ci: rotate hosted light rescue scans fairly
Summary
Persistent gated pull request runs could consume the oldest-40 inspection window forever. A first Actions listing page also hid older candidates once more than 100 runs were in flight. The minute sweeper now rotates its 40-run inspection cursor, reads the newest listing page plus one rotating overflow page, and retains discovered candidates until their 90-minute rescue window expires. This prevents page rotation from discarding candidates before their turn.
Cancellation ownership, strict open-PR/current-head checks, attempt-1 and no-start checks, isolated workflow-token access, and the existing single mutation owner remain in force. The timer stops on the existing sweeper handover; process-local scan metadata expires by time and disappears when the worker exits. The existing CI_HOSTED_LIGHT_RESCUE_DISABLED=1 switch disables the path.
Leo asked: "more things we can skip/do better" and "just build out everything, bro. We want everything. We want it all". This follows #34571 and #34820, both now merged. It does not change the existing work-stealing trial or establish production queue acceptance.
Performance
| Metric | Before | After | Delta | Harness or run |
|---|---|---|---|---|
| Eligible run behind 101 persistent gated runs | not discovered within 3 passes | rescued on pass 3 | eventual service | Sweep.test_a_fair_cursor_reaches_a_newer_eligible_run_behind_40_gated_runs |
| Eligible run among 901 runs across rotating pages | still starved after 35 passes | rescued on pass 10 | starvation removed | Sweep.test_rotating_overflow_pages_do_not_drop_an_eligible_run_before_it_is_read |
| Maximum initial job reads per pass | 40 | 40 | 0 | focused suite |
| Maximum rescues per pass | 10 | 10 | 0 | focused suite |
| Listing requests per workflow/status per pass | 1 | 2 | +1 bounded overflow read | focused suite |
Validation
The multi-page behavioral regression failed at ef983061e10 with no rerun of eligible run 400, then passed after the fix. Command: python3 -m unittest tests.test_ci_hosted_light_rescue.Sweep.test_rotating_overflow_pages_do_not_drop_an_eligible_run_before_it_is_read.
Observed / Not run
Observed: python3 -m unittest tests.test_ci_hosted_light_rescue passes all 45 tests at 1802a17898daa6f002c7e70a18f83d06c9c7410e; git diff --check passes. Fleet validation is in run 41786254586, testing source f9b2d53613205f1eb60702d987d7e7ea4cff0366. Its tree 4624fac77658633542fc1b068067b7b6f1688015 is identical to the final head after merging main.
Not run: the production two-hour queue/quota acceptance window belongs to the coordinating lane.
Previous review F1/F2 concerned the inherited rescue workflow. Merged #34571 explicitly scopes this rescuer to PR workflows and checks out trusted main; this diff preserves those changes. #34820 adds cancellation recovery and strict PR-head checks, also preserved here.
Changelog
none
🤖 Generated with Codex
Agent session: agent session