diff --git a/.github/scripts/pr-merge/merge-holds.mjs b/.github/scripts/pr-merge/merge-holds.mjs
index fad05310ed..ac8150fc13 100755
--- a/.github/scripts/pr-merge/merge-holds.mjs
+++ b/.github/scripts/pr-merge/merge-holds.mjs
@@ -1397,6 +1397,66 @@ export async function readStatuses(github, repo, head) {
   throw new Error("more than 1000 statuses on the head");
 }
 
+// The tracker config's human-gated role label (.work-item-tracker.json
+// config.role_labels["human-gated"], trimmed), `needs-human` when it names
+// none, as ci-status reads it.
+export function humanGatedLabel(tracker) {
+  const label = tracker?.config?.role_labels?.["human-gated"];
+  return typeof label === "string" && label.trim() ? label.trim() : "needs-human";
+}
+
+// The hold labels on pull request `number`: `do-not-merge`, the tracker's
+// human-gated label and `pr-verify-failed`, one reason each. `labels` are
+// names or label objects; a list that is not an array throws.
+export function labelHolds(labels, tracker, number) {
+  if (!Array.isArray(labels)) {
+    throw new Error("the labels are not a list");
+  }
+  const names = new Set(labels.map((label) => (typeof label === "string" ? label : label?.name)));
+  const gated = humanGatedLabel(tracker);
+  return [
+    names.has("do-not-merge") && `#${number} carries the 'do-not-merge' label; the merge queue removes it. Remove the label and re-queue to merge.`,
+    names.has(gated) && `#${number} carries '${gated}'; the merge queue removes it. Removing the label approves this pull request; re-queue it to merge.`,
+    names.has("pr-verify-failed") &&
+      `#${number} carries 'pr-verify-failed': pr-verify failed its head, and a pass at a new commit removes the label. The merge queue removes it; re-queue it once the label is off.`,
+  ].filter(Boolean);
+}
+
+// The lanes kill switch on a lanes App pull request: while CLAUDE_LANES_DISABLED
+// or CLAUDE_LANES_REPO_DISABLED is anything but the exact value `false`, a pull
+// request whose author is the Bot of numeric id `appId` holds. Any other
+// author, or an `appId` that is not a numeric id, holds nothing here.
+export function switchHold(pull, { appId, disabled, repoDisabled } = {}) {
+  const id = Number(appId);
+  if (!/^[1-9][0-9]*$/.test(String(appId)) || pull?.user?.type !== "Bot" || pull?.user?.id !== id) {
+    return null;
+  }
+  if (disabled === "false" && repoDisabled === "false") {
+    return null;
+  }
+  return `#${pull.number}: the lanes kill switch is on (CLAUDE_LANES_DISABLED or CLAUDE_LANES_REPO_DISABLED is not 'false'), so no lanes App pull request merges; it merges once both read 'false' and ci-status is re-run, which the lost-runs reconciler does when this is the run's only failure.`;
+}
+
+// THE HOLDS THAT COST NO LANE WORK, for a queued pull request: its hold labels,
+// its head's pr-unblock stops and the lanes kill switch, from the pull request
+// as the pulls API returns it, its head's statuses newest first, the tracker
+// config (or null) and the kill switch's { appId, disabled, repoDisabled }.
+// select-tests runs this before the lanes; ci-status keeps judging each hold.
+export function queueHolds({ pull, statuses, tracker = null, lanes = {} } = {}) {
+  const head = pull?.head?.sha;
+  if (!Number.isInteger(pull?.number) || typeof head !== "string") {
+    throw new Error("the pull request does not read");
+  }
+  return [
+    ...labelHolds(pull.labels, tracker, pull.number),
+    ...unblockStops(statuses).map(
+      ({ context, state, description }) =>
+        `'${context}' is ${state} on ${head}: ${description}. The lane that stopped clears it by running again on this head, or a new head carries none.`,
+    ),
+    switchHold(pull, lanes),
+  ].filter(Boolean);
+}
+
 // Whether a person wrote the body of pull request `number` (personWrote); a
 // read that fails counts as a person.
 async function bodyByPerson(github, repo, number) {
diff --git a/.github/scripts/pr-merge/merge-holds.test.mjs b/.github/scripts/pr-merge/merge-holds.test.mjs
index 7aae9f5a75..a8eee4efc2 100644
--- a/.github/scripts/pr-merge/merge-holds.test.mjs
+++ b/.github/scripts/pr-merge/merge-holds.test.mjs
@@ -1455,3 +1455,70 @@ test("Q10: a compare not read whole, not ahead, or with a dismissal the push did
   }
   assert.equal(carriesQ10(pushed(["docs/a.md"]), null), false, "unread hold paths");
 });
+
+// The queue holds select-tests checks before the lanes (#10747). Expected
+// reasons are ci-status's own error texts for the same holds: its hold-label
+// step's three label errors, its pr-unblock step's error and its lanes App
+// step's kill-switch error, which reconcile.test.mjs keys on.
+const QUEUED = "fedcba9876543210fedcba9876543210fedcba98";
+const queuedPull = (over = {}) => ({ number: 7, head: { sha: QUEUED }, labels: [], user: { id: 42, type: "User" }, ...over });
+const ON = { appId: "99", disabled: "false", repoDisabled: "false" };
+
+test("queueHolds: a pull request with no hold label, stop or switch passes", () => {
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(), statuses: [], tracker: null, lanes: ON }), []);
+});
+
+test("queueHolds: each hold label holds with ci-status's text", () => {
+  for (const [label, want] of [
+    ["do-not-merge", "#7 carries the 'do-not-merge' label; the merge queue removes it. Remove the label and re-queue to merge."],
+    ["needs-human", "#7 carries 'needs-human'; the merge queue removes it. Removing the label approves this pull request; re-queue it to merge."],
+    ["pr-verify-failed", "#7 carries 'pr-verify-failed': pr-verify failed its head, and a pass at a new commit removes the label. The merge queue removes it; re-queue it once the label is off."],
+  ]) {
+    assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull({ labels: [{ name: "bug" }, { name: label }] }), statuses: [] }), [want], label);
+  }
+  assert.equal(holdsModule.queueHolds({ pull: queuedPull({ labels: [{ name: "do-not-merge" }, { name: "needs-human" }] }), statuses: [] }).length, 2);
+});
+
+test("queueHolds: the human-gated label is the tracker's, trimmed, else needs-human", () => {
+  const tracker = { config: { role_labels: { "human-gated": "  hitl " } } };
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull({ labels: [{ name: "needs-human" }] }), statuses: [], tracker }), []);
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull({ labels: [{ name: "hitl" }] }), statuses: [], tracker }), [
+    "#7 carries 'hitl'; the merge queue removes it. Removing the label approves this pull request; re-queue it to merge.",
+  ]);
+  for (const blank of [{ config: { role_labels: { "human-gated": " " } } }, { config: {} }, [], "x", null]) {
+    assert.equal(holdsModule.humanGatedLabel(blank), "needs-human", JSON.stringify(blank));
+  }
+});
+
+test("queueHolds: a pr-unblock stop on the head holds; a newer success or another account's status does not", () => {
+  const lane = { login: "github-actions[bot]" };
+  const failure = { context: "pr-unblock/fix-ci", state: "failure", creator: lane, description: "The lane stopped" };
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(), statuses: [failure] }), [
+    `'pr-unblock/fix-ci' is failure on ${QUEUED}: The lane stopped. The lane that stopped clears it by running again on this head, or a new head carries none.`,
+  ]);
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(), statuses: [{ ...failure, state: "success" }, failure] }), []);
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(), statuses: [{ ...failure, creator: { login: "someone" } }] }), []);
+});
+
+test("queueHolds: the kill switch holds only the lanes App's pull request, until both read false", () => {
+  const app = { user: { id: 99, type: "Bot" } };
+  const text =
+    "#7: the lanes kill switch is on (CLAUDE_LANES_DISABLED or CLAUDE_LANES_REPO_DISABLED is not 'false'), so no lanes App pull request merges; it merges once both read 'false' and ci-status is re-run, which the lost-runs reconciler does when this is the run's only failure.";
+  for (const [name, lanes] of [
+    ["on", { ...ON, disabled: "true" }],
+    ["repo on", { ...ON, repoDisabled: "1" }],
+    ["unset", { appId: "99" }],
+  ]) {
+    assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(app), statuses: [], lanes }), [text], name);
+  }
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(app), statuses: [], lanes: ON }), []);
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(), statuses: [], lanes: { appId: "99", disabled: "true" } }), [], "a person's");
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull({ user: { id: 99, type: "User" } }), statuses: [], lanes: { appId: "99" } }), [], "a User with the id");
+  assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull(app), statuses: [], lanes: { appId: "", disabled: "true" } }), [], "no app id");
+});
+
+test("queueHolds: a pull request, label list or status list that does not read throws", () => {
+  assert.throws(() => holdsModule.queueHolds({ pull: { number: 7, head: {} }, statuses: [] }), /does not read/);
+  assert.throws(() => holdsModule.queueHolds({ pull: queuedPull({ labels: null }), statuses: [] }), /labels are not a list/);
+  assert.throws(() => holdsModule.queueHolds({ pull: queuedPull(), statuses: {} }), /not a list/);
+});
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 02782f4aeb..dbd5aa0a4a 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -283,10 +283,14 @@ jobs:
     timeout-minutes: 3
     # The detect-changes action lists the pull request's files through the
     # API. Nothing else in this workflow needs that read, so it is granted here
-    # and nowhere else. No write scope: this job runs pull request code.
