Merge main dd9834d44d (v1.92.61.0) into gsta203-pr3-subshards (rule 19 grant, GSTA-203 PR 3)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

# Conflicts:
#	.github/workflows/free-tests.yml
#	docs/TESTING_INTERNALS.md
#	scripts/harness-version.json
#	scripts/lib/shard-jobs.ts
#	scripts/test-free-shards.ts
#	test/shard-jobs.test.ts
#	test/windows-native-workflows.test.ts

.github/workflows/evals-main-backstop.yml

@@ -49,7 +49,17 @@ jobs:
       - name: Read the train policy (main)
         id: policy
         run: |
-          train=$(git show "${GITHUB_SHA}:.gstack/ship-policy.json" 2>/dev/null | jq -c 'if (.train | type) == "object" then .train else null end' 2>/dev/null || true)
+          ref="$GITHUB_SHA" file=.gstack/ship-policy.json policy=null
+          read_failed() { echo "::error::cannot read ${file} at ${ref}. $1 ($(git --version)). Fix: see docs/troubleshooting.md#history-read-failed (HISTORY_READ_FAILED)" >&2; exit 1; }
+          listed=$(git ls-tree --full-tree "$ref" -- "$file") || read_failed "git ls-tree failed"
+          if [ -n "$listed" ]; then
+            for try in 1 2 3; do
+              policy=$(git show "${ref}:${file}") && break
+              if [ "$try" = 3 ]; then read_failed "git show failed 3 times"; fi
+              sleep $((try * 2))
+            done
+          fi
+          train=$(jq -c 'if (.train | type) == "object" then .train else null end' <<<"$policy") || { echo "::error::${GITHUB_SHA}:.gstack/ship-policy.json is not valid JSON; fix the policy file" >&2; exit 1; }
           if [ -z "$train" ] || [ "$train" = null ]; then
             echo "train=false" >> "$GITHUB_OUTPUT"
             echo "- Backstop inert: main's .gstack/ship-policy.json declares no train block; per-PR gates cover main" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/evals.yml

@@ -179,6 +179,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -193,9 +194,19 @@ jobs:
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           base="${BASE_SHA:-origin/${DEFAULT_BRANCH}}"
-          train=$(git show "${base}:.gstack/ship-policy.json" 2>/dev/null | jq -c 'if (.train | type) == "object" then .train else null end' 2>/dev/null || true)
-          artifact=$(jq -r '.record_artifact // ""' <<<"${train:-null}" 2>/dev/null || true)
-          check=$(jq -r '.full_gate_check // ""' <<<"${train:-null}" 2>/dev/null || true)
+          ref="$base" file=.gstack/ship-policy.json policy=null
+          read_failed() { echo "::error::cannot read ${file} at ${ref}. $1 ($(git --version)). Fix: see docs/troubleshooting.md#history-read-failed (HISTORY_READ_FAILED)" >&2; exit 1; }
+          listed=$(git ls-tree --full-tree "$ref" -- "$file") || read_failed "git ls-tree failed"
+          if [ -n "$listed" ]; then
+            for try in 1 2 3; do
+              policy=$(git show "${ref}:${file}") && break
+              if [ "$try" = 3 ]; then read_failed "git show failed 3 times"; fi
+              sleep $((try * 2))
+            done
+          fi
+          train=$(jq -c 'if (.train | type) == "object" then .train else null end' <<<"$policy") || { echo "::error::${base}:.gstack/ship-policy.json is not valid JSON; fix the policy file" >&2; exit 1; }
+          artifact=$(jq -r '.record_artifact // ""' <<<"${train:-null}")
+          check=$(jq -r '.full_gate_check // ""' <<<"${train:-null}")
           if [ -z "$train" ] || [ "$train" = null ]; then
             echo "train=false" >> "$GITHUB_OUTPUT"
             echo "- Train policy: none at ${base}; this run routes as before" >> "$GITHUB_STEP_SUMMARY"
@@ -470,6 +481,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -528,6 +540,7 @@ jobs:
           # Preserve full history for merge-base diff selection. Moving the
           # planner off the eval image must not change its selection inputs.
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -670,6 +683,7 @@ jobs:
           # shards on the lane's first live run ("ambiguous argument
           # 'main...HEAD'"). The manifest still governs WHICH shards run.
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - name: Fix bun temp
@@ -903,6 +917,7 @@ jobs:
         with:
           ref: ${{ inputs.screen_merge_sha }}
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - name: Fix bun temp
@@ -1029,6 +1044,7 @@ jobs:
         with:
           ref: ${{ fromJSON(needs.route.outputs.bisect_refs)[matrix.slice] }}
           fetch-depth: 0
+          filter: blob:none
           persist-credentials: false
 
