ci: one list for Windows boundary tests and one step for ratchets (#30643)

* ci: one list for Windows boundary tests and one step for ratchets The Windows boundary step's 74 test paths were hand-listed in pr.yml and again in WINDOWS_PACKAGE_TESTS, and the copies had drifted: six files ran in the step but could not trigger the job. The step now prints WINDOWS_BOUNDARY_TESTS, which WINDOWS_PACKAGE_TESTS spreads. The ten per-ratchet preflight steps and the eight lint entries become one run-ratchets.mjs that runs every check-*-ratchet(s).mjs it finds. * fix(ci): preserve existing local lint ratchet scope
2026-10-30 16:47:34 +00:00 · 2026-10-20 22:13:36 -07:00
parent b2370f1c6e
commit 2187f0b6b2
7 changed files with 117 additions and 165 deletions
@@ -380,53 +380,10 @@ jobs:
          node config/scripts/run-ephemeral-vm-runtime-store-rollback-repro.mjs \
            config/scripts/ephemeral-vm-runtime-store-cross-version.test.ts

-      - name: Enforce max-lines ratchet
+      # Runs every config/scripts/check-*-ratchet(s).mjs, so a new ratchet needs no step here.
+      - name: Enforce ratchets
        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-max-lines-ratchet.mjs
-
-      - name: Enforce ts-nocheck ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-ts-nocheck-ratchet.mjs
-
-      - name: Enforce runtime Electron-import ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-runtime-electron-ratchet.mjs
-
-      - name: Enforce focus-read ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-focus-read-ratchet.mjs
-
-      - name: Enforce layout-writer ratchets
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: bun config/scripts/check-layout-writer-ratchets.mjs
-
-      - name: Enforce path-literal ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-path-literal-ratchet.mjs
-
-      - name: Enforce worktree-id composer ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-worktree-id-composer-ratchet.mjs
-
-      - name: Enforce e2e typecheck ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-e2e-typecheck-ratchet.mjs
-
-      - name: Enforce legacy relay fence ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-legacy-relay-fence-ratchet.mjs
-
-      - name: Enforce unproven PTY retirement ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-unproven-pty-retirement-ratchet.mjs
-
-      - name: Enforce id-only store write ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-id-only-store-write-ratchet.mjs
-
-      - name: Enforce repo host-read ratchet
-        if: needs.code_paths.outputs.static_analysis == 'true'
-        run: node config/scripts/check-repo-host-read-ratchet.mjs
+        run: node config/scripts/run-ratchets.mjs

      - name: Check Node runtime pin
        if: needs.code_paths.outputs.static_analysis == 'true'
@@ -1438,88 +1395,15 @@ jobs:
      - name: Build the Windows CLI launcher
        run: node config/scripts/build-windows-cli-launcher.mjs

