fix(ci): bound Windows process contention

scripts/ci-workflow.spec.ts

@@ -98,9 +98,9 @@ describe('CI workflow', () => {
     ))
     expect(buildCommands.map(step => step.run)).toContain('pnpm run check:ci:windows-blocking')
 
-    // windows-coverage runs the 6-partition profile.
+    // windows-coverage uses the lower 4-partition profile.
     expect(windowsCoverage.name).toBe('windows node 24 / coverage')
-    expect(windowsCoverage.env).toMatchObject({ DSH_COVERAGE_PARTITIONS: '6' })
+    expect(windowsCoverage.env).toMatchObject({ DSH_COVERAGE_PARTITIONS: '4' })
     const coverageSteps = windowsCoverage.steps as unknown[]
     const coverageCommands = coverageSteps.filter((step): step is Record<string, unknown> & { run: string } => (
       isRecord(step) && typeof step.run === 'string'

scripts/run-gates.spec.ts

@@ -194,6 +194,20 @@ describe('gate graph validation', () => {
     }
   })
 
+  it('runs the Windows built-bin smoke after other observational gates settle', () => {
+    const observational = withPnpmEntrypoint(() => gatesForMode('ci-windows-observational'))
+    const builtBin = observational.find(gate => gate.id === 'built-bin-smoke')
+
+    expect(builtBin?.after).toEqual(
+      observational.filter(gate => gate.id !== 'built-bin-smoke').map(gate => gate.id),
+    )
+
+    const completeBuiltBin = withPnpmEntrypoint(() => gatesForMode('ci-windows-complete'))
+      .find(gate => gate.id === 'built-bin-smoke')
+    expect(completeBuiltBin?.after).toContain('windows-site')
+    expect(completeBuiltBin?.after).not.toContain('docs-site-build')
+  })
+
   it('applies one configured test and polling timeout to both coverage gates', () => {
     const gates = withEnv('DSH_COVERAGE_TEST_TIMEOUT_MS', '15000', () =>
       withPnpmEntrypoint(() => gatesForMode('ci-windows-complete')))

scripts/run-gates.ts

@@ -507,7 +507,10 @@ function ciWindowsCompleteGates(): Gate[] {
     .map(gate => ({
       ...gate,
       allowFailure: true,
-      after: [...new Set([...coverageAfter, ...(gate.after ?? [])])],
+      after: [...new Set([
+        ...coverageAfter,
+        ...(gate.after ?? []).map(id => id === 'docs-site-build' ? 'windows-site' : id),
+      ])],
     }))
   return [
     ciBuildGate(),
@@ -518,7 +521,7 @@ function ciWindowsCompleteGates(): Gate[] {
 }
 
 function ciWindowsObservationalGates(): Gate[] {
-  return [
+  const predecessors = [
     ...ciStaticGates({ ownsBuild: true }),
     // Linux owns required lint and snapshots; Windows omits those duplicates.
     pnpmScript('duplication', 'duplication'),
@@ -528,7 +531,15 @@ function ciWindowsObservationalGates(): Gate[] {
       needs: ['build'],
     }),
     builtPackageInvariantsGate(['build']),
-    builtBinSmokeGate(),
+  ]
+  return [
+    ...predecessors,
+    {
+      ...builtBinSmokeGate(),
+      // This smoke starts real application children with bounded startup
+      // deadlines. Let other Windows processes settle before measuring startup.
+      after: predecessors.map(gate => gate.id),
+    },
   ]
 }