       - name: Verify the prefix checkout
@@ -1173,6 +1189,7 @@ jobs:
           # history of its prefix commits T1..Tk for the train record.
           ref: ${{ inputs.screen_merge_sha }}
           fetch-depth: ${{ needs.plan-slices.outputs.mode == 'train' && '0' || '1' }}
+          filter: blob:none
           persist-credentials: false
 
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.github/workflows/free-durations-record.yml

@@ -71,6 +71,9 @@ jobs:
 
   windows:
     uses: ./.github/workflows/windows-free-tests.yml
+    permissions:
+      contents: read
+      actions: read
     with:
       record_durations: true
 
@@ -161,7 +164,7 @@ jobs:
           - Files that failed while recording (durations kept; this PR's own free checks decide): $failed_line
           - Seed growth ratchet (60 s ceiling, shrink-only allowlist): $ratchet_line
 
-          Data only. This run dispatched Free Tests (the required free-tests check), Windows Free Tests and Quality gate on this branch; those are this PR's checks. The pull_request runs wait as "action required" because a token-opened PR never starts them without approval. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
+          Data only. This run dispatched Free Tests (the required free-tests check), Windows Smoke and Quality gate on this branch; those are this PR's checks. The pull_request runs wait as "action required" because a token-opened PR never starts them without approval. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
           EOF
           if [ -n "$number" ]; then
             gh pr edit "$number" --body-file pr-body.md
@@ -169,5 +172,5 @@ jobs:
             gh pr create --base main --head "$branch" --title "test(seed): refresh the free-suite duration seeds" --body-file pr-body.md
           fi
           gh workflow run free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
-          gh workflow run windows-free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
+          gh workflow run windows-smoke.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
           gh workflow run quality-gate.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"

.github/workflows/free-tests.yml

@@ -14,6 +14,15 @@ name: Free Tests
 # is permanent false comfort.
 #
 # Local `bun run test` still uses the existing bounded process pool.
+#
+# One full suite per tree (GSTA-156, docs/pregate.md#ci-reuse). The aggregate
+# uploads a `tested-tree` record (tree.json) only after strict verification
+# passes. A push to main first runs `reuse`: when the merged pull request's
+# head has the pushed tree and a green pull_request or workflow_dispatch run of
+# this workflow verifies (lib/run-evidence.ts), every suite job is skipped and
+# the aggregate links that run instead. Any other answer, a reuse failure
+# included, runs every job as before. Pull request and dispatch runs never
+# consume; reused runs never upload a record, so they are never reused.
 
 on:
   pull_request:
@@ -62,7 +71,40 @@ permissions:
   contents: read
 
 jobs:
+  # Main pushes only, and the one job with actions: read (it reads this
+  # repository's runs and their tested-tree artifacts). Every suite job below
+  # runs unless this job succeeded and reused a run; a skipped or failed reuse
+  # job runs them all. Their conditions start with !cancelled() because a
+  # skipped needed job would otherwise skip its dependents on pull_request and
+  # dispatch runs, where reuse never runs.
+  reuse:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      reused: ${{ steps.find.outputs.reused }}
+      run_id: ${{ steps.find.outputs.run_id }}
+      run_url: ${{ steps.find.outputs.run_url }}
+      tree: ${{ steps.find.outputs.tree }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+      - id: find
+        name: Find a green pull request or dispatch run of this exact tree
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bun run scripts/ci-tree-reuse.ts find --workflow free-tests.yml --profile ci-reuse/free-tests
+
   free-plan:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
@@ -73,8 +115,10 @@ jobs:
         with:
           persist-credentials: false
           # Full history: the seed ratchet compares the allowlist with its
-          # merge-base copy, which a depth-1 checkout cannot read.
+          # merge-base copy, which a depth-1 checkout cannot read. Blobless:
+          # that copy is fetched on demand, and a failed read fails the ratchet.
           fetch-depth: 0
+          filter: blob:none
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
@@ -118,6 +162,8 @@ jobs:
           if-no-files-found: error
 