+      # Files come from WINDOWS_BOUNDARY_TESTS, the same list that decides whether this job runs.
      - name: Test Windows-specific boundaries
        env:
          ORCA_BACKGROUND_LAUNCH: '1'
          ORCA_REAL_WINDOWS_SKILL_TEST: '1'
-        run: >-
-          pnpm exec vitest run --config config/vitest.config.ts
-          src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts
-          config/scripts/rebuild-native-deps.test.mjs
-          config/scripts/rebuild-native-deps-windows-process-tree.test.mjs
-          config/scripts/rebuild-native-deps-node-pty.test.mjs
-          config/scripts/ensure-native-runtime-job-ownership.test.mjs
-          config/scripts/verify-packaged-node-pty-job-ownership.test.mjs
-          config/scripts/windows-pe-machine.test.mjs
-          config/scripts/build-windows-cli-launcher.test.mjs
-          config/scripts/verify-packaged-windows-agent-hook.test.mjs
-          config/scripts/script-module-dependencies.test.mjs
-          src/main/windows-registry-addon.test.ts
-          src/shared/windows-security-addon.win32.test.ts
-          config/scripts/windows-process-tree-gyp-path.test.mjs
-          config/scripts/windows-process-tree-gyp-rebuild.test.mjs
-          config/scripts/package-electron-runtime-contract.test.mjs
-          config/scripts/electron-builder-runtime-resources.test.mjs
-          src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts
-          src/main/browser/browser-route-tcp-egress.electron.test.ts
-          src/main/browser/browser-route-webrtc-egress.electron.test.ts
-          src/main/browser/browser-route-h3-egress.electron.test.ts
-          src/main/browser/browser-route-dns-prefetch.electron.test.ts
-          src/main/persistence/profile-state/profile-state-writer-stall.electron.test.ts
-          src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts
-          src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts
-          src/shared/__tests__/process-host/windows-command-line.win32.test.ts
-          src/shared/__tests__/process-host/windows-cmd-shim-resolution.test.ts
-          src/shared/__tests__/process-host/windows-cmd-shim-resolution.win32.test.ts
-          src/shared/__tests__/process-host/windows-tree-kill-late-taskkill.win32.test.ts
-          src/shared/omp-fresh-launch-cmd.win32.test.ts
-          src/main/agent-hooks/windows-hook-payload-delivery.test.ts
-          src/main/agent-hooks/managed-hook-stdin-lifecycle.test.ts
-          src/main/jcode/hook-gate-script.test.ts
-          src/main/agent-hooks/windows-direct-cmd-hook-command.test.ts
-          src/main/agent-hooks/windows-native-hook-exe-hosts.test.ts
-          src/main/claude/windows-native-hook-registration.test.ts
-          src/main/agent-hooks/windows-cmd-hook-command-unicode.test.ts
-          src/main/agent-hooks/windows-batch-hook-launcher.test.ts
-          src/main/agent-hooks/windows-powershell-hook-launcher.test.ts
-          src/main/claude/claude-status-line-windows.test.ts
-          src/main/codex/windows-hook-command.test.ts
-          src/main/codex/windows-hook-upgrade.test.ts
-          src/main/codex/hook-service-managed-install.test.ts
-          src/main/windows/windows-pty-job.win32.test.ts
-          src/main/windows/windows-msys-job.win32.test.ts
-          src/main/providers/agent-foreground-process-git-bash.win32.test.ts
-          src/main/windows/windows-host-job.win32.test.ts
-          src/main/windows/windows-process-tree-command-line-patch.test.ts
-          src/main/windows/windows-process-table-native-addon.win32.test.ts
-          src/main/windows/windows-administrator-status.win32.test.ts
-          src/main/windows/windows-administrator-restart.win32.test.ts
-          src/main/daemon/daemon-pid-identity-native.win32.test.ts
-          src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts
-          src/main/windows-live-tree-kill.win32.test.ts
-          src/main/wsl/wsl-runner.test.ts
-          src/main/wsl/wsl-guest-environment.test.ts
-          src/main/wsl/wsl-executable-path.win32.test.ts
-          src/main/claude-accounts/claude-profile-history-windows.test.ts
-          src/main/wsl/wsl-w1-w3-contract.test.ts
-          src/shared/source-scan/source-tree-scan.test.ts
-          src/main/cli/wsl-cli-powershell-boundary.test.ts
-          src/main/computer/desktop-script-runtime-host.win32.test.ts
-          src/main/cursor/hook-service.test.ts
-          src/main/orca-profiles/profile-index-store.test.ts
-          src/main/startup/windows-install-dir-acl-repair.win32.test.ts
-          src/main/startup/windows-app-data-path.test.ts
-          src/main/runtime/repo-worktree-admin-fingerprint.test.ts
-          src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts
-          src/shared/secure-file-fsync-flags.test.ts
-          src/shared/secure-path-windows-acl.win32.test.ts
-          src/main/runtime/unreadable-secret-store-preservation.win32.test.ts
-          src/main/ipc/pty-codex-account-attribution.test.ts
-          src/main/ipc/pty-spawn-env-codex-resume-provenance.test.ts
-          src/main/ipc/preflight-provider-command-selection.test.ts
-          src/main/ipc/preflight-runnable-local-cli.test.ts
-          src/main/managed-server/install/remote-node-runtime-store-windows.test.ts
-          src/main/skills/skill-windows-rename-contention.integration.test.ts
+        run: |
+          $files = node config/scripts/pr-package-test-paths.mjs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          pnpm exec vitest run --config config/vitest.config.ts $files

