ci.yml

# ============================================================================
# Laige CI — P0 platform matrix on merge (M0-CI-01)
#
# Roadmap:  roadmap/M0-foundations.md, step M0-CI-01
# PRD refs: §6 (P0 platforms, AC-6.1), §14 (cadence), §8.1 (build budget)
#
# Cadence (PRD §14, as amended 2026-10-13 — "fast lane + gated slow
# suites"):
#   * This workflow runs on every push to the default branch (master) —
#     i.e., on merge — and on manual workflow_dispatch. The eleven FAST
#     jobs always run: the seven P0 OS/variant jobs — the five P0 OS
#     jobs plus the two sanitizer lanes (M0-CI-02) — and the four
#     platform-independent tooling jobs: the include-graph lint with
#     dependency-count metric (M0-CI-03), the public API manifest drift
#     check (M0-TOOL-01), the determinism source scan (M1-DET-01), and
#     the determinism check (M0-TOOL-02).
#
#   * The SLOW suites do NOT run in the push lane. Every ctest entry
#     that took longer than 30 s in the latest master run (38312355303,
#     2026-10-12) has been moved out of the main job into a dedicated
#     job of its own (one per lane), and those jobs run ONLY when the
#     matching workflow_dispatch checkbox is ticked — the merge-lane
#     equivalent of the ci:slow:* PR labels used by ci-pull.yml:
#
#       checkbox (dispatch input) / label    ctest entry(es)             lanes
#       slow-sim      / ci:slow:sim          laige-sim_tests             gcc clang asan tsan
#       slow-render   / ci:slow:render       laige-render_tests          gcc clang asan tsan
#       slow-particle / ci:slow:particle     particle_render             gcc clang tsan
#       slow-zero-alloc / ci:slow:zero-alloc zero_alloc                  asan tsan
#       slow-ecs-stress / ci:slow:ecs-stress ecs_stress                  asan tsan
#       slow-bench-50k / ci:slow:bench-50k   laige_bench_render_50k_fpx16,
#                                            laige_bench_render_50k_fp32,
#                                            laige_bench_ac4_fpx16,
#                                            laige_bench_ac4_fp32 (M2-AC-01)   gcc clang
#
#     Evidence (run 38312355303, per-entry times in s, threshold 30 s):
#       laige_bench_render_50k_fpx16  gcc 577.05  clang 578.42
#       laige_bench_render_50k_fp32   gcc 593.82  clang 566.52
#       laige_bench_ac4_fpx16 / _fp32 NEW in M2-AC-01 — estimated ~60 s
#       from the render-50k evidence (577 s over 4000 frames of 116k
#       quads vs the ac4 frame's 10k quads); first-run times replace
#       this estimate in the header once the entry has a master-run
#       measurement
#       laige-sim_tests               gcc 59.97   clang 53.79  asan 124.03  tsan 159.52
#       laige-render_tests            gcc 53.83   clang 44.45  asan 43.20   tsan 60.41
#       particle_render               gcc 38.76   clang 34.67  asan 28.84   tsan 39.56
#       zero_alloc                    gcc 16.16   clang 14.39  asan 43.76   tsan 54.75
#       ecs_stress                    gcc 16.34   clang 14.45  asan 42.87   tsan 54.70
#     The threshold is per lane: zero_alloc / ecs_stress stay in the
#     main gcc/clang jobs (under 30 s there) and move only on the
#     sanitizer lanes; particle_render stays in the main asan job
#     (28.84 s). No entry exceeds 30 s on windows/macOS (worst:
#     laige-sim_tests 27.11 s on macos-intel), so those lanes have no
#     slow jobs and their jobs are unchanged.
#
#     The main jobs' ctest EXCLUDES the moved entries (-E) and each
#     slow job SELECTS its entry (-R): every entry runs exactly once
#     per gated run, never twice, and never ungated. The suite list is
#     re-derived from the latest master run whenever a suite crosses
#     (or leaves) the 30 s threshold — see AGENTS.md §5, "Slow CI
#     suites and the milestone gate".
#
#   * MILESTONE GATE: a milestone-gate PR MUST carry ALL six ci:slow:*
#     labels so every slow job runs and passes before merge (AGENTS.md
#     §5). After the gate merges, a workflow_dispatch here with all six
#     checkboxes ticked re-runs the slow matrix on master.
#
#   * Pull requests run the SAME matrix in the companion workflow
#     .github/workflows/ci-pull.yml: the fast jobs run unconditionally
#     on every PR, the slow jobs only when the PR carries the matching
#     ci:slow:* label. A label added after a run is created never
#     re-triggers that run — the label must be on the PR before the
#     run starts. Local verification of the Linux trees before pushing
#     remains a developer obligation (AGENTS.md, section 5: the local
#     Linux test gate).
#
# One job per P0 OS/variant (PRD §6). Each job runs the canonical flow from
# docs/getting-started/building.md — configure → build → ctest (unit tests
# only in M0):
#
#   linux-gcc     Linux x64, g++            (ubuntu-24.04)
#   linux-clang   Linux x64, clang++        (ubuntu-24.04)
#   linux-asan    Linux x64, clang++, LAIGE_ASAN=ON  (ubuntu-24.04)
#   linux-tsan    Linux x64, clang++, LAIGE_TSAN=ON  (ubuntu-24.04)
#   windows-msvc  Windows x64, MSVC 2022    (windows-2022)
#   macos-arm64   macOS arm64, AppleClang   (macos-15)
#   macos-intel   macOS Intel, AppleClang   (macos-14)
#   include-lint  Include-graph lint + dependency count (M0-CI-03)
#   api-manifest  Public API manifest drift check (M0-TOOL-01)
#   det-lint      Determinism source scan (M1-DET-01)
#   detcheck      Determinism check (M0-TOOL-02)
#
# The include-lint job (M0-CI-03; NFR-8.11, NFR-8.13) is platform-
# independent — it parses the #include edges of src/** (PRD §10.1 rules:
# laige-core includes nothing internal, arrows only downward in the
# module stack, vendored deps included only from their deps.lock owner)
# and asserts the vendored-dependency count stays ≤ 10 (PRD §11) while
# printing the list. It is Python 3 stdlib only, so one runner image
# suffices; it runs on every PR too (ci-pull.yml, same job definition).
