@@ -32,14 +32,13 @@ on:
           documentation PR is opened with GITHUB_TOKEN and gets no checks.
         required: false
 
-concurrency:
-  group: publish-wheel
-  cancel-in-progress: false
-  queue: max
-
 jobs:
   publish:
     runs-on: ubuntu-latest
+    concurrency:
+      group: publish-wheel
+      cancel-in-progress: false
+      queue: max
     steps:
       # A branch pushed or a PR opened with GITHUB_TOKEN raises no events, so
       # the documentation PR would sit there with no checks. Push and open it
 
@@ -43,15 +43,7 @@ jobs:
         env:
           PACKAGE: ${{ inputs.package }}
           VERSION_GLOB: ${{ inputs.version }}
-          BRANCH: ${{ github.head_ref || github.ref_name }}
         run: |
-          # The docs branch only records what was just published, so building
-          # anything from it would rebuild versions that are already released.
-          if [ "$BRANCH" = "github-actions/update-doc" ]; then
-            echo "versions=[]" >> "$GITHUB_OUTPUT"
-            echo "Versions to build: [] (documentation branch)"
-            exit 0
-          fi
           versions=$(uv run --quiet ci_scripts/pending_versions.py ${VERSION_GLOB:+--glob "$VERSION_GLOB"} "$PACKAGE")
           echo "versions=$versions" >> "$GITHUB_OUTPUT"
           echo "Versions to build: $versions"
@@ -24,6 +24,10 @@ env:
 jobs:
   check_versions:
     runs-on: ubuntu-latest
+    concurrency:
+      group: publish-wheel
+      cancel-in-progress: false
+      queue: max
     steps:
       # A branch pushed or a PR opened with GITHUB_TOKEN raises no events, so
       # the per-package PRs would sit there with no checks at all. Push and open
@@ -71,45 +75,52 @@ jobs:
           base=$(git rev-parse HEAD)
           ci_scripts/git-identity.sh
 
-          # Branch off main and re-declare this package alone, so the PR only
-          # ever touches its own docs/packages/<pkg>.yaml (plus packages.txt and
-          # deprecated.txt for a deprecation).
+          # Re-declare each package on the same package-specific branch used by
+          # wheel publication. This preserves publication metadata already
+          # waiting for review while keeping unrelated packages isolated.
           open_pr() {
             local package="$1" slug="$2" title="$3"
-            local branch="github-actions/nightly-upgrade/$slug" pr
-
-            git switch --force-create "$branch" "$base" || return 1
-            git reset --hard --quiet "$base" || return 1
+            local branch="package/$slug" pr pr_title="$slug: update packages" remote_sha=""
+
+            if git fetch --quiet origin "$branch" 2>/dev/null; then
+              remote_sha=$(git rev-parse FETCH_HEAD) || return 1
+              git switch --force-create "$branch" "$remote_sha" || return 1
+              if ! git rebase "$base"; then
+                git rebase --abort || true
+                return 1
+              fi
+            else
+              git switch --force-create "$branch" "$base" || return 1
+            fi
 
             uv run --with-requirements ci_scripts/requirements.txt python3 \
               ci_scripts/check_versions.py --declare "$package" || return 1
 
             if git diff --quiet -- docs/packages ci_scripts/packages.txt ci_scripts/deprecated.txt; then
+              if [ -n "$remote_sha" ] && [ "$(git rev-parse HEAD)" != "$remote_sha" ]; then
+                git push --force-with-lease="$branch:$remote_sha" origin "$branch" || return 1
+              fi
               echo "$package: nothing to declare"
               return 0
             fi
 
             git add docs/packages ci_scripts/packages.txt ci_scripts/deprecated.txt || return 1
             git commit -s -m "$title" || return 1
 
-            # Leave an open PR alone when it already declares the same thing:
-            # a nightly force-push would restart its build for nothing.
-            if git fetch --quiet origin "$branch" 2>/dev/null &&
-               git diff --quiet FETCH_HEAD HEAD -- "docs/packages/$slug.yaml"; then
-              echo "$package: $branch is already up to date"
-              return 0
+            if [ -n "$remote_sha" ]; then
+              git push --force-with-lease="$branch:$remote_sha" origin "$branch" || return 1
+            else
+              git push origin "$branch" || return 1
             fi
 
