From cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df Mon Sep 17 00:00:00 2001
From: Val Alexander <68980965+BunsDev@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:01:05 -0500
Subject: [PATCH 1/4] fix(ci): cancel superseded Windows supervision

---
 .github/workflows/ci.yml            |  2 +-
 docs/phase1-conformance.md          | 18 ++++++++++++++++++
 phase1-conformance.lock.json        |  4 ++--
 src/phase1-conformance-lock.test.ts |  4 ++--
 src/specification-guards.test.ts    | 21 +++++++++++++++++++++
 5 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 742d13f7..a18a00fc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -680,7 +680,7 @@ jobs:
     # Windows bills at twice the Linux rate, and this job needs the artifact
     # `rust` produces, so it follows the same gate.
     if: >-
-      always() && needs.rust.result == 'success'
+      !cancelled() && needs.rust.result == 'success'
       && needs.changes.outputs.docs_only != 'true'
       && ((github.event_name == 'push' && github.ref == 'refs/heads/main')
       || contains(github.event.pull_request.labels.*.name, 'ci:full'))
diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md
index 5fa8fadd..a99dff8c 100644
--- a/docs/phase1-conformance.md
+++ b/docs/phase1-conformance.md
@@ -2874,3 +2874,21 @@ independent profile-probe job lifetimes described at the top of this document.
 Candidate, consumer, Cave, Coven, and supervisor executable authorities are unchanged.
 Native Windows checks and an SDK binding to the eventual delivery remain required
 before protected conformance can establish acceptance.
+
+
+### Cancelling superseded pull-request Windows CI
+
+The ordinary `Windows supervisor behavior` job uses `!cancelled()` together
+with its existing Rust-success, docs-only, main-push and `ci:full` gates. This
+lets a superseded pull-request run stop instead of retaining a Windows runner
+through `always()`. Main concurrency still completes each merge, and independent
+conformance scan, keychain cleanup and artifact-retention steps keep their
+existing conditions. The job name, 20-minute limit, and supervisor containment
+are unchanged.
+
+A cancelled run is not cleanup or conformance acceptance evidence. Its replacement
+must pass all required checks. Issue #306 tracks this change and the remaining
+hosted supersession/replacement validation. The motivating old-head run
+`35117564510` was cancelled while its Windows job continued to completion; the
+replacement run `35118809575` subsequently passed all eleven jobs. That history
+does not validate the new cancellation guard.
diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json
index d2fdf1cd..9015b21e 100644
--- a/phase1-conformance.lock.json
+++ b/phase1-conformance.lock.json
@@ -141,8 +141,8 @@
       },
       {
         "path": ".github/workflows/ci.yml",
-        "blob": "742d13f7a75faa0c7f7064328d0c1f1d4877c6c4",
-        "sha256": "f21eb5af2925a6d721ba45f73f51718bb9f43c36f9230e03655210251df38911"
+        "blob": "a18a00fc1e8dda0c427cd1a4864d896044d7b3df",
+        "sha256": "b28f4700104c70690b0068edfdd435f4b4810043cdd7ba23e868b5e782cf500a"
       },
       {
         "path": ".github/workflows/client-v1-conformance.yml",
diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts
index 66b5d3c8..d3ba8f9e 100644
--- a/src/phase1-conformance-lock.test.ts
+++ b/src/phase1-conformance-lock.test.ts
@@ -125,8 +125,8 @@ const expectedBehaviorAuthority = {
     },
     {
       path: '.github/workflows/ci.yml',
-      blob: '742d13f7a75faa0c7f7064328d0c1f1d4877c6c4',
-      sha256: 'f21eb5af2925a6d721ba45f73f51718bb9f43c36f9230e03655210251df38911',
+      blob: 'a18a00fc1e8dda0c427cd1a4864d896044d7b3df',
+      sha256: 'b28f4700104c70690b0068edfdd435f4b4810043cdd7ba23e868b5e782cf500a',
     },
     {
       path: '.github/workflows/client-v1-conformance.yml',
diff --git a/src/specification-guards.test.ts b/src/specification-guards.test.ts
index 0e71d73d..100dbf38 100644
--- a/src/specification-guards.test.ts
+++ b/src/specification-guards.test.ts
@@ -1239,6 +1239,27 @@ describe('Phase 1 specification guards', () => {
     expect(workflow).toContain('cancel-in-progress: ${' + "{ github.ref_name != 'main' }}");
   });
 
