Merge pull request #2202 from deepseek-harness/ci/selfhosted-windows-runners

ci: unify Windows CI on native self-hosted runners

.github/AGENTS.md

@@ -1,3 +1,3 @@
 # AGENTS.md — GitHub Actions
 
-Run jobs on Windows runners (`windows-*` labels) under native `pwsh`. The pull-request `windows` job is the deliberate exception: it runs Windows Node under Wine on hosted Linux and blocks `all checks passed`; `windows-native` runs automatically on `windows-2025` but reports independently — see the [dual-lane Agent Note](../.agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md).
+Run jobs on Windows runners (`windows-*` labels) under native `pwsh`. The pull-request `windows` job is the deliberate exception: it runs Windows Node under Wine on hosted Linux and blocks `all checks passed`; `windows-native` runs automatically on `windows-2025` (or the self-hosted `[self-hosted, dsh-win-ci, windows]` pool under `DSH_CI_FAILOVER=selfhosted`) but reports independently. The master `serial-windows` standby continuously validates the self-hosted failover target — see the [failover runbook](../.agents/notes/implemented/process/2026-07-26-ci-failover-runbook.md).

.github/workflows/ci.yml

@@ -305,7 +305,7 @@ jobs:
   # Windows Node under Wine on standard hosted Linux. The independent
   # windows-native job below keeps the complete native-kernel inventory —
   # including the observational portability gates this lane does not run —
-  # on real windows-2025. This job only provisions runner state (caches,
+  # on real Windows. This job only provisions runner state (caches,
   # apt); scripts/wine-windows-gates.sh owns the gate logic and is the same
   # script the optional local gate `pnpm run check:windows-wine` runs.
   # Current topology and fidelity limits live in
@@ -411,12 +411,18 @@ jobs:
 
   # Every pull request also gets a real Windows-kernel signal. This job keeps
   # its own unmasked conclusion but is deliberately absent from
-  # all-checks-passed.needs, so it never delays or changes that required verdict.
-  # See the dual Wine/native pull-request CI decision:
-  # .agents/notes/implemented/process/2026-08-08-native-windows-pull-request-ci.md
+  # all-checks-passed.needs, so it never delays or changes that required
+  # verdict. Under normal operation it runs on the hosted larger runner; under
+  # failover (DSH_CI_FAILOVER=selfhosted) it retargets onto the in-house
+  # self-hosted Windows pool. Dependabot PRs are excluded from the self-hosted
+  # pool and stay queued for the hosted runner — see the failover runbook.
   windows-native:
     if: github.event_name == 'pull_request'
-    runs-on: dsh-windows-2025-16core
+    runs-on: >-
+      ${{ vars.DSH_CI_FAILOVER == 'selfhosted'
+          && github.event.pull_request.user.login != 'dependabot[bot]'
+          && fromJSON('["self-hosted", "dsh-win-ci", "windows"]')
+          || 'dsh-windows-2025-16core' }}
     name: windows node 24 / native complete
     timeout-minutes: 60
     env:
@@ -442,8 +448,10 @@ jobs:
         with:
           node-version: ${{ env.PRIMARY_NODE_VERSION }}
 
-      # Extracting the many-file pnpm store cache is slower than a clean install,
-      # and saving it adds more latency after the gates.
+      # Extracting the many-file pnpm store cache is slower than a clean
+      # install on hosted Windows runners, and saving it adds latency after
+      # the gates. The self-hosted VM's persistent store makes caching
+      # redundant.
       - name: Install (immutable)
         shell: pwsh
         run: pnpm install --frozen-lockfile
@@ -608,10 +616,22 @@ jobs:
           DSH_SNAPSHOT_MAX_CONCURRENCY: '1'
         run: pnpm run check:ci
 
+  # Hot-standby drill for the in-house self-hosted Windows pool: every master
+  # move re-runs the complete unsharded Windows gate inventory on the persistent
+  # VM, continuously proving that environment can take over the required
+  # `windows` lane if the hosted pool degrades (the switch is setting the
+  # writer-manageable DSH_CI_FAILOVER variable — see the failover runbook, no
+  # merge required). Push-triggered, so this lane always executes the base
+  # branch's own workflow definition. Non-blocking for pull requests; absent
+  # from all-checks-passed.needs by design — the required `windows` job owns
+  # the PR verdict. No cache steps because the VM's persistent pnpm store
+  # and tool caches make them redundant (and saving here would poison the
+  # hosted cache namespace with self-hosted paths).
   serial-windows:
-    if: false
-    name: serial / windows
-    runs-on: windows-2025
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    name: serial / windows (self-hosted standby)
+    runs-on: [self-hosted, dsh-win-ci, windows]
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v6
 
@@ -629,20 +649,23 @@ jobs:
         with:
           node-version: ${{ env.PRIMARY_NODE_VERSION }}
 
+      - name: Configure persistent pnpm store
+        shell: pwsh
+        run: |
+          $storeRoot = "$env:LOCALAPPDATA\pnpm\store"
+          echo "PNPM_CONFIG_STORE_DIR=$storeRoot" >> $env:GITHUB_ENV
+
       - name: Install (immutable)
         shell: pwsh
         run: pnpm install --frozen-lockfile
 
-      - name: Run complete unsharded primary Node CI serially
+      - name: Run complete unsharded Windows gate inventory serially
         shell: pwsh
         env:
           DSH_COVERAGE_MAX_WORKERS: '1'
-          DSH_E2E_MAX_WORKERS: '1'
           DSH_GATE_CONCURRENCY: '1'
-          DSH_OXLINT_THREADS: '1'
           DSH_PUBLINT_CONCURRENCY: '1'
-          DSH_SNAPSHOT_MAX_CONCURRENCY: '1'
-        run: pnpm run check:ci
+        run: pnpm run check:ci:windows-complete
 
   # Manual, bounded comparison of the actual critical Linux and Windows lanes.
   # The named pools are restricted at the organization level to this repository.