diff --git a/.github/workflows/build-paper.yml b/.github/workflows/build-paper.yml
index 54b4b4ec7a..e3e6a4887a 100644
--- a/.github/workflows/build-paper.yml
+++ b/.github/workflows/build-paper.yml
@@ -6,19 +6,13 @@ on:
     paths:
       - 'docs/WHITEPAPER/**'
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - 'docs/WHITEPAPER/**'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+concurrency:
+  group: build-paper-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build-paper:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/catalog-count-gate.yml b/.github/workflows/catalog-count-gate.yml
index adc7ac5a93..837606a1d5 100644
--- a/.github/workflows/catalog-count-gate.yml
+++ b/.github/workflows/catalog-count-gate.yml
@@ -19,11 +19,6 @@ name: Catalog Count Invariant (CI-01)
 
 on:
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - "specs/numeric/formats_catalog.t27"
       - "tools/gen_formats_catalog.py"
@@ -42,6 +37,9 @@ on:
       - ".github/workflows/catalog-count-gate.yml"
   workflow_dispatch:
 
+concurrency:
+  group: catalog-count-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   count-invariant:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/conformance-integrity-gate.yml b/.github/workflows/conformance-integrity-gate.yml
index 9275d987e8..634544dedc 100644
--- a/.github/workflows/conformance-integrity-gate.yml
+++ b/.github/workflows/conformance-integrity-gate.yml
@@ -31,6 +31,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: conformance-integrity-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   integrity-gate:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/coq-kernel.yml b/.github/workflows/coq-kernel.yml
index 858a815387..490b40ec80 100644
--- a/.github/workflows/coq-kernel.yml
+++ b/.github/workflows/coq-kernel.yml
@@ -16,11 +16,6 @@ on:
       # no-op and no run would notice, because nothing under coq/ changed.
       - 'bootstrap/src/phi_f64_literals.rs'
   pull_request:
-    # No `branches:` filter on pull_request, deliberately. A branch filter makes
-    # this gate silent on any PR whose base is not listed -- a stacked PR then
-    # shows a green check list that a master-based PR would not get. Enforced by
-    # scripts/ci/check_pr_branch_filters.py. The `push` filter below, where one
-    # exists, is left alone: restricting post-merge runs is a cost decision.
     paths:
       - 'coq/**'
       - 'proofs/**'
@@ -29,12 +24,11 @@ on:
       - 'tools/coq_outside_build_baseline.txt'
       - '.github/workflows/coq-kernel.yml'
       - 'bootstrap/src/phi_f64_literals.rs'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
+concurrency:
+  group: coq-kernel-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/coq-proofs.yml b/.github/workflows/coq-proofs.yml
index fe88a2a087..14181886a2 100644
--- a/.github/workflows/coq-proofs.yml
+++ b/.github/workflows/coq-proofs.yml
@@ -14,6 +14,9 @@ on:
       - '.github/workflows/coq-proofs.yml'
   workflow_dispatch:
 
+concurrency:
+  group: coq-proofs-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   compile-proofs:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/dupe-ratchet.yml b/.github/workflows/dupe-ratchet.yml
index 6d5495b339..2e8db735b4 100644
--- a/.github/workflows/dupe-ratchet.yml
+++ b/.github/workflows/dupe-ratchet.yml
@@ -13,9 +13,9 @@ name: Duplicate Body Ratchet
 
 on:
   pull_request:
-    # No `branches:` filter, deliberately: a filter makes this gate silent on a
-    # stacked pull request, which then shows a green check list a master-based
-    # one would not get (scripts/ci/check_pr_branch_filters.py enforces this).
+    # No `branches:` filter (scripts/ci/check_pr_branch_filters.py): a stacked PR must
+    # not see a different check list.
+    paths: ["specs/**", "tools/dupe_scan.py", "tools/duplicate_bodies_baseline.txt", ".github/workflows/dupe-ratchet.yml"]
   push:
     branches: [master]
   workflow_dispatch:
diff --git a/.github/workflows/gf-wide-conformance.yml b/.github/workflows/gf-wide-conformance.yml
index 2596185e0e..9726602e87 100644
--- a/.github/workflows/gf-wide-conformance.yml
+++ b/.github/workflows/gf-wide-conformance.yml
@@ -40,6 +40,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: gf-wide-conformance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   gf-wide:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/gf16-conformance.yml b/.github/workflows/gf16-conformance.yml
index 90b850ac0e..14643c913f 100644
--- a/.github/workflows/gf16-conformance.yml
+++ b/.github/workflows/gf16-conformance.yml
@@ -22,6 +22,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: gf16-conformance-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   gf16-oracle:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pack-index-consistency-gate.yml b/.github/workflows/pack-index-consistency-gate.yml
index e5c6363bbc..452bf6e7f8 100644
--- a/.github/workflows/pack-index-consistency-gate.yml
+++ b/.github/workflows/pack-index-consistency-gate.yml
@@ -27,6 +27,9 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: pack-index-consistency-gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   pack-index-consistency:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/seal-staleness-warn.yml b/.github/workflows/seal-staleness-warn.yml
index dd2627cf3e..802a91e955 100644
--- a/.github/workflows/seal-staleness-warn.yml
+++ b/.github/workflows/seal-staleness-warn.yml
@@ -22,16 +22,15 @@ on:
       - 'bootstrap/src/compiler.rs'
       - 'bootstrap/stage0/FROZEN_HASH'
       - 'repro/numerics/nmse_manifest.json'
-  # Without this the missing reading cannot be taken on purpose: a gate with
-  # a `paths:` filter that nothing has matched in months is unmeasured, not
-  # passing, and there was no way to fire it at the default branch and find
-  # out. `tri gates unmeasured` reports the gap; this is what closes it.
   workflow_dispatch:
 
 # Least-privilege: this advisory job only needs to read the checked-out tree.
 permissions:
   contents: read
 
+concurrency:
+  group: seal-staleness-warn-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
   warn-if-seal-stale:
     runs-on: ubuntu-latest
diff --git a/tools/census/quiet.txt b/tools/census/quiet.txt
index 548b02aaa5..03f5129335 100644
--- a/tools/census/quiet.txt
+++ b/tools/census/quiet.txt
@@ -2,7 +2,7 @@ GATE STEPS WHOSE PASS SURVIVES THE SUBJECT GOING MISSING
 
   workflow files read           67
   steps in a quiet shape        33
-  named a path but not quiet    237   (--excluded prints them)
+  named a path but not quiet    246   (--excluded prints them)
 
   by shape:
     failure branch passes       14   `… 2>/dev/null … || echo PASSED`