+    # and nowhere else. The queue-hold step reads the queued pull request and
+    # its head's commit statuses ("Commit statuses" read, per
+    # https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps).
+    # No write scope: this job runs pull request code.
     permissions:
       contents: read
       pull-requests: read
+      statuses: read
     outputs:
       run_full: ${{ steps.detect.outputs.docs_only != 'true' }}
       run_tests: ${{ steps.detect.outputs.docs_only != 'true' && github.event.pull_request.draft != true }}
@@ -320,6 +324,85 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      # A QUEUED PULL REQUEST A HOLD STOPS FAILS HERE, BEFORE THE LANES. In the
+      # merge queue the holds that cost no lane work, its hold labels, a
+      # pr-unblock stop on its head and the lanes kill switch, are judged by
+      # the base commit's merge-holds.mjs queueHolds: a held group fails this
+      # job in seconds, and every lane, which needs it, skips. ci-status still
+      # judges each hold itself, from its own reads, so the aggregate fails on
+      # the hold and on this job, and a skipped lane stays skipped there (this
+      # job did not succeed). Nothing here feeds a ci-status hold: this job runs
+      # pull request code. Only a hold read fails it: a read that fails, a ref
+      # it cannot parse, or a base module without queueHolds leaves the hold to
+      # ci-status, which retries and fails closed. Two reads, the pull request
+      # and its head's statuses (one per 100), through the api-budget gh
+      # wrapper, whose api-calls notice the step ends with. The base's
+      # module, tracker config and wrapper come from one shallow fetch of the
+      # group's base commit, which leaves `ok=true` only when all of it read;
+      # it never fails the job, so a failed fetch only leaves the holds to
+      # ci-status. The runner's Node runs the module: queueHolds needs no
+      # API newer than the image's. Pinned by
+      # scripts/ci-early-queue-holds.test.sh, which runs this body.
+      - name: Read the base commit's queue-hold rules
+        id: queue_rules
+        if: github.event_name == 'merge_group'
+        env:
+          BASE_SHA: ${{ github.event.merge_group.base_sha }}
+        run: |
+          dir="$RUNNER_TEMP/queue-rules"
+          if [[ $BASE_SHA =~ ^[0-9a-f]{40}$ ]] && git fetch --no-tags --depth=1 origin "$BASE_SHA" && mkdir -p "$dir" &&
+            git show "$BASE_SHA:.github/scripts/pr-merge/merge-holds.mjs" >"$dir/merge-holds.mjs" &&
+            git show "$BASE_SHA:.github/actions/log-api-budget/api-budget.bash" >"$dir/api-budget.bash"; then
+            git show "$BASE_SHA:.work-item-tracker.json" >"$dir/tracker.json" 2>/dev/null || rm -f "$dir/tracker.json"
+            echo "ok=true" >>"$GITHUB_OUTPUT"
+          else
+            echo "::warning::the base commit '$BASE_SHA' could not be read; ci-status judges the holds."
+          fi
+      - name: Fail a queued pull request a hold stops, before the lanes
+        if: github.event_name == 'merge_group'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RULES: ${{ steps.queue_rules.outputs.ok == 'true' && format('{0}/queue-rules', runner.temp) || '' }}
+          LANES_APP_SENDER_ID: ${{ vars.AUTOMATION_LANES_APP_SENDER_ID }}
+          LANES_DISABLED: ${{ vars.CLAUDE_LANES_DISABLED }}
+          LANES_REPO_DISABLED: ${{ vars.CLAUDE_LANES_REPO_DISABLED }}
+        run: |
+          if [ -z "$RULES" ] || [ ! -s "$RULES/merge-holds.mjs" ]; then
+            echo "::notice::the base commit's hold rules did not read; ci-status judges the holds."
+            exit 0
+          fi
+          # shellcheck source=/dev/null
+          if . "$RULES/api-budget.bash"; then
+            api_budget_wrap_gh github-token
+            trap 'api_budget_emit github-token; api_budget_emit_calls github-token' EXIT
+          fi
+          leave() { echo "::warning::$1; ci-status judges the holds."; exit 0; }
+          pr=$(sed -nE 's#^(refs/heads/)?gh-readonly-queue/.+/pr-([0-9]+)-[0-9a-f]{40}$#\2#p' <<<"$GITHUB_REF")
+          [ -n "$pr" ] || leave "cannot read a pull request number from the merge-group ref '$GITHUB_REF'"
+          gh api "repos/$GITHUB_REPOSITORY/pulls/$pr" >"$RUNNER_TEMP/queued-pull.json" || leave "could not read #$pr"
+          head=$(jq -r '.head.sha // ""' "$RUNNER_TEMP/queued-pull.json") || head=
+          [[ $head =~ ^[0-9a-f]{40}$ ]] || leave "the head of #$pr is not a commit SHA"
+          rows=$(gh api "repos/$GITHUB_REPOSITORY/commits/$head/statuses?per_page=100" --paginate --jq '.[]') || leave "could not read the statuses of $head"
+          tracker=null
+          [ ! -s "$RULES/tracker.json" ] || tracker=$(cat "$RULES/tracker.json")
+          jq -n --slurpfile pull "$RUNNER_TEMP/queued-pull.json" --argjson tracker "$tracker" --slurpfile statuses <(printf '%s\n' "$rows") \
+            --arg appId "${LANES_APP_SENDER_ID:-}" --arg disabled "${LANES_DISABLED:-}" --arg repoDisabled "${LANES_REPO_DISABLED:-}" \
+            '{pull: $pull[0], statuses: $statuses, tracker: $tracker, lanes: {appId: $appId, disabled: $disabled, repoDisabled: $repoDisabled}}' \
+            >"$RUNNER_TEMP/queue-holds.json" || leave "the reads of #$pr do not parse"
+          # shellcheck disable=SC2016 # JavaScript, not shell
+          reasons=$(node --input-type=module -e 'import { readFileSync } from "node:fs";
+            import { pathToFileURL } from "node:url";
+            const { queueHolds } = await import(pathToFileURL(process.argv[2]).href);
+            for (const reason of queueHolds(JSON.parse(readFileSync(process.argv[1], "utf8")))) console.log(reason.replaceAll(/[\r\n]/g, " "));' \
+            "$RUNNER_TEMP/queue-holds.json" "$RULES/merge-holds.mjs") || leave "the base commit's merge-holds.mjs could not judge #$pr"
+          if [ -z "$reasons" ]; then
+            echo "#$pr: no hold label, pr-unblock stop or kill switch holds it before the lanes."
+            exit 0
+          fi
+          while IFS= read -r reason; do
+            echo "::error::${reason//%/%25} The lanes do not run for this group."
+          done <<<"$reasons"
+          exit 1
       - name: Fetch base
         uses: ./.github/actions/download-full-history # zizmor: ignore[self-repository]
       # THE DIFF BASE, RESOLVED ONCE. A pull request diffs against its base
@@ -3837,13 +3920,56 @@ jobs:
               waited=1
             done
           }
+          # ONE READ OF THE PULL, ITS LABELS AND ITS EVENTS PER JOB. pr_read
+          # <gh api args>... answers what an earlier step of this job read for
+          # the same args, else reads through gh_read and keeps the answer in
+          # $RUNNER_TEMP/pr-reads. Steps use it for three reads only: the pull
+          # request (pulls/<n>), its labels and its issue events. Comments,
+          # reviews, runs, jobs and annotations are always read live with
+          # gh_read, so a member's veto or a new review is never missed. A read
+          # that fails keeps nothing, so the next step reads again and fails
+          # closed as before. pr_read_put <answer> <args>... keeps an answer a
+          # step read its own way; pr_read_forget drops every kept answer, and
+          # every step that writes to the pull request runs it after its write
+          # (the cost-hold step and the lanes App step's auto-merge disarm).
