diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index 925bcc32a..f653c1a0f 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -1,5 +1,25 @@
 name: smart-byte conformance gate
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/joule-code-conformance.yml b/.github/workflows/joule-code-conformance.yml
index 8e59d8707..ea684ae56 100644
--- a/.github/workflows/joule-code-conformance.yml
+++ b/.github/workflows/joule-code-conformance.yml
@@ -5,6 +5,26 @@ name: joule-code conformance gate
 # must round-trip (SPEC §8). "Conformant = round-trips the vectors" — checked,
 # not asserted.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/jouleclaw-public-surface-documented.yml b/.github/workflows/jouleclaw-public-surface-documented.yml
index 37532d304..d419ec24a 100644
--- a/.github/workflows/jouleclaw-public-surface-documented.yml
+++ b/.github/workflows/jouleclaw-public-surface-documented.yml
@@ -13,6 +13,26 @@ name: jouleclaw public surface must stay documented
 # public-surface Lost reason remains, so this workflow is a
 # permanent safety net against drift.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   # Manual re-run, so a transient runner/setup failure (which surfaces as a red
   # "audit" even though the audit itself never ran) can be retried without a
diff --git a/.github/workflows/no-vanity-metrics.yml b/.github/workflows/no-vanity-metrics.yml
index 1c819bd51..d156f331a 100644
--- a/.github/workflows/no-vanity-metrics.yml
+++ b/.github/workflows/no-vanity-metrics.yml
@@ -18,6 +18,26 @@ name: no-vanity-metrics
 # a public log. Without the secret, a push to main fails; a pull request shows a
 # failed (continue-on-error) step saying the name check did not run.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
@@ -118,3 +138,5 @@ jobs:
         run: |
           echo "::warning::the public-name check does not run on a pull request (its pattern list is never given to pull-request code); it runs on the push to main"
           exit 1
+
+# (touched to test that this very change supersedes its own queued runs)
diff --git a/.github/workflows/standards-build.yml b/.github/workflows/standards-build.yml
index cd5c084ef..31e2abac5 100644
--- a/.github/workflows/standards-build.yml
+++ b/.github/workflows/standards-build.yml
@@ -21,6 +21,26 @@ name: standards workspaces build + test
 # identical everywhere, and a shared dependency change should rebuild all of
 # them anyway. `fail-fast: false` so one red workspace does not mask the others.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-byte-equality.yml b/.github/workflows/wai-byte-equality.yml
index 34ef56ee6..60d5c3f92 100644
--- a/.github/workflows/wai-byte-equality.yml
+++ b/.github/workflows/wai-byte-equality.yml
@@ -25,6 +25,26 @@ name: wai cross-architecture byte-equality
 # pure-integer sources from wai-rs — no system codec libraries, no ONNX runtime
 # — so every leg runs in about a minute.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/wai-conformance.yml b/.github/workflows/wai-conformance.yml
index 823da2153..6c2973727 100644
--- a/.github/workflows/wai-conformance.yml
+++ b/.github/workflows/wai-conformance.yml
@@ -11,6 +11,26 @@ name: WAI conformance
 # Rust (no C codec chain, no ONNX Runtime), so the matrix needs no system
 # dependencies.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-energy-receipts.yml b/.github/workflows/wai-energy-receipts.yml
index a63dda81b..ed4e474ab 100644
--- a/.github/workflows/wai-energy-receipts.yml
+++ b/.github/workflows/wai-energy-receipts.yml
@@ -64,6 +64,26 @@ name: WAI energy receipts
 # It triggers only on changes under the paths listed below; a change to
 # wai-web alone does not trigger it.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-formal-verification.yml b/.github/workflows/wai-formal-verification.yml
index dfb7cadbb..79285a0c2 100644
--- a/.github/workflows/wai-formal-verification.yml
+++ b/.github/workflows/wai-formal-verification.yml
@@ -23,6 +23,26 @@ name: wai formal verification (integer core)
 # explicit unwind limits). Bounded is not universal, and the job claims only
 # what it checks.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/wai-jpegai-e2e.yml b/.github/workflows/wai-jpegai-e2e.yml
index f35df3c50..8422b35e7 100644
--- a/.github/workflows/wai-jpegai-e2e.yml
+++ b/.github/workflows/wai-jpegai-e2e.yml
@@ -62,6 +62,26 @@ name: WAI JPEG-AI whole decode (pinned inputs, required)
 # starts importing belongs here too; otherwise a change to that module alone is
 # first checked by the weekly run.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-neural-e2e.yml b/.github/workflows/wai-neural-e2e.yml
index cebedadc4..756775242 100644
--- a/.github/workflows/wai-neural-e2e.yml
+++ b/.github/workflows/wai-neural-e2e.yml
@@ -11,6 +11,26 @@ name: WAI neural decoders end-to-end
 # bitstreams, and the Rust decoders reproduce each reference. It runs only when
 # the neural decode code or the generator changes — not on every cargo class.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-neural-gates.yml b/.github/workflows/wai-neural-gates.yml
index 07fccb2c1..0e0b5e1b3 100644
--- a/.github/workflows/wai-neural-gates.yml
+++ b/.github/workflows/wai-neural-gates.yml
@@ -29,6 +29,26 @@ name: WAI neural sink gates
 # its digest, and when the sink holds no fresh status, and decodes it while a grant
 # holds it.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-section-refs.yml b/.github/workflows/wai-section-refs.yml
index 69ba8df38..c1ecff11c 100644
--- a/.github/workflows/wai-section-refs.yml
+++ b/.github/workflows/wai-section-refs.yml
@@ -8,6 +8,26 @@ name: WAI section references
 # notes are dated records and are not read. The check is
 # scripts/check-wai-section-refs.py; it needs Python and nothing else.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-sota-vectors.yml b/.github/workflows/wai-sota-vectors.yml
index 338e9e45a..cd6b59da4 100644
--- a/.github/workflows/wai-sota-vectors.yml
+++ b/.github/workflows/wai-sota-vectors.yml
@@ -86,6 +86,26 @@ name: WAI mbt2018_mean integer decode (regenerated vectors)
 # Licences of what is fetched: CompressAI and its model zoo, BSD-3-Clause-Clear;
 # the astronaut photograph, public domain (NASA), per the scikit-image docstring.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/wai-web-wasm.yml b/.github/workflows/wai-web-wasm.yml
index 6470617c8..52926fd95 100644
--- a/.github/workflows/wai-web-wasm.yml
+++ b/.github/workflows/wai-web-wasm.yml
@@ -20,6 +20,26 @@ name: wai-web wasm32
 # The full-scale int_hyper wasm decode needs vectors regenerated from a
 # pretrained model; wai-sota-vectors.yml runs it after regenerating them.
 
+# One run per branch at a time. A push supersedes the run before it.
+#
+# There is one `macos` runner and it is the dev Mac, so every macOS job in this
+# repo queues on it. With no concurrency group, a session pushing four versions
+# of a branch queued four complete sets of runs and every one of them had to
+# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
+# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
+# commit's verdict is wanted, so the older runs are cancelled.
+#
+# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
+# the key parses, and a newer push moves an older run to `cancelled` even while
+# it is still queued, which is the case that matters.
+#
+# `cancel-in-progress: true` also applies to `main`. That is deliberate and
+# safe here: main advances by merge commits whose tree contains the commits
+# before them, so the newer run covers the older one's changes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches: [main]