diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml
index 41ac781b..3f6b325f 100644
--- a/.github/workflows/bun-compatibility.yml
+++ b/.github/workflows/bun-compatibility.yml
@@ -95,11 +95,11 @@ on:
 permissions:
   contents: read
 
-# Supersede stale PR runs. The `main` guard is load-bearing: main runs are the
-# ONLY rust-cache writers (save-if), so they must never be cancelled mid-save.
+# Supersede stale PR runs only: main runs are the ONLY rust-cache writers
+# (save-if), so push, dispatch and schedule runs are never cancelled mid-save.
 concurrency:
   group: bun-patch-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_PROFILE_DEV_DEBUG: '0'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb2d4722..bba0540d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,12 +17,13 @@ on:
 permissions:
   contents: read
 
-# Supersede stale runs on force-push / rapid PR updates. The `main` guard is
-# load-bearing: main runs are the ONLY rust-cache writers (save-if), so they
-# must never be cancelled mid-save.
+# A newer push to the same PR supersedes its older run; nothing else is
+# cancelled. Push, dispatch and schedule runs always finish: main runs are
+# the ONLY rust-cache writers (save-if) and must not die mid-save, and a
+# dispatched base-branch run is the base's only CI verdict.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   clippy:
diff --git a/.github/workflows/go-compatibility.yml b/.github/workflows/go-compatibility.yml
index 18149fad..3f0e6b9b 100644
--- a/.github/workflows/go-compatibility.yml
+++ b/.github/workflows/go-compatibility.yml
@@ -30,7 +30,7 @@ permissions:
 
 concurrency:
   group: go-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/pdm-compatibility.yml b/.github/workflows/pdm-compatibility.yml
index ef4401b6..b417cb72 100644
--- a/.github/workflows/pdm-compatibility.yml
+++ b/.github/workflows/pdm-compatibility.yml
@@ -48,7 +48,7 @@ permissions:
 
 concurrency:
   group: pdm-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/poetry-compatibility.yml b/.github/workflows/poetry-compatibility.yml
index 49367717..c4b07934 100644
--- a/.github/workflows/poetry-compatibility.yml
+++ b/.github/workflows/poetry-compatibility.yml
@@ -40,7 +40,7 @@ permissions:
 
 concurrency:
   group: poetry-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 65839664..284164b7 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -117,11 +117,11 @@ on:
 permissions:
   contents: read
 
-# Supersede stale PR runs; main runs are the only rust-cache writers, so they
-# are never cancelled mid-save.
+# Supersede stale PR runs only: main runs are the only rust-cache writers, so
+# push, dispatch and schedule runs are never cancelled mid-save.
 concurrency:
   group: vlt-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_PROFILE_DEV_DEBUG: '0'
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index 72219731..c5e57a55 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -1484,8 +1484,9 @@ async fn scan_hosted_paths_run_once_per_project_directory() {
 
     let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["apps/*"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    for app in ["apps/a", "apps/b"] {
-        let header = format!("== {} ==", std::path::Path::new(app).display());
+    // glob rebuilds matches with the native separator (`apps\a` on Windows).
+    for app in ["a", "b"] {
+        let header = format!("== {} ==", Path::new("apps").join(app).display());
         assert!(stdout.contains(&header), "missing {header:?}: {stdout}");
     }
     assert_eq!(stdout.matches("Redirected 0 packages").count(), 2, "{stdout}");
diff --git a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
index 9b4ccd72..6cd2272e 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
@@ -306,7 +306,10 @@ fn fresh_checkout(from: &Path, to: &Path) {
     for f in ["app.csproj", "nuget.config", "packages.lock.json"] {
         std::fs::copy(from.join(f), to.join(f)).unwrap_or_else(|e| panic!("copy {f}: {e}"));
     }
-    copy_tree(&from.join(".socket"), &to.join(".socket"));
+    // v5 hosted mode writes no `.socket/`: the lock pins are its whole state.
+    if from.join(".socket").is_dir() {
+        copy_tree(&from.join(".socket"), &to.join(".socket"));
+    }
     strip_manifest(to);
     let blobs = to.join(".socket/blobs");
     if blobs.exists() {