      # Why its own step: the CPU burners that make taskkill slow would starve
      # every other test file sharing the runner.
@@ -3,6 +3,7 @@ import { runInNewContext } from 'node:vm'
 import { describe, expect, it } from 'vitest'
 import { parse } from 'yaml'
 import { classifyPrJobs } from './pr-code-change-scope.mjs'
+import { WINDOWS_BOUNDARY_TESTS } from './pr-package-test-paths.mjs'

 const read = (path) => parse(readFileSync(path, 'utf8'))
 const workflow = (name) => read(`.github/workflows/${name}.yml`)
@@ -556,9 +557,14 @@ describe('release install targets', () => {
  it('keeps installed Windows addon checks in the Windows CI lane', () => {
    const steps = Object.values(workflow('pr').jobs).flatMap((job) => job.steps ?? [])
    const test = steps.find((step) => step.name === 'Test Windows-specific boundaries')
-    expect(test.run).toContain('config/scripts/windows-process-tree-gyp-path.test.mjs')
-    expect(test.run).toContain('config/scripts/windows-process-tree-gyp-rebuild.test.mjs')
-    expect(test.run).toContain('config/scripts/package-electron-runtime-contract.test.mjs')
-    expect(test.run).toContain('config/scripts/electron-builder-runtime-resources.test.mjs')
+    expect(test.run).toContain('config/scripts/pr-package-test-paths.mjs')
+    expect(WINDOWS_BOUNDARY_TESTS).toEqual(
+      expect.arrayContaining([
+        'config/scripts/windows-process-tree-gyp-path.test.mjs',
+        'config/scripts/windows-process-tree-gyp-rebuild.test.mjs',
+        'config/scripts/package-electron-runtime-contract.test.mjs',
+        'config/scripts/electron-builder-runtime-resources.test.mjs'
+      ])
+    )
  })
 })
@@ -1,3 +1,6 @@
+import process from 'node:process'
+import { pathToFileURL } from 'node:url'
+
 export const LINUX_PACKAGE_TESTS = [
  'config/scripts/packaged-cloud-source-exclusion.test.mjs',
  'src/main/browser/popup-origin-chrome.electron.test.ts',
@@ -14,14 +17,12 @@ export const LINUX_PACKAGE_TESTS = [
  'src/main/browser/browser-popup-background-compatibility.electron.test.ts'
 ]