+          # check-contract writes before any step reads through this cache.
+          pr_read() {
+            local file out
+            file=$(pr_read_file "$@") || file=
+            if [ -n "$file" ] && [ -f "$file" ]; then
+              cat "$file"
+              return 0
+            fi
+            out=$(gh_read "$@") || return 1
+            [ -z "$file" ] || pr_read_put "$out" "$@"
+            [ -z "$out" ] || printf '%s\n' "$out"
+          }
+          pr_read_file() {
+            local dir=${RUNNER_TEMP:-}/pr-reads
+            if [ -z "${RUNNER_TEMP:-}" ] || ! mkdir -p "$dir" 2>/dev/null; then
+              return 1
+            fi
+            printf '%s/%s\n' "$dir" "$(printf '%s\0' "$@" | sha256sum | cut -c1-40)"
+          }
+          pr_read_put() {
+            local out=$1 file
+            shift
+            file=$(pr_read_file "$@") || return 0
+            if ! { [ -z "$out" ] || printf '%s\n' "$out"; } >"$file.$$" 2>/dev/null || ! mv -f "$file.$$" "$file" 2>/dev/null; then
+              rm -f "$file.$$"
+            fi
+            return 0
+          }
+          pr_read_forget() {
+            [ -z "${RUNNER_TEMP:-}" ] || rm -rf "$RUNNER_TEMP/pr-reads"
+          }
           echo $(($(date +%s) + GH_READ_JOB_SECONDS - GH_READ_MARGIN_SECONDS)) >"$RUNNER_TEMP/gh-read.deadline"
           # fd 9 is each sourcing step's stderr, so the notices reach the log
           # when a caller captures or redirects gh_read's own stderr.
           # The api-budget gh wrapper too: every `gh api` of a sourcing step,
           # gh_read's included, leaves its rate-limit reading for the notice
           # the lane-scope step writes.
-          { echo 'exec 9>&2'; declare -f gh_read; printf '%s\n' "${API_BUDGET_SH:-}" '! declare -F api_budget_wrap_gh >/dev/null || api_budget_wrap_gh github-token'; } >"$RUNNER_TEMP/gh-read.sh"
+          { echo 'exec 9>&2'; declare -f gh_read pr_read pr_read_file pr_read_put pr_read_forget; printf '%s\n' "${API_BUDGET_SH:-}" '! declare -F api_budget_wrap_gh >/dev/null || api_budget_wrap_gh github-token'; } >"$RUNNER_TEMP/gh-read.sh"
       - name: Check the pull-request contract
         uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@81a603a6e2b0319428c981bf28f3fe923032afb2 # v0.65.17
         with:
@@ -4103,16 +4229,19 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
-          [ -z "${API_BUDGET_SH:-}" ] || { eval "$API_BUDGET_SH"; api_budget_wrap_gh github-token; }
+          . "$RUNNER_TEMP/gh-read.sh"
           keep() {
             echo "The cost hold stays for a person: $1."
             exit 0
           }
+          # Every read is live, as this step acts on it; its pull and events
+          # answers are kept for the later steps' pr_read of the same args.
           read_api() {
             local attempt out
             for attempt in 1 2 3; do
               # gh-read-exempt: an unreadable input keeps the hold, and a wait would act on stale reads.
               if out=$(gh api "$@" 2>"$RUNNER_TEMP/cost-hold.err"); then
+                [[ ! $1 =~ ^repos/[^/]+/[^/]+/(pulls/[0-9]+|issues/[0-9]+/events\?per_page=100)$ ]] || pr_read_put "$out" "$@"
                 printf '%s\n' "$out"
                 return 0
               fi
@@ -4365,6 +4494,8 @@ jobs:
           # shellcheck disable=SC2016 # $l is a jq variable
           gh api -X DELETE "repos/$repo/issues/$PR_NUMBER/labels/$(jq -rn --arg l "$label" '$l | @uri')" >/dev/null ||
             echo "::warning::could not remove '$label' from #$PR_NUMBER; the step below holds it."
+          # The labels, comments and events changed: the steps below read them live.
+          pr_read_forget
       # A PULL REQUEST CARRYING THE HUMAN-GATED LABEL IS HELD. A review lane or
       # an escalation puts the label on so a person decides; removing it is the
       # approval, and the `unlabeled` event re-runs this job. The label's name
@@ -4412,7 +4543,7 @@ jobs:
           fi
           echo "label=$human_gated" >>"$GITHUB_OUTPUT"
           for attempt in 1 2 3; do
-            if labels=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate --jq '.[].name'); then
+            if raw=$(pr_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate) && labels=$(jq -r '.[].name' <<<"$raw"); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the labels of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -4427,9 +4558,9 @@ jobs:
           # hold comments name a reason.
           identity=$(yq -er '.merge."agent-identity"' "$BASE_CONFIG/docs/conventions/pr-pipeline.yaml" 2>/dev/null) || identity=
           [[ $identity =~ ^[a-z0-9][a-z0-9-]*\[bot\]$ ]] || identity=
-          # gh-read-exempt: the reason is best effort; the step fails either way.
-          reason=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate \
-            --jq '.[] | select(.user.type == "Bot" and (((.body | test("(^|\n)<!-- claude-lane-hold lane="))
+          # The reason is best effort; the step fails either way.
+          reason=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate |
+            jq -r '.[] | select(.user.type == "Bot" and (((.body | test("(^|\n)<!-- claude-lane-hold lane="))
               and (.user.login == "claude[bot]" or (.user.login == "github-actions[bot]"
                 and ([.body | splits("\r?\n") | gsub("^\\s+|\\s+$"; "") | select(. != "")] | last // ""
                   | test("^\u0060?claude-lane: (claude-review|claude-security-review)\u0060?$")))))
@@ -4480,19 +4611,19 @@ jobs:
           fi
           # shellcheck disable=SC2016 # the $ in the --jq filter is a regex anchor
           for attempt in 1 2 3; do
-            if held_at=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate \
-              --jq '.[] | select(.user.type == "Bot" and (.body | test("(^|\n)<!-- claude-lane-hold lane="))
+            if raw=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments?per_page=100" --paginate) && held_at=$(jq -r \
+              '.[] | select(.user.type == "Bot" and (.body | test("(^|\n)<!-- claude-lane-hold lane="))
                 and (.user.login == "claude[bot]" or (.user.login == "github-actions[bot]"
                   and ([.body | splits("\r?\n") | gsub("^\\s+|\\s+$"; "") | select(. != "")] | last // ""
                     | test("^`?claude-lane: (claude-review|claude-security-review)`?$")))))
-                | .created_at'); then
+                | .created_at' <<<"$raw"); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the comments of #$PR_NUMBER; re-run this run."; exit 1; }
             sleep $((attempt * 5))
           done
           for attempt in 1 2 3; do
-            if events=$(gh_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events?per_page=100" --paginate); then
+            if events=$(pr_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events?per_page=100" --paginate); then
               break
             fi
             [ "$attempt" -lt 3 ] || { echo "::error::could not read the events of #$PR_NUMBER; re-run this run."; exit 1; }
@@ -4600,10 +4731,11 @@ jobs:
             echo "::error::the head '$HEAD_SHA' is not a commit SHA."
             exit 1
           fi
+          # READER=pr_read for the pull alone; runs, jobs and annotations are live.
           read_api() {
             local attempt body
             for attempt in 1 2 3; do
-              if body=$(gh_read "$2"); then
+              if body=$("${READER:-gh_read}" "$2"); then
                 printf '%s\n' "$body"
                 return 0
               fi
@@ -4620,7 +4752,7 @@ jobs:
               echo "::error::the pull request number '$PR_NUMBER' is not a number."
               exit 1
             fi
-            pr=$(read_api "#$PR_NUMBER" "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER") || exit 1
+            pr=$(READER=pr_read read_api "#$PR_NUMBER" "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER") || exit 1
             # The broker step above leaves the file list it read; read it again
             # only when that step could not.
             if [ -s "$RUNNER_TEMP/pr-files.json" ]; then
@@ -5068,16 +5200,18 @@ jobs:
       # `pr-unblock/<activity>` commit status on the head (pr-unblock.yml
       # report-stop-status), and only ci-status is required, so this step
       # fails while the newest status of any `pr-unblock/*` context on the
-      # head is `failure` or `error`, naming each. Newest per context, by
-      # github-actions[bot] only, as report-escalation.sh `clear` reads it:
-      # its later `success` on the same head supersedes the failure, and
-      # another account's status neither holds nor clears. On a pull request
+      # head is `failure` or `error`, naming each, by the base commit's
+      # merge-holds.mjs unblockStops, the rule enable-auto-merge judges a head
+      # by: newest per context, by github-actions[bot] only, as
+      # report-escalation.sh `clear` reads it, so its later `success` on the
+      # same head supersedes the failure, and another account's status neither
+      # holds nor clears. On a pull request
       # event the head is the event's; in the merge queue it is the head of
       # the pull request named in the group's ref, read live (the ref's SHA is
       # the group's base). A status event re-runs nothing, so a stop posted
       # after this step passed holds at the merge queue's run. An unparsable
-      # ref, a head that is not a commit SHA, or an unreadable pull request or
-      # status list fails closed.
