fix(agent): Windows helper lifecycle durability (RDS accumulation)

.github/workflows/ci.yml

@@ -696,6 +696,75 @@ jobs:
           path: agent/coverage.out
           retention-days: 7
 
+  test-agent-windows:
+    name: Test Agent (Windows)
+    runs-on: windows-latest
+    needs: [lint]
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: agent/go.sum
+
+      - name: Download Go dependencies
+        working-directory: agent
+        run: go mod download
+
+      # CGO_ENABLED=0 is required, not incidental. internal/remote/desktop is a
+      # non-cgo package on Windows: comVtblFn, dxgiCapturer and procDeleteObject
+      # are defined in files tagged `windows && !cgo`, while audio_windows.go,
+      # cursor_windows.go, gpu_convert_windows.go, monitor_windows.go and
+      # dxgi_dirty_rects_windows.go use them under a plain `windows` tag.
+      # windows-latest ships gcc, so CGO_ENABLED defaults to 1 there and the
+      # package fails to compile — and heartbeat/agentapp import it transitively,
+      # so they need cgo off too.
+      #
+      # This list is explicit rather than ./... because Windows CI has never run
+      # before this job, so //go:build windows tests across the repo have never
+      # executed anywhere and many are red. Verified on windows-latest and a
+      # Windows Server 2022 host, ALL pre-existing on main (none touched by the
+      # branch that added this job):
+      #
+      #   internal/heartbeat  - TestSendHelperTokenUpdateOnlyReachesAssistSessions,
+      #                         TestHandleHelperSessionAuthenticatedPushesOnlyToAssist,
+      #                         TestReconcileUserHelper_UnexpectedStatError_NoDownload,
+      #                         TestResolveRunAsSessionUserPrefersRunAsUserScope
+      #   internal/agentapp   - TestStaticUnitMatchesEmbedded
+      #   internal/config     - TestPersistedServerURLProviderFollowsPromotion
+      #   also red under ./... : internal/backup{,/providers,/systemstate},
+      #                          peripheral, procoutput, remote/{desktop,filedrop,tools},
+      #                          updater
+      #
+      # Those packages are excluded so this gate reports on code that is actually
+      # green, rather than being red on inherited debt and therefore ignored.
+      # Fixing them and widening to ./... is tracked in #2523, which records the
+      # root cause of each failure.
+      #
+      # ./internal/eventlog IS listed and IS green: its tests previously ran on no
+      # platform at all (Linux skips them via build tag, and `go build` never
+      # compiles _test.go), which is the exact gap this job was added to close.
+      # When adding a package with //go:build windows tests, add it here.
+      - name: Run Windows Go tests
+        working-directory: agent
+        env:
+          CGO_ENABLED: "0"
+        run: go test ./internal/sessionbroker ./internal/eventlog ./internal/watchdog ./cmd/breeze-watchdog
+
+      # -race requires cgo, which remote/desktop cannot satisfy on Windows, so
+      # this covers only packages that do not import it (heartbeat and agentapp
+      # do, transitively). Same package set as the step above: sessionbroker is
+      # the concurrency-critical one — session-keyed helper admission, the
+      # lifecycle registry, and Job Object ownership all live there — so it is
+      # the one that most needs the detector on the OS it actually ships to.
+      - name: Run Windows race tests
+        working-directory: agent
+        run: go test -race ./internal/sessionbroker ./internal/eventlog ./internal/watchdog ./cmd/breeze-watchdog
+
   # ─── Windows runtime smoke (#1000) ────────────────────────────────────
   # CI cross-compiles the Windows agent (build-agent matrix) but never RAN
   # it on Windows, so runtime-only Windows regressions shipped green. This
@@ -1319,7 +1388,7 @@ jobs:
   ci-success:
     name: CI Success
     runs-on: ubuntu-latest
-    needs: [lint, typecheck, test-api, test-web, test-portal, test-office-addin-core, test-excel-addin, test-word-addin, test-powerpoint-addin, test-outlook-addin, security-audit, build-api, build-web, build-portal, build-agent, test-agent, windows-runtime-smoke, integration-test, rust-check, smoke-test]
+    needs: [lint, typecheck, test-api, test-web, test-portal, test-office-addin-core, test-excel-addin, test-word-addin, test-powerpoint-addin, test-outlook-addin, security-audit, build-api, build-web, build-portal, build-agent, test-agent, test-agent-windows, windows-runtime-smoke, integration-test, rust-check, smoke-test]
     if: ${{ !cancelled() }}
     steps:
       - name: Check all jobs passed
@@ -1340,6 +1409,7 @@ jobs:
           BUILD_PORTAL_RESULT: ${{ needs.build-portal.result }}
           BUILD_AGENT_RESULT: ${{ needs.build-agent.result }}
           TEST_AGENT_RESULT: ${{ needs.test-agent.result }}
+          TEST_AGENT_WINDOWS_RESULT: ${{ needs.test-agent-windows.result }}
           WINDOWS_RUNTIME_SMOKE_RESULT: ${{ needs.windows-runtime-smoke.result }}
           INTEGRATION_TEST_RESULT: ${{ needs.integration-test.result }}
           RUST_CHECK_RESULT: ${{ needs.rust-check.result }}
@@ -1362,6 +1432,7 @@ jobs:
              [[ "${BUILD_PORTAL_RESULT}" != "success" ]] || \
              [[ "${BUILD_AGENT_RESULT}" != "success" ]] || \
              [[ "${TEST_AGENT_RESULT}" != "success" ]] || \
+             [[ "${TEST_AGENT_WINDOWS_RESULT}" != "success" ]] || \
              [[ "${WINDOWS_RUNTIME_SMOKE_RESULT}" != "success" ]] || \
              [[ "${INTEGRATION_TEST_RESULT}" != "success" ]] || \
              [[ "${RUST_CHECK_RESULT}" != "success" ]]; then