#
# Sanitizer lanes (M0-CI-02; NFR-8.2 "Core is ASan + UBSan + TSan clean in
# CI", AGENTS TEST-006):
#
#   * linux-asan builds the canonical build-asan tree (LAIGE_ASAN=ON:
#     whole tree instrumented with ASan+UBSan) and runs the unit suites.
#     Any sanitizer report is fatal to the test process — UBSan via
#     -fno-sanitize-recover=all (wired by CMake), ASan via
#     abort_on_error=1:halt_on_error=1 below — so ctest exits non-zero and
#     the job fails: "fail build on any sanitizer report".
#   * linux-tsan builds the canonical build-tsan tree (LAIGE_TSAN=ON:
#     whole tree instrumented with TSan). tests/ applies
#     TSAN_OPTIONS=halt_on_error=1 per test (M0-BUILD-01), so the first
#     data race report kills the test process and ctest fails.
#
#   Toolchain: clang++ for both lanes — TSan is most mature on Clang and
#   -fsanitize=undefined enables a superset of the GCC UB checks; the GCC
#   build itself is covered by the linux-gcc job. Scope is Linux-only per
#   the M0-CI-02 roadmap step (the MSVC/AppleClang sanitizer flag wiring
#   already exists in CMake for later extension).
#
#   Reports are archived as artifacts on every run, green or red:
#     - the tee'd ctest output carries every report that reached stderr
#       (ASan and TSan both print reports to stderr);
#     - ASan additionally writes one report file per test process under
#       asan-reports/ (ASAN_OPTIONS log_path below);
#     - <tree>/Testing/Temporary/LastTest.log keeps ctest's full raw
#       output of every test.
#   The label-gated slow jobs on the sanitizer lanes carry the same
#   archive step (per-suite artifact names, below).
#
# Build budget (PRD §8.1: clean build ≤ 10 min on CI; roadmap M0-CI-01
# "matrix runs in < 10 min"): every fast build job carries
# timeout-minutes: 10, so a job (and therefore the whole matrix, which
# runs the jobs in parallel) longer than the budget fails instead of
# dragging on. The include-lint job is a lint job, not a build, and
# carries its own timeout-minutes: 5. Two documented exceptions carry
# wider caps: the two macOS build jobs (arm64 20, Intel 15 — below) and
# the two slow BENCH jobs (30 — M2-PERF-01's render-50k gate renders
# 4000 offscreen frames of the ~116k-item reference scene in software
# GL on this machine's llvmpipe stack: ~10 min of bench per backend on
# the reference lane plus ~3 min of build; the pre-split main jobs
# carried 45 for that work plus the rest of the suite). The main Linux
# jobs' caps reverted to 10 on 2026-10-13 with the split: their heaviest
# remaining entries are the filtered sim/render suites (≤ 26 s on the
# gcc lane) plus the build (~1.5 min), ~5 min total on the reference
# lane.
#
# macOS exceptions: the shared GitHub macOS runners' tail latency
# (runner preemption) exceeds the 10-min budget: the M2-UI-01 PR lane
# (run 38138278150) saw three consecutive 10-min cancellations of the
# macOS arm64 job (11m25s in Build, 10m18s in Test, 10m32s in Build)
# while the identical build + test finished in 5m37s on the macOS
# Intel lane. Raised on user decision 2026-10-11: macOS arm64 now
# carries timeout-minutes: 20, macOS Intel 15 — each cap gives the
# shared runners headroom without hiding a real hang (a job at its
# cap is still well past the 10-min budget and gets investigated).
# The arm64 15 -> 20 step (2026-10-12): this PR's run 38245828701 hit
# the 15-min cap on all three attempts — each finished its full build
# + the 122/122 ctest suite at 15:00-15:10, the cap firing seconds
# before the job's final cleanup (the identical macOS Intel job
# finished in 7:50 on the same run). If macOS lanes keep hitting
# their walls, the evidence is persistent runner degradation, not a
# code regression — revisit the budget, never silently lower the cap
# back.
#
# Windows note: CMake's default generator there is the multi-config
# "Visual Studio 17 2022" generator, which ignores CMAKE_BUILD_TYPE and
# would build every configuration from the canonical `cmake --build build
# -j`. The Windows job therefore pins the canonical Debug configuration
# explicitly on the build and test steps (--config Debug / -C Debug); the
# single-config platforms run the canonical commands verbatim. The
# Windows Test step additionally imports the VS 2022 development
# environment (vswhere + VsDevCmd.bat, same step, before ctest) because
# the trait_compile_* fixtures invoke cl.exe directly from a generated
# cmake -P script — outside the VS generator's toolchain setup — and
# need the MSVC environment (INCLUDE/LIB/PATH) to find the CRT/STL
# headers.
#
# Budget-gate scope (roadmap M1-BENCH-01: "the CI reference machine,
# ubuntu-24.04, is the gate"; docs/benchmarks/methodology.md §5): the
# sim-tick budget-gate ctest entries (laige_bench_sim_tick_fpx16 /
# laige_bench_sim_tick_fp32, tools/bench) run ONLY on the reference
# platform — the P0 Linux jobs, both of which run on ubuntu-24.04. The
# macOS/Windows jobs run the same ctest suite minus those entries: the
# absolute budgets.json targets are calibrated on the reference machine,
# and the shared macOS/Windows runners' tail latency (runner
# preemption) would flap the absolute p99 gate without tracking an
# engine regression. Every other test — including determinism,
# zero-alloc, fuzz, and the API/lint tooling jobs — still runs on all
# P0 platforms, as does the ungated sim-tick smoke
# (laige_bench_sim_tick_smoke): it exercises the workload and asserts
# its bit-identical fpx16_16 final_hash on every platform, without
# checking timing. The render-50k budget entries
# (laige_bench_render_50k_fpx16 / _fp32) and the AC-4 budget entries
# (laige_bench_ac4_fpx16 / _fp32, M2-AC-01) are the SLOW bench jobs
# above — reference-platform-scoped, gated by ci:slow:bench-50k / the
# slow-bench-50k checkbox, and run at every milestone gate (AGENTS.md
# §5).
#
# AC-6.1 (same source tree, same feature set, no per-OS feature flags): no
# build job passes feature flags; every build job builds the identical
# tree with the only variation being the platform/compiler (include-lint
# does not build).
# ============================================================================