-            git push --force origin "$branch" || return 1
-
             pr=$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$branch" --state open --json url --jq '.[0].url') || return 1
             if [ -n "$pr" ]; then
-              gh pr edit "$pr" --title "$title" --body-file "$REPORTS/$slug.md" || return 1
+              gh pr edit "$pr" --title "$pr_title" --body-file "$REPORTS/$slug.md" || return 1
               echo "Updated $pr"
             else
               gh pr create --draft --repo "$GITHUB_REPOSITORY" --base main --head "$branch" \
                 --reviewer luhenry \
-                --title "$title" --body-file "$REPORTS/$slug.md" || return 1
+                --title "$pr_title" --body-file "$REPORTS/$slug.md" || return 1
             fi
           }
 
 
@@ -278,16 +278,17 @@ def push_remote():
     return f"https://x-access-token:{GH_TOKEN}@github.com/{REPO}"
 
 
-def checkout_shared_branch(branch):
+def checkout_package_branch(branch):
     """
-    Check out the shared docs branch as a local worktree HEAD, based on
+    Check out the package's branch as a local worktree HEAD, based on
     origin/<branch> if it already exists, otherwise on origin/main, and replay
     its pending commits on top of origin/main.
 
-    All docs updates are pushed to this single branch, so a run needs to build
-    on whatever is already there rather than starting from main each time. main
-    keeps moving under it while it waits for review, so without the rebase the
-    branch carries an ever older tree and the PR ends up conflicting.
+    Nightly declarations and publication metadata share this package-specific
+    branch, so a run needs to build on whatever is already there rather than
+    starting from main each time. main keeps moving under it while it waits for
+    review, so without the rebase the branch carries an ever older tree and the
+    PR ends up conflicting.
 
     Returns the origin/<branch> commit the checkout started from, or None when
     the branch is new, so the push can lease against it.
@@ -377,8 +378,8 @@ def main():
     comment = None
     yaml_path = DOCS_DIR / f"{slug}.yaml"
 
-    branch = "github-actions/update-doc"
-    pr_title = "docs: Update projects"
+    branch = f"package/{slug}"
+    pr_title = f"{slug}: update packages"
 
     def compute_content():
         """Read the current YAML and return (is_new, old_content, new_content)."""
@@ -425,10 +426,10 @@ def compute_content():
         return
 
     configure_git_identity()
-    remote_sha = checkout_shared_branch(branch)
+    remote_sha = checkout_package_branch(branch)
 
-    # Compute the change against the shared branch's contents, so a package
-    # already documented there by an earlier run in this batch is seen.
+    # Compute the change against the package branch's contents, so a version
+    # declared by the nightly workflow is retained and filled in here.
     is_new, _old_content, new_content = compute_content()
     if new_content is None:
         print(f"{slug} {version} is already documented; nothing to do")
 
@@ -82,8 +82,10 @@ declared is a bug in the build, not something to document.
 To **upgrade** an existing package, append a `- version: <new version>` line to
 its YAML and open a PR; no workflow change is needed unless the new version
 needs one. The nightly `check_versions.py --declare` run opens one draft PR
-per package (`github-actions/nightly-upgrade/<package>`), so each upgrade is
-built, reviewed and merged on its own.
+per package from `package/<package>`, so each upgrade is built, reviewed and merged on its
+own. Publication uses the same package-specific branch, allowing a nightly
+version declaration and its release metadata to share one PR without mixing
+unrelated packages.
 
 ## Workflow Customizations for riscv64
 
@@ -328,19 +330,19 @@ run:
 3. uploads all selected wheels and any required `gpl-sources.tar` asset;
 4. publishes the release, at which point repository-level immutable releases
    freeze its tag and assets; and
-5. opens or updates the shared documentation pull request, filling in the
-   version's entry with the release tag, wheel filenames, SHA-256 hashes, and
-   `Requires-Python` metadata.
+5. opens or updates the package-specific `package/<package>` pull request,
+   titled `<package>: update packages`, filling in the version's entry with the
+   release tag, wheel filenames, SHA-256 hashes, and `Requires-Python` metadata.
 
 Every `main` run creates a new release; existing releases are never reused or
 modified. Its description links back to the workflow run that produced it.
 Publishing fails if immutable releases are disabled, or if the wheel's version
 is not declared in the package YAML.
 
-Merging the documentation pull request pushes the now-released entry to `main`
-and triggers the workflow once more; with nothing left pending, that run skips
-every job. Until then the version is still pending, so any other push touching
-the workflow or its YAML rebuilds and re-releases it.
+Merging the package pull request pushes the now-released entry to `main` and
+triggers the workflow once more; with nothing left pending, that run skips every
+guarded job. Until then the version is still pending on `main`, so any other
+push touching the workflow or its YAML rebuilds and re-releases it.
 
 The generated `/simple/` package index reads only `docs/packages/*.yaml`. The
 new release does not become discoverable through pip until the generated