   cso-macos-launcher:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: macos-latest
     timeout-minutes: 15
     steps:
@@ -156,6 +202,8 @@ jobs:
   # default, and the job fails if that layout is not symlinked. It also sources
   # the Codex probe from zsh, macOS's default shell (#3024; no paid call).
   macos-named-regressions:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: macos-latest
     timeout-minutes: 20
     steps:
@@ -200,6 +248,8 @@ jobs:
           bun test "${files[@]}"
 
   cso-windows-launcher:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: windows-latest
     timeout-minutes: 15
     steps:
@@ -228,6 +278,8 @@ jobs:
           retention-days: 14
 
   cso-docker-integration:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
@@ -258,6 +310,8 @@ jobs:
           DOCKER_HOST: unix:///var/run/docker.sock
 
   typecheck:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
@@ -281,6 +335,8 @@ jobs:
   # the quick tier also runs on it. Its pin equals GSTACK_BUN_DEFAULT;
   # test/bun-version-drift.test.ts checks this job exists and agrees.
   quick-bun-default:
+    needs: reuse
+    if: ${{ !cancelled() && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ubicloud-standard-8
     timeout-minutes: 30
     steps:
@@ -377,7 +433,8 @@ jobs:
         run: xvfb-run -a bun run test:quick
 
   free-suite:
-    needs: free-plan
+    needs: [free-plan, reuse]
+    if: ${{ !cancelled() && needs.free-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ${{ needs.free-plan.outputs.runner }}
     timeout-minutes: 20
     strategy:
@@ -602,13 +659,38 @@ jobs:
   # Branch protection already requires the `free-tests` context. Keep that
   # stable name as an always-running aggregate so every platform-specific CSO
   # gate is merge-blocking without a separate branch-protection migration.
+  # Its first step picks one of two exclusive paths before any download: a
+  # verified reuse (main pushes only) links the reused run and passes; anything
+  # else takes the strict path below unchanged, which alone uploads tested-tree.
   free-tests:
     if: always()
-    needs: [free-suite, typecheck, quick-bun-default, cso-macos-launcher, macos-named-regressions, cso-windows-launcher, cso-docker-integration]
+    needs: [reuse, free-suite, typecheck, quick-bun-default, cso-macos-launcher, macos-named-regressions, cso-windows-launcher, cso-docker-integration]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
+      - name: Take the reuse path only for a verified main-push reuse
+        id: route
+        env:
+          REUSE_RESULT: ${{ needs.reuse.result }}
+          REUSED: ${{ needs.reuse.outputs.reused }}
+          REUSE_RUN_ID: ${{ needs.reuse.outputs.run_id }}
+          REUSE_RUN_URL: ${{ needs.reuse.outputs.run_url }}
+          REUSE_TREE: ${{ needs.reuse.outputs.tree }}
+        run: |
+          set -eu
+          if [ "$REUSE_RESULT" != success ] || [ "$REUSED" != true ]; then
+            echo 'reused=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          test "$GITHUB_EVENT_NAME" = push
+          test "$GITHUB_REF" = refs/heads/main
+          case "$REUSE_RUN_ID" in ''|*[!0-9]*) echo "::error::the reuse job named no run id"; exit 1 ;; esac
+          case "$REUSE_TREE" in ''|*[!0-9a-f]*) echo "::error::the reuse job named no tree"; exit 1 ;; esac
+          test "$REUSE_RUN_URL" = "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$REUSE_RUN_ID"
+          echo "Reused $REUSE_RUN_URL, which passed on tree $REUSE_TREE; this push ran no suite of its own." >> "$GITHUB_STEP_SUMMARY"
+          echo 'reused=true' >> "$GITHUB_OUTPUT"
       - name: Require the free suite, typecheck, the quick tier on the default Bun, macOS regressions, and every CSO platform gate
+        if: steps.route.outputs.reused != 'true'
         env:
           FREE_SUITE_RESULT: ${{ needs.free-suite.result }}
           TYPECHECK_RESULT: ${{ needs.typecheck.result }}
@@ -627,16 +709,20 @@ jobs:
           test "$CSO_WINDOWS_RESULT" = success
           test "$CSO_DOCKER_RESULT" = success
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: steps.route.outputs.reused != 'true'
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        if: steps.route.outputs.reused != 'true'
         with:
           bun-version: 1.4.2
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        if: steps.route.outputs.reused != 'true'
         with:
           name: free-plan
           path: ${{ runner.temp }}
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        if: steps.route.outputs.reused != 'true'
         with:
           pattern: free-result-*
           merge-multiple: true
@@ -645,10 +731,27 @@ jobs:
       # flake-ledger.jsonl). A green run is where a retried flake hides, so the
       # summary runs before strict verification.
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        if: steps.route.outputs.reused != 'true'
         with:
           pattern: flake-ledger-*
           path: ${{ runner.temp }}/flake-ledgers
       - name: Summarize flaky passes absorbed by the serial retry
+        if: steps.route.outputs.reused != 'true'
         run: bun run scripts/test-health-report.ts flake-summary "$RUNNER_TEMP/flake-ledgers" >> "$GITHUB_STEP_SUMMARY"
       - name: Require exact coverage and complete strict results
+        if: steps.route.outputs.reused != 'true'
         run: bun run scripts/test-free-shards.ts --ci-verify "$RUNNER_TEMP/free-plan.json" --results "$RUNNER_TEMP/free-results"
+      # Only after strict verification passed, so a red or partial run never
+      # leaves a record; the reuse path never reaches here.
+      - name: Record the tested tree
+        if: steps.route.outputs.reused != 'true'
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: bun run scripts/ci-tree-reuse.ts record --plan "$RUNNER_TEMP/free-plan.json" --results "$RUNNER_TEMP/free-results" --os Linux,macOS,Windows --out "$RUNNER_TEMP/tested-tree/tree.json"
+      - name: Upload the tested tree
+        if: steps.route.outputs.reused != 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: tested-tree
+          path: ${{ runner.temp }}/tested-tree/tree.json
+          if-no-files-found: error