name: CI (merge)

on:
  push:
    branches: [master]
  workflow_dispatch:
    inputs:
      slow-sim:
        description: "Run the slow laige-sim_tests jobs (gcc, clang, asan, tsan)"
        type: boolean
        default: false
      slow-render:
        description: "Run the slow laige-render_tests jobs (gcc, clang, asan, tsan)"
        type: boolean
        default: false
      slow-particle:
        description: "Run the slow particle_render jobs (gcc, clang, tsan)"
        type: boolean
        default: false
      slow-zero-alloc:
        description: "Run the slow zero_alloc jobs (asan, tsan)"
        type: boolean
        default: false
      slow-ecs-stress:
        description: "Run the slow ecs_stress jobs (asan, tsan)"
        type: boolean
        default: false
      slow-bench-50k:
        description: "Run the slow bench jobs (laige_bench_render_50k + laige_bench_ac4, gcc, clang)"
        type: boolean
        default: false

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  linux-gcc:
    name: Linux x64 (g++)
    runs-on: ubuntu-24.04
    # Back to the 10-min build budget on 2026-10-13: the render-50k bench
    # and the other >30 s entries moved to the label-gated slow jobs
    # (linux-gcc-slow / linux-gcc-bench, below). The heaviest remaining
    # entries are the filtered sim/render suites (≤ 26 s) + the build
    # (~1.5 min) — ~5 min total on the reference lane.
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: Test (unit)
        # -E excludes the >30 s entries that moved to the dedicated
        # label-gated jobs (2026-10-13 split, see the header): they are
        # selected there with -R, so each entry runs exactly once per
        # gated run.
        run: |
          ctest --test-dir build --output-on-failure \
            -E '^(laige-sim_tests|laige-render_tests|particle_render|laige_bench_render_50k_fpx16|laige_bench_render_50k_fp32|laige_bench_ac4_fpx16|laige_bench_ac4_fp32)$'

  linux-clang:
    name: Linux x64 (clang++)
    runs-on: ubuntu-24.04
    # Back to the 10-min build budget on 2026-10-13 — see the linux-gcc
    # note and the header.
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: Test (unit)
        # -E excludes the >30 s entries that moved to the dedicated
        # label-gated jobs (2026-10-13 split, see the header): they are
        # selected there with -R, so each entry runs exactly once per
        # gated run.
        run: |
          ctest --test-dir build --output-on-failure \
            -E '^(laige-sim_tests|laige-render_tests|particle_render|laige_bench_render_50k_fpx16|laige_bench_render_50k_fp32|laige_bench_ac4_fpx16|laige_bench_ac4_fp32)$'