+      # ref, a head that is not a commit SHA, an unreadable pull request or
+      # status list, or a base module that cannot judge them fails closed.
       # Pinned by scripts/ci-hold-pr-unblock-status.test.sh, which runs this body.
       - name: Fail a head a pr-unblock lane stopped
         id: pr_unblock_status
@@ -5085,12 +5219,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
         run: |
           . "$RUNNER_TEMP/gh-read.sh"
+          module=${BASE_CONFIG:-}/.github/scripts/pr-merge/merge-holds.mjs
+          if [ -z "${BASE_CONFIG:-}" ] || [ ! -s "$module" ]; then
+            echo "::error::cannot read merge-holds.mjs at the base commit; re-run this run."
+            exit 1
+          fi
           read3() {
             local attempt
             for attempt in 1 2 3; do
-              gh_read "${@:2}" && return 0
+              "${READER:-gh_read}" "${@:2}" && return 0
               [ "$attempt" -lt 3 ] || { echo "::error::could not read $1; re-run this run." >&2; return 1; }
               sleep $((attempt * 5))
             done
@@ -5102,18 +5242,30 @@ jobs:
               echo "::error::cannot read a pull request number from the merge-group ref '$GITHUB_REF'."
               exit 1
             fi
-            pull=$(read3 "#$pr" "repos/$GITHUB_REPOSITORY/pulls/$pr") || exit 1
+            pull=$(READER=pr_read read3 "#$pr" "repos/$GITHUB_REPOSITORY/pulls/$pr") || exit 1
             head=$(jq -r '.head.sha // ""' <<<"$pull") || head=
           fi
           if [[ ! $head =~ ^[0-9a-f]{40}$ ]]; then
             echo "::error::the head '$head' is not a commit SHA."
             exit 1
           fi
-          # Newest first across pages, so the first row of a context is its newest.
-          rows=$(read3 "the statuses of $head" "repos/$GITHUB_REPOSITORY/commits/$head/statuses?per_page=100" --paginate \
-            --jq '.[] | select((.context | startswith("pr-unblock/")) and .creator.login == "github-actions[bot]")
-              | [.context, .state, (.description // "" | gsub("[\t\r\n]"; " "))] | @tsv') || exit 1
-          failing=$(awk -F'\t' '!seen[$1]++ && ($2 == "failure" || $2 == "error")' <<<"$rows")
+          # Newest first across pages, as unblockStops reads them. An inline
+          # import, not holds_js: holds_js is a function of the cost-hold step's
+          # own shell, which runs on pull_request events only, and this step
+          # runs in the merge queue too.
+          rows=$(read3 "the statuses of $head" "repos/$GITHUB_REPOSITORY/commits/$head/statuses?per_page=100" --paginate --jq '.[]') || exit 1
+          jq -s . <<<"$rows" >"$RUNNER_TEMP/pr-unblock-statuses.json" || { echo "::error::the statuses of $head do not parse."; exit 1; }
+          # shellcheck disable=SC2016 # JavaScript, not shell
+          if ! stops=$(node --input-type=module -e 'import { readFileSync } from "node:fs";
+            import { pathToFileURL } from "node:url";
+            const { unblockStops } = await import(pathToFileURL(process.argv[2]).href);
+            console.log(JSON.stringify(unblockStops(JSON.parse(readFileSync(process.argv[1], "utf8")))));' \
+            "$RUNNER_TEMP/pr-unblock-statuses.json" "$module") ||
+            ! jq -e 'type == "array"' <<<"$stops" >/dev/null ||
+            ! failing=$(jq -r '.[] | [.context, .state, .description] | @tsv' <<<"$stops"); then
+            echo "::error::merge-holds.mjs at the base commit could not judge the statuses of $head; re-run this run."
+            exit 1
+          fi
           if [ -z "$failing" ]; then
             echo "No pr-unblock/* status fails on $head."
             exit 0
@@ -5184,7 +5336,7 @@ jobs:
           read_api() {
             local attempt body
             for attempt in 1 2 3; do
-              if body=$(gh_read "${@:2}"); then
+              if body=$("${READER:-gh_read}" "${@:2}"); then
                 printf '%s\n' "$body"
                 return 0
               fi
@@ -5192,7 +5344,7 @@ jobs:
               sleep $((attempt * 5))
             done
           }
-          pull=$(read_api "#$pr" "repos/$GITHUB_REPOSITORY/pulls/$pr") || exit 1
+          pull=$(READER=pr_read read_api "#$pr" "repos/$GITHUB_REPOSITORY/pulls/$pr") || exit 1
           if ! jq -e '(.user.id | numbers) and (.user.type | strings)' <<<"$pull" >/dev/null; then
             echo "::error::the author of #$pr could not be read."
             exit 1
@@ -5226,6 +5378,8 @@ jobs:
               if gh api graphql -f query='mutation($id: ID!) { disablePullRequestAutoMerge(input: {pullRequestId: $id}) { clientMutationId } }' \
                 -f id="$(jq -r '.node_id' <<<"$pull")" >/dev/null; then
                 echo "#$pr: a push moved its head, so its native auto-merge is off until enable-auto-merge's next scheduled run judges the new head."
+                # The pull changed: later reads take it live.
+                pr_read_forget
               else
                 echo "::warning::could not turn off native auto-merge on #$pr after a push to its head; the merge queue still needs a pr-verify pass at the head it merges, and the next scheduled enable-auto-merge run disarms a head its reader refuses."
               fi
@@ -5263,7 +5417,8 @@ jobs:
             "repos/$GITHUB_REPOSITORY/contents/$actors?ref=$BASE_SHA" >"$RUNNER_TEMP/trusted-actors.json" || exit 1
           : >"$RUNNER_TEMP/discussion.jsonl"
           for kind in "issues/$pr/comments" "pulls/$pr/reviews" "pulls/$pr/comments"; do
-            rows=$(read_api "the $kind of #$pr" "repos/$GITHUB_REPOSITORY/$kind?per_page=100" --paginate --jq '.[] | @json') || exit 1
+            raw=$(read_api "the $kind of #$pr" "repos/$GITHUB_REPOSITORY/$kind?per_page=100" --paginate) || exit 1
+            rows=$(jq -c '.[]' <<<"$raw") || { echo "::error::the $kind of #$pr do not parse."; exit 1; }
             [ -z "$rows" ] || printf '%s\n' "$rows" >>"$RUNNER_TEMP/discussion.jsonl"
           done
           verdicts=()
diff --git a/scripts/ci-early-queue-holds.test.sh b/scripts/ci-early-queue-holds.test.sh
new file mode 100755
index 0000000000..775a6913ee
--- /dev/null
+++ b/scripts/ci-early-queue-holds.test.sh
@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# Runs the `Fail a queued pull request a hold stops, before the lanes` step
+# body of .github/workflows/pr-require-checks.yml's select-tests under the
+# shell Actions gives a step with no `shell:` (bash -e), against a stub `gh`,
+# with the repository's own merge-holds.mjs and api-budget.bash as the base
+# commit's.
+#
+# In the merge queue a pull request carrying a hold label (do-not-merge, the
+# tracker's human-gated label, pr-verify-failed), a head a pr-unblock lane
+# stopped, or a lanes App pull request while the kill switch is on fails
+# select-tests, which every lane needs, so no lane runs (#10747). ci-status
+# still judges each hold. A read that fails, an unparsable ref or a base module
+# without queueHolds leaves the hold to ci-status and passes. The step ends
+# with the api-calls notice: two requests, the pull and one statuses page.