.github/workflows/version-gate.yml

@@ -23,6 +23,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          # Blobless: full history with file contents fetched on demand; the
+          # reads below fail loudly when a fetch fails (.github/scripts/history-read.sh).
+          filter: blob:none
           ref: ${{ github.event.pull_request.head.sha }}
           # The head's release_tool runs inside the gate (lib/version-gate-train.ts);
           # no token may sit in the checkout it stages. The base fetch below is public.
@@ -49,8 +52,12 @@ jobs:
           set -euo pipefail
           PR_VERSION=$(cat VERSION | tr -d '[:space:]')
           BASE_REF="${{ github.event.pull_request.base.ref }}"
-          git fetch origin "$BASE_REF" --quiet || true
-          BASE_VERSION=$(git show "origin/$BASE_REF:VERSION" 2>/dev/null | tr -d '[:space:]' || echo "0.0.0.0")
+          for try in 1 2 3; do
+            git fetch origin "$BASE_REF" --quiet && break
+            if [ "$try" = 3 ]; then echo "::error::git fetch origin $BASE_REF failed 3 times ($(git --version)). Fix: see docs/troubleshooting.md#history-read-failed (HISTORY_READ_FAILED)"; exit 1; fi
+            sleep $((try * 2))
+          done
+          BASE_VERSION=$(bash .version-gate/.github/scripts/history-read.sh "origin/$BASE_REF" VERSION --absent 0.0.0.0 | tr -d '[:space:]')
           {
             echo "pr_version=$PR_VERSION"
             echo "base_version=$BASE_VERSION"

