nightly-only admission: an older nightly-next run yields to a newer one
claude-sr2-coord's ask: "glaeda admits the newest nightly run's jobs first on that label, ahead of older runs, without cancelling started jobs" (run 41655282358: 39 min landing to feed, about 6 of it queued on glaeda-nightly-only-m4pro).
Cause
GitHub hands an idle runner the oldest queued job on its label; a glaeda runner cannot pick one. nightly-next is promoted about every 6 minutes and a run takes 40-55, so 5-6 runs share the ten slots of the two nightly-only minis (runs #15787-#15820: every slot that mattered was held by another nightly run whenever #15807's jobs queued). decide's 163 s place-reserved is cmux's portable_job_placement.py re-reading for an idle slot on the same label (REQUIRE_LIVE_CAPACITY), so it is the same occupancy; the light-job move to fleet Linux (nightly-next-freshness lane) removes that wait and is not touched here.
Change (scripts/glaeda-nightly-only-admit only; hook bytes unchanged, so no signing-hook pin)
On attempt 1 of a nightly-next push of nightly.yml, the dedicated admission refuses in seconds a job of an overtaken run, and the runner takes the next queued job: the cmux NEXT feed (appcast-arm64.xml) lists a build above this run's (run id + 2-digit attempt, the same compare as cmux's sign-pick-overtaken.sh). Publication is latest-wins, so the run is certain not to publish; its jobs up to publish-nightly that run here yield. Legacy-identity, deltas and report jobs never yield.
Never: a newer push or a newer build that is only running (it may still fail; and when every run skipped for a newer push, promotions outran every build, cmux #28961), a started job, a re-run attempt, main's nightly (the trusted path), or any doubt (feed unreadable, a non-numeric id): those admit as before.
(The first head also yielded an older run's pre-build jobs while a newer build ran on the same mini; both reviews noted that this is not "certain to fail", so it was removed at 74532ab.)
Measured on #15787-#15820 (183 nightly-only jobs, 10.3 slot-hours): overtaken pre-publish jobs about 0.3-0.5 slot-hours, undercounted because #15799 published after #15805. Most of the rest is older runs' post-build signing, verify and legacy jobs while a newer run builds. Those runs can still publish first, so they keep running.
Known effect: a yielded job fails its run, so report-nightly-failure lists it. A follow-up asks cmux to treat a glaeda yield like its own "replaced" build.
Tests
python3 scripts/test-glaeda-nightly-only-admit.py: 44 passed (new NewestRunFirstTest: scope, overtaken, a newer attempt of the same run, a newer push alone never yields, bad ids admit, never raises, the trusted main path never yields, CLI end to end with a file:// feed).
Agent session: agent session