Windows shell validation does not run on pushes to main

[coneilen]

Summary

Windows shell validation -- the workflow that runs Tools/windows/uia-live-gate.ps1 -- does not run on pushes to main. It only runs on pull requests.

Checking the last 25 workflow runs on main shows only Linux and pages-build-deployment. There is no Windows shell validation run on main for any recent merge, including the gate-hardening commits that specifically changed that file (#440, #441, #442, #443, #444).

Why this matters

Every gate change is validated only on its own PR head, against the base it was branched from. Once merged, no run ever confirms the gate still passes on the integrated result.

This is not theoretical -- it already caused a real miss. While diagnosing #439, three CI runs on byte-identical trees produced three different outcomes:

head	duration	result
f1b95fe	60.1 min	hard timeout, logs not persisted
8610ad4	12.4 min	missing graph fragment after dynamic project/loop invocation
810ef46	15.6 min	activity navigation did not select the targeted loop

All three traced to one defect in a shared helper (Get-DirectChildren swallowing ElementNotAvailableException and returning an empty set). Because that helper underpins Find-FragmentById and Wait-ForGraphChildren, a transient error anywhere in a tree walk was converted into a silent "not found", which then burned a retry budget -- worst case attempts x nodes x 0.3s.

The failing assertion in the third case was pre-existing and textually untouched by the PR, which made it easy to misread as an unrelated flake. A post-merge run on main would have distinguished "broken by this PR" from "already broken on main" immediately.

Secondary concern: a swallowed error can make assertions vacuous

That same defect illustrates a hazard worth guarding against generally. Assert-FragmentLinks asserts:

Require ($unexpectedIds.Count -eq 0) "$label exposed unexpected children: ..."

If the underlying walk returns an empty set instead of throwing, this passes while verifying nothing. Any -eq 0 / -not assertion downstream of a helper that can silently return empty has this shape. (The specific instance is fixed in #439; this is about the class.)

Proposed change

Add main to the Windows shell validation workflow triggers:

on:
  push:
    branches: [main]
  pull_request:

Worth considering alongside it:

• The job has no explicit step timeout, so a hang runs to the workflow-level limit (~60 min) and Actions does not persist the logs when the job is force-killed -- losing exactly the diagnostic data needed. A shorter explicit timeout-minutes on the gate step would fail faster and preserve output.
• The gate is long and serial; a hang anywhere costs a full hour of a contended Windows runner.

Notes

• Requires a maintainer with workflow-edit rights.
• No product code involved; CI configuration only.
• Filed from coordinator session context during Validate folder lanes, zoom controls, attention rail, and connector handles #439 review.