test: guardrail Review-queue specs on dedicated servers -- kills the cohabitation flake

.github/workflows/ci.yml

@@ -328,8 +328,12 @@ jobs:
       # states for its own fail-fast: false, applied here too.
       fail-fast: false
       matrix:
-        shardIndex: [1, 2, 3]
-        shardTotal: [3]
+        # 4-way since the guardrail specs moved to per-test dedicated
+        # servers: the added boot time pushed two 3-way shards past
+        # the 15-minute job cap with zero failing tests -- the exact
+        # revisit trigger testing.md records for shard growth.
+        shardIndex: [1, 2, 3, 4]
+        shardTotal: [4]
     env:
       # Required for the same reason as build-go's ubuntu-latest entry:
       # playwright.config.ts's webServer builds the real server-mode

frontend/e2e/fixtures/server.ts

@@ -273,3 +273,28 @@ export const ATLAS_SELECT_GROUP_MCP_BASE_PORT = 10080
 // test -- same own-server-own-ports reasoning as persistence.
 export const ATLAS_SESSION_SERVER_BASE_PORT = 10100
 export const ATLAS_SESSION_MCP_BASE_PORT = 10120
+
+// guardrail.spec.ts's own dedicated pair: its Review-queue assertions
+// (exact pending/resolved rows, kind-filter narrowing, the sidebar
+// pending-count badge) must never be contaminated by another spec
+// cohabiting the standard per-worker pool's one shared server (e.g.
+// mcp-write-cancel.spec.ts parking its own MCP approval on the same
+// worker) -- same own-server-own-ports reasoning as guardrail-
+// authoring above, one class of bug applied to this file's own
+// Review-queue state.
+export const GUARDRAIL_SPEC_SERVER_BASE_PORT = 10140
+export const GUARDRAIL_SPEC_MCP_BASE_PORT = 10160
+
+// guardrail-review.spec.ts's own dedicated pair -- guardrail.spec.ts's
+// Review-queue tests split into this second file once the converted
+// file crossed the 500-line hand-written-file limit
+// (.claude/rules/architecture.md); its own port pair rather than
+// reusing GUARDRAIL_SPEC_* above, so the two files' worker-time
+// lifetimes can never overlap on the same ports even though same-file/
+// same-worker serialization no longer makes that a correctness risk.
+export const GUARDRAIL_REVIEW_SERVER_BASE_PORT = 10180
+// Kept well clear of the server range above: 8 tests x up to 10-per-
+// test offsets x up to 4 workers pushes the server range itself past
+// 10250, so the MCP base must start beyond that or a computed server
+// port can land on another test's MCP listener.
+export const GUARDRAIL_REVIEW_MCP_BASE_PORT = 10300