ci(windows): switch from windows-latest-8-cores to ubicloud-standard-2-windows

`windows-latest-8-cores` sat queued indefinitely because the GitHub
larger-runner billing isn't enabled at the org level — the
"Queued — Waiting to run this check" status surfaced on PR #1505 with
no progress for the whole CI run.

Switch to Ubicloud Windows runners (`ubicloud-standard-2-windows`) so
Windows CI uses the same provider as the existing Linux evals
(`ubicloud-standard-2`). Billing stays under one account instead of
two.

Register the new label in actionlint.yaml alongside the existing
ubicloud-standard-2 entry so actionlint doesn't reject it as unknown.

CHANGELOG entry updated: runner row reflects the actual provider chosen,
"Itemized changes" mentions the actionlint.yaml registration, and the
narrative paragraph documents why `windows-latest-8-cores` failed first.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/windows-free-tests.yml

@@ -8,11 +8,12 @@ name: Windows Free Tests
 # targeted resolver tests that exercise the Bun.which-based claude binary
 # resolution + the GSTACK_CLAUDE_BIN override path on Windows.
 #
-# Runner: migrated v1.38.0.0 from GitHub-hosted `windows-latest` to the paid
-# GitHub-hosted `windows-latest-8-cores` runner — 4x more cores at GitHub's
-# larger-runner billing rate. Ubicloud doesn't ship Windows runners (only
-# Linux), so we stay GitHub-hosted. Swap to `windows-latest` to revert to
-# the free runner if billing/quota becomes an issue.
+# Runner: Ubicloud Windows runner (`ubicloud-standard-2-windows`). Matches
+# the Ubicloud Linux runner the evals workflow already uses, so billing
+# stays consolidated under one provider. Swap to `windows-latest` to revert
+# to GitHub's free runner if Ubicloud has Windows capacity issues. Note
+# `windows-latest-8-cores` (GitHub paid larger runner) sat queued because
+# org-level larger-runner billing wasn't enabled.
 #
 # What this DOES NOT do (still out of scope, tracked as follow-up):
 #   - Run the full free suite on Windows. The 24 tests that hardcode /bin/sh,
@@ -33,9 +34,9 @@ concurrency:
 
 jobs:
   windows-free-tests:
-    # Paid GitHub-hosted larger Windows runner (8 cores vs the free 4-core
-    # windows-latest). To revert: swap to `windows-latest`.
-    runs-on: windows-latest-8-cores
+    # Ubicloud Windows runner (same provider as the Linux evals workflow).
+    # To revert: swap to `windows-latest` (GitHub's free 4-core Windows runner).
+    runs-on: ubicloud-standard-2-windows
     timeout-minutes: 15
 
     steps:

CHANGELOG.md

@@ -9,7 +9,7 @@ Windows users who pull `git pull && ./setup` now get fresh skill files for every
 
 The browse server's Unicode sanitization lifts from `handleCommand` (PR #1463's original target) to `handleCommandInternal` so the batch command path (`/command/batch`) inherits it too. Both SSE producers (activity feed at `/activity/stream` and inspector stream) now stringify with a `sanitizeReplacer` function that cleans every string value during JSON.stringify — post-stringify regex is ineffective there because `JSON.stringify` has already converted `\uD800` into the escape sequence `"\\ud800"` before the regex would run. Result: every page-content payload that ships from the server has lone UTF-16 surrogate halves replaced with U+FFFD before any downstream consumer (Anthropic API, sidebar JSON.parse) sees them.
 
-The `windows-free-tests.yml` CI lane migrates from GitHub-hosted `windows-latest` to GitHub's paid larger `windows-latest-8-cores` runner — 4x the cores at the larger-runner billing rate. Ubicloud doesn't ship a Windows pool, so we stay GitHub-hosted rather than introducing a new third-party CI provider just for one Windows job. Four new wave tests get registered: sanitizer unit + bug-repro + wiring invariants, setup helper static-invariant + behavior matrix, build-script POSIX-shell sanity, and a doc-vs-config deprecated-key drift guard. Docs that still referenced the renamed `gbrain_sync_mode` config key now say `artifacts_sync_mode` consistently, and the drift guard prevents reintroduction.
+The `windows-free-tests.yml` CI lane migrates from GitHub-hosted `windows-latest` to `ubicloud-standard-2-windows` — same provider as the existing `ubicloud-standard-2` Linux evals runner, so billing stays consolidated. Earlier attempts used GitHub's paid `windows-latest-8-cores` larger runner but that queued indefinitely waiting for org-level larger-runner billing enablement. Four new wave tests get registered: sanitizer unit + bug-repro + wiring invariants, setup helper static-invariant + behavior matrix, build-script POSIX-shell sanity, and a doc-vs-config deprecated-key drift guard. Docs that still referenced the renamed `gbrain_sync_mode` config key now say `artifacts_sync_mode` consistently, and the drift guard prevents reintroduction.
 