+# test-scope: .github/workflows/pr-require-checks.yml
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
+
+# shellcheck source=lib/test-harness.sh
+. "$ROOT/scripts/lib/test-harness.sh"
+
+TMP_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+NAME='Fail a queued pull request a hold stops, before the lanes'
+step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
+  on && /^      - / { exit }
+  on { print }' "$WORKFLOW")"
+awk '/^        run: \|$/ { on = 1; next }
+  on && /^          / { print substr($0, 11); next }
+  on && /^[[:blank:]]*$/ { print ""; next }
+  on { exit }' <<<"$step" >"$TMP_ROOT/body.sh"
+
+if [[ ! -s "$TMP_ROOT/body.sh" ]]; then
+  fail "no '$NAME' step with a run: | body in $WORKFLOW"
+  test_harness::report
+  exit 1
+fi
+if [[ "$step" == *"if: github.event_name == 'merge_group'"* && "$step" != *"continue-on-error"* ]]; then
+  ok "step runs only in the merge queue and fails the job on its exit code"
+else
+  fail "step lost its merge_group condition or continues on error"
+fi
+order="$(grep -nE "^  (select-tests|lint-repo):$|^      - name: ($NAME|Fetch base)$" "$WORKFLOW" | cut -d: -f1 | head -4 | paste -sd' ')"
+read -r job_line hold_line fetch_line next_job <<<"$order"
+if [[ -n "${next_job:-}" && "$job_line" -lt "$hold_line" && "$hold_line" -lt "$fetch_line" && "$fetch_line" -lt "$next_job" ]]; then
+  ok "step sits in select-tests before the history fetch"
+else
+  fail "step is not in select-tests before the history fetch (lines: $order)"
+fi
+if grep -qE "^      - (select-tests|mark-lanes)$" <<<"$(awk '/^  ci-status:$/ { on = 1 } on && /^    if:/ { exit } on' "$WORKFLOW")"; then
+  ok "ci-status still needs select-tests, so a held group's aggregate fails"
+else
+  fail "ci-status no longer needs select-tests"
+fi
+
+RULES="$TMP_ROOT/rules"
+mkdir -p "$RULES"
+cp "$ROOT/.github/scripts/pr-merge/merge-holds.mjs" "$ROOT/.github/actions/log-api-budget/api-budget.bash" "$RULES/"
+
+# The gh stub logs its arguments and, under GH_DEBUG, the request line the
+# api-budget wrapper counts. A pulls read answers STUB_PULL, after a header
+# block when the wrapper added -i. A statuses read applies the step's --jq to
+# STUB_STATUSES (newest first). STUB_FAIL=pulls|statuses fails that read.
+mkdir -p "$TMP_ROOT/bin"
+cat >"$TMP_ROOT/bin/gh" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$STUB_LOG"
+[[ -z "${GH_DEBUG:-}" ]] || echo "* Request to https://api.github.com/x" >&2
+case "$*" in
+*/pulls/*)
+  [[ "${STUB_FAIL:-}" != pulls ]] || exit 1
+  [[ "$2" != -i ]] || printf 'HTTP/2.0 200 OK\r\nX-Ratelimit-Remaining: 4000\r\nX-Ratelimit-Resource: core\r\n\r\n'
+  printf '%s\n' "$STUB_PULL"
+  ;;
+*/statuses*)
+  [[ "${STUB_FAIL:-}" != statuses ]] || exit 1
+  while [[ $# -gt 0 && "$1" != --jq ]]; do shift; done
+  jq -r "$2" <<<"${STUB_STATUSES:-[]}"
+  ;;
+*) exit 1 ;;
+esac
+EOF
+chmod +x "$TMP_ROOT/bin/gh"
+
+HEAD=fedcba9876543210fedcba9876543210fedcba98
+GROUP_BASE=89abcdef0123456789abcdef0123456789abcdef
+REF="refs/heads/gh-readonly-queue/main/pr-7-$GROUP_BASE"
+LANE='{"login":"github-actions[bot]"}'
+# pull [labels-json] [user-json]
+PERSON='{"id":5,"type":"User"}'
+pull() { jq -cn --arg h "$HEAD" --argjson l "${1:-[]}" --argjson u "${2:-$PERSON}" '{number: 7, head: {sha: $h}, labels: $l, user: $u}'; }
+status() { jq -cn --arg c "$1" --arg s "$2" --argjson u "$LANE" '{context: $c, state: $s, creator: $u, description: "The lane stopped"}'; }
+
+# expect <label> <want-rc> <STUB_PULL> <STUB_STATUSES> [want-out] [refuse-out]
+expect() {
+  local label="$1" want_rc="$2" out rc
+  : >"$TMP_ROOT/log"
+  rm -rf "$TMP_ROOT/api-budget"
+  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_PULL="$3" STUB_STATUSES="$4" \
+    GITHUB_REPOSITORY=o/r GITHUB_REF="${GROUP_REF-$REF}" RULES="${RULES_DIR-$RULES}" RUNNER_TEMP="$TMP_ROOT" \
+    LANES_APP_SENDER_ID=99 LANES_DISABLED="${DISABLED-false}" LANES_REPO_DISABLED=false bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+  if [[ "$rc" -ne "$want_rc" ]]; then
+    fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
+  elif [[ -n "${5:-}" && "$out" != *"$5"* ]]; then
+    fail "$label: output lacks '$5': '$out'"
+  elif [[ -n "${6:-}" && "$out" == *"$6"* ]]; then
+    fail "$label: output has '$6': '$out'"
+  else
+    ok "$label"
+  fi
+}
+
+expect "an unheld pull request passes" 0 "$(pull)" "[$(status pr-unblock/fix-ci success)]" \
+  "#7: no hold label, pr-unblock stop or kill switch holds it before the lanes." "::error::"
+if grep -q "^api -i repos/o/r/pulls/7$" "$TMP_ROOT/log" && grep -q "^api repos/o/r/commits/$HEAD/statuses?per_page=100 --paginate --jq " "$TMP_ROOT/log" &&
+  ! grep -q "$GROUP_BASE/statuses" "$TMP_ROOT/log"; then
+  ok "it reads #7 and its head's statuses, every page, not the group's base"
+else
+  fail "unexpected reads: '$(cat "$TMP_ROOT/log")'"
+fi
+expect "the step ends with its api-calls notice: the pull and one statuses page" 0 "$(pull)" "[]" \
+  "::notice title=api-calls::github-token=2 not-modified=0"
+expect "do-not-merge fails before the lanes" 1 "$(pull '[{"name":"do-not-merge"}]')" "[]" \
+  "::error::#7 carries the 'do-not-merge' label; the merge queue removes it. Remove the label and re-queue to merge. The lanes do not run"
+expect "needs-human fails before the lanes" 1 "$(pull '[{"name":"needs-human"}]')" "[]" "::error::#7 carries 'needs-human'"
+expect "pr-verify-failed fails before the lanes" 1 "$(pull '[{"name":"pr-verify-failed"}]')" "[]" "::error::#7 carries 'pr-verify-failed'"
+expect "an unheld label passes" 0 "$(pull '[{"name":"bug"}]')" "[]"
+echo '{"config":{"role_labels":{"human-gated":"hitl"}}}' >"$RULES/tracker.json"
+expect "the base tracker's human-gated label holds" 1 "$(pull '[{"name":"hitl"}]')" "[]" "::error::#7 carries 'hitl'"
+expect "with the tracker's own label, needs-human is not a hold" 0 "$(pull '[{"name":"needs-human"}]')" "[]"
+rm "$RULES/tracker.json"
+expect "a pr-unblock stop on the head fails before the lanes" 1 "$(pull)" "[$(status pr-unblock/fix-ci failure)]" \
+  "::error::'pr-unblock/fix-ci' is failure on $HEAD: The lane stopped."
+expect "a stop a newer success supersedes passes" 0 "$(pull)" "[$(status pr-unblock/fix-ci success),$(status pr-unblock/fix-ci failure)]"
+expect "another account's failure does not hold" 0 "$(pull)" "$(jq -c '.[0].creator = {login: "someone"}' <<<"[$(status pr-unblock/fix-ci failure)]")"
+DISABLED=true expect "the lanes App's pull request fails while the kill switch is on" 1 "$(pull '[]' '{"id":99,"type":"Bot"}')" "[]" \
+  "::error::#7: the lanes kill switch is on"
+DISABLED=true expect "a person's pull request is not held by the kill switch" 0 "$(pull)" "[]"
+DISABLED=false expect "the lanes App's pull request passes with the switch off" 0 "$(pull '[]' '{"id":99,"type":"Bot"}')" "[]"
+DISABLED=true
+expect "every hold is named" 1 "$(pull '[{"name":"do-not-merge"}]' '{"id":99,"type":"Bot"}')" "[$(status pr-unblock/conflict error)]" \
+  "'pr-unblock/conflict' is error"
+n=$(grep -c "^::error::" <<<"$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_PULL="$(pull '[{"name":"do-not-merge"}]' '{"id":99,"type":"Bot"}')" \
+STUB_STATUSES="[$(status pr-unblock/conflict error)]" GITHUB_REPOSITORY=o/r GITHUB_REF="$REF" RULES="$RULES" RUNNER_TEMP="$TMP_ROOT" \
+LANES_APP_SENDER_ID=99 LANES_DISABLED=true LANES_REPO_DISABLED=false bash -e "$TMP_ROOT/body.sh" 2>&1)")
+if [[ "$n" -eq 3 ]]; then ok "three holds give three errors"; else fail "three holds gave $n errors"; fi
+unset DISABLED
+
+# What it cannot read it leaves to ci-status, and passes.