-export const WINDOWS_PACKAGE_TESTS = [
+// The package (windows) job's "Test Windows-specific boundaries" step runs exactly these files.
+export const WINDOWS_BOUNDARY_TESTS = [
  'src/main/zcode/zcode-plan-api-key-store-native-windows.test.ts',
-  ...LINUX_PACKAGE_TESTS,
  'config/scripts/rebuild-native-deps.test.mjs',
  'config/scripts/rebuild-native-deps-windows-process-tree.test.mjs',
  'config/scripts/rebuild-native-deps-node-pty.test.mjs',
-  'config/scripts/nsis-process-check.test.mjs',
-  'config/scripts/idle-cpu-process-sampling.test.mjs',
  'config/scripts/ensure-native-runtime-job-ownership.test.mjs',
  'config/scripts/verify-packaged-node-pty-job-ownership.test.mjs',
  'config/scripts/windows-pe-machine.test.mjs',
@@ -30,6 +31,16 @@ export const WINDOWS_PACKAGE_TESTS = [
  'config/scripts/script-module-dependencies.test.mjs',
  'src/main/windows-registry-addon.test.ts',
  'src/shared/windows-security-addon.win32.test.ts',
+  'config/scripts/windows-process-tree-gyp-path.test.mjs',
+  'config/scripts/windows-process-tree-gyp-rebuild.test.mjs',
+  'config/scripts/package-electron-runtime-contract.test.mjs',
+  'config/scripts/electron-builder-runtime-resources.test.mjs',
+  'src/main/browser/browser-client-page-renderer-lifecycle.electron.test.ts',
+  'src/main/browser/browser-route-tcp-egress.electron.test.ts',
+  'src/main/browser/browser-route-webrtc-egress.electron.test.ts',
+  'src/main/browser/browser-route-h3-egress.electron.test.ts',
+  'src/main/browser/browser-route-dns-prefetch.electron.test.ts',
+  'src/main/persistence/profile-state/profile-state-writer-stall.electron.test.ts',
  'src/main/providers/windows-conpty-wide-char-duplication.node-pty.test.ts',
  'src/main/providers/pty-repaint-wide-char-buffer.node-pty.test.ts',
  'src/shared/__tests__/process-host/windows-command-line.win32.test.ts',
@@ -56,14 +67,15 @@ export const WINDOWS_PACKAGE_TESTS = [
  'src/main/windows/windows-host-job.win32.test.ts',
  'src/main/windows/windows-process-tree-command-line-patch.test.ts',
  'src/main/windows/windows-process-table-native-addon.win32.test.ts',
-  'src/main/daemon/daemon-pid-identity-native.win32.test.ts',
  'src/main/windows/windows-administrator-status.win32.test.ts',
  'src/main/windows/windows-administrator-restart.win32.test.ts',
+  'src/main/daemon/daemon-pid-identity-native.win32.test.ts',
  'src/main/persistence/profile-state/profile-state-access-windows-native.win32.test.ts',
  'src/main/windows-live-tree-kill.win32.test.ts',
  'src/main/wsl/wsl-runner.test.ts',
  'src/main/wsl/wsl-guest-environment.test.ts',
  'src/main/wsl/wsl-executable-path.win32.test.ts',
+  'src/main/claude-accounts/claude-profile-history-windows.test.ts',
  'src/main/wsl/wsl-w1-w3-contract.test.ts',
  'src/shared/source-scan/source-tree-scan.test.ts',
  'src/main/cli/wsl-cli-powershell-boundary.test.ts',
@@ -71,6 +83,7 @@ export const WINDOWS_PACKAGE_TESTS = [
  'src/main/cursor/hook-service.test.ts',
  'src/main/orca-profiles/profile-index-store.test.ts',
  'src/main/startup/windows-install-dir-acl-repair.win32.test.ts',
+  'src/main/startup/windows-app-data-path.test.ts',
  'src/main/runtime/repo-worktree-admin-fingerprint.test.ts',
  'src/main/runtime/worktree-scan-admin-fingerprint-gate.test.ts',
  'src/shared/secure-file-fsync-flags.test.ts',
@@ -83,3 +96,15 @@ export const WINDOWS_PACKAGE_TESTS = [
  'src/main/managed-server/install/remote-node-runtime-store-windows.test.ts',
  'src/main/skills/skill-windows-rename-contention.integration.test.ts'
 ]
+
+export const WINDOWS_PACKAGE_TESTS = [
+  ...WINDOWS_BOUNDARY_TESTS,
+  ...LINUX_PACKAGE_TESTS,
+  // The "Test Windows installer process probe" step runs these serially.
+  'config/scripts/nsis-process-check.test.mjs',
+  'config/scripts/idle-cpu-process-sampling.test.mjs'
+]
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  console.log(WINDOWS_BOUNDARY_TESTS.join('\n'))
+}
@@ -247,18 +247,7 @@ it('pins every foreground and background step to its selected phase', () => {
    ['Check reliability gate manifest', staticPhase],
    ['Enforce dead design-system classes', staticPhase],
    ['Check VM runtime rollback compatibility', staticPhase],
-    ['Enforce max-lines ratchet', staticPhase],
-    ['Enforce ts-nocheck ratchet', staticPhase],
-    ['Enforce runtime Electron-import ratchet', staticPhase],
-    ['Enforce focus-read ratchet', staticPhase],
-    ['Enforce layout-writer ratchets', staticPhase],
-    ['Enforce path-literal ratchet', staticPhase],
-    ['Enforce worktree-id composer ratchet', staticPhase],
-    ['Enforce e2e typecheck ratchet', staticPhase],
-    ['Enforce legacy relay fence ratchet', staticPhase],
-    ['Enforce unproven PTY retirement ratchet', staticPhase],
-    ['Enforce id-only store write ratchet', staticPhase],
-    ['Enforce repo host-read ratchet', staticPhase],
+    ['Enforce ratchets', staticPhase],
    ['Check Node runtime pin', staticPhase],
    ['Check root and mobile lock the same shared dependencies', staticPhase],
    ['Decide whether the orcad terminal smoke runs', staticPhase],
@@ -0,0 +1,44 @@
+import { spawnSync } from 'node:child_process'
+import { readdirSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { pathToFileURL } from 'node:url'
+
+// Discover CI ratchets by filename; local lint keeps its separate explicit check list.
+const RATCHET_SCRIPT = /^check-.+-ratchets?\.mjs$/
+const RUN_ELSEWHERE = new Set([
+  // Needs the PR diff base; the cross-version-wire job runs it.
+  'check-runtime-launcher-protocol-ratchet.mjs',
+  // Its own background preflight step, so it overlaps lint and typecheck.
+  'check-main-sync-spawn-ratchet.mjs'
+])
+
+export function listRatchetScripts(scriptsDir) {
+  return readdirSync(scriptsDir)
+    .filter((name) => RATCHET_SCRIPT.test(name) && !RUN_ELSEWHERE.has(name))
+    .sort()
+}
+
+function main(root) {
+  const scriptsDir = path.join(root, 'config', 'scripts')
+  const failed = []
+  for (const name of listRatchetScripts(scriptsDir)) {
+    console.log(`\n▶ ${name}`)
+    const result = spawnSync(process.execPath, [path.join(scriptsDir, name)], {
+      cwd: root,
+      stdio: 'inherit'
+    })
+    if (result.error || result.status !== 0) {
+      failed.push(name)
+    }
+  }
+  if (failed.length > 0) {
+    console.error(`\nFailed ratchets: ${failed.join(', ')}`)
+    return 1
+  }
+  return 0
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exit(main(process.cwd()))
+}
@@ -4,9 +4,10 @@ import { describe, expect, it } from 'vitest'
 import { parse } from 'yaml'
 import { scanSourceTree, stripComments } from '../../src/shared/source-scan/source-tree-scan'
 import { classifyPrJobs } from './pr-code-change-scope.mjs'
+import { WINDOWS_BOUNDARY_TESTS } from './pr-package-test-paths.mjs'

