],
+                        slot_family=p["slot_family"],
                         x=p["x"],
                         y=p["y"],
                     )
@@ -95,6 +101,15 @@ def list_formations(
                         teaches=z.teaches,
                         polygon=z.polygon_json,
                         trains_pattern_codes=z.trains_pattern_codes,
+                        # doc 06 section 2.3 (T-112). canonical_rondo is the
+                        # no-opposition fallback label; zone_kind and radius
+                        # are what tell the Rondo Map that the counterpress
+                        # ring is a circle around the ball rather than the
+                        # polygon seeded alongside it, which only bounds the
+                        # half of the pitch the ring is coached in.
+                        canonical_rondo=z.canonical_rondo,
+                        zone_kind=z.zone_kind,
+                        radius=z.radius,
                     )
                     for z in zones
                 ],