[CI] Azure Artifacts NU1301: HTTP 500 Concurrency/IPAddress quota rejections

## Confirmed CI infrastructure failure

Azure Artifacts rejects package restore requests with the same explicit concurrency-quota response across **two distinct monitored PRs**:

```text
error NU1301: Response status code does not indicate success:
500 (Internal Server Error - Request was blocked due to exceeding usage
of resource 'Concurrency' in namespace 'IPAddress'.)
```

**Stable root signature:** `infrastructure|Azure-Artifacts|NU1301-HTTP500-Concurrency-IPAddress`.

Task-specific signatures and occurrence identities are retained separately; they are correlated by this exact server rejection, not merely by `NU1301`, a task name, or a final status. `IPAddress` is the service's quota namespace, not a disclosed machine address.

## Occurrences

All six records are from `xamarin-macios-sim-pr-tests` (definition **21922**, `devdiv/DevDiv`).

| PR / head | Run / attempt | Job and failing task |
|---|---|---|
| [#26591](https://github.com/dotnet/macios/pull/26591) / `6b6f634e4c8a20b5fb9a6640c78d9dffaa0fb0fa` | 15269330 / 4 | [`T: dotnettests_tvos` -> `Install dotnet workloads`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15269330&view=logs&j=15fe656b-975b-5813-6ee3-3609d6b19761&t=64c7edbc-448d-5c71-66a2-974ac59cae96), log 4387 |
| [#26591](https://github.com/dotnet/macios/pull/26591) / `6b6f634e4c8a20b5fb9a6640c78d9dffaa0fb0fa` | 15269330 / 6 | Windows [`Dotnet tests` -> `Run .NET tests locally`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15269330&view=logs&j=b723e990-f5f1-524e-4b82-fb564fcc018e&t=d39f0717-3a49-572e-e0ec-6d0493b7c58c), log 5725 |
| [#26593](https://github.com/dotnet/macios/pull/26593) / `40b69a020152084846c7266b2df5691406c3c069` | 15287567 / 1 | Linux Build Verification: [`Build on Linux` -> `Build on Linux`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287567&view=logs&j=cd95c9ab-ceee-5f36-46bb-743e43fba63c&t=e8599f2d-16cf-5ca3-8351-5ddd36575f8c), log 32 |
| [#26593](https://github.com/dotnet/macios/pull/26593) / `9714e46c44d4bc651a2f606c66df10f2da46cbd4` | 15287579 / 1 | Linux Build Verification: [`Build on Linux` -> `Build on Linux`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287579&view=logs&j=cd95c9ab-ceee-5f36-46bb-743e43fba63c&t=e8599f2d-16cf-5ca3-8351-5ddd36575f8c), log 32 |
| [#26593](https://github.com/dotnet/macios/pull/26593) / `40b69a020152084846c7266b2df5691406c3c069` | 15287567 / 1 | macOS package build: [`Build packages` -> `Build`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287567&view=logs&j=600d49c6-e96b-5e8b-2c3a-9f351e2e5848&t=80a136b1-24dd-5d7f-8552-895fbffe54ed), log 105 |
| [#26593](https://github.com/dotnet/macios/pull/26593) / `9714e46c44d4bc651a2f606c66df10f2da46cbd4` | 15287579 / 1 | macOS package build: [`Build packages` -> `Build`](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287579&view=logs&j=600d49c6-e96b-5e8b-2c3a-9f351e2e5848&t=80a136b1-24dd-5d7f-8552-895fbffe54ed), log 105 |

**Total: 6 confirmed task occurrences across 2 distinct monitored PRs.** Repeated HTTP responses, repeated MSBuild summaries, individual packages and parent stage/job failures are not additional occurrences.

**First observed:** 2026-09-10 19:43:29 UTC, in #26591's workload-install log.
**Latest confirmed failure:** 2026-09-11 02:12:28 UTC, when #26593's current-head package-build task completed.

## Diagnostic details and reproduction pattern

- **#26591, attempt 4:** `builds/package-download/download-packages.csproj` fails while restoring `Microsoft.NETCore.App.Runtime.Mono.tvos-arm64`. The task records the exact HTTP 500 `Concurrency`/`IPAddress` rejection from 19:43:29 through 19:43:53 UTC.
- **#26591, Windows attempt 6:** local `tests/dotnet/UnitTests/DotNetUnitTests.csproj` restore encounters the same rejection for `Microsoft.Testing.Extensions.TrxReport.Abstractions` and `System.Windows.Extensions`. The task exits 1 and is recorded as `succeededWithIssues`; local tests do not start. It ran 22:37:35-22:37:49 UTC.
- **#26593, initial-head attempt 1:** package restore fails in `builds/package-download/download-packages.csproj`; the final MSBuild summary reports **12 errors**, including rejected requests for `Serilog.Sinks.Console` and `Mono.Options`. The Linux task exits 2.
- **#26593, current-head attempt 1:** the same project fails with **39 errors**, including runtime-pack service-index and package-resource requests. Every collected compiler-style error code is `NU1301`, accompanied by the explicit quota response; the Linux task exits 2. The current-head change regenerates `global.json`; it does not remove the shared service-side rejection.
- **#26593, package-build tasks on both heads:** each task exits 2 with **one NuGet restore error** in `download-packages.csproj`. The initial-head failure is against `darc-pub-dotnet-dotnet-781e06a1`; the current-head failure is against `darc-pub-dotnet-runtime-380833e6`. Both published binlogs identify target `Restore`, task `RestoreTask`, and the same explicit quota response. SDK installation succeeded through its `ci.dot.net` fallback before these failures; the earlier unavailable SDK download URLs are not the build's root cause.