+STUB_FAIL=pulls expect "an unreadable pull request passes to ci-status" 0 "$(pull '[{"name":"do-not-merge"}]')" "[]" \
+  "::warning::could not read #7; ci-status judges the holds."
+STUB_FAIL=statuses expect "an unreadable status list passes to ci-status" 0 "$(pull)" "[]" "::warning::could not read the statuses of $HEAD"
+expect "a pull request with no head passes to ci-status" 0 '{"number":7,"head":{},"labels":[{"name":"do-not-merge"}]}' "[]" \
+  "::warning::the head of #7 is not a commit SHA"
+GROUP_REF=refs/heads/gh-readonly-queue/main/pr-7-abc expect "an unparsable ref passes to ci-status" 0 "$(pull)" "[]" \
+  "::warning::cannot read a pull request number from the merge-group ref"
+if [[ -s "$TMP_ROOT/log" ]]; then fail "an unparsable ref was read: '$(cat "$TMP_ROOT/log")'"; else ok "an unparsable ref makes no call"; fi
+RULES_DIR='' expect "no base rules pass to ci-status" 0 "$(pull '[{"name":"do-not-merge"}]')" "[]" \
+  "::notice::the base commit's hold rules did not read; ci-status judges the holds."
+if [[ -s "$TMP_ROOT/log" ]]; then fail "no base rules still read: '$(cat "$TMP_ROOT/log")'"; else ok "no base rules make no call"; fi
+mkdir -p "$TMP_ROOT/old"
+cp "$RULES/api-budget.bash" "$TMP_ROOT/old/"
+echo 'export const unblockStops = () => [];' >"$TMP_ROOT/old/merge-holds.mjs"
+RULES_DIR="$TMP_ROOT/old" expect "a base module without queueHolds passes to ci-status" 0 "$(pull '[{"name":"do-not-merge"}]')" "[]" \
+  "::warning::the base commit's merge-holds.mjs could not judge #7; ci-status judges the holds."
+
+test_harness::report
diff --git a/scripts/ci-gh-read.test.sh b/scripts/ci-gh-read.test.sh
index e145ba4636..ad3c991464 100755
--- a/scripts/ci-gh-read.test.sh
+++ b/scripts/ci-gh-read.test.sh
@@ -68,7 +68,7 @@ if [[ "$first" == "      - name: Write the rate-limit-aware read helper" ]]; the
 else
   fail "ci-status's first step is '$first', not the helper"
 fi
-# Every step that reads through gh_read sources it first.
+# Every step that reads through gh_read or pr_read sources it first.
 while IFS= read -r name; do
   body="$(awk -v name="      - name: $name" '$0 == name { on = 1; next } on && /^      - / { exit } on { print }' <<<"$job")"
   if [[ "$body" == *$'        run: |\n          . "$RUNNER_TEMP/gh-read.sh"\n'* ]]; then
@@ -76,7 +76,7 @@ while IFS= read -r name; do
   else
     fail "'$name' calls gh_read without sourcing it first"
   fi
-done < <(awk '/^      - name: / { name = substr($0, 15) } /gh_read [-"]/ && name != "Write the rate-limit-aware read helper" { print name }' <<<"$job" | sort -u)
+done < <(awk '/^      - name: / { name = substr($0, 15) } /(gh|pr)_read [-"]/ && name != "Write the rate-limit-aware read helper" { print name }' <<<"$job" | sort -u)
 # Every other `gh api` in the job is a write, or marked gh-read-exempt on the
 # line above, so a new fail-closed read cannot skip the wait unnoticed.
 stray="$(awk '/^      - name: / { helper = ($0 == "      - name: Write the rate-limit-aware read helper") }
@@ -297,4 +297,26 @@ fresh
 STUB_SCRIPT='fail 403 Resource not accessible by integration' run 'gh_read repos/o/r/pulls/1 || echo "rc=$?"'
 check "a 403 that is not a rate limit returns at once" 0 1 "" "rc=1" "::error::"
 
+# pr_read: one read per job of the same args. A later step's pr_read answers
+# the kept body with no call; other args read again; a failed read keeps
+# nothing, so the next pr_read reads again; pr_read_put keeps an answer read
+# another way; pr_read_forget drops them all.
+fresh
+STUB_SCRIPT='ok {"number":1}' run 'pr_read repos/o/r/pulls/1'
+check "pr_read reads once" 0 1 "" '{"number":1}'
+STUB_SCRIPT='ok changed' run 'pr_read repos/o/r/pulls/1'
+check "a later step's pr_read of the same args answers the kept body with no call" 0 0 "" '{"number":1}' "changed"
+STUB_SCRIPT='ok two' run 'pr_read repos/o/r/pulls/1 --paginate'
+check "other args read again" 0 1 "" "two"
+STUB_SCRIPT='fail 502 Server Error' run 'pr_read repos/o/r/pulls/3 || echo "rc=$?"'
+check "a failed pr_read returns gh's failure" 0 1 "" "rc=1"
+STUB_SCRIPT='ok three' run 'pr_read repos/o/r/pulls/3'
+check "a failed read keeps nothing, so the next pr_read reads again" 0 1 "" "three"
+STUB_SCRIPT='ok never' run 'pr_read_put "[1]" repos/o/r/issues/1/events --paginate; pr_read repos/o/r/issues/1/events --paginate'
+check "pr_read answers what pr_read_put kept" 0 0 "" "[1]"
+STUB_SCRIPT='ok live' run 'pr_read_forget; pr_read repos/o/r/pulls/1'
+check "pr_read_forget drops every kept answer" 0 1 "" "live"
+STUB_SCRIPT='ok' run 'pr_read repos/o/r/issues/2/labels; echo "[$(pr_read repos/o/r/issues/2/labels)]"'
+check "an empty answer is kept as empty" 0 1 "" "[]"
+
 test_harness::report
diff --git a/scripts/ci-hold-cost-decision.test.sh b/scripts/ci-hold-cost-decision.test.sh
index 109415e195..4310d04cff 100755
--- a/scripts/ci-hold-cost-decision.test.sh
+++ b/scripts/ci-hold-cost-decision.test.sh
@@ -34,6 +34,10 @@ WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" || fail "the ci-status gh_read helper step is missing or fails"
+
 NAME='Clear a cost-only review hold the owner decided'
 step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
   on && /^      - / { exit }
@@ -263,7 +267,9 @@ expect() {
   local label="$1" out rc cleared deleted posted config="$TMP_ROOT/base-config"
   : >"$TMP_ROOT/log"
   : >"$TMP_ROOT/output"
-  rm -rf "$config"
+  rm -rf "$config" "$TMP_ROOT/pr-reads"
+  # STALE_EVENTS stands for an events answer an earlier step kept (pr_read).
