fix: give the macOS leg a 70-minute ceiling, warning at 60

[REPPL]

What this changes

The check job's macOS leg gets a 70-minute ceiling, with its warning at 60, up from 60 and 50. The coordinating session decided this on delegation from the technical facilitator (dcn-2610181756328249).

Why. Ten merge-group runs on 2026-10-18:

Leg	Race pass	Package-time sum	Sum ÷ wall	loop starts–ends	loop
35.1	33.9	5,738 s	2.83	9.5–31.4	1,310 s
42.3	41.0	6,997 s	2.85	10.2–38.3	1,684 s
42.2	40.8	6,927 s	2.83	11.0–37.6	1,597 s
43.8	41.9	7,099 s	2.83	10.8–38.5	1,663 s
37.9	36.2	6,114 s	2.82	8.4–33.1	1,484 s
44.4	42.2	7,155 s	2.82	11.8–38.4	1,594 s
48.6	46.1	7,750 s	2.80	11.2–42.0	1,847 s
49.3	47.4	8,050 s	2.83	11.5–43.2	1,901 s
45.2	43.3	7,331 s	2.82	9.9–39.2	1,758 s
44.8	42.4	7,150 s	2.81	11.2–39.0	1,672 s

Times are in minutes unless marked. One run came within 0.7 minutes of the old 50-minute warning.

• No single long package: the race pass keeps a steady 2.80 to 2.85 of the runner's three test slots busy. The leg's time is its total work, not one long package: internal/core/implement/loop starts 8 to 12 minutes in and ends 2.5 to 4.2 minutes before the pass does.
• The runner sets the variation: the same tree's package times summed to between 5,738 and 8,050 seconds.
• Still under the queue's cap: 70 stays under the merge queue's 90-minute check response timeout, and the warning keeps its 10-minute lead.

The warning message. It named the cap as its warning line plus ten, a second copy of the lead that no test read. The step now carries CEILING_MINUTES, the message names the cap from it, and TestCheckJobWarnsBeforeTheQueueCap holds it to the leg's ceiling. There is still no ${{ }} inside run:.

Unchanged, and why:

• The per-package -timeout of 40 minutes: the slowest package under race took at most 1,901 seconds (31.7 minutes), a margin of 8.3.
• release.yml's verify job: it runs the ubuntu race lane over ./internal/..., about 21 minutes, under its own 55-minute ceiling, not this pass.
• Not taken: starting the loop package first (at most 2 to 3 minutes, against a list pinned in three files), and running it without the race detector on macOS (the macOS-only flakes seen so far came from the race leg).

Records.

• iss-2610181711260494 resolved: its remedy named this raise, with the spread as evidence.
• iss-2610181757540736 captured (minor): the longer lever, cutting the race passes' total work. It carries the package-wide figure: perf: name origin's default branch once per claim operation #1099 and perf: read a view's reservation tips in one batch #1100 cut one drain test's git processes by a quarter, but the whole of the loop and claim packages' by only 5.5% (126,334 to 119,327). The loop-speed record's Outcome now says the same.

Evidence

• TestRaceLaneBudgetIsDeclaredAndFitsItsJob and TestCheckJobWarnsBeforeTheQueueCap failed before the ci.yml edit and pass after it. The CEILING_MINUTES pin was watched failing before the step carried it.
• The warning message was run under bash -e with the step's values.
• make preflight passed on this commit (receipt minted).
• Opus and Sonnet reviewers on a frozen copy, as asked, since ci.yml is on the CODEOWNERS publish surface: both LAND. They checked the expression, the test pin, zizmor's template-injection rule and the decision's numbers against the table. Their notes are applied in the second commit.

Resolves: iss-2610181711260494
Refs: iss-2610181757540736
Refs: iss-2610180545134593

Assisted-by: Claude:claude-opus-5-5