# Tooling: keeping the Windows CI honest

Three follow-ups hardened the new `ci-windows` job against the runners' pathologies, each backed by evidence rather than a blind retry: the server test suite's cleanup now retries `ENOTEMPTY`/`EBUSY` removals and runs under platform-aware deadlines (one failed cleanup used to cascade into "database is not open" across later files); core's win32 test deadline moved to 120s after instrumented runs showed a single cold Git-Bash spawn taking 35.7s on a degraded runner — with an amplification experiment proving latency flows through the engine 1:1, no race — plus a platform-neutral regression test pinning that a slow tool delays a run only by its own latency; and two cross-PR combination breaks caught by main's CI (a test fake missing a newly required member, platform-naive path expectations) were fixed the hour they appeared. And the batch closes with a dependency security sweep: all 23 open Dependabot alerts resolved with real fixes — vitest 3, react-router 8 and hono-node-server 2 majors verified across the full suite, in-range transitive refreshes, and two temporary overrides (`@anthropic-ai/sdk`, esbuild) each carrying an explicit retirement condition — taking `pnpm audit` to zero in both dev and prod scopes.