+  [[ -z "${STALE_EVENTS:-}" ]] || RUNNER_TEMP="$TMP_ROOT" bash -c '. "$RUNNER_TEMP/gh-read.sh"; pr_read_put "$1" "repos/o/r/issues/6419/events?per_page=100" --paginate' _ "$STALE_EVENTS"
   mkdir -p "$config/.github/standards/trusted-actors"
   [[ -z "${STUB_TRACKER+set}" ]] || printf '%s\n' "$STUB_TRACKER" >"$config/.work-item-tracker.json"
   [[ " $STUB_FAIL " == *" actors "* ]] || printf '%s\n' "$STUB_ACTORS" >"$config/.github/standards/trusted-actors/trusted-actors.json"
@@ -307,6 +313,11 @@ if grep -q '/jobs?filter=all&per_page=100 --paginate$' "$TMP_ROOT/log" && grep -
 else
   fail "the jobs or annotations read is not paginated: '$(grep -E 'jobs|annotations' "$TMP_ROOT/log")'"
 fi
+if [[ ! -e "$TMP_ROOT/pr-reads" ]]; then
+  ok "after its writes the step drops every kept read, so later steps read live"
+else
+  fail "the step kept reads after writing: '$(ls "$TMP_ROOT/pr-reads")'"
+fi
 if [[ "$(grep -n -- '-X POST' "$TMP_ROOT/log" | cut -d: -f1)" -lt "$(grep -n -- '-X DELETE' "$TMP_ROOT/log" | cut -d: -f1)" ]]; then
   ok "the comment is posted before the label comes off"
 else
@@ -702,6 +713,17 @@ if [[ "$(grep -c '^api ' "$TMP_ROOT/log")" -eq 1 ]] && grep -q '^api repos/o/r/i
 else
   fail "with no lane label event the step read more than the events: '$(cat "$TMP_ROOT/log")'"
 fi
+if [[ "$(cat "$TMP_ROOT"/pr-reads/* 2>/dev/null)" == "[]" ]]; then
+  ok "the events answer is kept for the later steps' pr_read"
+else
+  fail "the events answer was not kept: '$(ls "$TMP_ROOT/pr-reads" 2>&1)'"
+fi
+STALE_EVENTS="[$(event labeled "$OWNER" 2026-10-23T13:20:20Z)]" expect "a kept events answer is not this step's: it reads the events live" no no no "no label was added"
+if grep -q '^api repos/o/r/issues/6419/events' "$TMP_ROOT/log"; then
+  ok "the step reads the events itself even with a kept answer"
+else
+  fail "the step answered from a kept read: '$(cat "$TMP_ROOT/log")'"
+fi
 export STUB_TRACKER='{"config":{"role_labels":{"human-gated":"owner-call"}}}'
 STUB_EVENTS="[$(jq -c '.label.name = "owner-call"' <<<"$(event labeled "$OWNER" 2026-10-23T13:20:20Z)")]"
 expect "the base tracker's human-gated label is the one judged" no no no "someone other than a review lane"
diff --git a/scripts/ci-hold-human-gated.test.sh b/scripts/ci-hold-human-gated.test.sh
index 5a307d25b1..f0c901b9a1 100755
--- a/scripts/ci-hold-human-gated.test.sh
+++ b/scripts/ci-hold-human-gated.test.sh
@@ -99,9 +99,9 @@ fi
 # .work-item-tracker.json (absent when unset), and STUB_CHECKOUT_FAILED leaves
 # BASE_CONFIG empty, as a failed checkout does. The gh stub logs its
 # arguments. A labels read fails its first STUB_FAILS calls, then
-# prints STUB_LABELS one per line. A comments read fails when STUB_COMMENTS_FAIL
-# is set, else applies the --jq filter to the STUB_COMMENTS array, as gh does
-# per page.
+# answers STUB_LABELS (comma separated) as the API's label list. A comments
+# read fails when STUB_COMMENTS_FAIL is set, else answers the STUB_COMMENTS
+# array.
 mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
@@ -109,12 +109,11 @@ printf '%s\n' "$*" >>"$STUB_LOG"
 case "$*" in
 */labels*)
   [[ "$(grep -c '/labels' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || { printf '%s\n' "${STUB_FAIL_TEXT:-}" >&2; exit 1; }
-  [[ -z "$STUB_LABELS" ]] || tr ',' '\n' <<<"$STUB_LABELS"
+  jq -cn --arg l "$STUB_LABELS" '$l | split(",") | map(select(. != "") | {name: .})'
   ;;
 */comments*)
   [[ -z "${STUB_COMMENTS_FAIL:-}" ]] || exit 1
-  while [[ $# -gt 0 && "$1" != --jq ]]; do shift; done
-  jq -r "$2" <<<"${STUB_COMMENTS:-[]}"
+  printf '%s\n' "${STUB_COMMENTS:-[]}"
   ;;
 *) exit 1 ;;
 esac
@@ -166,7 +165,7 @@ expect() {
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
   elif [[ "$calls" -ne "$want_calls" ]]; then
     fail "$label: expected $want_calls labels call(s) got $calls"
-  elif [[ "$calls" -gt 0 && "$(grep '/labels' "$TMP_ROOT/log" | sort -u)" != "api repos/o/r/issues/6419/labels?per_page=100 --paginate --jq .[].name" ]]; then
+  elif [[ "$calls" -gt 0 && "$(grep '/labels' "$TMP_ROOT/log" | sort -u)" != "api repos/o/r/issues/6419/labels?per_page=100 --paginate" ]]; then
     fail "$label: unexpected labels call '$(grep '/labels' "$TMP_ROOT/log" | sort -u)'"
   elif grep -q '/contents/' "$TMP_ROOT/log"; then
     fail "$label: the tracker config was read through the API: '$(sort -u "$TMP_ROOT/log")'"
diff --git a/scripts/ci-hold-lifted-by.test.sh b/scripts/ci-hold-lifted-by.test.sh
index 2bbd4e12b5..a762083ddc 100755
--- a/scripts/ci-hold-lifted-by.test.sh
+++ b/scripts/ci-hold-lifted-by.test.sh
@@ -62,8 +62,7 @@ else
 fi
 
 # The stub logs its arguments. A comments read fails when STUB_COMMENTS_FAIL is
-# set, else applies the --jq filter to the STUB_COMMENTS array, as gh does per
-# page. An events read fails when STUB_EVENTS_FAIL is set, else prints
+# set, else answers the STUB_COMMENTS array. An events read fails when STUB_EVENTS_FAIL is set, else prints
 # STUB_EVENTS (pages concatenated, as --paginate prints them). The base
 # commit's config is a fixture directory holding STUB_ACTORS as the
 # trusted-actor list; STUB_CHECKOUT_FAILED leaves BASE_CONFIG empty, as a
@@ -75,8 +74,7 @@ printf '%s\n' "$*" >>"$STUB_LOG"
 case "$*" in
 */comments*)
   [[ -z "${STUB_COMMENTS_FAIL:-}" ]] || exit 1
-  while [[ $# -gt 0 && "$1" != --jq ]]; do shift; done
-  jq -r "$2" <<<"${STUB_COMMENTS:-[]}"
+  printf '%s\n' "${STUB_COMMENTS:-[]}"
   ;;
 */events*)
   [[ -z "${STUB_EVENTS_FAIL:-}" ]] || exit 1
@@ -107,7 +105,7 @@ EARLY_LIFT="$(unlabeled needs-human 2026-10-23T09:00:00Z 153232337 kyle-sexton)"
 expect() {
   local label="$1" want_rc="$2" out rc config="$TMP_ROOT/base-config"
   : >"$TMP_ROOT/log"
-  rm -rf "$config"
+  rm -rf "$config" "$TMP_ROOT/pr-reads"
   mkdir -p "$config/.github/standards/trusted-actors"
   printf '%s\n' "${STUB_ACTORS-$ACTORS}" >"$config/.github/standards/trusted-actors/trusted-actors.json"
   [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
diff --git a/scripts/ci-hold-pr-unblock-status.test.sh b/scripts/ci-hold-pr-unblock-status.test.sh
index 34a1085b77..44c8db2753 100755
--- a/scripts/ci-hold-pr-unblock-status.test.sh
+++ b/scripts/ci-hold-pr-unblock-status.test.sh
@@ -6,8 +6,9 @@
 # ci-status fails while the newest `pr-unblock/*` status on the head, by
 # github-actions[bot], is a failure or error, and names each such context. A
 # later success on the same head supersedes a failure. In the merge queue the
-# head is the queued pull request's, read live. It fails closed when it cannot
-# tell.
+# head is the queued pull request's, read live. The rule is the base commit's
+# merge-holds.mjs unblockStops, here the repository's own copy. It fails closed
+# when it cannot tell, a base module that cannot judge included.
