QA: reproduce-first bug suite + LSP/grammar extraction fixes (5-platform board green)

.github/workflows/_build.yml

@@ -45,7 +45,7 @@ jobs:
     # release with no Intel macOS binary (a user-reported gap). macos-15-intel
     # is GitHub's supported Intel image through Aug 2027 (the last x86_64 macOS
     # runner); revisit the Intel leg before that retirement.
-    timeout-minutes: 25
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -120,7 +120,7 @@ jobs:
 
   build-windows:
     runs-on: windows-latest
-    timeout-minutes: 25
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -195,7 +195,7 @@ jobs:
           - arch: arm64
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 25
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 

.github/workflows/_security.yml

@@ -24,7 +24,7 @@ jobs:
 
   license-gate:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install ScanCode Toolkit
@@ -40,7 +40,7 @@ jobs:
 
   codeql-gate:
     runs-on: ubuntu-latest
-    timeout-minutes: 50
+    timeout-minutes: 240
     steps:
       - name: Wait for CodeQL on current commit (max 45 min)
         env:

.github/workflows/_smoke.yml

@@ -2,31 +2,81 @@
 name: Smoke
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      broad_platforms:
+        description: 'Smoke the shipped binaries on the broad platform matrix (extra OS versions) instead of the core set'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
 jobs:
+  # Emit the platform matrices as JSON. The CORE set is the default (fast,
+  # unchanged); the BROAD set adds extra free runners (additional OS versions)
+  # that download the SAME shipped artifact for their goos/goarch and verify it
+  # runs on a wider range of OS versions. No new artifacts are built — broad
+  # legs reuse the exact binaries produced by _build.yml.
+  setup-matrix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      unix: ${{ steps.set.outputs.unix }}
+      windows: ${{ steps.set.outputs.windows }}
+      portable: ${{ steps.set.outputs.portable }}
+    steps:
+      - name: Compute matrices
+        id: set
+        env:
+          BROAD: ${{ inputs.broad_platforms }}
+        run: |
+          CORE_UNIX='[
+            {"os":"ubuntu-latest","goos":"linux","goarch":"amd64"},
+            {"os":"ubuntu-24.04-arm","goos":"linux","goarch":"arm64"},
+            {"os":"macos-14","goos":"darwin","goarch":"arm64"},
+            {"os":"macos-15-intel","goos":"darwin","goarch":"amd64"}
+          ]'
+          # Broad legs reuse existing goos/goarch artifacts on newer/older OS
+          # versions (e.g. ubuntu-22.04 = older glibc) to widen the run-anywhere
+          # signal without building new targets.
+          BROAD_UNIX='[
+            {"os":"ubuntu-22.04","goos":"linux","goarch":"amd64","optional":true},
+            {"os":"ubuntu-22.04-arm","goos":"linux","goarch":"arm64","optional":true},
+            {"os":"macos-15","goos":"darwin","goarch":"arm64","optional":true}
+          ]'
+          CORE_WIN='[{"os":"windows-latest"}]'
+          # windows-11-arm runs the shipped x86_64 binary under emulation —
+          # verifies the Windows artifact still launches on ARM hardware.
+          BROAD_WIN='[{"os":"windows-2025","optional":true},{"os":"windows-11-arm","optional":true}]'
+          CORE_PORTABLE='[
+            {"arch":"amd64","runner":"ubuntu-latest"},
+            {"arch":"arm64","runner":"ubuntu-24.04-arm"}
+          ]'
+          BROAD_PORTABLE='[
+            {"arch":"amd64","runner":"ubuntu-22.04","optional":true},
+            {"arch":"arm64","runner":"ubuntu-22.04-arm","optional":true}
+          ]'
+          if [ "$BROAD" = "true" ]; then
+            UNIX=$(jq -cn --argjson a "$CORE_UNIX" --argjson b "$BROAD_UNIX" '$a + $b')
+            WIN=$(jq -cn --argjson a "$CORE_WIN" --argjson b "$BROAD_WIN" '$a + $b')
+            PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" --argjson b "$BROAD_PORTABLE" '$a + $b')
+          else
+            UNIX=$(jq -cn --argjson a "$CORE_UNIX" '$a')
+            WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
+            PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" '$a')
+          fi
+          echo "unix={\"variant\":[\"standard\",\"ui\"],\"include\":$UNIX}" >> "$GITHUB_OUTPUT"
+          echo "windows={\"variant\":[\"standard\",\"ui\"],\"include\":$WIN}" >> "$GITHUB_OUTPUT"
+          echo "portable={\"variant\":[\"standard\",\"ui\"],\"include\":$PORTABLE}" >> "$GITHUB_OUTPUT"
+
   smoke-unix:
+    needs: setup-matrix
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            goos: linux
-            goarch: amd64
-          - os: ubuntu-24.04-arm
-            goos: linux
-            goarch: arm64
-          - os: macos-14
-            goos: darwin
-            goarch: arm64
-          - os: macos-15-intel
-            goos: darwin
-            goarch: amd64
-        variant: [standard, ui]
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.unix) }}
     runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.optional == true }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -98,11 +148,12 @@ jobs:
           clamscan --no-summary ./codebase-memory-mcp
 
