diff --git a/.github/workflows/check-dotfolder-anchors.yml b/.github/workflows/check-dotfolder-anchors.yml
index 390f413aed..e88794b8f5 100644
--- a/.github/workflows/check-dotfolder-anchors.yml
+++ b/.github/workflows/check-dotfolder-anchors.yml
@@ -6,6 +6,20 @@ on:
   pull_request:
   merge_group:
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-dotfolder-anchors:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/check-notebooks-paired.yml b/.github/workflows/check-notebooks-paired.yml
index 5da1cb8043..d4cc9f0c68 100644
--- a/.github/workflows/check-notebooks-paired.yml
+++ b/.github/workflows/check-notebooks-paired.yml
@@ -21,6 +21,14 @@ on:
 permissions:
   contents: read
 
+# Supersede, don't stack. This workflow runs on pull_request and workflow_dispatch
+# only — no push, no merge_group — so the group key is just the ref, and a newer run
+# for the same PR replaces an older one. A PR run scans the notebook set as it stands,
+# not a delta, so nothing is lost by superseding.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   paired:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/check-portable-paths.yml b/.github/workflows/check-portable-paths.yml
index b5d1541d40..1c737b5ffe 100644
--- a/.github/workflows/check-portable-paths.yml
+++ b/.github/workflows/check-portable-paths.yml
@@ -6,6 +6,16 @@ on:
     branches: [main]
   merge_group:
 
+concurrency:
+  # Push groups are SHA-specific, so push runs never cancel each other.
+  # These checks scan only the push's own before..after delta, so a cancelled
+  # push run loses that delta's coverage for good: push A adds a violation,
+  # push B touches an unrelated file and cancels A, and B then scans only its
+  # own files while A's remain on the branch, unexamined. pull_request runs
+  # scan base..head, which is cumulative, so superseding one loses nothing.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}-${{ github.event_name == 'push' && github.sha || 'shared' }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-paths:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/cross-platform-smoke.yml b/.github/workflows/cross-platform-smoke.yml
index 97a1dfb2b5..bdd71dfae8 100644
--- a/.github/workflows/cross-platform-smoke.yml
+++ b/.github/workflows/cross-platform-smoke.yml
@@ -20,6 +20,20 @@ on:
 permissions:
   contents: read
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   smoke:
     strategy:
diff --git a/.github/workflows/laf-usb-manifest-policy.yml b/.github/workflows/laf-usb-manifest-policy.yml
index 7d17f9a971..36596c6e83 100644
--- a/.github/workflows/laf-usb-manifest-policy.yml
+++ b/.github/workflows/laf-usb-manifest-policy.yml
@@ -14,6 +14,17 @@ on:
       - ".github/scripts/laf_usb_manifest.py"
       - ".github/workflows/laf-usb-manifest-policy.yml"
 
+# Supersede, don't stack: a newer run for the same branch replaces the still-running
+# one, which nobody is waiting on. This check reads the manifest as it stands rather
+# than a per-push delta, so the replacement run sees everything the cancelled one would.
+#
+# `github.event_name` is in the group key on purpose: it keeps push-event and
+# pull_request-event runs of one branch in SEPARATE groups, so a push run cannot
+# cancel a required PR check. This workflow has no merge_group trigger.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   validate:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/large-file-policy.yml b/.github/workflows/large-file-policy.yml
index 3061e286bd..18a980ffac 100644
--- a/.github/workflows/large-file-policy.yml
+++ b/.github/workflows/large-file-policy.yml
@@ -7,6 +7,16 @@ on:
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  # Push groups are SHA-specific, so push runs never cancel each other.
+  # These checks scan only the push's own before..after delta, so a cancelled
+  # push run loses that delta's coverage for good: push A adds a violation,
+  # push B touches an unrelated file and cancels A, and B then scans only its
+  # own files while A's remain on the branch, unexamined. pull_request runs
+  # scan base..head, which is cumulative, so superseding one loses nothing.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}-${{ github.event_name == 'push' && github.sha || 'shared' }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-large-files:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/secret-pattern-policy.yml b/.github/workflows/secret-pattern-policy.yml
index 85c6869244..dffdbac186 100644
--- a/.github/workflows/secret-pattern-policy.yml
+++ b/.github/workflows/secret-pattern-policy.yml
@@ -3,10 +3,25 @@ name: Secret Pattern Policy
 on:
   pull_request:
   push:
-    branches: [main]
+    # Broadened 2026-07-02 from [main] only: the leak was a direct push to a
+    # working branch (logan/obsidian), which the main-only trigger never scanned.
+    # Runs on every branch push now; the job scopes the new-branch case
+    # (before==0000…) to the files that branch introduces, and falls back to the
+    # whole tree if it cannot isolate them.
+    branches: ['**']
   merge_group:
   workflow_dispatch:
 