agent/cmd/breeze-watchdog/failover_dispatch_test.go

@@ -118,3 +118,45 @@ func hasJournalEvent(entries []watchdog.JournalEntry, event string) bool {
 	}
 	return false
 }
+
+// An operator failover command carries its own intent. The watchdog must map
+// the command type to that intent explicitly and never let the escalation
+// ladder's attempt count decide: at attempt 2 the unhealthy ladder selects a
+// forced restart (terminate the process, then start), which a "start_agent"
+// command must never trigger. Ladder selection itself is proven against the
+// controllers in internal/watchdog; these tests pin the command → intent map
+// that feeds it.
+
+func TestFailoverStartAgentUsesEnsureStartIntent(t *testing.T) {
+	intent, resetFirst, ok := failoverRecoveryIntent("start_agent")
+	if !ok {
+		t.Fatal("start_agent is not mapped to a recovery intent")
+	}
+	if intent != watchdog.RecoveryIntentEnsureStart {
+		t.Errorf("intent = %q, want %q", intent, watchdog.RecoveryIntentEnsureStart)
+	}
+	if resetFirst {
+		t.Error("start_agent reset the escalation window; only an operator restart may")
+	}
+}
+
+func TestFailoverRestartAgentUsesRestartIntent(t *testing.T) {
+	intent, resetFirst, ok := failoverRecoveryIntent("restart_agent")
+	if !ok {
+		t.Fatal("restart_agent is not mapped to a recovery intent")
+	}
+	if intent != watchdog.RecoveryIntentRestart {
+		t.Errorf("intent = %q, want %q", intent, watchdog.RecoveryIntentRestart)
+	}
+	if !resetFirst {
+		t.Error("restart_agent did not reset the escalation window before attempting")
+	}
+}
+
+func TestFailoverRecoveryIntentRejectsNonRecoveryCommands(t *testing.T) {
+	for _, cmdType := range []string{"collect_diagnostics", "update_agent", "", "start"} {
+		if intent, _, ok := failoverRecoveryIntent(cmdType); ok {
+			t.Errorf("%q mapped to recovery intent %q, want no mapping", cmdType, intent)
+		}
+	}
+}