The symptom spans different package sets, a Windows test-local restore, workload provisioning, and Linux package download. It blocks work before the relevant build/test phase. There is no evidence here that a requested dependency version is missing or that API bindings or API-diff suppressions are incorrect.

## Retry outcomes and current impact

- #26591's externally initiated tvOS **attempt 5 succeeded**: workload installation and the affected test job completed successfully on the same head. This is a recovery outcome, not another failure.
- #26591's Windows **attempt 6 remained failed because of the local restore quota error**, even though its remote task passed 34/34 tests. The parent run completed failed at 2026-09-10 23:22:51 UTC. That historical head had already reached at least the 10-retry per-head limit; no new retry was initiated.
- #26593's Linux and package-build failures are on **two automatically triggered heads, both attempt 1**, not manual retries. Simulator test stages were skipped after their prerequisite package builds failed; the separate package/API-diff pipelines and result publishing were still active at the latest observation. No overlapping retry was submitted, and the superseded head is not a retry target.

The monitor made **no CI retry or source change** for these six occurrences.

## Investigation and available diagnostics

- Correlated authenticated Azure build metadata, exact head SHAs, complete job/task timelines, raw task logs, and the durable prior-occurrence ledger.
- Checked both full Linux task logs, not just the check titles or exit codes. Their final `make` failures are consequences of the package restore failure.
- The Linux logs say a local `builds/package-download/msbuild.binlog` was written, but **no Linux-job binlog was published** in the authorized inventories. The subsequently published macOS package-build binlogs are separate evidence and must not be attributed to the Linux jobs.
- Downloaded and inspected the macOS package-build `macios/builds/package-download/msbuild.binlog` from `all-binlogs-15287567-1-1` and `all-binlogs-15287579-1-1` in the corresponding runs' [15287567 artifacts](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287567&view=artifacts&type=publishedArtifacts) and [15287579 artifacts](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15287579&view=artifacts&type=publishedArtifacts). Both confirm `RestoreTask` -> `NU1301` -> the quota rejection. The viewer warned that one unknown event type was skipped; exact errors were also verified against the raw task logs. No local rebuild was performed.
- #26591's prior raw downloads were cleaned up after attributable diagnostic facts were retained. Its Windows attempt-6 artifact inventory was available, but downloading the diagnostic artifact was blocked by authorization; the authorized task log remains the evidence source.
- These pipelines do not use Helix.
- Searched all open and closed issues separately for the stable quota terms, exact Linux/workload tasks, server-error fragment, `NU1301`, and Azure Artifacts. [#26503](https://github.com/dotnet/macios/issues/26503) is a distinct **403 ReadPackages authorization** failure. [#25312](https://github.com/dotnet/macios/issues/25312) records generic workload timeouts, missing packages and a 404, without this exact quota rejection. [#26421](https://github.com/dotnet/macios/issues/26421) concerns GitHub jobs canceled before runner assignment, not package restore. Their bodies and non-ignored comments do not establish the same root cause.

No existing canonical issue or issue-specific **Additional info to collect** checklist was found for this exact signature. The per-occurrence unavailable-data results are documented above.

## Workaround

No repository-side workaround has been validated. After service throttling has subsided and the relevant run is terminal, retry only the affected failed jobs if the current head is conflict-free, exact retry budgets are reconciled, and no equivalent retry is already active. A Windows Integration retry must rerun the **entire stage**. Do not bypass the quota or disable package verification.

Azure logs and artifacts are retention-limited. This issue deliberately omits credentials, worker identities, machine addresses and large log excerpts.

Start with the linked Azure build logs for runs 15269330, 15287567, and 15287579, then inspect builds/package-download/download-packages.csproj and tests/dotnet/UnitTests/DotNetUnitTests.csproj. Compare the task logs with the published macOS msbuild.binlog artifacts and distinguish the shared Azure Artifacts quota response from downstream failures. Done requires a validated repository-side mitigation or confirmed service-side resolution; no workaround is currently established.

Written by the indexing model from the issue text.