+  it('cancels superseded Windows supervision without dropping its eligibility gates', () => {
+    const workflow = readText('.github/workflows/ci.yml');
+    const job = workflow.split('\n  windows-supervisor-behavior:\n')[1];
+    expect(job).toBeDefined();
+    const condition = job?.match(/\n {4}if: >-\n([\s\S]*?)\n {4}timeout-minutes:/)?.[1];
+    expect(condition?.trim()).toBe(
+      "!cancelled() && needs.rust.result == 'success'\n" +
+        "      && needs.changes.outputs.docs_only != 'true'\n" +
+        "      && ((github.event_name == 'push' && github.ref == 'refs/heads/main')\n" +
+        "      || contains(github.event.pull_request.labels.*.name, 'ci:full'))",
+    );
+    // Cancellation must not remove the independent conformance cleanup steps.
+    expect(workflow).toContain(
+      "if: always() && hashFiles('test-results/phase1-conformance/report.json') != ''",
+    );
+    expect(workflow).toContain(
+      "if: always() && steps.secret-scan.outcome == 'success' && steps.phase1-keychain-cleanup.outcome == 'success'",
+    );
+    expect(workflow.match(/^ {8}if: always\(\)$/gm)).toHaveLength(2);
+  });
+
   it('reads counterpart repositories with a token that does not depend on their visibility', () => {
     // The default GITHUB_TOKEN is scoped to this repository, so it can only
     // read a counterpart that happens to be public. Relying on that has taken

From fcd2afc9fd9111a73e5ef48762c0807bf0a5728a Mon Sep 17 00:00:00 2001
From: Val Alexander <68980965+BunsDev@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:06:14 -0500
Subject: [PATCH 2/4] chore(conformance): bind cancellation guard source

---
 docs/phase1-conformance.md          | 4 ++--
 phase1-conformance.lock.json        | 6 +++---
 src/phase1-conformance-lock.test.ts | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md
index a99dff8c..9fe5abdd 100644
--- a/docs/phase1-conformance.md
+++ b/docs/phase1-conformance.md
@@ -163,8 +163,8 @@ assignment, RPC decoder and primary/secondary exception pipeline. This fixture
 correction does not establish the protected installation failure's cause or
 relax the round-trip assertions.
 
-The lock now selects reviewed source `2dd79ec1505d9c12051552109244067b35813357`,
-tree `5187dc5f385bb07f2a5c2f637ffe58898741017b`, including all 25 governed files
+The lock now selects reviewed source `cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df`,
+tree `b525758adec88797d75638b4b9c2af38866e4574`, including all 25 governed files
 and ten production deltas. The checkout regression exercises all five labels
 from that immutable revision. SDK rebinding, both scope rotations and fresh
 protected validation remain required; this binding alone is not acceptance.
diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json
index 9015b21e..d1e81f69 100644
--- a/phase1-conformance.lock.json
+++ b/phase1-conformance.lock.json
@@ -18,11 +18,11 @@
   },
   "harness": {
     "repository": "OpenCoven/chat",
-    "revision": "2dd79ec1505d9c12051552109244067b35813357"
+    "revision": "cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df"
   },
   "harnessAuthority": {
-    "revision": "2dd79ec1505d9c12051552109244067b35813357",
-    "tree": "5187dc5f385bb07f2a5c2f637ffe58898741017b",
+    "revision": "cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df",
+    "tree": "b525758adec88797d75638b4b9c2af38866e4574",
     "files": [
       {
         "path": "scripts/phase1-conformance.mjs",
diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts
index d3ba8f9e..f4964bfe 100644
--- a/src/phase1-conformance-lock.test.ts
+++ b/src/phase1-conformance-lock.test.ts
@@ -80,8 +80,8 @@ const committedHarnessAuthority = JSON.parse(
   readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'),
 ).harnessAuthority;
 const expectedBehaviorAuthority = {
-  revision: '2dd79ec1505d9c12051552109244067b35813357',
-  tree: '5187dc5f385bb07f2a5c2f637ffe58898741017b',
+  revision: 'cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df',
+  tree: 'b525758adec88797d75638b4b9c2af38866e4574',
   files: [
     {
       path: 'scripts/phase1-conformance.mjs',