.github/workflows/windows-free-tests.yml

@@ -1,9 +1,15 @@
 name: Windows Free Tests
 
-# The Windows-safe subset of the free suite on GitHub's free `windows-latest`
-# runners. scripts/test-free-shards.ts --windows-only is the single source of
-# truth for which files run: POSIX-bound tests (bin/ shebang spawns, raw /tmp
-# paths, /bin/sh, mode bitmasks, the Bun-driven browse server) are excluded by
+# Nightly, not a PR gate. Windows has minimal support (docs/support-tiers.md):
+# the required Windows check is windows-smoke.yml (./setup plus the core
+# skills). This workflow runs the curated Windows-safe subset of the free suite
+# on main every night and on workflow_dispatch, and never blocks a pull
+# request. A red nightly run gets a fix only when it shows an install, startup
+# or core-workflow break; other Windows-only failures close as won't fix.
+#
+# scripts/test-free-shards.ts --windows-only is the single source of truth for
+# which files run: POSIX-bound tests (bin/ shebang spawns, raw /tmp paths,
+# /bin/sh, mode bitmasks, the Bun-driven browse server) are excluded by
 # pattern there, with explicit force-include and known-incompatible lists.
 # Every run prints the curated count and top exclusion reasons in the job
 # summary so a shrinking subset is visible.
@@ -19,15 +25,17 @@ name: Windows Free Tests
 #
 # Native browser qualification campaigns (Windows cookie extraction, launch
 # diagnostics) are dispatch-only in native-qualification.yml.
+#
+# One full suite per tree (GSTA-156, docs/pregate.md#ci-reuse), as in
+# free-tests.yml: the aggregate uploads `tested-tree` only after strict
+# verification passes, and a push to main whose merged pull request already
+# ran this workflow green on the same tree reuses that run. Pull request,
+# dispatch and duration-recording runs never consume.
 
 on:
-  pull_request:
-    branches: [main]
-  # Also on main pushes, as free-tests.yml does: trains dispatch only the
-  # Linux free workflow, so without this no Windows run ever sees a train's
-  # combined tree or main after a merge.
-  push:
-    branches: [main]
+  # 09:17 UTC, about 2 AM Pacific, on the default branch (main).
+  schedule:
+    - cron: '17 9 * * *'
   workflow_dispatch:
     inputs:
       record_durations:
@@ -59,8 +67,36 @@ permissions:
   contents: read
 
 jobs:
+  # Main pushes only, and the one job with actions: read; see free-tests.yml.
+  # A skipped or failed reuse job runs every job below as before.
+  reuse:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      reused: ${{ steps.find.outputs.reused }}
+      run_id: ${{ steps.find.outputs.run_id }}
+      run_url: ${{ steps.find.outputs.run_url }}
+      tree: ${{ steps.find.outputs.tree }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+      - id: find
+        name: Find a green pull request or dispatch run of this exact tree
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bun run scripts/ci-tree-reuse.ts find --workflow windows-free-tests.yml --profile ci-reuse/windows-free-tests
+
   windows-plan:
-    if: ${{ !inputs.record_durations }}
+    needs: reuse
+    if: ${{ !cancelled() && !inputs.record_durations && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
@@ -98,7 +134,10 @@ jobs:
           if-no-files-found: error
 
   windows-free-shard:
-    needs: windows-plan
+    # gstack-pregate reads a job keyed on a dispatch input as manual, never a
+    # PR obligation; this lane runs only nightly or by hand.
+    needs: [windows-plan, reuse]
+    if: ${{ !cancelled() && !inputs.record_durations && needs.windows-plan.result == 'success' && (needs.reuse.result != 'success' || needs.reuse.outputs.reused != 'true') }}
     runs-on: windows-latest
     timeout-minutes: 15
     strategy:
@@ -123,14 +162,8 @@ jobs:
           name: windows-plan
           path: ${{ runner.temp }}
 
-      # bun's install cache lives under ~/.bun/install/cache on every platform.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.bun/install/cache
-          key: windows-bun-${{ hashFiles('bun.lock') }}
-          # A lockfile bump starts from the previous cache instead of cold.
-          restore-keys: |
-            windows-bun-
+      # No bun install cache: restoring the ~450 MB entry took 33-42 s per
+      # shard, a cold install 16-17 s (GSTA-203 PR 1 A/B, 3 runs per arm).
 