  linux-asan:
    name: Linux x64 ASan+UBSan (clang++)
    runs-on: ubuntu-24.04
    # 10-min build budget: the >30 s entries moved to the label-gated
    # linux-asan-slow job (2026-10-13 split, see the header).
    timeout-minutes: 10
    # Job-scoped token: the archive step below needs actions:write, which
    # the workflow-level contents:read token does not grant (GitHub
    # Actions has no step-level permissions).
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (ASan+UBSan)
        run: cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_ASAN=ON
      - name: Build (ASan+UBSan)
        run: cmake --build build-asan -j
      - name: Test (unit, ASan+UBSan)
        # Every sanitizer report is fatal to the test process: ASan via
        # abort_on_error=1:halt_on_error=1 here, UBSan via
        # -fno-sanitize-recover=all (wired by CMake). detect_leaks=1 (the
        # Linux default) is stated explicitly. log_path keeps one report
        # file per test process for the artifact upload below. -E
        # excludes the >30 s entries that moved to the label-gated
        # linux-asan-slow job (2026-10-13 split, see the header).
        env:
          ASAN_OPTIONS: "abort_on_error=1:halt_on_error=1:detect_leaks=1:log_path=${{ github.workspace }}/asan-reports/asan"
        run: |
          set -o pipefail
          ctest --test-dir build-asan --output-on-failure \
            -E '^(laige-sim_tests|laige-render_tests|zero_alloc|ecs_stress)$' \
            2>&1 | tee asan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact. The job-level token grants actions:write.
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-asan-reports
          path: |
            asan-ctest-output.txt
            asan-reports/
            build-asan/Testing/Temporary/LastTest.log

  linux-tsan:
    name: Linux x64 TSan (clang++)
    runs-on: ubuntu-24.04
    # 10-min build budget: the >30 s entries moved to the label-gated
    # linux-tsan-slow job (2026-10-13 split, see the header). Before the
    # split the full TSan suite (incl. laige-sim_tests at ~2.7 min and
    # the render suites) needed 30 min; the heaviest REMAINING entries
    # are archetype (~26 s) and laige_run_smoke (~17 s) plus the build
    # (~2 min) — ~5 min total, inside 10 with runner-variance margin.
    timeout-minutes: 10
    # Job-scoped token: the archive step below needs actions:write (see
    # the linux-asan job comment).
    permissions:
      contents: read
      actions: write
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: Test (unit, TSan)
        # TSAN_OPTIONS=halt_on_error=1 is applied per test by tests/
        # (M0-BUILD-01), so the first data race report kills the test
        # process and ctest fails. The race report is printed to stderr
        # and captured by the tee below. -E excludes the >30 s entries
        # that moved to the label-gated linux-tsan-slow job (2026-10-13
        # split, see the header).
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -E '^(laige-sim_tests|laige-render_tests|particle_render|zero_alloc|ecs_stress)$' \
            2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the race report lives in this
        # artifact. The job-level token grants actions:write.
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-reports
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  # ------------------------------------------------------------------------
  # Slow suites (2026-10-13 split; see the header). Each job below is one
  # ctest entry that exceeded 30 s in the latest master run: one dedicated
  # job per suite per lane (the matrix context is not available in a
  # job-level `if:`, so one block per suite). The main job's ctest
  # excludes the entry, so it runs exactly once per gated run, here.
  # ------------------------------------------------------------------------
  linux-gcc-sim:
    name: "Linux x64 (g++) slow: laige-sim_tests"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + laige-sim_tests (59.97 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-sim == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-gcc).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: laige-sim_tests)"
        run: ctest --test-dir build --output-on-failure -R '^laige-sim_tests$'

  linux-gcc-render:
    name: "Linux x64 (g++) slow: laige-render_tests"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + laige-render_tests (53.83 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-render == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-gcc).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: laige-render_tests)"
        run: ctest --test-dir build --output-on-failure -R '^laige-render_tests$'

  linux-gcc-particle:
    name: "Linux x64 (g++) slow: particle_render"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + particle_render (38.76 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-particle == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-gcc).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: particle_render)"
        run: ctest --test-dir build --output-on-failure -R '^particle_render$'

  linux-gcc-bench-fpx16:
    name: "Linux x64 (g++) slow bench: laige_bench_render_50k_fpx16 + laige_bench_ac4_fpx16"
    runs-on: ubuntu-24.04
    # 30: build (~1.5 min) + the render-50k bench (577.05 s in the evidence
    # run) + the ac4 bench (estimated ~60 s, M2-AC-01) plus runner
    # variance. The pre-split 45-min exception minus the rest of the suite.
    timeout-minutes: 30
    if: github.event.inputs.slow-bench-50k == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-gcc).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow bench: render-50k + ac4, fpx16)"
        run: ctest --test-dir build --output-on-failure -R '^(laige_bench_render_50k_fpx16|laige_bench_ac4_fpx16)$'

  linux-gcc-bench-fp32:
    name: "Linux x64 (g++) slow bench: laige_bench_render_50k_fp32 + laige_bench_ac4_fp32"
    runs-on: ubuntu-24.04
    # 30: build (~1.5 min) + the render-50k bench (593.82 s in the evidence
    # run) + the ac4 bench (estimated ~60 s, M2-AC-01) plus runner variance.
    timeout-minutes: 30
    if: github.event.inputs.slow-bench-50k == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-gcc).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow bench: render-50k + ac4, fp32)"
        run: ctest --test-dir build --output-on-failure -R '^(laige_bench_render_50k_fp32|laige_bench_ac4_fp32)$'