   smoke-windows:
+    needs: setup-matrix
     strategy:
       fail-fast: false
-      matrix:
-        variant: [standard, ui]
-    runs-on: windows-latest
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.windows) }}
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.optional == true }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -164,16 +215,12 @@ jobs:
           Write-Host "=== Windows Defender: clean ==="
 
   smoke-linux-portable:
+    needs: setup-matrix
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - arch: amd64
-            runner: ubuntu-latest
-          - arch: arm64
-            runner: ubuntu-24.04-arm
-        variant: [standard, ui]
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.portable) }}
     runs-on: ${{ matrix.runner }}
+    continue-on-error: ${{ matrix.optional == true }}
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/_soak.yml

@@ -47,7 +47,12 @@ jobs:
             cc: cc
             cxx: c++
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
+    # BUG FIX: this was hard-coded to 30, but the caller (nightly-soak.yml)
+    # passes duration_minutes: 240. GitHub killed the job at 30 min, so the
+    # "4h nightly soak" was SILENTLY TRUNCATED to 30 min and never once ran
+    # multi-hour. Budget must always exceed the passed duration; 300 covers
+    # the 240-min nightly with headroom (build + analysis + idle phases).
+    timeout-minutes: 300
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install deps (Linux)
@@ -67,7 +72,10 @@ jobs:
 
   soak-quick-windows:
     runs-on: windows-latest
-    timeout-minutes: 30
+    # BUG FIX (same 30→240 mismatch as soak-quick above): the caller passes
+    # duration_minutes: 240, so a 30-min cap truncated the nightly soak here
+    # too. 300 covers the 240-min nightly with headroom.
+    timeout-minutes: 300
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
@@ -125,7 +133,12 @@ jobs:
             cc: cc
             cxx: c++
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
+    # ASan soak runs a FIXED 15-min soak (hard-coded below, NOT driven by
+    # inputs.duration_minutes), but the ASan-instrumented build is slow and
+    # leak reporting adds teardown time. 60 keeps the budget comfortably above
+    # the 15-min run so it is never truncated. (Same class of bug as the
+    # soak-quick 30→240 mismatch above — keep the timeout above the run length.)
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install deps (Linux)
@@ -150,7 +163,10 @@ jobs:
   soak-asan-windows:
     if: ${{ inputs.run_asan }}
     runs-on: windows-latest
-    timeout-minutes: 45
+    # FIXED 15-min soak (hard-coded below). MSYS2/Wine + ASan build is the
+    # slowest path; 60 keeps the budget well above the run length so it is
+    # never truncated.
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2