 Contributed by @realcarsonterry: PRs #1460, #1461, #1462, and #1463 are the seed of this wave. The scope expansion to all 42 setup sites + every server egress path + Windows CI migration is the gstack maintainer's follow-through.
 
@@ -24,7 +24,7 @@ Source: this branch's diff against `origin/main` and the wave plan at `~/.claude
 | Bash brace groups in `package.json` build script (Bun-Windows-hostile) | 3 | 0 | -3 |
 | Stale `gbrain_sync_mode` references in docs | 5 | 0 | -5 |
 | New regression tests | 0 | 29 (4 files) | +29 |
-| Windows CI runner cores | 4 (windows-latest) | 8 (windows-latest-8-cores) | 2x cores at larger-runner billing rate |
+| Windows CI runner | windows-latest (GitHub free) | ubicloud-standard-2-windows | consolidates Windows + Linux CI under one Ubicloud account |
 
 The static invariant test (D7) reads `setup` and asserts zero raw `ln` calls outside the `_link_or_copy` helper body — even a single one-line slip by a future contributor fails the build.
 
@@ -46,7 +46,7 @@ If you run gstack on Windows: `./setup` now produces a working install across ev
 - **`browse/src/server.ts`** — `handleCommandInternal` split into `handleCommandInternalImpl` (raw) + thin sanitizing wrapper. Single egress point for both HTTP and batch consumers. Inline INVARIANT comment near the wrapper documents the architectural constraint.
 - **`browse/src/server.ts` SSE producers** — activity feed (`/activity/stream`) and inspector stream stringify with `sanitizeReplacer`, a `JSON.stringify` replacer function that cleans every string value during encoding. Post-stringify regex is a no-op because `JSON.stringify` has already converted `\uD800` to `"\\ud800"` before the regex could match. Inline INVARIANT comment in each.
 - **`setup`** — new `_link_or_copy SRC DST` helper near `IS_WINDOWS` detection (~line 33). Auto-dispatches on file-vs-directory + Windows-vs-Unix, and skips Unix-style name-only aliases (e.g. `gstack/open-gstack-browser` for the connect-chrome alias) when the source doesn't resolve on disk so Windows installs don't abort under `set -e`. All 42 prior `ln -snf` call sites converted to `_link_or_copy`. New `_print_windows_copy_note_once` helper called from `link_claude_skill_dirs` after any link work completes. `cleanup_old_claude_symlinks` and `cleanup_prefixed_claude_symlinks` extended with a Windows branch so `--prefix` / `--no-prefix` flips remove stale real-file SKILL.md copies instead of leaving them behind.
-- **`.github/workflows/windows-free-tests.yml`** — `runs-on: windows-latest` → `runs-on: windows-latest-8-cores` (paid GitHub-hosted larger runner). Test-list expanded to include the 4 new wave tests.
+- **`.github/workflows/windows-free-tests.yml`** — `runs-on: windows-latest` → `runs-on: ubicloud-standard-2-windows` (Ubicloud Windows runner, same provider as the Linux evals). `actionlint.yaml` registers the new label alongside `ubicloud-standard-2`. Test-list expanded to include the 4 new wave tests.
 - **`package.json`** — build script's three `{ git rev-parse HEAD 2>/dev/null || true; } > path/.version` brace groups replaced with `( ... )` subshells. POSIX-universal, Bun-Windows-compatible.
 - **`docs/gbrain-sync.md`, `docs/gbrain-sync-errors.md`** — 5 stale `gbrain_sync_mode` config-key references → `artifacts_sync_mode` (the rename landed in v1.27.0.0 but two docs still pointed at the old key).
 

actionlint.yaml

@@ -1,3 +1,4 @@
 self-hosted-runner:
   labels:
     - ubicloud-standard-2
+    - ubicloud-standard-2-windows