[teamleaderleo]

Apple caps notarizations per day. On 2026-11-03 we hit the cap (429 RATE_LIMIT, "Exceeded daily limit for notarizations"), and every NEXT nightly from 03:46Z failed at a notary step for hours. About ten runs were signing side by side, and only the newest could ever publish: publication is latest-wins (nightly_version.py check). Each run spends a notarization each on the helper, app and DMG, for both feeds (#32140), so a run that is already overtaken burns up to six for nothing.

Change

• pick-nightly-sign-runner runs right before signing and, since nightly: pick the signer on hosted Ubuntu instead of the saturated reservation #32966, on hosted Ubuntu. It gets a last step, "Leave notarization to a newer published build" (scripts/ci/nightly-steps/sign-pick-overtaken.sh).
  • The step reads the cmux NEXT feed. When the feed's highest sparkle:version is above this run's build (the run id plus a two-digit attempt), it sets overtaken=true. That is the same rule publish-nightly applies, so this build could only be called superseded there.
  • It runs only on nightly-next pushes, with continue-on-error, a 1-minute budget, and curl capped at 15 s.
• signer-app and the Mac fallback build-sign-notarize-nightly skip on overtaken, the way they already skip on resolve's superseded.
  • Everything after them (signer-app-notary, signer-dmg-image, signer-dmg, the verify jobs, publish-nightly) then skips as it does for a superseded run, with no red and no failure issue.
  • The legacy (cmux NIGHTLY) signer already signs only the newest NEXT feed build when it is this run's, so it needs no change.
• Only a published newer build counts, never a newer push alone. A newer run that then fails must not leave the feed with nothing; that is why ci(nightly): nightly-next runs stop skipping their own builds; no 32 vCPU pins; display visual gate opt-in #28961 turned off the ref-moved skip. An unreadable feed signs as before.
• The picker's job timeout goes from 15 to 16 minutes, keeping room for every step budget (an existing test checks this).

Both feeds stay as they are. The stapled app inside the DMG and both notarizations are unchanged. Consolidating to one feed is #33050, for later. #33028 (merged) waits out a 429 when one still happens.

Performance

metric	before	after	delta	harness or run link
notarizations spent by a run a newer published build is above	up to 6 (helper, app, DMG × 2 identities), plus the Mac fallback's retry	0	-6 per overtaken run	runs 41570134320 / 41568520110 job lists; numbers per day to follow in a comment
wall time added to the feed's path	0	one feed read (< 2 s) inside the existing picker job	~0	no new job
Blacksmith minutes/day	unchanged	unchanged	0

Tests

tests/test_nightly_sign_runner.py gets an Overtaken class:

• a newer published build skips;
• an older or equal feed signs;
• the attempt is part of the build;
• an unreadable feed signs;
• the signers and the fallback are wired to the output, and the step can never fail the pick.

The new tests fail without the change. tests/test_nightly_step_coverage.py, the routing and signer suites, and tests/test_ci_self_hosted_guard.sh pass.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Stops nightly runs that are already overtaken by a newer published build from spending notarizations, which are capped by Apple per day (hit as a 429 RATE_LIMIT on 2026-11-03, failing every nightly for hours).

• The signing picker now reads the cmux NEXT feed and skips notarization when its highest build is above this run's, matching the rule publish-nightly applies.
• Only a published newer build counts, never a newer push alone, so a newer run that fails still leaves the feed with something; an unreadable feed signs as before.

^{Written for commit e480a89. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review e480a89: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr33109 -f ref=lane/nightly-notary-count -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on e8b1b7d to compare; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4160373381601 (d485585f77)
• cmux NEXT nightly 1.0.0-nightly.4160614853601 (0e8eb9bf99)

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp7itrhz6z/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpq7og2uu0/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex, router-review): SHIP at e480a89

Reviewer: codex gpt-6.1-sol xhigh, fast tier.

Follow-ups: 2. Each lands as an issue in this repo that links this receipt; the lane that opened the PR fixes it forward.

SHIP at e480a89
Visual verdict: no images; Leo tries the build

1. [P2] [follow-up] sign-pick-overtaken.sh:21: Extract every version before taking the maximum. The greedy sed keeps only the last version per line. Reproduced: a one-line feed containing 4157485009901 then 4157013432001 returns overtaken=false for build 4157156797801, wasting notarizations.

2. [P2] [follow-up] nightly.yml:4816: Propagate this gate to legacy signing when its target is this run’s build. With rings enabled and NEXT’s Nightly ahead of legacy’s Nightly, the legacy target filters out newer Dev items and can select this run’s prepared build. Reproduced that selection alongside overtaken=true; legacy signing still spends notarizations on a build NEXT will never publish.

Follow-ups:

• Parse all feed versions and test newest-first compact XML.
• Skip legacy signing of this run’s overtaken candidate.

[teamleaderleo]

Review (codex gpt-6.1-sol high, sweep, via the review router; full diff from merge base dfc60a4 to this head): SHIP at e480a89

No P1/P2 findings.