.github/workflows/_test.yml

@@ -8,30 +8,72 @@ on:
         description: 'Skip incremental perf tests (phases 2-7)'
         type: boolean
         default: true
+      broad_platforms:
+        description: 'Test the broad platform matrix (older glibc + extra OS versions) instead of the core set'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
 jobs:
+  # Emit the platform matrices as JSON. The CORE set is the default (fast,
+  # unchanged); the BROAD set adds extra free runners (older glibc /
+  # additional OS versions) for a wider "does it build everywhere" picture.
+  setup-matrix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      unix: ${{ steps.set.outputs.unix }}
+      windows: ${{ steps.set.outputs.windows }}
+    steps:
+      - name: Compute matrices
+        id: set
+        env:
+          BROAD: ${{ inputs.broad_platforms }}
+        run: |
+          CORE_UNIX='[
+            {"os":"ubuntu-latest","cc":"gcc","cxx":"g++"},
+            {"os":"ubuntu-24.04-arm","cc":"gcc","cxx":"g++"},
+            {"os":"macos-14","cc":"cc","cxx":"c++"},
+            {"os":"macos-15-intel","cc":"cc","cxx":"c++"}
+          ]'
+          BROAD_UNIX='[
+            {"os":"ubuntu-22.04","cc":"gcc","cxx":"g++","optional":true},
+            {"os":"ubuntu-22.04-arm","cc":"gcc","cxx":"g++","optional":true},
+            {"os":"macos-15","cc":"cc","cxx":"c++","optional":true}
+          ]'
+          # Each Windows leg pins the msys2 environment + package arch to the
+          # RUNNER architecture so the build is native, never emulated:
+          #   x86-64 runners -> CLANG64 (mingw-w64-clang-x86_64-*)
+          #   ARM64  runner  -> CLANGARM64 (mingw-w64-clang-aarch64-*)
+          # windows-11-arm previously used the x86-64 CLANG64 toolchain, so its
+          # binary ran under Windows-on-ARM x86-64 emulation and ASan's function
+          # interception crashed (interception_win: unhandled instruction). With
+          # the native ARM64 toolchain ASan instruments native ARM64 code, so it
+          # is a real (non-optional) gate, not a tolerated emulated-flake.
+          CORE_WIN='[{"os":"windows-latest","msystem":"CLANG64","pkg":"x86_64"}]'
+          BROAD_WIN='[{"os":"windows-2025","optional":true,"msystem":"CLANG64","pkg":"x86_64"},{"os":"windows-11-arm","msystem":"CLANGARM64","pkg":"aarch64"}]'
+          if [ "$BROAD" = "true" ]; then
+            UNIX=$(jq -cn --argjson a "$CORE_UNIX" --argjson b "$BROAD_UNIX" '$a + $b')
+            WIN=$(jq -cn --argjson a "$CORE_WIN" --argjson b "$BROAD_WIN" '$a + $b')
+          else
+            UNIX=$(jq -cn --argjson a "$CORE_UNIX" '$a')
+            WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
+          fi
+          echo "unix={\"include\":$UNIX}" >> "$GITHUB_OUTPUT"
+          echo "windows={\"include\":$WIN}" >> "$GITHUB_OUTPUT"
+
   test-unix:
+    needs: setup-matrix
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            cc: gcc
-            cxx: g++
-          - os: ubuntu-24.04-arm
-            cc: gcc
-            cxx: g++
-          - os: macos-14
-            cc: cc
-            cxx: c++
-          - os: macos-15-intel
-            cc: cc
-            cxx: c++
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.unix) }}
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 60
+    # Broad-only legs (extra OS versions) are informational: visible but
+    # non-blocking, so a flaky/less-common runner can't block a release.
+    continue-on-error: ${{ matrix.optional == true }}
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -45,24 +87,35 @@ jobs:
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
 
   test-windows:
-    runs-on: windows-latest
-    timeout-minutes: 60
+    needs: setup-matrix
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.windows) }}
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.optional == true }}
+    timeout-minutes: 240
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
-          msystem: CLANG64
+          msystem: ${{ matrix.msystem }}
           path-type: inherit
           install: >-
-            mingw-w64-clang-x86_64-clang
-            mingw-w64-clang-x86_64-compiler-rt
-            mingw-w64-clang-x86_64-zlib
+            mingw-w64-clang-${{ matrix.pkg }}-clang
+            mingw-w64-clang-${{ matrix.pkg }}-compiler-rt
+            mingw-w64-clang-${{ matrix.pkg }}-zlib
             make
             git
 
       - name: Test
         shell: msys2 {0}
-        run: scripts/test.sh CC=clang CXX=clang++
+        # AddressSanitizer is unavailable on native ARM64 Windows (LLVM ships no
+        # libclang_rt.asan for aarch64-w64-windows-gnu) and cannot intercept the
+        # system DLLs under x86-64 emulation either, so windows-11-arm runs the
+        # native ARM64 build with SANITIZE= (no sanitizer) — still a real
+        # functional gate. ASan/UBSan coverage comes from the other 9 legs,
+        # including native-ARM Linux/macOS. x86-64 Windows keeps full sanitizers.
+        run: scripts/test.sh CC=clang CXX=clang++ ${{ matrix.os == 'windows-11-arm' && 'SANITIZE=' || '' }}
         env:
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}