 /**
- * Every Windows-gated test file must be registered in BOTH Windows-lane lists.
+ * Every Windows-gated test file must be registered in the Windows CI lane.
 *
 * PR CI has exactly one job on a Windows runner -- asserted below on any
 * `runs-on` spelling that could land there, because that premise is what makes
@@ -19,10 +20,9 @@ import { classifyPrJobs } from './pr-code-change-scope.mjs'
 * unrelated work while the first five were being fixed -- so the class needs a
 * guard.
 *
- * Both lists matter and being in one is not enough: `WINDOWS_PACKAGE_TESTS` in
- * pr-code-change-scope.mjs decides whether the `package_windows` job RUNS at
- * all for a diff, and the workflow step's vitest argv decides whether the FILE
- * runs once the job started.
+ * Registration is one line in `WINDOWS_BOUNDARY_TESTS` (pr-package-test-paths.mjs):
+ * the workflow step runs that list, and `WINDOWS_PACKAGE_TESTS` spreads it so the
+ * same entry decides whether the `package_windows` job RUNS for a diff.
 *
 * WHAT THIS DETECTS -- a file is Windows-gated when its name is `*.win32.test.*`
 * / `*.win32.spec.*`, or when it contains ANY suite-level gate, nested ones
@@ -76,14 +76,14 @@ const WINDOWS_LANE_STEPS = [
 const WINDOWS_LANE_RUNNER = 'windows-2022'

 /**
- * Windows-gated files that predate this guard and are registered in neither
- * list. Shrink-only: registering one means deleting its line here. Never add.
+ * Windows-gated files that predate this guard and are not registered in the
+ * Windows lane. Shrink-only: registering one means deleting its line here. Never add.
 */
 const UNREGISTERED_ON_MAIN = [
  // Suite gated with `describe.skipIf(platform !== 'win32')`; the cross-platform
  // half of the file still runs on ubuntu, the Windows half runs nowhere.
  'src/main/antigravity/windows-hook-payload-delivery.test.ts',
-  // `.win32.test.ts` by name yet in neither list -- the plainest instance of the class.
+  // `.win32.test.ts` by name yet not registered -- the plainest instance of the class.
  'src/main/daemon/node-pty-windows-input-error.win32.test.ts',
  // Same shape as the antigravity file: a win32-only sibling suite that never runs.
  'src/main/grok/windows-grok-hook-script.test.ts',
@@ -281,7 +281,7 @@ export function couldRunOnWindows(runsOn) {
  return labels.some((label) => /windows/i.test(String(label)) || String(label).includes('${{'))
 }

-/** The vitest argv of the one Windows job's one curated-file step. */
+/** The Windows job's curated files: the boundary list plus any argv the lane steps spell out. */
 function readWindowsWorkflow() {
  const workflow = parse(readFileSync(join(projectDir, '.github/workflows/pr.yml'), 'utf8'))
  const jobs = Object.entries(workflow.jobs ?? {})
@@ -300,10 +300,16 @@ function readWindowsWorkflow() {
    }
    return run
  })
+  if (!runs[0].includes('config/scripts/pr-package-test-paths.mjs')) {
+    throw new Error(`The "${WINDOWS_LANE_STEPS[0]}" step no longer reads WINDOWS_BOUNDARY_TESTS.`)
+  }
  const run = runs.join(' ')
  return {
    windowsJobNames: windowsJobs.map(([name]) => name),
-    laneFiles: run.split(/\s+/).filter((token) => TEST_FILE_PATTERN.test(token))
+    laneFiles: [
+      ...WINDOWS_BOUNDARY_TESTS,
+      ...run.split(/\s+/).filter((token) => TEST_FILE_PATTERN.test(token))
+    ]
  }
 }