       - name: Configure git identity (required by tests that init temp repos)
         run: |
@@ -203,11 +236,33 @@ jobs:
 
   windows-free-tests:
     if: ${{ always() && !inputs.record_durations }}
-    needs: [windows-plan, windows-free-shard]
+    needs: [reuse, windows-plan, windows-free-shard]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
+      - name: Take the reuse path only for a verified main-push reuse
+        id: route
+        env:
+          REUSE_RESULT: ${{ needs.reuse.result }}
+          REUSED: ${{ needs.reuse.outputs.reused }}
+          REUSE_RUN_ID: ${{ needs.reuse.outputs.run_id }}
+          REUSE_RUN_URL: ${{ needs.reuse.outputs.run_url }}
+          REUSE_TREE: ${{ needs.reuse.outputs.tree }}
+        run: |
+          set -eu
+          if [ "$REUSE_RESULT" != success ] || [ "$REUSED" != true ]; then
+            echo 'reused=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          test "$GITHUB_EVENT_NAME" = push
+          test "$GITHUB_REF" = refs/heads/main
+          case "$REUSE_RUN_ID" in ''|*[!0-9]*) echo "::error::the reuse job named no run id"; exit 1 ;; esac
+          case "$REUSE_TREE" in ''|*[!0-9a-f]*) echo "::error::the reuse job named no tree"; exit 1 ;; esac
+          test "$REUSE_RUN_URL" = "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$REUSE_RUN_ID"
+          echo "Reused $REUSE_RUN_URL, which passed on tree $REUSE_TREE; this push ran no suite of its own." >> "$GITHUB_STEP_SUMMARY"
+          echo 'reused=true' >> "$GITHUB_OUTPUT"
       - name: Require the plan and every Windows shard
+        if: steps.route.outputs.reused != 'true'
         env:
           PLAN_RESULT: ${{ needs.windows-plan.result }}
           SHARD_RESULT: ${{ needs.windows-free-shard.result }}
@@ -216,22 +271,40 @@ jobs:
           test "$PLAN_RESULT" = success
           test "$SHARD_RESULT" = success
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        if: steps.route.outputs.reused != 'true'
         with:
           persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        if: steps.route.outputs.reused != 'true'
         with:
           bun-version: 1.4.2
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        if: steps.route.outputs.reused != 'true'
         with:
           name: windows-plan
           path: ${{ runner.temp }}
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        if: steps.route.outputs.reused != 'true'
         with:
           pattern: windows-result-*
           merge-multiple: true
           path: ${{ runner.temp }}/windows-results
       - name: Require exact coverage and complete strict results
+        if: steps.route.outputs.reused != 'true'
         run: bun run scripts/test-free-shards.ts --windows-only --ci-verify "$RUNNER_TEMP/windows-plan.json" --results "$RUNNER_TEMP/windows-results"
+      # Only after strict verification passed; the reuse path never reaches here.
+      - name: Record the tested tree
+        if: steps.route.outputs.reused != 'true'
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: bun run scripts/ci-tree-reuse.ts record --plan "$RUNNER_TEMP/windows-plan.json" --results "$RUNNER_TEMP/windows-results" --os Windows --out "$RUNNER_TEMP/tested-tree/tree.json"
+      - name: Upload the tested tree
+        if: steps.route.outputs.reused != 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: tested-tree
+          path: ${{ runner.temp }}/tested-tree/tree.json
+          if-no-files-found: error
 
   windows-record-durations:
     if: ${{ inputs.record_durations }}

.github/workflows/windows-setup-e2e.yml

@@ -92,16 +92,8 @@ jobs:
         with:
           bun-version: 1.4.2
 
-      # Same lockfile-keyed install cache as windows-free-tests.yml (install
-      # was 45s of a 64s job, all network).
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.bun/install/cache
-          key: windows-bun-${{ hashFiles('bun.lock') }}
-          # A lockfile bump starts from the previous cache instead of cold
-          # (restore alone costs ~43s; without this a bump pays it for nothing).
-          restore-keys: |
-            windows-bun-
+      # No bun install cache, as in windows-free-tests.yml: a cold install is
+      # faster on windows-latest than restoring the ~450 MB cache entry.
 