 # test-scope: .github/workflows/pr-require-checks.yml
 set -uo pipefail
 
@@ -85,6 +86,8 @@ cat >"$TMP_ROOT/bin/sleep" <<'EOF'
 printf '%s\n' "$*" >>"$STUB_SLEEPS"
 EOF
 chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep"
+mkdir -p "$TMP_ROOT/base/.github/scripts/pr-merge"
+cp "$ROOT/.github/scripts/pr-merge/merge-holds.mjs" "$TMP_ROOT/base/.github/scripts/pr-merge/"
 
 HEAD=0123456789abcdef0123456789abcdef01234567
 QUEUED=fedcba9876543210fedcba9876543210fedcba98
@@ -103,7 +106,7 @@ expect() {
   ci_gh_read::reset "$TMP_ROOT" 1792800600
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_SLEEPS="$TMP_ROOT/sleeps" STUB_STATUSES="$3" \
     GITHUB_REPOSITORY=o/r GITHUB_EVENT_NAME="${EVENT:-pull_request}" GITHUB_REF="${REF:-refs/pull/7/merge}" \
-    HEAD_SHA="${HEAD_SHA-$HEAD}" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+    HEAD_SHA="${HEAD_SHA-$HEAD}" BASE_CONFIG="${BASE_CONFIG-$TMP_ROOT/base}" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
   if [[ "$rc" -ne "$want_rc" ]]; then
     fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
   elif [[ -n "${4:-}" && "$out" != *"$4"* ]]; then
@@ -131,7 +134,7 @@ expect "each failing context is named" 1 "[$(status pr-unblock/fix-ci failure),$
   "'pr-unblock/conflict' is error" "'pr-unblock/address-feedback'"
 out_both="$(grep -c "::error::'pr-unblock/" <<<"$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" STUB_SLEEPS="$TMP_ROOT/sleeps" \
   STUB_STATUSES="[$(status pr-unblock/fix-ci failure),$(status pr-unblock/conflict error)]" GITHUB_REPOSITORY=o/r \
-  GITHUB_EVENT_NAME=pull_request HEAD_SHA="$HEAD" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)")"
+  GITHUB_EVENT_NAME=pull_request HEAD_SHA="$HEAD" BASE_CONFIG="$TMP_ROOT/base" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)")"
 if [[ "$out_both" -eq 2 ]]; then ok "two failing contexts give two errors"; else fail "two failing contexts gave $out_both errors"; fi
 expect "a newer success supersedes an older failure" 0 "[$(status pr-unblock/fix-ci success),$(status pr-unblock/fix-ci failure)]"
 expect "a newer failure over an older success fails" 1 "[$(status pr-unblock/fix-ci failure),$(status pr-unblock/fix-ci success)]" "'pr-unblock/fix-ci' is failure"
@@ -142,6 +145,18 @@ expect "a description's percent sign is escaped" 1 "[$(status pr-unblock/fix-ci
 export STUB_STATUS_FAILS=1
 expect "an unreadable status list fails closed" 1 "[]" "::error::could not read the statuses of $HEAD; re-run this run."
 unset STUB_STATUS_FAILS
+expect "a description's tab and newline become spaces" 1 "[$(status pr-unblock/fix-ci failure "$LANE" $'one\ttwo\nthree')]" "on $HEAD: one two three. The lane"
+export BASE_CONFIG=
+expect "no base config fails closed" 1 "[]" "::error::cannot read merge-holds.mjs at the base commit; re-run this run."
+if [[ -s "$TMP_ROOT/log" ]]; then fail "no base config still read: '$(cat "$TMP_ROOT/log")'"; else ok "no base config makes no call"; fi
+mkdir -p "$TMP_ROOT/old/.github/scripts/pr-merge"
+echo 'export const refsIssue = () => null;' >"$TMP_ROOT/old/.github/scripts/pr-merge/merge-holds.mjs"
+export BASE_CONFIG="$TMP_ROOT/old"
+expect "a base module without unblockStops fails closed" 1 "[$(status pr-unblock/fix-ci success)]" \
+  "::error::merge-holds.mjs at the base commit could not judge the statuses of $HEAD; re-run this run."
+echo 'export const unblockStops = () => ({});' >"$TMP_ROOT/old/.github/scripts/pr-merge/merge-holds.mjs"
+expect "a base module that answers no list fails closed" 1 "[]" "could not judge the statuses of $HEAD"
+unset BASE_CONFIG
 export HEAD_SHA=main
 expect "a pull request head that is not a commit SHA fails closed" 1 "[]" "::error::the head 'main' is not a commit SHA."
 if [[ -s "$TMP_ROOT/log" ]]; then fail "a bad head was read: '$(cat "$TMP_ROOT/log")'"; else ok "a bad head makes no call"; fi
diff --git a/scripts/ci-lanes-pr-hold.test.sh b/scripts/ci-lanes-pr-hold.test.sh
index 510b8fe124..1278286337 100755
--- a/scripts/ci-lanes-pr-hold.test.sh
+++ b/scripts/ci-lanes-pr-hold.test.sh
@@ -104,8 +104,8 @@ LANES_APP_ID="$(jq -r --arg login "$identity" '.. | objects | select(.login? ==
 # The stub logs its arguments. A pull read prints STUB_PULL. A contents read
 # of merge-holds.mjs prints the working tree's module, or answers 404 when
 # STUB_NO_MODULE is set. A discussion read fails its first STUB_FAILS calls,
-# then prints each row of STUB_ISSUE, STUB_REVIEWS or STUB_INLINE (JSON
-# arrays) as one line, as `--jq '.[] | @json'` does. A contents read of
+# then prints STUB_ISSUE, STUB_REVIEWS or STUB_INLINE (JSON arrays) as the
+# API's page. A contents read of
 # pr-pipeline.yaml prints STUB_CONFIG, or answers 404 when STUB_NO_CONFIG is
 # set. A files read answers STUB_FILES (a JSON array of [path,
 # renamed-from or null, status] arrays, status renamed with a renamed-from
@@ -123,7 +123,7 @@ mkdir -p "$TMP_ROOT/bin"
 cat >"$TMP_ROOT/bin/gh" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' "$*" >>"$STUB_LOG"
-rows() { jq -c '.[]' <<<"${1:-[]}"; }
+rows() { printf '%s\n' "${1:-[]}"; }
 discussion() {
   [[ "$(grep -cE '/(comments|reviews)\?' "$STUB_LOG")" -gt "${STUB_FAILS:-0}" ]] || { echo 'gh: Server Error (HTTP 502)' >&2; exit 1; }
 }
@@ -261,7 +261,7 @@ WARM_CARRIED='{"carried-run-record":{"o/r|1":{"at":"2026-10-25T10:00:00Z","value
 expect() {
   local label="$1" want_rc="$2" want_calls="$3" out rc calls
   : >"$TMP_ROOT/log"
-  rm -f "$TMP_ROOT/verify-listing.json"
+  rm -rf "$TMP_ROOT/verify-listing.json" "$TMP_ROOT/pr-reads"
   # A warm reader: the carry step wrote pr-merge's carried reads (STUB_COLD: none).
   # STUB_CARRIED replaces the carried file (all-empty sections are cold too).
   if [[ -n "${STUB_COLD:-}" ]]; then
@@ -629,6 +629,11 @@ if [[ "$(disarms)" -eq 1 ]] && grep -q -- '-f id=PR_7' "$TMP_ROOT/log"; then
 else
   fail "the push sent $(disarms) disarm(s): '$(sort -u "$TMP_ROOT/log")'"
 fi
+if [[ ! -e "$TMP_ROOT/pr-reads" ]]; then
+  ok "after the disarm the step drops every kept read, so a later read of the pull is live"
+else
+  fail "the step kept reads after its disarm: '$(ls "$TMP_ROOT/pr-reads")'"
+fi
 STUB_PULL="$(STUB_ARMED=1 pull 'Closes #1')"
 export STUB_DISARM_FAILS=1
 expect "a disarm that fails only warns, so a token that cannot disarm never holds a push red" 0 3 "::warning::could not turn off native auto-merge on #7 after a push to its head"
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index 445e3ebc8c..3199f07676 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -186,7 +186,7 @@ expect() {
   local label="$1" want_rc="$2" out rc
   : >"$TMP_ROOT/log"
   # SHARED_FILES stands for the pages the broker step left under RUNNER_TEMP.
-  rm -f "$TMP_ROOT/pr-files.json"
+  rm -rf "$TMP_ROOT/pr-files.json" "$TMP_ROOT/pr-reads"
   [[ -z "${SHARED_FILES:-}" ]] || printf '%s\n' "$SHARED_FILES" >"$TMP_ROOT/pr-files.json"
   out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" GITHUB_REPOSITORY=o/r HEAD_SHA="${HEAD_SHA-$HEAD}" \
     AUTHOR_ID="${AUTHOR_ID-153232337}" HEAD_REPO="${HEAD_REPO-o/r}" RUNNER_TEMP="$TMP_ROOT" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
diff --git a/scripts/lib/ci-gh-read.sh b/scripts/lib/ci-gh-read.sh
index 948aa056c4..9a604e28dc 100644
--- a/scripts/lib/ci-gh-read.sh
+++ b/scripts/lib/ci-gh-read.sh
@@ -13,7 +13,8 @@
 #
 #   ci_gh_read::reset <dir> <deadline>
 #
-# Clears the rate-guard stops an earlier case left in <dir> and sets the
+# Clears the rate-guard stops and kept pull request reads (pr_read) an
+# earlier case left in <dir> and sets the
 # wait deadline to the epoch second <deadline>, so a case runs on a stub clock.
 ci_gh_read::install() {
   local workflow="$1" dir="$2" budget=
@@ -40,6 +41,7 @@ ci_gh_read::install() {
 }
 
 ci_gh_read::reset() {
+  rm -rf "$1/pr-reads"
   rm -rf "$1/api-budget"
   echo "$2" >"$1/gh-read.deadline"
 }