From ffa954c2678bd933d7057d526b5fc4ed67a16f32 Mon Sep 17 00:00:00 2001
From: Val Alexander <68980965+BunsDev@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:15:07 -0500
Subject: [PATCH 3/4] test(ci): exercise Windows supervision eligibility cases

---
 src/specification-guards.test.ts | 55 ++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/src/specification-guards.test.ts b/src/specification-guards.test.ts
index 100dbf38..1646a9c5 100644
--- a/src/specification-guards.test.ts
+++ b/src/specification-guards.test.ts
@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { resolve } from 'node:path';
+import { runInNewContext } from 'node:vm';
 
 type CapabilityFile = {
   $schema?: string;
@@ -1260,6 +1261,60 @@ describe('Phase 1 specification guards', () => {
     expect(workflow.match(/^ {8}if: always\(\)$/gm)).toHaveLength(2);
   });
 
+  it.each([
+    ['labelled PR', 'success', false, false, 'pull_request', 'refs/pull/308/merge', true, true],
+    ['failed Rust', 'failure', false, false, 'pull_request', 'refs/pull/308/merge', true, false],
+    ['skipped Rust', 'skipped', false, false, 'pull_request', 'refs/pull/308/merge', true, false],
+    [
+      'cancelled Rust',
+      'cancelled',
+      false,
+      false,
+      'pull_request',
+      'refs/pull/308/merge',
+      true,
+      false,
+    ],
+    ['cancelled PR', 'success', true, false, 'pull_request', 'refs/pull/308/merge', true, false],
+    ['docs-only PR', 'success', false, true, 'pull_request', 'refs/pull/308/merge', true, false],
+    ['unlabelled PR', 'success', false, false, 'pull_request', 'refs/pull/308/merge', false, false],
+    ['main push', 'success', false, false, 'push', 'refs/heads/main', false, true],
+    ['main with failed Rust', 'failure', false, false, 'push', 'refs/heads/main', false, false],
+    ['cancelled main', 'success', true, false, 'push', 'refs/heads/main', false, false],
+    ['feature push', 'success', false, false, 'push', 'refs/heads/feature', false, false],
+  ] as const)(
+    'evaluates Windows supervision eligibility for %s',
+    (_name, rust, cancelled, docsOnly, eventName, ref, full, expected) => {
+      const workflow = readText('.github/workflows/ci.yml');
+      const job = workflow.split('\n  windows-supervisor-behavior:\n')[1];
+      const condition = job?.match(/\n {4}if: >-\n([\s\S]*?)\n {4}timeout-minutes:/)?.[1];
+      expect(condition).toBeDefined();
+      if (!condition) throw new Error('Missing Windows supervision condition');
+      // Evaluate this boolean/string subset, not GitHub cancellation scheduling.
+      // The exact-expression guard above prevents unsupported syntax drifting in.
+      const expression = condition.replace(
+        'github.event.pull_request.labels.*.name',
+        'github.event.pull_request.labels.map(label => label.name)',
+      );
+      const result: unknown = runInNewContext(
+        expression,
+        {
+          always: () => true,
+          cancelled: () => cancelled,
+          contains: (values: string[], value: string) => values.includes(value),
+          needs: { rust: { result: rust }, changes: { outputs: { docs_only: String(docsOnly) } } },
+          github: {
+            event_name: eventName,
+            ref,
+            event: { pull_request: { labels: full ? [{ name: 'ci:full' }] : [] } },
+          },
+        },
+        { timeout: 1000 },
+      );
+      expect(result).toBe(expected);
+    },
+  );
+
   it('reads counterpart repositories with a token that does not depend on their visibility', () => {
     // The default GITHUB_TOKEN is scoped to this repository, so it can only
     // read a counterpart that happens to be public. Relying on that has taken