  linux-clang-sim:
    name: "Linux x64 (clang++) slow: laige-sim_tests"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + laige-sim_tests (53.79 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-sim == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-clang).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: laige-sim_tests)"
        run: ctest --test-dir build --output-on-failure -R '^laige-sim_tests$'

  linux-clang-render:
    name: "Linux x64 (clang++) slow: laige-render_tests"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + laige-render_tests (44.45 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-render == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-clang).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: laige-render_tests)"
        run: ctest --test-dir build --output-on-failure -R '^laige-render_tests$'

  linux-clang-particle:
    name: "Linux x64 (clang++) slow: particle_render"
    runs-on: ubuntu-24.04
    # 20: build (~1.5 min) + particle_render (34.67 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    if: github.event.inputs.slow-particle == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-clang).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow: particle_render)"
        run: ctest --test-dir build --output-on-failure -R '^particle_render$'

  linux-clang-bench-fpx16:
    name: "Linux x64 (clang++) slow bench: laige_bench_render_50k_fpx16 + laige_bench_ac4_fpx16"
    runs-on: ubuntu-24.04
    # 30: build (~1.5 min) + the render-50k bench (578.42 s in the evidence
    # run) + the ac4 bench (estimated ~60 s, M2-AC-01) plus runner variance.
    timeout-minutes: 30
    if: github.event.inputs.slow-bench-50k == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-clang).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow bench: render-50k + ac4, fpx16)"
        run: ctest --test-dir build --output-on-failure -R '^(laige_bench_render_50k_fpx16|laige_bench_ac4_fpx16)$'

  linux-clang-bench-fp32:
    name: "Linux x64 (clang++) slow bench: laige_bench_render_50k_fp32 + laige_bench_ac4_fp32"
    runs-on: ubuntu-24.04
    # 30: build (~1.5 min) + the render-50k bench (566.52 s in the evidence
    # run) + the ac4 bench (estimated ~60 s, M2-AC-01) plus runner variance.
    timeout-minutes: 30
    if: github.event.inputs.slow-bench-50k == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-clang).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
      - name: Build
        run: cmake --build build -j
      - name: "Test (slow bench: render-50k + ac4, fp32)"
        run: ctest --test-dir build --output-on-failure -R '^(laige_bench_render_50k_fp32|laige_bench_ac4_fp32)$'

  linux-asan-sim:
    name: "Linux x64 ASan+UBSan (clang++) slow: laige-sim_tests"
    runs-on: ubuntu-24.04
    # 20: build (~2.5 min) + laige-sim_tests (124.03 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-asan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-sim == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-asan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (ASan+UBSan)
        run: cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_ASAN=ON
      - name: Build (ASan+UBSan)
        run: cmake --build build-asan -j
      - name: "Test (slow: laige-sim_tests, ASan+UBSan)"
        env:
          ASAN_OPTIONS: "abort_on_error=1:halt_on_error=1:detect_leaks=1:log_path=${{ github.workspace }}/asan-reports/asan"
        run: |
          set -o pipefail
          ctest --test-dir build-asan --output-on-failure \
            -R '^laige-sim_tests$' 2>&1 | tee asan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-asan-slow-sim
          path: |
            asan-ctest-output.txt
            asan-reports/
            build-asan/Testing/Temporary/LastTest.log

  linux-asan-render:
    name: "Linux x64 ASan+UBSan (clang++) slow: laige-render_tests"
    runs-on: ubuntu-24.04
    # 20: build (~2.5 min) + laige-render_tests (43.20 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-asan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-render == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-asan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (ASan+UBSan)
        run: cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_ASAN=ON
      - name: Build (ASan+UBSan)
        run: cmake --build build-asan -j
      - name: "Test (slow: laige-render_tests, ASan+UBSan)"
        env:
          ASAN_OPTIONS: "abort_on_error=1:halt_on_error=1:detect_leaks=1:log_path=${{ github.workspace }}/asan-reports/asan"
        run: |
          set -o pipefail
          ctest --test-dir build-asan --output-on-failure \
            -R '^laige-render_tests$' 2>&1 | tee asan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-asan-slow-render
          path: |
            asan-ctest-output.txt
            asan-reports/
            build-asan/Testing/Temporary/LastTest.log

  linux-asan-zero-alloc:
    name: "Linux x64 ASan+UBSan (clang++) slow: zero_alloc"
    runs-on: ubuntu-24.04
    # 20: build (~2.5 min) + zero_alloc (43.76 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-asan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-zero-alloc == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-asan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (ASan+UBSan)
        run: cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_ASAN=ON
      - name: Build (ASan+UBSan)
        run: cmake --build build-asan -j
      - name: "Test (slow: zero_alloc, ASan+UBSan)"
        env:
          ASAN_OPTIONS: "abort_on_error=1:halt_on_error=1:detect_leaks=1:log_path=${{ github.workspace }}/asan-reports/asan"
        run: |
          set -o pipefail
          ctest --test-dir build-asan --output-on-failure \
            -R '^zero_alloc$' 2>&1 | tee asan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-asan-slow-zero-alloc
          path: |
            asan-ctest-output.txt
            asan-reports/
            build-asan/Testing/Temporary/LastTest.log

