v1.91.5.0 feat: balanced free-suite shards, test:ubicloud, and faster PR eval lane (#2989)

* v1.91.5.0 feat: balanced free-suite shards, 16-way Linux runs, and bun run test:ubicloud

* chore: regenerate agents digest for v1.91.5.0

* ci: serial flaky retry and flake ledger for the Windows free lane

* ci: cancel superseded eval runs; relax LLM-judge clarity bar to 3

.github/workflows/evals-periodic.yml

@@ -275,9 +275,10 @@ jobs:
   report:
     runs-on: ubicloud-standard-2
     needs: [plan-slices, eval-slices, gate-census]
-    # always(): the report must run (and FAIL) when an executor died — a
-    # missing slice artifact reading as green is the class this lane kills.
-    if: always() && needs.plan-slices.result == 'success'
+    # !cancelled(): the report must run (and FAIL) when an executor died — a
+    # missing slice artifact reading as green is the class this lane kills —
+    # but a cancelled run stops here.
+    if: ${{ !cancelled() && needs.plan-slices.result == 'success' }}
     timeout-minutes: 10
     permissions:
       contents: read

.github/workflows/evals.yml

@@ -178,7 +178,10 @@ jobs:
   eval-slices:
     runs-on: ubicloud-standard-8
     needs: [build-image, plan-slices]
-    if: always() && needs.build-image.result == 'success' && needs.plan-slices.result == 'success'
+    # !cancelled(), not always(): still runs when build-image was skipped
+    # (image already published), but a newer push's cancel-in-progress stops
+    # it instead of letting a superseded run finish its paid slices first.
+    if: ${{ !cancelled() && needs.build-image.result == 'success' && needs.plan-slices.result == 'success' }}
     # Aggregate spawn-concurrency budget: 6 slices x EVALS_JOBS=2 x
     # EVALS_CONCURRENCY=2 = 24 concurrent tests lane-wide (the old matrix's
     # 40-way per row queued claude session STARTUP behind 39 siblings and ate
@@ -314,9 +317,10 @@ jobs:
   slices-report:
     runs-on: ubicloud-standard-2
     needs: [plan-slices, eval-slices]
-    # always(): the report must run (and FAIL) when an executor died — a
-    # missing slice artifact reading as green is the class this lane kills.
-    if: always() && needs.plan-slices.result == 'success'
+    # !cancelled(): the report must run (and FAIL) when an executor died — a
+    # missing slice artifact reading as green is the class this lane kills —
+    # but a run superseded by a newer push stops here.
+    if: ${{ !cancelled() && needs.plan-slices.result == 'success' }}
     timeout-minutes: 5
     # contents:read ONLY — this job executes the PR-authored reconcile
     # runner from the PR checkout, so it
@@ -382,7 +386,7 @@ jobs:
   slices-comment:
     runs-on: ubicloud-standard-2
     needs: slices-report
-    if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.slices-report.result != 'skipped'
+    if: ${{ !cancelled() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && needs.slices-report.result != 'skipped' }}
     timeout-minutes: 5
     permissions:
       pull-requests: write

.github/workflows/quality-gate.yml

@@ -93,3 +93,6 @@ jobs:
           scripts/build-app.sh
           scripts/write-version-files.sh
           browse/scripts/build-node-server.sh
+          scripts/ubicloud/ubi-runner.sh
+          scripts/ubicloud/setup-free-suite.sh
+          scripts/ubicloud/test-free.sh

.github/workflows/windows-free-tests.yml

@@ -146,6 +146,13 @@ jobs:
         # exclusions — don't resurrect a hand list in this file.
         env:
           GSTACK_FREE_JOBS: '2'
+          # Same policy as the required Linux lane: process-supervision timing
+          # tests pass alone on this 4-vCPU runner but can stall under the
+          # two-shard load, so attributed failures get one serial retry
+          # (cap 5 files, truncation veto). Every flaky pass is appended to
+          # the ledger uploaded below, so repeats stay visible and ranked.
+          GSTACK_FREE_RETRY_FLAKY: '1'
+          GSTACK_FLAKE_LEDGER: ${{ runner.temp }}/flake-ledger.jsonl
           # Point os.tmpdir() at the runner temp so the shard logs land
           # somewhere the artifact step below can glob.
           TEMP: ${{ runner.temp }}
@@ -176,6 +183,15 @@ jobs:
           path: ${{ runner.temp }}/gstack-free-test-*.log
           if-no-files-found: ignore
 
+      - name: Upload flake ledger
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: flake-ledger-windows
+          path: ${{ runner.temp }}/flake-ledger.jsonl
+          if-no-files-found: ignore
+          retention-days: 90
+
   cookie-native-qualification:
     if: github.event_name == 'workflow_dispatch' && !inputs.dia_native_only && !inputs.native_diagnostics_only && !inputs.dia_launch_comparison && !inputs.dia_gui_readiness
     runs-on: windows-latest