       - name: Configure git identity
         run: |

.github/workflows/windows-smoke.yml

@@ -0,0 +1,170 @@
+name: Windows Smoke
+
+# The required Windows check under minimal support (docs/support-tiers.md):
+# with a default Git for Windows install, ./setup installs and the core skills
+# start. One windows-latest job, under 5 minutes:
+#   1. ./setup --host claude into an isolated HOME under Git Bash, with
+#      gstack's own browser (Playwright Chromium).
+#   2. The core skills start: gstack-skill-start for /ship, /review,
+#      /qa-only, /investigate and /browse answers SKILL_START_PROTO: 1.
+#   3. /browse on gstack's own browser: the installed browse runs a piped
+#      chain flow against a local page from an unrelated directory.
+#   4. The fastest Windows-safe free tests for those paths (list below).
+# The full curated Windows suite is windows-free-tests.yml: nightly on main
+# and on dispatch, never a PR gate.
+#
+# No bun install cache: a cold install took 16-17 s on windows-latest, a
+# restore of the ~450 MB cache 33-42 s (GSTA-203 PR 1 A/B, 3 runs per arm).
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: windows-smoke-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  windows-smoke:
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.2
+
+      - name: Configure git identity (required by tests that init temp repos)
+        run: |
+          git config --global user.email "windows-smoke@gstack.test"
+          git config --global user.name "Windows Smoke"
+          git config --global init.defaultBranch main
+        shell: bash
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+        shell: bash
+
+      - name: ./setup installs into an isolated HOME
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          mkdir -p "$SMOKE_HOME"
+          HOME="$SMOKE_HOME" USERPROFILE="$(cygpath -w "$SMOKE_HOME")" ./setup --host claude
+          test -x "$SMOKE_HOME/.claude/skills/gstack/bin/gstack-skill-start" || (echo "MISSING: installed gstack-skill-start" && exit 1)
+        shell: bash
+
+      - name: The core skills start
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          USERPROFILE="$(cygpath -w "$SMOKE_HOME")"
+          export HOME="$SMOKE_HOME" USERPROFILE
+          for skill in ship review qa-only investigate browse; do
+            set +e
+            OUT=$(timeout 120 "$SMOKE_HOME/.claude/skills/gstack/bin/gstack-skill-start" --skill "$skill" --model claude 2>&1 < /dev/null)
+            CODE=$?
+            set -e
+            echo "::group::$skill"; echo "$OUT"; echo "::endgroup::"
+            test "$CODE" -eq 0 || (echo "/$skill: gstack-skill-start exited $CODE" && exit 1)
+            grep -q '^SKILL_START_PROTO: 1' <<< "$OUT" || (echo "/$skill: no SKILL_START_PROTO: 1 line" && exit 1)
+          done
+        shell: bash
+
+      - name: /browse on gstack's own browser runs a piped chain flow from an unrelated directory
+        run: |
+          set -euo pipefail
+          SMOKE_HOME="$RUNNER_TEMP/smoke-home"
+          USERPROFILE="$(cygpath -w "$SMOKE_HOME")"
+          export HOME="$SMOKE_HOME" USERPROFILE
+          BROWSE="$SMOKE_HOME/.claude/skills/gstack/browse/dist/browse.exe"
+          [ -f "$BROWSE" ] || BROWSE="$SMOKE_HOME/.claude/skills/gstack/browse/dist/browse"
+          test -f "$BROWSE" || (echo "MISSING: installed browse" && exit 1)
+          bun -e 'Bun.serve({ hostname: "127.0.0.1", port: 47124, fetch: () => new Response("<title>gstack smoke</title><h1>gstack-windows-smoke-ok</h1>", { headers: { "content-type": "text/html" } }) }); setInterval(() => {}, 1 << 30);' &
+          PAGE_PID=$!
+          trap 'kill "$PAGE_PID" 2>/dev/null || true; "$BROWSE" stop >/dev/null 2>&1 || true' EXIT
+          mkdir -p "$RUNNER_TEMP/unrelated-dir" && cd "$RUNNER_TEMP/unrelated-dir"
+          set +e