  linux-asan-ecs-stress:
    name: "Linux x64 ASan+UBSan (clang++) slow: ecs_stress"
    runs-on: ubuntu-24.04
    # 20: build (~2.5 min) + ecs_stress (42.87 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-asan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-ecs-stress == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-asan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (ASan+UBSan)
        run: cmake -S . -B build-asan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_ASAN=ON
      - name: Build (ASan+UBSan)
        run: cmake --build build-asan -j
      - name: "Test (slow: ecs_stress, ASan+UBSan)"
        env:
          ASAN_OPTIONS: "abort_on_error=1:halt_on_error=1:detect_leaks=1:log_path=${{ github.workspace }}/asan-reports/asan"
        run: |
          set -o pipefail
          ctest --test-dir build-asan --output-on-failure \
            -R '^ecs_stress$' 2>&1 | tee asan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-asan-slow-ecs-stress
          path: |
            asan-ctest-output.txt
            asan-reports/
            build-asan/Testing/Temporary/LastTest.log

  linux-tsan-sim:
    name: "Linux x64 TSan (clang++) slow: laige-sim_tests"
    runs-on: ubuntu-24.04
    # 20: build (~2 min) + laige-sim_tests (159.52 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-tsan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-sim == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-tsan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: "Test (slow: laige-sim_tests, TSan)"
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -R '^laige-sim_tests$' 2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-slow-sim
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  linux-tsan-render:
    name: "Linux x64 TSan (clang++) slow: laige-render_tests"
    runs-on: ubuntu-24.04
    # 20: build (~2 min) + laige-render_tests (60.41 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-tsan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-render == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-tsan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: "Test (slow: laige-render_tests, TSan)"
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -R '^laige-render_tests$' 2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-slow-render
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  linux-tsan-particle:
    name: "Linux x64 TSan (clang++) slow: particle_render"
    runs-on: ubuntu-24.04
    # 20: build (~2 min) + particle_render (39.56 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-tsan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-particle == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-tsan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: "Test (slow: particle_render, TSan)"
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -R '^particle_render$' 2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-slow-particle
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  linux-tsan-zero-alloc:
    name: "Linux x64 TSan (clang++) slow: zero_alloc"
    runs-on: ubuntu-24.04
    # 20: build (~2 min) + zero_alloc (54.75 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-tsan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-zero-alloc == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-tsan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: "Test (slow: zero_alloc, TSan)"
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -R '^zero_alloc$' 2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-slow-zero-alloc
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  linux-tsan-ecs-stress:
    name: "Linux x64 TSan (clang++) slow: ecs_stress"
    runs-on: ubuntu-24.04
    # 20: build (~2 min) + ecs_stress (54.70 s in the evidence run),
    # plus runner variance.
    timeout-minutes: 20
    # Job-scoped token: the archive step needs actions:write (see
    # linux-tsan).
    permissions:
      contents: read
      actions: write
    if: github.event.inputs.slow-ecs-stress == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # Same rationale as the main job (see linux-tsan).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure (TSan)
        run: cmake -S . -B build-tsan -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ -DLAIGE_TSAN=ON
      - name: Build (TSan)
        run: cmake --build build-tsan -j
      - name: "Test (slow: ecs_stress, TSan)"
        run: |
          set -o pipefail
          ctest --test-dir build-tsan --output-on-failure \
            -R '^ecs_stress$' 2>&1 | tee tsan-ctest-output.txt
      - name: Archive sanitizer reports
        # Runs green or red: on a red run the reports live in this
        # artifact (one artifact per suite, per run).
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: linux-tsan-slow-ecs-stress
          path: |
            tsan-ctest-output.txt
            build-tsan/Testing/Temporary/LastTest.log

  windows-msvc:
    name: Windows x64 (MSVC 2022)
    runs-on: windows-2022
    # Unchanged by the 2026-10-13 slow-suite split: no ctest entry
    # exceeds 30 s on this lane (worst: laige-sim_tests 16.71 s in the
    # evidence run), so the full suite stays in the main job.
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        # CMAKE_BUILD_TYPE is ignored by the multi-config VS generator; the
        # Debug configuration is pinned on the build/test steps below.
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
      - name: Build
        run: cmake --build build --config Debug -j
      - name: Test (unit)
        # The trait_compile_* fixtures invoke cl.exe DIRECTLY from a
        # generated cmake -P script (execute_process), outside the VS
        # generator's toolchain setup, so — unlike every other test in
        # this job — they need the MSVC environment (INCLUDE/LIB/PATH)
        # to find the CRT/STL headers; the plain runner shell lacks it
        # and cl fails with C1083 on <cstdint> etc. This step imports
        # the VS development environment into the current PowerShell
        # process: vswhere locates the installation, VsDevCmd.bat (the
        # canonical vcvars, present in every VS 2017+ install under
        # Common7\Tools — called by relative name from that directory,
        # so no path quoting is involved) sets it, and its `set` dump
        # is imported variable by variable. ctest, cmake -P, and cl all
        # inherit it. Everything else in this step is unchanged.
        run: |
          $vs = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -property installationPath
          Push-Location (Join-Path $vs "Common7\Tools")
          $envDump = cmd /c "call VsDevCmd.bat -arch=amd64 -host_arch=amd64 >nul && set"
          Pop-Location
          foreach ($line in $envDump) {
            if ($line -match '^([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
              Set-Item -Path "env:$($matches[1])" -Value $matches[2]
            }
          }
          ctest --test-dir build -C Debug --output-on-failure

