AGENTS.md and the Wine Agent Note pair state the run policy: CI owns the
everyday win32 signal; run check:windows-wine only while investigating a
known Windows-related failure, and pre-push selection never includes it.
scripts/wine-windows-gates.sh owns the whole lane — workspace snapshot,
concurrent Node/wineboot/install provisioning, entrypoint resolution, the
vue link, smoke, and the two concurrent blocking gates — so the ci.yml
windows job shrinks to runner provisioning plus one script call, and
pnpm run check:windows-wine runs the identical script locally. The local
path never mutates the working tree, persists the Wine prefix and the
checksum-verified Windows Node zip under .cache/wine-windows/, and falls
back to the cached zip offline. AGENTS.md ceiling 1680 -> 1695 for the
one-line command entry.
- The clone exclusion is now '.runner*' (catches .runner_migrated /
.credentials_migrated, which GitHub writes on migrated runners and
which equally trip the already-configured refusal — hit live during
the 2026-07-27 org-group migration).
- The problem statement now states the verdict runs on ubuntu-latest,
scopes the switch to enterprise Linux-pool outages, and names the
residual dependency: node-compat/python-sdk/windows stay standard-
hosted, so a broader hosted-capacity failure still blocks the
verdict, with Windows the only leg lacking any in-house substitute.
Static gate green locally: 32 passed, 0 failed.
The Agent Note paragraph recorded test-specific timing advice, which
docs/AGENTS.md excludes from implemented notes. The durable half of it —
LocalSendOperation.append drops output after settle, so it survives only in
the scrollback — now documents append itself.
config.sh only registers; the runner stays offline until svc.sh
install/start. Both language sides updated so emergency capacity
actually comes online.
- serial-linux-selfhosted checks out fetch-depth 0: depth 2 misses
github.event.before on multi-commit or force pushes, failing the
archive verifier on a valid tree. Full fetch is cheap against the
VM's local mirror.
- Runbook (both languages): every remaining admin phrasing (problem
statement, switch heading, alternatives, consequences) now says
writer; and the 'composes with this mechanism' claim about a
master-ref-pinned runner group is replaced with the truth observed
live on 2026-07-27 — master-ref pinning blocks PR failover, and the
shipped posture is repository-scoped all-workflow group access.
Static gate green locally: 32 passed, 0 failed.
The standby lane itself is push-only, but under failover pull_request
jobs do reach these runners with the PR merge ref's workflow. The
workflow comment and the larger-runner note (both languages) now state
that plainly and name the actual boundary — repository membership
(private, forking disabled, Dependabot excluded) — matching the
runbook. Static gate green locally: 32 passed, 0 failed.