From a28cf3cf0d77966667378ec812e872c5e33b5add Mon Sep 17 00:00:00 2001
From: Val Alexander <68980965+BunsDev@users.noreply.github.com>
Date: Wed, 16 Sep 2026 12:20:28 -0500
Subject: [PATCH 4/4] chore(conformance): bind eligibility coverage source

---
 docs/phase1-conformance.md          | 4 ++--
 phase1-conformance.lock.json        | 6 +++---
 src/phase1-conformance-lock.test.ts | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/phase1-conformance.md b/docs/phase1-conformance.md
index 9fe5abdd..f4e6598e 100644
--- a/docs/phase1-conformance.md
+++ b/docs/phase1-conformance.md
@@ -163,8 +163,8 @@ assignment, RPC decoder and primary/secondary exception pipeline. This fixture
 correction does not establish the protected installation failure's cause or
 relax the round-trip assertions.
 
-The lock now selects reviewed source `cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df`,
-tree `b525758adec88797d75638b4b9c2af38866e4574`, including all 25 governed files
+The lock now selects reviewed source `ffa954c2678bd933d7057d526b5fc4ed67a16f32`,
+tree `3d667c7d816fe3fac088b6865b46756a84581beb`, including all 25 governed files
 and ten production deltas. The checkout regression exercises all five labels
 from that immutable revision. SDK rebinding, both scope rotations and fresh
 protected validation remain required; this binding alone is not acceptance.
diff --git a/phase1-conformance.lock.json b/phase1-conformance.lock.json
index d1e81f69..070d568e 100644
--- a/phase1-conformance.lock.json
+++ b/phase1-conformance.lock.json
@@ -18,11 +18,11 @@
   },
   "harness": {
     "repository": "OpenCoven/chat",
-    "revision": "cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df"
+    "revision": "ffa954c2678bd933d7057d526b5fc4ed67a16f32"
   },
   "harnessAuthority": {
-    "revision": "cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df",
-    "tree": "b525758adec88797d75638b4b9c2af38866e4574",
+    "revision": "ffa954c2678bd933d7057d526b5fc4ed67a16f32",
+    "tree": "3d667c7d816fe3fac088b6865b46756a84581beb",
     "files": [
       {
         "path": "scripts/phase1-conformance.mjs",
diff --git a/src/phase1-conformance-lock.test.ts b/src/phase1-conformance-lock.test.ts
index f4964bfe..195eef80 100644
--- a/src/phase1-conformance-lock.test.ts
+++ b/src/phase1-conformance-lock.test.ts
@@ -80,8 +80,8 @@ const committedHarnessAuthority = JSON.parse(
   readFileSync(resolve(projectRoot, 'phase1-conformance.lock.json'), 'utf8'),
 ).harnessAuthority;
 const expectedBehaviorAuthority = {
-  revision: 'cccdb204fb8fdaeddd1f7e02eafd7f12ad9c87df',
-  tree: 'b525758adec88797d75638b4b9c2af38866e4574',
+  revision: 'ffa954c2678bd933d7057d526b5fc4ed67a16f32',
+  tree: '3d667c7d816fe3fac088b6865b46756a84581beb',
   files: [
     {
       path: 'scripts/phase1-conformance.mjs',