  macos-arm64:
    name: macOS arm64 (AppleClang)
    runs-on: macos-15
    # The shared macOS runners' tail latency exceeds the 10-min build
    # budget (the macOS exception, documented in this file's header).
    # 15 -> 20: this PR's run 38245828701 (2026-10-12) hit the 15-min
    # cap on all three attempts — each attempt finished its full
    # build + the 122/122 ctest suite at 15:00-15:10 and the cap
    # fired seconds before the job's final cleanup (the identical
    # macOS Intel job finished in 7:50 on the same run).
    # Unchanged by the 2026-10-13 slow-suite split: no ctest entry
    # exceeds 30 s on this lane (worst: laige-sim_tests 21.60 s in the
    # evidence run), so the full suite stays in the main job.
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
      - name: Build
        run: cmake --build build -j
      - name: Test (unit)
        run: ctest --test-dir build --output-on-failure

  macos-intel:
    name: macOS Intel (AppleClang)
    runs-on: macos-14
    # The shared macOS runners' tail latency exceeds the 10-min build
    # budget (the macOS exception, documented in this file's header).
    # Unchanged by the 2026-10-13 slow-suite split: no ctest entry
    # exceeds 30 s on this lane (worst: laige-sim_tests 27.11 s in the
    # evidence run), so the full suite stays in the main job.
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
      - name: Build
        run: cmake --build build -j
      - name: Test (unit)
        run: ctest --test-dir build --output-on-failure

  include-lint:
    # M0-CI-03 (NFR-8.11, NFR-8.13): platform-independent repository
    # check — the include-graph lint over src/** plus the vendored-
    # dependency count (budget 10, PRD §11). See the header note.
    name: Include-graph lint + dependency count
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Lint include graph + report dependency count
        run: python3 tools/laige-include-lint

  determinism-lint:
    # M1-DET-01: platform-independent repository check — the sim-source
    # determinism scan (the second half of the G-R8 guarantee; the first
    # is the compile-time trait checked by the trait_compile_* CTest
    # fixtures). Forbids raw float/double and unordered containers in
    # src/laige-sim/**, with per-line LAIGE-DETERM-EXCEPTION markers as
    # the documented false-positive policy (docs/concepts/determinism.md).
    # Python 3 stdlib only, so one runner image suffices; it runs on
    # every PR too (ci-pull.yml, same job definition). The CTest suite
    # runs it against fixture trees and the real tree in every P0 job as
    # well (tests/tools, tests `determinism-lint-*`).
    name: Determinism source scan (sim module)
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - name: Scan sim sources for raw FP / unordered containers
        run: python3 tools/laige-determinism-lint

  api-manifest:
    # M0-TOOL-01 (PRD §9.4, NFR-13.1): the checked-in public API manifest
    # (laige-api.json) must stay in sync with the public headers. This
    # job regenerates the manifest from the current headers with
    # laige-api-scanner and fails on any drift, so adding a public symbol
    # without regenerating the manifest fails CI. The CTest suite runs
    # the same check against the real tree in every P0 job as well
    # (tests/api, test `api-real-tree`).
    name: Public API manifest drift
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      - name: Configure
        run: cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug
      - name: Build scanner
        run: cmake --build build --target laige-api-scanner -j
      - name: Check manifest drift
        run: ./build/bin/laige-api-scanner --root . --check laige-api.json