+concurrency:
+  # Push groups are SHA-specific, so push runs never cancel each other.
+  # These checks scan only the push's own before..after delta, so a cancelled
+  # push run loses that delta's coverage for good: push A adds a violation,
+  # push B touches an unrelated file and cancels A, and B then scans only its
+  # own files while A's remain on the branch, unexamined. pull_request runs
+  # scan base..head, which is cumulative, so superseding one loses nothing.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}-${{ github.event_name == 'push' && github.sha || 'shared' }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-secret-patterns:
     runs-on: ubuntu-latest
@@ -25,6 +40,8 @@ jobs:
           python-version: "3.13"
       - name: Check changed files for secret patterns
         shell: bash
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set -eo pipefail  # a failed git diff must fail the step, not feed the checker empty stdin
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
@@ -41,8 +58,50 @@ jobs:
             before="${{ github.event.before }}"
             after="${{ github.sha }}"
             if [[ "$before" == "0000000000000000000000000000000000000000" ]]; then
-              git ls-tree -r -z --name-only "$after" |
-                python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              # New branch: there is no `before` to diff against, but "everything in
+              # the repo" is the wrong answer. It re-reports ~55 findings that were
+              # already here (minified plugin bundles, clipped articles with embedded
+              # map keys) on every branch anyone creates, which is how a gate that
+              # caught a real leak gets trained into noise people click past.
+              #
+              # Diff from the merge-base with the default branch. That is the ONLY
+              # baseline in this repo that has actually been scanned: the default
+              # branch is scanned on every push to it and on every pull_request.
+              #
+              # An earlier version of this subtracted every other ref instead
+              # (`rev-list --not <all branches and tags>`) to find "commits unique to
+              # this branch". That asserts those refs are clean history, and they are
+              # not: until this workflow's trigger was broadened, only the default
+              # branch was scanned on push, so a sibling branch ref may never have
+              # been scanned at all — and a ref survives a scan that FAILED. If such a
+              # ref points at secret-bearing commit S and this branch adds U on top,
+              # subtracting it sets base to S and the S..U scan steps over the secret.
+              # The leak that broadened this trigger on 2026-07-02 was a direct push to
+              # a working branch, which is exactly that shape.
+              #
+              # Cost of using merge-base instead: a branch cut from another unmerged
+              # branch rescans that branch's files too. That is an over-scan — noise —
+              # and noise is the correct direction for a secret gate to fail.
+              base=""
+              for ref in "origin/${DEFAULT_BRANCH}" "${DEFAULT_BRANCH}"; do
+                if git rev-parse -q --verify "$ref" >/dev/null 2>&1; then
+                  base=$(git merge-base "$ref" "$after" 2>/dev/null) && break
+                  base=""
+                fi
+              done
+
+              if [ -n "$base" ]; then
+                echo "New branch: scanning $base..$after (files this branch introduces)"
+                git diff --name-only -z --diff-filter=ACMR "$base" "$after" |
+                  python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              else
+                # Fail closed. If the branch's own commits cannot be isolated (root
+                # commit, orphan branch, no other refs fetched), scan everything
+                # rather than scan nothing. Worst case is the previous behaviour.
+                echo "New branch: cannot isolate branch commits; scanning whole tree."
+                git ls-tree -r -z --name-only "$after" |
+                  python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              fi
             else
               git diff --name-only -z --diff-filter=ACMR "$before" "$after" |
                 python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
diff --git a/.github/workflows/validate-agent-content.yml b/.github/workflows/validate-agent-content.yml
index 8077d2c1f2..e663986532 100644
--- a/.github/workflows/validate-agent-content.yml
+++ b/.github/workflows/validate-agent-content.yml
@@ -5,6 +5,23 @@ on:
     branches:
       - "agent/**"
 
+# No concurrency guard here, deliberately.
+#
+# This workflow fires on `push` and nothing else, and it scans only that push's
+# own before..after delta. Those two facts together rule out every option:
+#
+#   - Grouping by branch would let a later push cancel an earlier one, and the
+#     earlier push's files would then never be scanned by anything — the next
+#     push's `before` is the cancelled run's `after`. Coverage lost for good.
+#   - Grouping by SHA makes every run unique, so nothing is ever superseded and
+#     the block does nothing at all. Config that reads as a guard but is inert
+#     is worse than no config, because it invites being counted as one.
+#
+# So this check is genuinely unguardable as written. Making it safely
+# cancellable means making a replacement run validate cumulative branch state
+# rather than one push's delta; until someone does that, the honest thing is
+# an empty space and this note.
+
 jobs:
   validate:
     name: Validate markdown content on agent branches
diff --git a/.github/workflows/validate-daily-notes.yml b/.github/workflows/validate-daily-notes.yml
index c3a9ca58a1..ca6dd2be45 100644
--- a/.github/workflows/validate-daily-notes.yml
+++ b/.github/workflows/validate-daily-notes.yml
@@ -8,6 +8,16 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  # Push groups are SHA-specific, so push runs never cancel each other.
+  # These checks scan only the push's own before..after delta, so a cancelled
+  # push run loses that delta's coverage for good: push A adds a violation,
+  # push B touches an unrelated file and cancels A, and B then scans only its
+  # own files while A's remain on the branch, unexamined. pull_request runs
+  # scan base..head, which is cumulative, so superseding one loses nothing.
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}-${{ github.event_name == 'push' && github.sha || 'shared' }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-date-placeholders:
     runs-on: ubuntu-latest