@@ -331,13 +337,12 @@ function registrationFailure(path) {
  const missing = []
  if (!laneFiles.includes(path)) {
    missing.push(
-      `add "${path}" to the "${WINDOWS_LANE_STEPS[0]}" vitest argv in .github/workflows/pr.yml ` +
-        `(job ${WINDOWS_LANE_JOB})`
+      `add '${path}' to WINDOWS_BOUNDARY_TESTS in config/scripts/pr-package-test-paths.mjs`
    )
  }
  if (!isInClassifier(path)) {
    missing.push(
-      `add '${path}' to WINDOWS_PACKAGE_TESTS in config/scripts/pr-code-change-scope.mjs`
+      `add '${path}' to WINDOWS_PACKAGE_TESTS in config/scripts/pr-package-test-paths.mjs`
    )
  }
  return missing.length === 0 ? null : `${path}: ${missing.join('; and ')}`
@@ -355,7 +360,7 @@ describe('Windows-gated test files are registered in the Windows CI lane', () =>
    )
    expect(step.env.ORCA_REAL_WINDOWS_SKILL_TEST).toBe('1')
    expect(step.env.ORCA_BACKGROUND_LAUNCH).toBe('1')
-    expect(step.run).toContain(
+    expect(WINDOWS_BOUNDARY_TESTS).toContain(
      'src/main/skills/skill-windows-rename-contention.integration.test.ts'
    )
  })
@@ -428,7 +433,7 @@ describe('Windows-gated test files are registered in the Windows CI lane', () =>
    expect(isInClassifier('src/main/windows/not-a-real-file.win32.test.ts')).toBe(false)
  })

-  it('has every Windows-gated test file in both registration lists', () => {
+  it('has every Windows-gated test file registered in the Windows lane', () => {
    const grandfathered = new Set([...UNREGISTERED_ON_MAIN, ...MANUAL_OPT_IN])
    const failures = gatedFiles
      .filter((path) => !grandfathered.has(path))
@@ -436,10 +441,8 @@ describe('Windows-gated test files are registered in the Windows CI lane', () =>
      .filter((failure) => failure !== null)
    expect(
      failures,
-      'A Windows-gated test file is missing from a Windows CI registration list. It self-skips on ' +
-        'ubuntu and reports success, so it runs on no machine. Both lists are required: ' +
-        'WINDOWS_PACKAGE_TESTS decides whether the package_windows job runs for a diff, the ' +
-        'workflow argv decides whether the file runs once it started. Fix each line below.'
+      'A Windows-gated test file is not registered in the Windows CI lane. It self-skips on ' +
+        'ubuntu and reports success, so it runs on no machine. Fix each line below.'
    ).toEqual([])
  })

@@ -472,7 +475,7 @@ describe('Windows-gated test files are registered in the Windows CI lane', () =>
    expect(
      notActuallyOptIn,
      'A MANUAL_OPT_IN entry has no env-var opt-in, so registering it WOULD make it run. ' +
-        'Register it in both lists and delete the line.'
+        'Register it in WINDOWS_BOUNDARY_TESTS and delete the line.'
    ).toEqual([])
  })

@@ -36,6 +36,7 @@
    "test:repro:remote-agent-session": "pnpm run build:cli && pnpm run build:electron-vite && node config/scripts/remote-agent-session-authority-repro.mjs",
    "capture:agent-transcript": "node config/scripts/ensure-native-runtime.mjs --runtime=node && node config/scripts/capture-agent-pty-transcript.mjs",
    "check:reliability-gates": "node config/scripts/check-reliability-gates.mjs",
+    "check:ratchets": "node config/scripts/run-ratchets.mjs",
    "check:max-lines-ratchet": "node config/scripts/check-max-lines-ratchet.mjs",
    "check:ts-nocheck-ratchet": "node config/scripts/check-ts-nocheck-ratchet.mjs",
    "check:path-literal-ratchet": "node config/scripts/check-path-literal-ratchet.mjs",