  detcheck:
    # M1-DET-04 (FR-11.5; AGENTS ARCH-010, TEST-004): bit-exactness CI.
    # The M1-SAMPLE-01 hello scenario is run headless across the
    # determinism matrix and asserted for per-tick hash identity:
    #
    #   vs the committed baselines (samples/hello/baselines/; reference
    #       build: canonical Debug g++) — the P0 OS jobs' ctest already
    #       runs this half on every platform (tests/sample:
    #       hello_baseline_fpx / hello_baseline_fp32); this job pins the
    #       reference build against its own baselines and adds the
    #       cross-build pairs no single P0 job can produce:
    #
    #   pair A:  g++ Debug   vs clang++ Debug     (the two Linux
    #                                                compilers)
    #   pair B:  Debug+ASan  vs g++ Release       (the two
    #                                                configurations)
    #
    #   ... x both SimMath backends (fixed_point_16_16 and
    #       float_pinned_32 — ADR 0002). A desynced pair is declared
    #       unsupported for float_pinned_32 (same-build/same-ISA
    #       scope); fixed_point_16_16 must always match. The result is
    #       recorded in docs/benchmarks/determinism-matrix.md (scope
    #       stated per ARCH-010).
    #
    # Like include-lint and api-manifest, the job runs on every PR and
    # merge unconditionally (it is a tooling check, not an additional P0
    # OS build — the PRD §14 cadence is unchanged).
    name: Determinism check
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - name: Install GLFW X11 headers (laige-render)
        # GLFW's X11 backend (GLFW_BUILD_WAYLAND=OFF in src/laige-render/
        # CMakeLists.txt) needs only the X11 *headers* at configure time
        # (GLFW 3.5 dlopens the X11/GL libraries at runtime); the
        # ubuntu-24.04 runner image ships none of them. The libegl/libgl
        # packages are the RUNTIME GL stack for the headless GL smoke
        # (Mesa surfaceless EGL + llvmpipe software GL; the engine and
        # GLAD load them by dlopen at runtime) (M2-GL-01).
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq \
            libx11-dev libxcursor-dev libxrandr-dev \
            libxinerama-dev libxi-dev libxext-dev \
            libegl1 libgl1 libegl-mesa0 libglx-mesa0 libgl1-mesa-dri
      # -- The four build configurations (targeted builds: only the
      #    scenario binaries and the checker — no full project build).
      #    The hello binaries land at the SOURCE-tree path
      #    samples/hello/bin/ (shared across build trees), so each
      #    tree's binaries are copied into detbin/ immediately after
      #    that tree is built.
      - name: Build reference (Debug g++)
        run: |
          cmake -S . -B build-det-ref \
                -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=g++
          cmake --build build-det-ref -j \
                --target hello hello-fp32 laige-detcheck
          mkdir -p detbin
          cp samples/hello/bin/hello detbin/hello-gcc-debug
          cp samples/hello/bin/hello-fp32 detbin/hello-fp32-gcc-debug
          cp build-det-ref/bin/laige-detcheck detbin/laige-detcheck
      - name: Build clang++ Debug
        run: |
          cmake -S . -B build-det-clang \
                -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++
          cmake --build build-det-clang -j --target hello hello-fp32
          cp samples/hello/bin/hello detbin/hello-clang-debug
          cp samples/hello/bin/hello-fp32 detbin/hello-fp32-clang-debug
      - name: Build Debug + ASan (clang++)
        run: |
          cmake -S . -B build-det-asan \
                -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER=clang++ \
                -DLAIGE_ASAN=ON
          cmake --build build-det-asan -j --target hello hello-fp32
          cp samples/hello/bin/hello detbin/hello-asan-debug
          cp samples/hello/bin/hello-fp32 detbin/hello-fp32-asan-debug
      - name: Build Release (g++)
        run: |
          cmake -S . -B build-det-release \
                -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=g++
          cmake --build build-det-release -j --target hello hello-fp32
          cp samples/hello/bin/hello detbin/hello-gcc-release
          cp samples/hello/bin/hello-fp32 detbin/hello-fp32-gcc-release
      # -- The reference build must reproduce its own committed baselines
      #    (a stale baseline is a loud job failure, never a silent
      #    re-baseline — CORE-008).
      - name: Reference baseline sanity
        run: |
          ./detbin/hello-gcc-debug \
            --expect samples/hello/baselines/fixed_point_16_16/hash_stream.txt
          ./detbin/hello-fp32-gcc-debug \
            --expect samples/hello/baselines/float_pinned_32/hash_stream.txt
      # -- The checker's built-in synthetic scenario self-check (two
      #    in-process runs; the M0-TOOL-02 step's Verify clause).
      - name: Synthetic scenario self-check
        run: ./detbin/laige-detcheck --scenario=synthetic
      # -- The two-configuration pairs (the roadmap matrix), both
      #    backends. Phase 1 spawns the two runs and streams their
      #    per-tick hash lines into one combined file (the children
      #    inherit the redirected stdout); phase 2 compares it offline
      #    (the Windows handle-delivery workaround; this job is
      #    ubuntu-only, so phase 1 is a plain bash redirection).
      - name: Pair A — g++ Debug vs clang++ Debug
        run: |
          ./detbin/laige-detcheck \
            --run-a=detbin/hello-gcc-debug --run-b=detbin/hello-clang-debug \
            > detbin/combined-a-fpx.txt
          ./detbin/laige-detcheck --compare-combined=detbin/combined-a-fpx.txt
          ./detbin/laige-detcheck \
            --run-a=detbin/hello-fp32-gcc-debug --run-b=detbin/hello-fp32-clang-debug \
            > detbin/combined-a-fp32.txt
          ./detbin/laige-detcheck --compare-combined=detbin/combined-a-fp32.txt
      - name: Pair B — Debug+ASan vs Release
        run: |
          ./detbin/laige-detcheck \
            --run-a=detbin/hello-asan-debug --run-b=detbin/hello-gcc-release \
            > detbin/combined-b-fpx.txt
          ./detbin/laige-detcheck --compare-combined=detbin/combined-b-fpx.txt
          ./detbin/laige-detcheck \
            --run-a=detbin/hello-fp32-asan-debug --run-b=detbin/hello-fp32-gcc-release \
            > detbin/combined-b-fp32.txt
          ./detbin/laige-detcheck --compare-combined=detbin/combined-b-fp32.txt