+          OUT=$(printf '%s\n' '[["goto","http://127.0.0.1:47124/"],["text"]]' | "$BROWSE" chain 2>&1)
+          CODE=$?
+          set -e
+          echo "$OUT"
+          if [ "$CODE" -ne 0 ]; then
+            find "$RUNNER_TEMP/unrelated-dir" "$SMOKE_HOME" -maxdepth 4 \( -name 'browse-daemon.log' -o -name 'browse-startup-error.log' \) -print -exec tail -n 60 {} \; 2>/dev/null || true
+            echo "browse chain exited $CODE" && exit 1
+          fi
+          grep -q 'gstack-windows-smoke-ok' <<< "$OUT" || (echo "chain output lacks the page text: the flow did not run" && exit 1)
+        shell: bash
+
+      - name: Fastest Windows-safe free tests for install and the core skills
+        # Windows-measured seconds from scripts/free-test-durations-windows.json.
+        #   setup-windows-fallback (0.1): setup's _link_or_copy copies, never links, on Windows
+        #   setup-staged-copy (0.6): a copy install is staged and swapped in only when complete
+        #   setup-windows-rerun-refresh (1.7): re-running ./setup refreshes copied skills (#2444)
+        #   setup-skill-copies (0.1): copied SKILL.md hashes and the backup of an edited copy
+        #   setup-bun-cmd-and-pipe-bugs (0.4): setup's bun.cmd and pipe handling
+        #   gstack-launch-probe (0.1): setup's Smart App Control launch probe (#2595)
+        #   state-root-parity (2.1): every skill start resolves one state root in TS and bash
+        #   bun-isolation-launch (1.1): Bun entries ignore .env and bunfig under Git Bash (#3415)
+        #   gstack-lease-git-bash (3.7): the skill-start lease under Git Bash (#3330)
+        #   gstack-wtree-windows-paths (1.3): /review and /ship record a start on C:/ paths (#3101)
+        #   ship-hook-windows-paths (2.3): /ship's pre-push guard in a Windows worktree (#2805)
+        #   qa-only-browser-probe (2.4): /qa-only's browser probe fixture
+        #   find-browse (0.1): /browse resolves its binary (.exe)
+        #   cli-chain-stdin (0.3): /browse chain reads its flow from stdin on Windows (#3039)
+        #   windows-spawn-hide (0.1): /browse's spawns hide their console window (#1835)
+        env:
+          GSTACK_FREE_RETRY_FLAKY: '1'
+          GSTACK_FLAKE_LEDGER: ${{ runner.temp }}/flake-ledger.jsonl
+          TEMP: ${{ runner.temp }}
+          TMP: ${{ runner.temp }}
+        run: |
+          set -euo pipefail
+          cat > "$RUNNER_TEMP/windows-smoke-files.txt" <<'LIST'
+          test/setup-windows-fallback.test.ts
+          test/setup-staged-copy.test.ts
+          test/setup-windows-rerun-refresh.test.ts
+          test/setup-skill-copies.test.ts
+          test/setup-bun-cmd-and-pipe-bugs.test.ts
+          test/gstack-launch-probe.test.ts
+          test/state-root-parity.test.ts
+          test/bun-isolation-launch.test.ts
+          test/gstack-lease-git-bash.test.ts
+          test/gstack-wtree-windows-paths.test.ts
+          test/ship-hook-windows-paths.test.ts
+          test/qa-only-browser-probe.test.ts
+          browse/test/find-browse.test.ts
+          browse/test/cli-chain-stdin.test.ts
+          browse/test/windows-spawn-hide.test.ts
+          LIST
+          bun run scripts/test-free-shards.ts --files-from "$RUNNER_TEMP/windows-smoke-files.txt"
+        shell: bash
+
+      - name: Upload full test logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: windows-smoke-logs
+          path: |
+            .context/free-test-logs/gstack-free-test-*.log
+            ${{ runner.temp }}/gstack-free-test-*.log
+          include-hidden-files: true
+          if-no-files-found: ignore
+
+      - name: Upload flake ledger
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: flake-ledger-windows-smoke
+          path: ${{ runner.temp }}/flake-ledger.jsonl
+          if-no-files-found: ignore
+          retention-days: 90